@bridge_gpt/mcp-server 0.2.34 → 0.2.37

package/build/pipeline-orchestrator.js

@@ -18,6 +18,9 @@
  */
 import { createHash } from "node:crypto";
 import { resolveRecipe } from "./pipeline-utils.js";
+import { parseUnsupportedInLocalModeEnvelope } from "./tool-error-envelope.js";
+import { PlanLedgerError } from "./plan-execution-ledger.js";
+import { assertPlanIsRoutable, buildPhaseRoutingContext, extractPlanMetadata, injectPhaseRoutingContext, parseCheckpointResult, phaseForInstructionFile, settlePhaseResult, } from "./plan-phase-routing.js";
 /**
  * Derive a STABLE, content-addressed hash of an idea — the basis for the
  * cross-run idempotency label ``bapi-idea-hash-{idea_hash}``. Normalizes
@@ -328,13 +331,70 @@ export async function resumePipeline(deps, input) {
     let nextIndex = stepIndex;
     let approvalAgentResult;
     if (step.type === "agent_task") {
-        accumulatedResults.push({
+        const entry = {
             step: step.step,
             type: "agent_task",
             ok: true,
             description: step.description,
             result: input.agent_result,
-        });
+        };
+        // BAPI-763: record the checkpoint's branch/SHA the moment checkpoint-work
+        // reports them, so the pre-PR verification phase that runs next can cross-check
+        // its own HEAD against the durable state rather than trusting its own account.
+        // Only a checkpoint that proved origin contains HEAD is recorded.
+        if (step.instruction_file === "checkpoint-work.md") {
+            const checkpoint = parseCheckpointResult(input.agent_result);
+            if (checkpoint) {
+                entry.checkpoint = { branch: checkpoint.branch, sha: checkpoint.sha };
+            }
+            else {
+                entry.plan_routing_diagnostic =
+                    "checkpoint-work returned no durable checkpoint block (branch/sha with pushed and remoteMatchesHead true); pre-PR verification will fall back to verifying origin directly";
+                console.error(`[pipeline] ${entry.plan_routing_diagnostic}`);
+            }
+        }
+        // Settle a routed phase's owned steps into the durable ledger, and persist it on
+        // THIS entry — before the run advances, and before any approval gate. A ledger
+        // written after the gate is a ledger that does not survive it.
+        const phase = phaseForInstructionFile(step.instruction_file);
+        const planMetadata = recordedPlanMetadata(accumulatedResults);
+        if (phase && planMetadata) {
+            const outcome = settlePhaseResult(input.agent_result, planMetadata, phase, recordedLedger(accumulatedResults));
+            entry.plan_step_records = outcome.ledger;
+            if (outcome.diagnostic) {
+                entry.plan_routing_diagnostic = outcome.diagnostic;
+                console.error(`[pipeline] ${outcome.diagnostic}`);
+            }
+            // A phase that reported an envelope which violates the contract has made a
+            // claim that does not hold. Recording it would make that claim the durable
+            // truth, so the run stops here instead of advancing.
+            if (outcome.contractViolation) {
+                accumulatedResults.push({ ...entry, ok: false, error: outcome.diagnostic });
+                try {
+                    await persistence.patchRun(row.pipeline_run_id, {
+                        current_step_index: stepIndex,
+                        results: accumulatedResults,
+                        status: "failed",
+                        expected_status: "paused",
+                        expected_current_step_index: stepIndex,
+                    });
+                }
+                catch {
+                    // Persisting the failure is best-effort; the envelope below is what the
+                    // caller acts on either way.
+                }
+                return {
+                    status: "failed",
+                    pipeline_run_id: row.pipeline_run_id,
+                    pipeline: recipe.pipeline,
+                    error_code: "VALIDATION",
+                    error: outcome.diagnostic ?? "invalid phase result",
+                    step_index: step.step,
+                    results: accumulatedResults,
+                };
+            }
+        }
+        accumulatedResults.push(entry);
         nextIndex = stepIndex + 1;
     }
     else {
@@ -445,6 +505,67 @@ export async function deletePipelineRun(deps, input) {
 // ---------------------------------------------------------------------------
 // continuePipelineExecution — shared by run + resume
 // ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// BAPI-763 — plan routing state, read back out of ``results``
+// ---------------------------------------------------------------------------
+/** The plan metadata recorded by the plan-generation step, if it ran. */
+function recordedPlanMetadata(results) {
+    for (let i = results.length - 1; i >= 0; i -= 1) {
+        const metadata = results[i].plan_metadata;
+        if (metadata)
+            return metadata;
+    }
+    return undefined;
+}
+/** The durable ledger as of the most recent routed phase. */
+function recordedLedger(results) {
+    for (let i = results.length - 1; i >= 0; i -= 1) {
+        const records = results[i].plan_step_records;
+        if (records)
+            return records;
+    }
+    return [];
+}
+/** Checkpoint branch/SHA recorded by the checkpoint step, if it ran. */
+function recordedCheckpoint(results) {
+    for (let i = results.length - 1; i >= 0; i -= 1) {
+        const checkpoint = results[i].checkpoint;
+        if (checkpoint)
+            return checkpoint;
+    }
+    return undefined;
+}
+/**
+ * Attach plan provenance to a completed ``request_plan_generation`` entry and prove
+ * the plan is routable before any phase runs.
+ *
+ * Coverage is asserted here, at the earliest possible moment, because the whole point
+ * is to catch a step class that no phase owns while nothing has been produced yet.
+ * Discovering it after a pull request is open is discovering it too late.
+ *
+ * A plan with no metadata does not stop the run: only the implement-ticket recipe is
+ * routed, and every other pipeline calls this same code path. The absence is recorded
+ * as a diagnostic and the routed phases downstream escalate rather than guess.
+ */
+function attachPlanMetadata(entry) {
+    if (entry.tool !== "request_plan_generation" || !entry.ok)
+        return;
+    try {
+        const metadata = extractPlanMetadata(entry.result);
+        if (!metadata) {
+            entry.plan_routing_diagnostic =
+                "plan generation returned no provenance metadata; routed phases will escalate rather than infer step ownership from plan prose";
+            return;
+        }
+        assertPlanIsRoutable(metadata);
+        entry.plan_metadata = metadata;
+    }
+    catch (err) {
+        const message = err instanceof PlanLedgerError ? err.message : String(err);
+        entry.plan_routing_diagnostic = message;
+        console.error(`[pipeline] plan routing unavailable: ${message}`);
+    }
+}
 async function continuePipelineExecution(deps, persistence, row, recipe, autoApprove, forceExecuteAtIndex, approvalAgentResult) {
     let pipelineRunId = row.pipeline_run_id;
     let stepIndex = row.current_step_index;
@@ -508,6 +629,17 @@ async function continuePipelineExecution(deps, persistence, row, recipe, autoApp
                     step_index: step.step,
                 });
             }
+            // BAPI-763: a routed phase is handed its owned step ranges and the durable
+            // ledger through the instruction text. Injected here rather than left to the
+            // conversation because this is exactly the boundary the conversational
+            // hand-off did not survive — the recipe pauses, and the session that resumes
+            // may be a different one.
+            let instruction = step.instruction ?? "";
+            const phase = phaseForInstructionFile(step.instruction_file);
+            const planMetadata = recordedPlanMetadata(results);
+            if (phase && planMetadata) {
+                instruction = injectPhaseRoutingContext(instruction, buildPhaseRoutingContext(planMetadata, phase, recordedLedger(results), recordedCheckpoint(results)));
+            }
             return {
                 status: "needs_agent_task",
                 pipeline_run_id: pipelineRunId,
@@ -515,7 +647,7 @@ async function continuePipelineExecution(deps, persistence, row, recipe, autoApp
                 step_index: step.step,
                 total_steps: totalSteps,
                 step_description: step.description,
-                instruction: step.instruction ?? "",
+                instruction,
                 results,
                 preamble: recipe.agent_instructions,
             };
@@ -537,6 +669,9 @@ async function continuePipelineExecution(deps, persistence, row, recipe, autoApp
             if (capturedApprovalAgentResult !== undefined) {
                 entry.approval_agent_result = capturedApprovalAgentResult;
             }
+            // BAPI-763: capture the plan's provenance and prove every step class has an
+            // executing phase, before the first routed phase begins.
+            attachPlanMetadata(entry);
             results.push(entry);
             stepIndex += 1;
             try {
@@ -569,7 +704,14 @@ async function continuePipelineExecution(deps, persistence, row, recipe, autoApp
             failureEntry.approval_agent_result = capturedApprovalAgentResult;
         }
         results.push(failureEntry);
-        if (step.on_error === "warn_and_continue") {
+        // BAPI-710: an unsupported-local refusal is TERMINAL and overrides
+        // `warn_and_continue`. `warn_and_continue` means "this step is optional" —
+        // but a 409 saying the repository's backend cannot perform the operation is
+        // a permanent property of the repository, not a transient hiccup. Continuing
+        // past it converts a hard refusal into a partial success and lets the
+        // remaining steps run against work that was never done.
+        const unsupportedLocal = parseUnsupportedInLocalModeEnvelope(callResult.error);
+        if (step.on_error === "warn_and_continue" && unsupportedLocal === null) {
             stepIndex += 1;
             try {
                 await persistence.patchRun(pipelineRunId, {

package/build/pipeline-utils.js

@@ -222,6 +222,7 @@ export function resolveRecipe(pipeline, instructions, variables, skipSteps, auto
                     throw new Error(`Instruction file "${step.instruction_file}" not found in bundled instructions.`);
                 }
                 rawInstruction = content;
+                base.instruction_file = step.instruction_file;
             }
             else {
                 rawInstruction = step.instruction;
@@ -236,6 +237,8 @@ export function resolveRecipe(pipeline, instructions, variables, skipSteps, auto
         "If requires_approval is true, pause before executing. For agent_task steps, the instruction file's own approval format is authoritative — follow it verbatim and do not substitute your own short confirmation prompt. For mcp_call steps with no instruction file, present the resolved params as bullet points and ask for approval. " +
         'For on_error "halt", stop the pipeline immediately on failure. ' +
         'For on_error "warn_and_continue", log a warning and proceed. ' +
+        "Recipes are re-entrant: a recovery run may begin again at step 1, and a step whose tool reports a server-side reuse (e.g. reused: true) has completed successfully — treat that as the expected fast path, not a failure, and continue. " +
+        'A step can succeed (no on_error handling applies) while its own returned content is a JSON envelope shaped like error: "GATEWAY_TIMEOUT", status: 504, and a recovery_get field — recognize that shape and read it as "server-side processing may still be running", not as a failure or an invitation to retry. Poll the named retrieval tool (or the recovery_get URL) with the same artifact identifier until a terminal response is reached, and never reissue the original request tool. Only fall back to on_error handling if that retrieval itself terminally fails. ' +
         "Do not skip steps, reorder them, or substitute your own tool calls.";
     // Default-on: include the upgrade-advice surfacing convention unless the
     // caller explicitly opts out (BAPI_MCP_UPGRADE_ADVICE_ENABLED=false).