@bridge_gpt/mcp-server 0.2.36 → 0.2.38

package/build/executor/observation.js

@@ -53,6 +53,118 @@ export async function collectGitTelemetry(deps, worktreePath, baseBranch) {
     }
     return telemetry;
 }
+/** A full 40-character hex object name. */
+const FULL_SHA_PATTERN = /^[0-9a-f]{40}$/i;
+/** Normalize a candidate SHA, or `null` when it is absent/malformed. */
+function normalizeSha(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return FULL_SHA_PATTERN.test(trimmed) ? trimmed.toLowerCase() : null;
+}
+/**
+ * Fail-CLOSED pre-spawn contract over already-collected telemetry (BAPI-731,
+ * WS-E). Pure: it shells out to nothing and reuses `collectGitTelemetry()`'s
+ * existing reads rather than adding new git invocations.
+ *
+ * THE DEGRADED-READ RULE IS THE POINT. `collectGitTelemetry()` degrades silently
+ * — a failed `status --porcelain` simply omits `dirty`, and a failed
+ * `rev-parse HEAD` omits `last_commit_sha`. For ordinary telemetry that is
+ * correct (an observability gap must never fail a worker). For a fail-closed
+ * assertion it is the opposite: an omitted field means "could not verify", and
+ * "could not verify" must never be reported as "verified clean". Both omissions
+ * therefore REFUSE.
+ *
+ * `expectedHeadSha` is optional because `resume` legitimately has no
+ * remote-derived expectation: its protocol auto-commits dirty state as a WIP
+ * checkpoint, so it is verified for cleanliness AFTER that checkpoint but is
+ * exempt from SHA equality. Every other path supplies one.
+ *
+ * Messages are fixed strings plus validated hex SHAs — never porcelain output, a
+ * filename, a worktree path, stderr, or raw exception text.
+ */
+export function evaluatePreSpawnGitVerification(telemetry, expectedHeadSha) {
+    if (typeof telemetry.dirty !== "boolean") {
+        return {
+            ok: false,
+            reason: "status-unverifiable",
+            message: "pre-spawn verification failed: the worktree's clean/dirty status could not be read, " +
+                "so cleanliness cannot be confirmed",
+        };
+    }
+    if (telemetry.dirty) {
+        return {
+            ok: false,
+            reason: "dirty",
+            message: "pre-spawn verification failed: the prepared worktree has uncommitted or untracked " +
+                "changes; refusing to spawn a worker that could commit unrelated leftover work",
+        };
+    }
+    const observedSha = normalizeSha(telemetry.last_commit_sha);
+    if (observedSha === null) {
+        return {
+            ok: false,
+            reason: "head-unverifiable",
+            message: "pre-spawn verification failed: the worktree's HEAD commit could not be read, " +
+                "so it cannot be confirmed to match the prepared commit",
+        };
+    }
+    // No expectation supplied (`resume`): cleanliness plus a readable HEAD is the
+    // whole contract.
+    if (expectedHeadSha === undefined) {
+        return { ok: true, observedSha };
+    }
+    const expected = normalizeSha(expectedHeadSha);
+    if (expected === null) {
+        // Never echo an unvalidated value into a message.
+        return {
+            ok: false,
+            reason: "head-unverifiable",
+            message: "pre-spawn verification failed: the expected commit supplied by worktree preparation " +
+                "is not a valid commit id",
+            observedSha,
+        };
+    }
+    if (expected !== observedSha) {
+        return {
+            ok: false,
+            reason: "head-mismatch",
+            message: `pre-spawn verification failed: the prepared worktree is at ${observedSha} but ` +
+                `preparation expected ${expected}`,
+            observedSha,
+        };
+    }
+    return { ok: true, observedSha };
+}
+/**
+ * Read the LOCAL remote-tracking marker for a branch (BAPI-731, WS-H).
+ *
+ * Reads `refs/remotes/origin/<branch>` from the local object store only. It
+ * deliberately issues NO network operation — no `fetch`, no `ls-remote`, no
+ * provider API — because this runs on the high-frequency telemetry path where a
+ * network stall would block the heartbeat loop and defeat the dead-man switch.
+ * A worker's own `git push` updates this ref locally, which is precisely the
+ * signal being sampled.
+ *
+ * Degrade-don't-throw, exactly like `collectGitTelemetry()`: any failure or
+ * malformed output yields `undefined` and never fails the job.
+ */
+export async function collectRemoteTrackingSha(deps, worktreePath, branch) {
+    try {
+        const result = await deps.runCommand("git", [
+            "-C",
+            worktreePath,
+            "rev-parse",
+            `refs/remotes/origin/${branch}^{commit}`,
+        ]);
+        if (result.exitCode !== 0)
+            return undefined;
+        return normalizeSha(result.stdout) ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Tolerantly parse one Claude stream-json line for an advisory `phase_hint`.
  * Catches ALL parse/schema errors and never throws; returns `{}` when nothing
@@ -89,6 +201,8 @@ export function createObservationState(deps, options) {
     let git = {};
     const advisory = {};
     let exitCode;
+    let attemptStartSha;
+    let attemptEndSha;
     return {
         recordStdout(chunk) {
             advisory.last_stdout_at = new Date(deps.now()).toISOString();
@@ -106,6 +220,16 @@ export function createObservationState(deps, options) {
         setExitCode(code) {
             exitCode = code;
         },
+        setAttemptStartSha(sha) {
+            const normalized = normalizeSha(sha);
+            if (normalized)
+                attemptStartSha = normalized;
+        },
+        setAttemptEndSha(sha) {
+            const normalized = normalizeSha(sha);
+            if (normalized)
+                attemptEndSha = normalized;
+        },
         git() {
             return git;
         },
@@ -117,6 +241,12 @@ export function createObservationState(deps, options) {
                 residue.last_stdout_at = advisory.last_stdout_at;
             if (exitCode !== undefined)
                 residue.exit_code = exitCode;
+            // The attempt boundary pair is independent of `last_commit_sha`: it
+            // survives a degraded final sample rather than being overwritten by one.
+            if (attemptStartSha !== undefined)
+                residue.attempt_start_sha = attemptStartSha;
+            if (attemptEndSha !== undefined)
+                residue.attempt_end_sha = attemptEndSha;
             return residue;
         },
     };

package/build/executor/permissions.js

@@ -15,18 +15,30 @@
  * through the separately launched `mcp-invoke` shim process, which resolves the
  * credential itself — the model process never reads it directly.
  *
+ * BAPI-740/F2: worker-config isolation seeds a repo-scoped copy of that store
+ * INSIDE the per-job isolation directory (`bapi-conductor-claude-cfg-*` under the
+ * executor tmp root — see `worker-config-isolation.ts`), where the `~/.config`
+ * rule cannot reach it. A prefix glob denies model reads under any isolation
+ * directory so the seeded `credentials.json` gets the same shielding as the
+ * operator store. The shim still reads it: the shim is a separate process, not
+ * the model.
+ *
  * The Wave-1 probe on the target machine reports enforcement layer `settings-deny`
  * (claude 2.1.201), so plain `permissions.deny` is provisioned; the PreToolUse
  * fallback is available for CLIs where settings-deny is not enforced.
  */
+import path from "node:path";
 import { mergeClaudeSettingsWithCommandHook, provisionClaudeSettingsForWorktree, DEFAULT_PRE_TOOL_USE_MATCHER, } from "../claude-settings.js";
+import { ISOLATION_DIR_PREFIX } from "./worker-config-isolation.js";
 /**
  * The stable executor deny rules. Grammar mirrors the deny-enforcement probe's
  * `Bash(<cmd>:<args-glob>)` / `Read(<path-glob>)` form. Covers: reads under
  * ~/.ssh, ~/.aws, and keychain paths; the user-scoped Bridge credential store
  * (BAPI-724 — the model is denied direct reads, while the separately launched
- * `mcp-invoke` shim process still resolves it); force-push to the base branch;
- * and destructive `rm -rf` outside the worktree.
+ * `mcp-invoke` shim process still resolves it); the per-job isolation directory
+ * (BAPI-740/F2 — the seeded repo-scoped `credentials.json` lives there, outside
+ * the `~/.config` rule's reach); force-push to the base branch; and destructive
+ * `rm -rf` outside the worktree.
  */
 export function executorDenyRules(inputs) {
     return [
@@ -35,6 +47,10 @@ export function executorDenyRules(inputs) {
         "Read(~/Library/Keychains/**)",
         "Read(/etc/shadow)",
         "Read(~/.config/bridge/**)",
+        // Any path under any per-job isolation directory, wherever the executor's
+        // tmp root lives (`//` anchors at the filesystem root; the prefix constant
+        // is shared with `worker-config-isolation.ts` so they cannot drift).
+        `Read(//**/${ISOLATION_DIR_PREFIX}*/**)`,
         `Bash(git push:*--force*${inputs.baseBranch}*)`,
         "Bash(git push:*--force*)",
         "Bash(rm:*-rf /*)",
@@ -63,7 +79,80 @@ export function mergeExecutorDenySettings(existing, inputs) {
     return { ...existing, permissions };
 }
 /**
- * Provision the executor deny layer into `<worktree>/.claude/settings.local.json`.
+ * The exact line appended to the worktree's `.git/info/exclude` so a worker's
+ * `git add -A` cannot commit the executor-owned settings file.
+ */
+export const EXECUTOR_SETTINGS_EXCLUDE_LINE = ".claude/settings.local.json";
+/**
+ * Keep the executor-owned `.claude/settings.local.json` out of worker commits
+ * (BAPI-740/F2). Worker-config isolation redirects `XDG_CONFIG_HOME`, so the
+ * operator's global git excludes (`~/.config/git/ignore`) no longer apply inside
+ * a worker — empirically, a worker `git add -A` commits the deny-layer file this
+ * module just wrote. A per-worktree `.git/info/exclude` entry is invisible to
+ * the diff and travels with the gitdir, so it closes that without touching the
+ * worktree's tracked `.gitignore`.
+ *
+ * A linked worktree's `.git` is a FILE containing `gitdir: <path>` pointing at
+ * the main repository's per-worktree gitdir; that indirection is resolved rather
+ * than assuming a directory (`EISDIR` on the read identifies a real main-checkout
+ * `.git` directory). Idempotent: the line is appended once, never duplicated.
+ * Fail-open, matching the rest of this module: unresolvable git metadata is a
+ * silent skip, and an exclude-write failure returns a warning — never a block.
+ */
+async function provisionWorktreeSettingsExclude(worktreePath, deps) {
+    const gitPath = path.join(worktreePath, ".git");
+    let gitDir;
+    try {
+        const raw = await deps.readFile(gitPath);
+        const match = /^gitdir:\s*(.+?)\s*$/m.exec(raw);
+        if (!match) {
+            // A readable `.git` file with no gitdir pointer is not git metadata this
+            // function understands; do not guess at a location to write into.
+            return { ok: true };
+        }
+        const target = match[1];
+        gitDir = path.isAbsolute(target) ? target : path.resolve(worktreePath, target);
+    }
+    catch (err) {
+        const code = err && typeof err === "object" ? err.code : undefined;
+        if (code === "EISDIR") {
+            // Main-checkout shape: `.git` is a real directory.
+            gitDir = gitPath;
+        }
+        else {
+            // No readable git metadata at all (e.g. ENOENT) — nothing to protect.
+            return { ok: true };
+        }
+    }
+    try {
+        const infoDir = path.join(gitDir, "info");
+        await deps.mkdir(infoDir, { recursive: true });
+        const excludePath = path.join(infoDir, "exclude");
+        let existing = "";
+        try {
+            existing = await deps.readFile(excludePath);
+        }
+        catch {
+            existing = "";
+        }
+        if (existing.split(/\r?\n/).includes(EXECUTOR_SETTINGS_EXCLUDE_LINE)) {
+            return { ok: true };
+        }
+        const prefix = existing.length === 0 || existing.endsWith("\n") ? existing : `${existing}\n`;
+        await deps.writeFile(excludePath, `${prefix}${EXECUTOR_SETTINGS_EXCLUDE_LINE}\n`);
+        return { ok: true };
+    }
+    catch {
+        return {
+            ok: false,
+            warning: "worktree git-exclude provisioning did not complete " +
+                `(${EXECUTOR_SETTINGS_EXCLUDE_LINE} may appear in worker commits); continuing fail-open`,
+        };
+    }
+}
+/**
+ * Provision the executor deny layer into `<worktree>/.claude/settings.local.json`,
+ * and shield that file from worker commits via `.git/info/exclude` (BAPI-740/F2).
  * Fails open: a malformed existing file is preserved (not clobbered) and I/O
  * errors return a warning — the caller still spawns the worker.
  */
@@ -80,10 +169,17 @@ export async function provisionExecutorDenyLayer(worktreePath, options, deps) {
         }
         return merged;
     }, deps);
-    if (result.ok)
+    // Independent of the settings write above: the exclude protects a file that
+    // may already exist from an earlier provisioning, so it runs even when the
+    // merge-write was refused or failed.
+    const exclude = await provisionWorktreeSettingsExclude(worktreePath, deps);
+    const warnings = [];
+    if (!result.ok) {
+        warnings.push(`deny-layer provisioning did not complete (${result.reason}); continuing fail-open`);
+    }
+    if (!exclude.ok)
+        warnings.push(exclude.warning);
+    if (warnings.length === 0)
         return { ok: true };
-    return {
-        ok: false,
-        warning: `deny-layer provisioning did not complete (${result.reason}); continuing fail-open`,
-    };
+    return { ok: false, warning: warnings.join("; ") };
 }

package/build/executor/preflight.js

@@ -15,6 +15,7 @@
  */
 import { runDenyEnforcementPreflight } from "../conductor/deny-enforcement-preflight.js";
 import { DEFAULT_PROBE_TIMEOUT_MS } from "../agent-capabilities/types.js";
+import { evaluateClaudeMcpShadowingPolicy, inspectClaudeUserConfigForMcpShadowing, resolveClaudeUserConfigPath, } from "../claude-user-config-doctor.js";
 import { resolveAllExecutorApiAccess, resolveBaseUrl, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
 const VERSION_DETAIL_MAX = 200;
 /**
@@ -201,6 +202,37 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
     catch {
         fatalFindings.push("deny-layer enforcement probe failed; refusing to claim");
     }
+    // --- Claude user-config MCP shadowing (fatal by default, BAPI-727) ----
+    // REFUSAL BY DEFAULT is the whole point. A `bridge-api` entry in the machine's
+    // ~/.claude.json was observed to win over a linked worktree's provisioned
+    // `.mcp.json`, so the worker silently talks to whatever endpoint that entry
+    // names instead of the one the executor provisioned — a production-integrity
+    // failure that produces no error, only wrong work. A warning-only check would
+    // preserve exactly that silence; the explicit
+    // BAPI_CONDUCTOR_ALLOW_CLAUDE_MCP_SHADOWING override is the deliberate operator
+    // escape hatch for the cases where the collision is known and intended.
+    //
+    // Inconclusive states (unreadable/malformed config) are warnings, never fatal:
+    // "could not look" must not become "found a collision".
+    try {
+        const inspect = seams.inspectClaudeUserConfig ?? inspectClaudeUserConfigForMcpShadowing;
+        const inspection = await inspect({
+            claudeConfigPath: resolveClaudeUserConfigPath(deps.homedir(), deps.platform),
+            platform: deps.platform,
+            cwd: deps.cwd,
+            // The executor's own checkout is the main repository. Preflight runs
+            // before any job, so there is no prepared worktree to name here — the
+            // per-job check in `job-runner.ts` covers that scope.
+            mainRepositoryPath: deps.cwd,
+        }, { readFile: deps.readFile });
+        const policy = evaluateClaudeMcpShadowingPolicy(inspection, deps.env);
+        warnings.push(...policy.warnings);
+        if (!policy.ok)
+            fatalFindings.push(...policy.refusals);
+    }
+    catch {
+        warnings.push("Claude user-config MCP shadowing check did not complete; could not verify worker MCP integrity");
+    }
     return {
         ok: fatalFindings.length === 0,
         fatalFindings,

package/build/executor/runner.js

@@ -74,6 +74,14 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
     }
     for (;;) {
         const report = await collectPreflight(options, deps, preflightSeams);
+        // BAPI-727: preflight warnings were previously collected but never emitted, so
+        // a non-fatal finding — an overridden MCP-shadowing collision, an unreadable
+        // ~/.claude.json — was invisible to the operator. Emit them before the claim
+        // decision; this only logs and never changes the existing `!report.ok`
+        // claim-skipping behavior below.
+        for (const warning of report.warnings) {
+            deps.errorLog(`executor preflight warning: ${warning}`);
+        }
         if (!report.ok) {
             deps.errorLog(`executor preflight refused claiming: ${report.fatalFindings.join("; ")}`);
         }

package/build/executor/test-clock.js

@@ -72,7 +72,15 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
         spawnProcess: () => {
             throw new Error("spawnProcess not configured for this test");
         },
-        readFile: async () => {
+        readFile: async (filePath) => {
+            // BAPI-731: the prepared worktree's own `.mcp.json` must carry the required
+            // `bridge-api` registration or the runner refuses to spawn (an isolated
+            // worker has no operator-scoped registration to fall back to). Serve a
+            // minimal valid one so pre-existing spawn tests still reach the spawn they
+            // were written to assert on.
+            if (typeof filePath === "string" && filePath.endsWith(".mcp.json")) {
+                return JSON.stringify({ mcpServers: { "bridge-api": { command: "node", args: [] } } });
+            }
             // Mirror real fs/promises: a missing-file rejection carries code "ENOENT"
             // (so BAPI-664 command provisioning treats absent files as fillable).
             throw Object.assign(new Error("ENOENT"), { code: "ENOENT" });
@@ -81,11 +89,31 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
         mkdir: async () => undefined,
         stat: async () => ({ mode: 0o644 }),
         statfs: async () => ({ bavail: 1_000_000, bsize: 4096 }),
+        // BAPI-731 worker config isolation boundaries. In-memory fakes: no test ever
+        // creates, permissions, or removes a real directory. Isolation is
+        // fail-CLOSED, so a spawn-path test that did not supply these would refuse to
+        // spawn — these defaults keep the many pre-existing spawn tests exercising
+        // what they were written to exercise.
+        mkdtemp: async (prefix) => `${prefix}test`,
+        chmod: async () => { },
+        rmRecursive: async () => { },
+        readdir: async () => [],
+        lstatPath: async () => ({ isDirectory: true, isSymbolicLink: false, mtimeMs: 0 }),
+        tmpdir: () => "/tmp",
         sleep: clock.sleep,
         now: clock.now,
         setTimer: clock.setTimer,
         clearTimer: clock.clearTimer,
-        env: {},
+        // `ANTHROPIC_API_KEY` is the isolation strategy's required credential source
+        // (see `worker-config-isolation.ts`); without it capability evaluation
+        // reports `unsupported-auth-layout` and no spawn test could run.
+        // `BAPI_API_KEY` is the seed credential for the isolated Bridge store
+        // (BAPI-740/F2); without it the runner refuses pre-spawn with
+        // `ContractError.BridgeCredentialUnavailable` and no spawn test could run.
+        env: {
+            ANTHROPIC_API_KEY: "test-key-not-a-real-credential",
+            BAPI_API_KEY: "test-bapi-key-not-a-real-credential",
+        },
         cwd: "/repo",
         platform: "linux",
         homedir: () => "/home/tester",
@@ -98,7 +126,43 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
             serverEntryPath: "/repo/mcp_server/build/index.js",
         },
     };
-    return { ...base, ...overrides };
+    const merged = { ...base, ...overrides };
+    // BAPI-731: two fail-CLOSED spawn gates depend on ambient fixture state that
+    // predates them, so an override supplied for an unrelated reason would
+    // silently turn a spawn test into a refusal test. Both are re-applied here as
+    // FALLBACKS — an override that deliberately exercises a refusal still wins,
+    // because it either supplies its own key/registration or explicitly omits one.
+    // 1. Isolation needs an Anthropic key, and the Bridge-store seeding refusal
+    //    (BAPI-740/F2) needs a resolvable `BAPI_API_KEY`. A test overriding `env`
+    //    for some other purpose keeps both unless it sets the key itself — an
+    //    override that deliberately exercises a refusal supplies its own value
+    //    (empty string included: presence wins over the fallback).
+    if (overrides.env) {
+        const fallbacks = {};
+        for (const key of ["ANTHROPIC_API_KEY", "BAPI_API_KEY"]) {
+            if (!(key in overrides.env))
+                fallbacks[key] = base.env[key];
+        }
+        merged.env = { ...fallbacks, ...overrides.env };
+    }
+    // 2. The required-registration check reads the worktree's `.mcp.json`. A test
+    //    overriding `readFile` (usually to script command provisioning) still gets
+    //    the default registration for that one path when its own read rejects.
+    if (overrides.readFile) {
+        const override = overrides.readFile;
+        merged.readFile = async (filePath) => {
+            try {
+                return await override(filePath);
+            }
+            catch (err) {
+                if (typeof filePath === "string" && filePath.endsWith(".mcp.json")) {
+                    return base.readFile(filePath);
+                }
+                throw err;
+            }
+        };
+    }
+    return merged;
 }
 /** Sensible default executor options for tests. */
 export function makeTestOptions(overrides = {}) {

package/build/executor/types.js

@@ -1 +1,4 @@
-export {};
+/** Normalize either heartbeat response form into the structured shape. */
+export function normalizeHeartbeatResult(response) {
+    return typeof response === "string" ? { outcome: response } : response;
+}

package/build/executor/worker-command.js

@@ -80,10 +80,18 @@ export function resolveExecutorPrompt(job) {
     // change addressing, and merge-conflict resolution (see .claude/commands/
     // implement-ticket.md "Clean session exit"). So the recovery jobs that operate
     // on the ticket's existing branch/PR — `remediate`/`ci_fix`/`rebase` — resume
-    // through the same command, which detects the outstanding CI/review/conflict
-    // state and continues rather than restarting. Without this, a code_review
+    // by RE-ENTERING THE COMPLETE RECIPE from step 1, not a distinct resume path.
+    // That re-entry is safe (BAPI-746), backed by re-entry handling already
+    // present in three of the recipe's own steps, not a new assumption: plan
+    // generation is idempotent because the server reuses a fresh existing plan
+    // instead of regenerating it (BAPI-745, `reused: true`); commit-and-push.md
+    // treats a clean tree with an already-pushed branch/PR as a legitimate
+    // re-entry rather than an empty implementation; and create-pr.md treats an
+    // already-open pull request on the head branch as satisfying its success
+    // condition. Without synthesizing this command, a code_review
     // `changes_requested` (near-certain in real runs) enqueues a `remediate` job
-    // that fails `no usable prompt` and strands the run (BAPI-528 Milestone-A gap #3).
+    // that fails `no usable prompt` and strands the run (BAPI-528 Milestone-A gap
+    // #3).
     const ticketKey = typeof job.ticket_key === "string" && job.ticket_key.trim().length > 0
         ? job.ticket_key.trim()
         : null;