@bridge_gpt/mcp-server 0.2.34 → 0.2.37

package/build/executor/worker-finalization.js

@@ -22,8 +22,20 @@
  * an existence-only check. The check instead compares the authoritative origin
  * branch tip SHA against the worker's own HEAD commit (`headSha`, from git
  * telemetry) whenever that comparison is available.
+ *
+ * BAPI-762: the authoritative origin-tip-vs-HEAD comparison runs regardless of
+ * whether the completion result carries a `pr_url`. The pipeline guarantees a PR
+ * URL for essentially every implement job, so a PR-presence short-circuit ABOVE
+ * this comparison could never catch an unpushed correction commit — a run could
+ * report `clean_exit`/`succeeded` with a PR open and a commit that never reached
+ * origin. When the origin tip exists but does not match the worker's own HEAD,
+ * that is positive proof of a DIFFERENT failure shape than "no evidence any work
+ * reached origin": `WorkerFinalizationSavedButUnfinalized` names it distinctly so
+ * the terminal-disposition classifier (`terminal_disposition.py`) can route it as
+ * a resumable, deterministic cause instead of laundering it into a generic crash
+ * that gets retried as a transient upstream failure.
  */
-import { secretFreeErrorMessage, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationPrBaseMismatch, } from "./job-errors.js";
+import { secretFreeErrorMessage, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationPrBaseMismatch, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
 import { isImplementationStyleJobType } from "./job-types.js";
 /** Bounded settling re-check defaults for the authoritative origin-tip lookup. */
 const DEFAULT_ORIGIN_FINALIZATION_ATTEMPTS = 3;
@@ -171,18 +183,51 @@ function prBaseMismatchFailure(job, prNumber, expectedBase, actualBase) {
         classification: "crashed",
     };
 }
-function missingBranchAndPrFailure(job, detail) {
+/**
+ * `detail` describes a state with NO evidence any work reached origin (branch
+ * unresolved, branch absent from origin, or the origin lookup itself failed).
+ * `hasPrUrl` only changes the wording — a PR existing is never treated as
+ * evidence of a push, so the message must not claim "no PR URL" when one was
+ * actually present (that would be false and would mislead the operator reading
+ * it toward the wrong recovery step).
+ */
+function missingBranchAndPrFailure(job, detail, hasPrUrl) {
     const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
+    const prefix = hasPrUrl ? "opened a PR, but" : "produced no PR URL and";
     return {
         error_kind: WorkerFinalizationMissingRemoteBranchAndPr,
-        error_message: `${label} exited cleanly but ${detail}`,
+        error_message: `${label} exited cleanly but ${prefix} ${detail}`,
+        classification: "crashed",
+    };
+}
+/**
+ * BAPI-762: the origin branch exists at an authoritative tip that does not match
+ * the worker's own HEAD — durable work exists on origin, but not this worker's
+ * latest commit. Unlike {@link missingBranchAndPrFailure}, this state has positive
+ * evidence of something recoverable, so the message names the branch and the
+ * origin SHA an operator can resume/finalize from rather than re-running. The
+ * human-facing text truncates SHAs to 12 characters (matching the codebase's
+ * existing convention); the full 40-character origin SHA is carried in the
+ * structured `last_commit_sha` field so nothing has to re-derive it from prose.
+ */
+function savedButUnfinalizedFailure(job, branch, originSha, workerHeadSha) {
+    const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
+    return {
+        error_kind: WorkerFinalizationSavedButUnfinalized,
+        error_message: `${label} exited cleanly, but origin branch '${branch}' is at ${originSha.slice(0, 12)}, ` +
+            `which does not match this worker's HEAD ${workerHeadSha.slice(0, 12)} — the worker's latest ` +
+            `commit was not pushed. Work already on origin at this SHA is recoverable: resume/finalize ` +
+            `from '${branch}' instead of re-running from scratch.`,
         classification: "crashed",
+        last_commit_sha: originSha,
     };
 }
 /**
- * Validate that an implementation-style job's clean exit actually produced a PR
- * or a pushed origin branch. Non-implementation-style jobs (verdict jobs) and
- * any result carrying a non-empty `pr_url` bypass the git check entirely.
+ * Validate that an implementation-style job's clean exit actually published its
+ * work to origin. Non-implementation-style jobs (verdict jobs) bypass the git
+ * check entirely. A `pr_url` on the completion result is NOT proof of a push
+ * (BAPI-762) — the authoritative origin-tip-vs-HEAD comparison below always runs,
+ * so an unpushed local commit is detected whether or not a pull request exists.
  */
 export async function validateWorkerFinalization(input) {
     const { job, branch, worktreePath, result, runCommand, headSha } = input;
@@ -216,14 +261,15 @@ export async function validateWorkerFinalization(input) {
             }
         }
     }
-    if (extractPrUrl(result)) {
-        return { ok: true };
-    }
+    const hasPrUrl = Boolean(extractPrUrl(result));
+    // BAPI-762: `branch`/`headSha` are normalized once here and reused through the
+    // rest of the check — including by the diagnostics below — instead of being
+    // re-derived at each failure site.
     const trimmedBranch = typeof branch === "string" ? branch.trim() : "";
     if (!trimmedBranch) {
         return {
             ok: false,
-            failure: missingBranchAndPrFailure(job, "produced no PR URL and no expected branch to verify on origin"),
+            failure: missingBranchAndPrFailure(job, "no expected branch to verify on origin", hasPrUrl),
         };
     }
     // Recovery/resume jobs fetch `origin/<branch>` before the worker even starts,
@@ -233,7 +279,9 @@ export async function validateWorkerFinalization(input) {
     // fails loud instead of passing. When HEAD is unresolved (degraded telemetry),
     // fall back to the existence-only check rather than inventing a new failure
     // mode. The authoritative lookup is retried a few times so a push that settles
-    // just after the worker exits still finalizes (BAPI-566 Bug A).
+    // just after the worker exits still finalizes (BAPI-566 Bug A). This lookup
+    // runs unconditionally — including when `hasPrUrl` is true (BAPI-762, AC-5): a
+    // PR being open is never accepted as proof this worker's own commit landed.
     const trimmedHeadSha = typeof headSha === "string" ? headSha.trim().toLowerCase() : "";
     const attempts = normalizeAttempts(input.originResolveAttempts);
     const retryDelayMs = normalizeRetryDelay(input.originResolveRetryDelayMs);
@@ -245,19 +293,25 @@ export async function validateWorkerFinalization(input) {
     catch (err) {
         return {
             ok: false,
-            failure: missingBranchAndPrFailure(job, `produced no PR URL and branch '${trimmedBranch}' could not be verified on origin: ${secretFreeErrorMessage(err)}`),
+            failure: missingBranchAndPrFailure(job, `branch '${trimmedBranch}' could not be verified on origin: ${secretFreeErrorMessage(err)}`, hasPrUrl),
         };
     }
     if (remoteSha === null) {
         return {
             ok: false,
-            failure: missingBranchAndPrFailure(job, `produced no PR URL and branch '${trimmedBranch}' is not on origin`),
+            failure: missingBranchAndPrFailure(job, `branch '${trimmedBranch}' is not on origin`, hasPrUrl),
         };
     }
+    // BAPI-762: an authoritative origin tip that does not match the worker's HEAD
+    // is positive evidence of RECOVERABLE work — distinct from the sub-cases above,
+    // which have no evidence any work reached origin at all. This is the only
+    // sub-case that produces `WorkerFinalizationSavedButUnfinalized`, and it fires
+    // identically whether or not a PR is open (AC-5) — the PR shortcut this ticket
+    // removes could otherwise conceal exactly this state.
     if (trimmedHeadSha && remoteSha !== trimmedHeadSha) {
         return {
             ok: false,
-            failure: missingBranchAndPrFailure(job, `produced no PR URL and origin branch '${trimmedBranch}' is at ${remoteSha.slice(0, 12)}, which does not match this worker's HEAD ${trimmedHeadSha.slice(0, 12)} — the worker's commit was not pushed`),
+            failure: savedButUnfinalizedFailure(job, trimmedBranch, remoteSha, trimmedHeadSha),
         };
     }
     return { ok: true };

package/build/executor/worktree.js

@@ -34,6 +34,10 @@ function toWorktreeCoreDeps(deps) {
         platform: deps.platform,
         env: deps.env,
         cwd: deps.cwd,
+        // BAPI-727: route path-only untracked-cleanup diagnostics to the executor's
+        // stderr logger. Shared `start-tickets` callers may keep omitting this — the
+        // primitive treats an absent callback as "do not report".
+        onCleanupDiagnostic: deps.errorLog,
     };
 }
 /** Build the command-provisioning boundary from the executor deps (BAPI-664). */
@@ -57,12 +61,35 @@ function toCommandProvisioningDeps(deps) {
  * preserved unchanged. Errors stay secret-free (no raw filesystem exception, Git
  * output, or command contents).
  */
-async function finalizeExecutorWorktree(worktreePath, branch, deps) {
+async function finalizeExecutorWorktree(worktreePath, branch, expectedHeadSha, deps) {
     const provisioned = await provisionCommandsForWorktree(worktreePath, toCommandProvisioningDeps(deps));
     if (!provisioned.ok) {
         return { ok: false, error: provisioned.error };
     }
-    return { ok: true, worktreePath, branch };
+    return { ok: true, worktreePath, branch, expectedHeadSha };
+}
+/** A full 40-character hex object name. */
+const FULL_SHA_PATTERN = /^[0-9a-f]{40}$/i;
+/**
+ * Resolve a ref to its immutable commit via `rev-parse <ref>^{commit}`.
+ *
+ * Returns `null` on any failure or malformed output. The caller turns that into
+ * a bounded worktree failure rather than inventing an expected SHA — a made-up
+ * expectation would make the pre-spawn assertion either vacuous or wrong.
+ */
+async function resolveCommitSha(deps, worktreeCwd, ref) {
+    try {
+        const result = await deps.runCommand("git", ["rev-parse", `${ref}^{commit}`], {
+            cwd: worktreeCwd,
+        });
+        if (!commandSucceeded(result))
+            return null;
+        const sha = result.stdout.trim();
+        return FULL_SHA_PATTERN.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
 }
 /**
  * Ensure the worktree for a job exists, delegating to the shared Worktrunk
@@ -115,13 +142,25 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
                 error: `git fetch origin ${branch} failed${reason ? `: ${reason}` : ""}`,
             };
         }
+        // BAPI-731: resolve the freshly fetched remote head to an immutable commit
+        // BEFORE creating the worktree, so the pre-spawn assertion has an
+        // authoritative expectation. Resolved here (right after the fetch) rather
+        // than after creation, so the expectation is independent of the worktree the
+        // assertion will later inspect.
+        const expectedHeadSha = await resolveCommitSha(deps, deps.cwd, originRef);
+        if (expectedHeadSha === null) {
+            return {
+                ok: false,
+                error: `failed to resolve '${originRef}' to a commit after fetching branch '${branch}'`,
+            };
+        }
         const row = await createWorktreeForTicket(toWorktreeCoreDeps(deps), key, { [key]: branch }, options.worktrunkBinary, baseStartPoint, guardStaleWorktree, 
         // Hard-reset a reused existing local branch onto the freshly fetched
         // pushed head; a missing local branch is instead cut from `baseStartPoint`
         // (= `origin/<branch>`) inside the primitive, so both land at origin.
         { freshenFromOrigin: originRef });
         if (row.status === "created" && typeof row.path === "string") {
-            return finalizeExecutorWorktree(row.path, branch, deps);
+            return finalizeExecutorWorktree(row.path, branch, expectedHeadSha, deps);
         }
         return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
     }
@@ -146,7 +185,10 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
     const baseSha = resolvedBase.base_sha;
     const row = await createWorktreeForTicket(toWorktreeCoreDeps(deps), key, { [key]: branch }, options.worktrunkBinary, baseSha, guardStaleWorktree, { alignExistingBranchTo: baseSha, verifyHeadMatches: baseSha });
     if (row.status === "created" && typeof row.path === "string") {
-        return finalizeExecutorWorktree(row.path, branch, deps);
+        // BAPI-731: `baseSha` is already the pinned immutable commit this fresh
+        // worktree was cut from and verified against (`verifyHeadMatches`), so it is
+        // the expectation — no extra resolution needed.
+        return finalizeExecutorWorktree(row.path, branch, baseSha, deps);
     }
     return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
 }