@bridge_gpt/mcp-server 0.2.36 → 0.2.37

package/build/credential-store.js

@@ -524,6 +524,38 @@ export const BOOTSTRAP_PENDING_FINGERPRINT_FIELD = "BOOTSTRAP_INVITE_FINGERPRINT
  * is NEVER logged, printed, or placed in an error string.
  */
 export const BOOTSTRAP_PENDING_REPLAY_TOKEN_FIELD = "BOOTSTRAP_SELF_SERVE_INVITE";
+/**
+ * Signup-challenge metadata fields (BAPI-757).
+ *
+ * A self-serve run now passes through TWO durable pending shapes in sequence:
+ *
+ *   1. **Challenge-only** — these three fields and nothing else. Written after the
+ *      server accepts the email and before the CLI prompts for the code, so a
+ *      terminal closed mid-prompt can resume the SAME challenge instead of
+ *      requesting a second email against the user's own per-address send budget.
+ *   2. **Exchange-resumable** — the pre-existing `key_secret` + fingerprint +
+ *      replay-token shape, written once verification returns an invite token.
+ *
+ * The transition is a single atomic replacement: {@link buildPendingEntry} removes
+ * all three challenge fields when it writes shape 2, so a record is never both.
+ *
+ * **NONE of these is a secret, and the verification CODE is deliberately not among
+ * them.** The code is never written to disk, never passed to a writer, and has no
+ * field name here — on restart the CLI re-prompts for it rather than recovering it.
+ * That is what keeps a readable credential store from being enough to complete
+ * someone else's signup: the store holds the handle, the mailbox holds the code.
+ */
+export const BOOTSTRAP_PENDING_SIGNUP_EMAIL_FIELD = "BOOTSTRAP_SIGNUP_EMAIL";
+/** Public challenge handle. Lookup material, not an authorization. */
+export const BOOTSTRAP_PENDING_CHALLENGE_HANDLE_FIELD = "BOOTSTRAP_CHALLENGE_HANDLE";
+/** Server-supplied ISO-8601 challenge expiry, used only to decide resume vs. restart. */
+export const BOOTSTRAP_PENDING_CHALLENGE_EXPIRES_FIELD = "BOOTSTRAP_CHALLENGE_EXPIRES_AT";
+/** Every challenge-only field, for the removal in {@link buildPendingEntry}. */
+const BOOTSTRAP_PENDING_CHALLENGE_FIELDS = [
+    BOOTSTRAP_PENDING_SIGNUP_EMAIL_FIELD,
+    BOOTSTRAP_PENDING_CHALLENGE_HANDLE_FIELD,
+    BOOTSTRAP_PENDING_CHALLENGE_EXPIRES_FIELD,
+];
 /** Pending target for a repo: `bootstrap-pending:<repo>`. */
 export function getBootstrapPendingTarget(repoName) {
     return `${BOOTSTRAP_PENDING_TARGET_PREFIX}${(repoName ?? "").trim()}`;
@@ -596,6 +628,15 @@ function buildPendingEntry(existing, keySecret, inviteFingerprint, replayToken)
     else {
         delete next[BOOTSTRAP_PENDING_REPLAY_TOKEN_FIELD];
     }
+    // BAPI-757: writing the exchange-resumable shape RETIRES the challenge-only one,
+    // in this same durable replacement. The challenge has been verified — its handle
+    // is spent and its expiry is meaningless — and leaving the fields behind would
+    // produce a record that reads as both shapes at once, which the lookup would
+    // then have to arbitrate. Removing them here means the two shapes are mutually
+    // exclusive by construction rather than by convention.
+    for (const field of BOOTSTRAP_PENDING_CHALLENGE_FIELDS) {
+        delete next[field];
+    }
     return next;
 }
 /**
@@ -767,6 +808,100 @@ export async function prepareBootstrapPendingCredential(params, deps) {
         return { ok: true, path: primaryPath, target, keySecret, reused: false };
     }, (error) => ({ ok: false, path: primaryPath, target, kind: "lock-error", error }));
 }
+/**
+ * Durably persist signup-challenge metadata BEFORE the CLI prompts for the code
+ * (BAPI-757).
+ *
+ * The ordering is the point, and it mirrors the load-bearing
+ * persist-before-exchange rule one phase earlier: the server has already sent an
+ * email and already charged the user's per-address send budget by the time this
+ * runs, so the handle must reach disk before anything can interrupt the run. A
+ * terminal closed at the code prompt then resumes the SAME challenge, and the
+ * original emailed code still works.
+ *
+ * Written through {@link durablyReplaceCredentialStoreJson}, so it is fsync-backed
+ * and mode 0600 on POSIX exactly like every other record here — the write either
+ * lands or reports a failure; it never half-lands.
+ *
+ * **The verification code is not a parameter and has no field.** There is no way to
+ * pass one in, which is what makes "the code never touches disk" a property of the
+ * type rather than a rule someone has to remember.
+ *
+ * Refuses to clobber an existing pending record that belongs to something else —
+ * an ordinary `--invite` redemption or a completed self-serve exchange awaiting
+ * replay. That record may be the only proof that can recover a live admin key.
+ */
+export async function prepareSelfServeBootstrapChallenge(params, deps) {
+    const primaryPath = getPrimaryCredentialStorePath(deps);
+    const repoName = (params.repoName ?? "").trim();
+    const signupEmail = (params.signupEmail ?? "").trim();
+    const challengeHandle = (params.challengeHandle ?? "").trim();
+    const challengeExpiresAt = (params.challengeExpiresAt ?? "").trim();
+    const target = getBootstrapPendingTarget(repoName);
+    if (repoName.length === 0) {
+        return {
+            ok: false,
+            path: primaryPath,
+            target,
+            kind: "invalid-repo",
+            error: "Cannot record a signup challenge: a non-empty repo name is required.",
+        };
+    }
+    // All three or none. A partial record is exactly the `pending-challenge-malformed`
+    // state the lookup fails closed on, so refusing to WRITE one keeps that state
+    // reachable only through external tampering. The rejected values never appear in
+    // the error — one of them is the invitee's address.
+    if (signupEmail.length === 0 ||
+        challengeHandle.length === 0 ||
+        challengeExpiresAt.length === 0) {
+        return {
+            ok: false,
+            path: primaryPath,
+            target,
+            kind: "invalid-challenge",
+            error: "Cannot record a signup challenge: the challenge metadata was incomplete.",
+        };
+    }
+    return withCredentialStoreLock(deps, async () => {
+        const loaded = await loadStoreForMutation(deps);
+        if (!loaded.ok) {
+            return { ok: false, path: primaryPath, target, kind: loaded.kind, error: loaded.error };
+        }
+        const base = loaded.base;
+        const existing = base[target];
+        // Never overwrite a record that holds a key_secret: that record is the only
+        // proof that can replay a redemption, and if its exchange already succeeded
+        // the admin key it created becomes unrecoverable. A challenge-only record
+        // (no key_secret) is ours to replace — that is the ordinary "requested a new
+        // challenge after the old one expired" path.
+        if (readPendingField(existing, BOOTSTRAP_PENDING_SECRET_FIELD).length > 0) {
+            return {
+                ok: false,
+                path: primaryPath,
+                target,
+                kind: "pending-conflict",
+                error: `A pending bootstrap credential already exists at ${target} in ${primaryPath}. ` +
+                    "This run will not overwrite it. Finish or remove that setup attempt first.",
+            };
+        }
+        const next = {
+            ...base,
+            [target]: {
+                // Deliberately NOT spread from `existing`: a challenge-only record is a
+                // complete replacement, and inheriting stray fields from a previous
+                // attempt is how a record ends up describing two challenges at once.
+                [BOOTSTRAP_PENDING_SIGNUP_EMAIL_FIELD]: signupEmail,
+                [BOOTSTRAP_PENDING_CHALLENGE_HANDLE_FIELD]: challengeHandle,
+                [BOOTSTRAP_PENDING_CHALLENGE_EXPIRES_FIELD]: challengeExpiresAt,
+            },
+        };
+        const written = await durablyReplaceCredentialStoreJson(primaryPath, next, deps);
+        if (!written.ok) {
+            return { ok: false, path: primaryPath, target, kind: written.kind, error: written.error };
+        }
+        return { ok: true, path: primaryPath, target };
+    }, (error) => ({ ok: false, path: primaryPath, target, kind: "lock-error", error }));
+}
 /**
  * Atomically move a pending record to a different repo name, preserving the exact
  * same `key_secret` — used when the server answers `409 repo_name_taken` and the
@@ -913,6 +1048,36 @@ export async function promoteBootstrapPendingCredential(params, deps) {
         return { ok: true, path: primaryPath, target, action: hadKey ? "updated" : "created" };
     }, (error) => ({ ok: false, path: primaryPath, target, kind: "lock-error", error }));
 }
+/**
+ * Classify a pending entry's signup-challenge fields (BAPI-757).
+ *
+ * All three present → `live` or `expired`. None present → `absent`. **Any other
+ * combination is `malformed`, and that is a failure rather than a fallback**: a
+ * partial record may correspond to a challenge whose email was already sent, and
+ * silently treating it as absent would request another one.
+ *
+ * An unparseable expiry is `malformed` for the same reason. Guessing at it would
+ * mean either discarding a live challenge or trusting a value nothing produced.
+ */
+function classifySignupChallengeRecord(entry, now) {
+    const signupEmail = readPendingField(entry, BOOTSTRAP_PENDING_SIGNUP_EMAIL_FIELD);
+    const challengeHandle = readPendingField(entry, BOOTSTRAP_PENDING_CHALLENGE_HANDLE_FIELD);
+    const challengeExpiresAt = readPendingField(entry, BOOTSTRAP_PENDING_CHALLENGE_EXPIRES_FIELD);
+    const present = [signupEmail, challengeHandle, challengeExpiresAt].filter((value) => value.length > 0).length;
+    if (present === 0)
+        return { kind: "absent" };
+    if (present < 3)
+        return { kind: "malformed" };
+    const expiresAtMs = Date.parse(challengeExpiresAt);
+    if (Number.isNaN(expiresAtMs))
+        return { kind: "malformed" };
+    // Only a SUPPLIED clock can conclude expiry. Without one, the challenge is
+    // reported live — see the `now` doc comment for why that direction is safer.
+    if (typeof now === "number" && Number.isFinite(now) && expiresAtMs <= now) {
+        return { kind: "expired" };
+    }
+    return { kind: "live", signupEmail, challengeHandle, challengeExpiresAt };
+}
 /**
  * Look up the SELF-SERVE pending record for a repo (BAPI-667) — the read that
  * makes a self-serve retry resume instead of minting a second workspace.
@@ -924,8 +1089,13 @@ export async function promoteBootstrapPendingCredential(params, deps) {
  * logical target and the store path and nothing else.
  *
  * States:
- *   - `none` — no record, or a record with nothing at stake (no usable secret and
- *     no replay material). The caller mints normally.
+ *   - `none` — no record, or a record with nothing at stake (no usable secret, no
+ *     replay material, and no challenge metadata). The caller requests normally.
+ *   - `challenge` — a LIVE signup challenge (BAPI-757). The caller resumes at the
+ *     code prompt and MUST NOT request or resend: the emailed code is still valid,
+ *     and requesting again would spend the user's own per-address send budget.
+ *   - `challenge-expired` — a signup challenge conclusively past its expiry against
+ *     the supplied clock. The caller may request a fresh one.
  *   - `resumable` — a complete self-serve record. The caller MUST reuse it and MUST
  *     NOT mint.
  *   - `pending-not-self-serve` — a real pending record with a `key_secret` but no
@@ -972,9 +1142,40 @@ export async function lookupSelfServeBootstrapPendingCredential(params, deps) {
         const fingerprint = readPendingField(entry, BOOTSTRAP_PENDING_FINGERPRINT_FIELD);
         const replayToken = readPendingField(entry, BOOTSTRAP_PENDING_REPLAY_TOKEN_FIELD);
         if (replayToken.length === 0) {
-            // No replay material: either nothing is stored, or an ordinary invite
-            // redemption owns this target. Only the latter is a conflict.
+            // No replay material: either nothing is stored, a signup challenge is in
+            // flight, or an ordinary invite redemption owns this target.
             if (keySecret.length === 0) {
+                // BAPI-757: checked BEFORE returning `none`, because a challenge-only
+                // record legitimately has no key_secret and no fingerprint. Treating it
+                // as "nothing stored" would request a second verification email against
+                // the user's own per-address budget and invalidate nothing — the classic
+                // way a resumable state becomes a lockout.
+                const challenge = classifySignupChallengeRecord(entry, params.now);
+                if (challenge.kind === "malformed") {
+                    return {
+                        ok: false,
+                        path: primaryPath,
+                        target,
+                        kind: "pending-challenge-malformed",
+                        error: `The pending signup record at ${target} in ${primaryPath} is incomplete, so it ` +
+                            "cannot be resumed and will not be discarded automatically (a verification email " +
+                            "may already have been sent). Ask your Bridge API operator to recover it.",
+                    };
+                }
+                if (challenge.kind === "live") {
+                    return {
+                        ok: true,
+                        state: "challenge",
+                        path: primaryPath,
+                        target,
+                        signupEmail: challenge.signupEmail,
+                        challengeHandle: challenge.challengeHandle,
+                        challengeExpiresAt: challenge.challengeExpiresAt,
+                    };
+                }
+                if (challenge.kind === "expired") {
+                    return { ok: true, state: "challenge-expired", path: primaryPath, target };
+                }
                 return { ok: true, state: "none", path: primaryPath, target };
             }
             return {

package/build/direct-ticket-tools.js

@@ -0,0 +1,70 @@
+/**
+ * direct-ticket-tools — agent-facing entry points for the ticket updater and the
+ * single-ticket estimator (BAPI-711).
+ *
+ * Both flows were previously reachable only through a Jira-shaped webhook. In
+ * Jira mode Jira is the driver; in local mode the driver is the agent, which
+ * already talks to Bridge directly — so the fix is not a local event emitter, it
+ * is a direct entry point. These tools are that entry point.
+ *
+ * Two properties are load-bearing:
+ *
+ *   - The repository is INJECTED from `BAPI_REPO_NAME`, never accepted from the
+ *     agent. An agent-supplied repo would let a tool call address a repository
+ *     the session was not configured for; the backend re-authorizes it anyway,
+ *     but the schema should not invite the attempt.
+ *   - Every outcome — success, duplicate-active, and backend error — resolves to
+ *     a normal text content envelope. Throwing through the MCP transport turns a
+ *     recoverable 429 into a dead session.
+ */
+function text(value) {
+    return { content: [{ type: "text", text: value }] };
+}
+/**
+ * POST a direct-invocation request and render its outcome as normal content.
+ *
+ * A connection failure is reported as text rather than rethrown: the submission
+ * outcome is genuinely unknown at that point, and the recoverable action (poll
+ * `get_ticket_state`) is the same either way.
+ */
+async function postDirectInvocation(deps, path, body, ticketNumber) {
+    let resp;
+    try {
+        resp = await (deps.fetchImpl ?? fetch)(deps.buildUrl(path), {
+            method: "POST",
+            headers: await deps.getPostHeaders(),
+            body: JSON.stringify({ ...body, repo_name: deps.repoName }),
+        });
+    }
+    catch {
+        return text(`The request could not be delivered, so it is unknown whether it was accepted. ` +
+            `Call get_ticket_state for ${ticketNumber} to check before retrying.`);
+    }
+    if (!resp.ok) {
+        return text(await deps.handleResponse(resp));
+    }
+    return text(await resp.text());
+}
+export async function runRequestTicketUpdate(args, deps) {
+    return postDirectInvocation(deps, `/ticket/${encodeURIComponent(args.ticket_number)}/generate-ticket-update`, {}, args.ticket_number);
+}
+export async function runRequestEstimate(args, deps) {
+    return postDirectInvocation(deps, `/ticket/${encodeURIComponent(args.ticket_number)}/generate-estimate`, 
+    // Sent explicitly rather than omitted so the backend default and the tool
+    // default can never drift apart silently.
+    { recreate: args.recreate === true }, args.ticket_number);
+}
+export async function runGetTicketUpdateReview(args, deps) {
+    const url = deps.buildGetUrl(`/ticket/${encodeURIComponent(args.ticket_number)}/ticket-update-review`, { repo_name: deps.repoName });
+    let resp;
+    try {
+        resp = await (deps.fetchImpl ?? fetch)(url, { headers: await deps.getHeaders() });
+    }
+    catch {
+        return text(`The held-for-review proposal for ${args.ticket_number} could not be fetched. Retry shortly.`);
+    }
+    if (!resp.ok) {
+        return text(await deps.handleResponse(resp));
+    }
+    return text(await resp.text());
+}