@bridge_gpt/mcp-server 0.2.34 → 0.2.36

package/build/executor/test-clock.js

@@ -92,6 +92,11 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
         fetch: async () => ({ status: 204, text: async () => "" }),
         log: () => { },
         errorLog: () => { },
+        mcpServerInvocation: {
+            form: "absolute-build-path",
+            nodeExecutable: "node",
+            serverEntryPath: "/repo/mcp_server/build/index.js",
+        },
     };
     return { ...base, ...overrides };
 }
@@ -111,6 +116,9 @@ export function makeTestOptions(overrides = {}) {
         baseBranch: "main",
         advisoryParserEnabled: false,
         defaultJobTimeoutSeconds: 1200,
+        // The executor requires an explicit base URL (BAPI-676) — supply a fake one
+        // so preflight-driven tests are not fatal on the URL prerequisite.
+        baseUrl: "http://localhost:8002",
         ...overrides,
     };
 }

package/build/executor/types.js

@@ -1,18 +1 @@
-/**
- * Epic Conductor v2 executor — core type/boundary definitions (BAPI-534, TDD §7).
- *
- * ARCHITECTURE BOUNDARY (TDD §12, Req 1): files under `mcp_server/src/executor/`
- * are a dumb, pull-based local worker. They MUST NOT import from the v1
- * conductor event/ledger graph — `conductor/store.ts`, `conductor/taxonomy.ts`,
- * `conductor/event-accessors.ts`, `conductor/epic-runtime.ts`,
- * `conductor/epic-reconcile.ts`, `conductor/epic-state.ts`, or any conductor
- * producer / supervisor-runtime module. Allowed conductor reuse is limited to
- * read-only / deterministic helpers — the deny-enforcement preflight
- * (`conductor/deny-enforcement-preflight.ts`), and (BAPI-535 T3b) the local merge
- * executor (`conductor/local-merge.ts`) plus the read-only Bridge API access +
- * merge request/response types (`conductor/bridge-api-client.ts`) for the
- * deterministic `merge` job.
- * All subprocess / HTTP / filesystem / clock access is behind injected deps so
- * every requirement is unit-testable on Linux CI with no real I/O.
- */
 export {};

package/build/executor/worker-command.js

@@ -6,6 +6,7 @@
  * MCP config is ever added. When no safe alias is available, `--model` is omitted.
  */
 import { resolveAgentSpec, resolveModelAlias, isModelTier, isValidModelAlias, } from "../agent-registry.js";
+import { ExecutorNamedError } from "./job-errors.js";
 import { isRecoveryJobType } from "./job-types.js";
 /**
  * Resolve the Claude model alias from a job payload. Accepts a direct
@@ -38,13 +39,17 @@ export function resolveExecutorModelAlias(payload) {
  * `implement` and the recovery jobs, builds the conservative
  * `/implement-ticket <ticket_key> --auto` prompt.
  *
- * Structured `payload.prompt_spec` rendering (the `spec_review` path) is NOT done
- * here: it needs the prepared worktree/git state, so `job-runner.ts` renders it
- * in the prepared-spawn path AFTER worktree preparation. `spec_review` therefore
- * returns `ok:false` from this function by design — that non-ok result is the
- * signal for the runner to fall through to prompt-spec rendering, not a terminal
- * failure. A real spawn job with neither an explicit prompt, a synthesis path,
- * nor a `prompt_spec` is the genuine contract failure.
+ * Structured `payload.prompt_spec` rendering is NOT done here: it needs the
+ * prepared worktree/git state, so `job-runner.ts` renders it in the prepared-spawn
+ * path AFTER worktree preparation. A job with a `prompt_spec` and no explicit
+ * prompt therefore returns `ok:false` from this function by design — that non-ok
+ * result is the signal for the runner to fall through to prompt-spec rendering,
+ * not a terminal failure. A real spawn job with neither an explicit prompt, a
+ * synthesis path, nor a `prompt_spec` is the genuine contract failure.
+ *
+ * BAPI-725: `spec_review` now arrives with an explicit server-built
+ * `payload.prompt` and so resolves on the first branch, like `implement` with an
+ * explicit prompt. It no longer depends on the prompt-spec fall-through.
  */
 /**
  * True for the job types that synthesize `/implement-ticket <KEY> --auto` when no
@@ -90,16 +95,64 @@ export function resolveExecutorPrompt(job) {
         error: `no usable prompt for job_type '${job.job_type}' (no payload.prompt and no ticket_key)`,
     };
 }
+/** The ratified default — the pre-BAPI-725 behavior for every job. */
+export const DEFAULT_WORKER_PERMISSION_POSTURE = "skip_permissions";
+const WORKER_PERMISSION_POSTURES = [
+    "skip_permissions",
+    "accept_edits",
+];
+/**
+ * Resolve the permission posture at the payload boundary.
+ *
+ * - ABSENT (`undefined`/`null`) → the ratified `skip_permissions` default, so
+ *   legacy jobs enqueued before BAPI-725 keep working unchanged.
+ * - a supported value → returned as-is.
+ * - present but unsupported → THROWS a named contract error before argv
+ *   construction, so the job fails loudly instead of spawning under a posture
+ *   nobody chose.
+ *
+ * The thrown message names the FIELD and nothing else. An operator can paste a
+ * credential into a policy value by mistake, and this error text travels to the
+ * server through `/fail` — so echoing the supplied value would turn a typo into
+ * an exfiltration path.
+ */
+export function resolveWorkerPermissionPosture(payload) {
+    const p = payload && typeof payload === "object" ? payload : {};
+    const raw = p.worker_permission_posture;
+    if (raw === undefined || raw === null) {
+        return DEFAULT_WORKER_PERMISSION_POSTURE;
+    }
+    if (typeof raw === "string" &&
+        WORKER_PERMISSION_POSTURES.includes(raw)) {
+        return raw;
+    }
+    throw new ExecutorNamedError("ContractError.PermissionPosture", "job payload worker_permission_posture is present but is not a supported posture " +
+        "(expected 'skip_permissions' or 'accept_edits').");
+}
 /**
  * Build the exact headless Claude argv. `--model <alias>` is included only when
  * an alias is provided. No MCP config arguments are ever emitted.
+ *
+ * Exactly ONE permission form is emitted, selected by `posture`:
+ * `--dangerously-skip-permissions` for `skip_permissions`, or the two adjacent
+ * entries `--permission-mode acceptEdits` for `accept_edits`. They are mutually
+ * exclusive by construction — emitting both would let the skip flag win silently
+ * and make the policy key look effective while doing nothing.
+ *
+ * The posture changes how Claude PROMPTS, not what it may do: the deny layer is
+ * provisioned by `job-runner.ts` before the spawn in both postures.
  */
-export function buildClaudeExecutorArgv(prompt, alias) {
+export function buildClaudeExecutorArgv(prompt, alias, posture = DEFAULT_WORKER_PERMISSION_POSTURE) {
     const argv = ["-p", prompt, "--output-format", "stream-json", "--verbose"];
     if (alias) {
         argv.push("--model", alias);
     }
-    argv.push("--dangerously-skip-permissions");
+    if (posture === "accept_edits") {
+        argv.push("--permission-mode", "acceptEdits");
+    }
+    else {
+        argv.push("--dangerously-skip-permissions");
+    }
     return argv;
 }
 /** The worker executable is always exactly `claude`. */