@bridge_gpt/mcp-server 0.2.37 → 0.2.39

package/build/executor/preflight.js

@@ -1,23 +1,8 @@
-/**
- * Executor preflight + capability manifest construction (BAPI-534, TDD §11, R8).
- *
- * Before claiming, verify local tooling (wt/git/claude), credentials, disk, and
- * — the binding post-Wave-2 contract — deny-layer enforcement. REFUSE TO CLAIM
- * on any fatal finding. The capability manifest (exactly the 8 T2-accepted keys)
- * is built from these inspections. Local `gh` auth is captured in the internal
- * report (for T5's fatal-before-merge preflight) but is NOT added to the T2
- * claim manifest, which does not accept it in this slice.
- *
- * The deny-enforcement probe is injected (`seams.runDenyPreflight`) so unit tests
- * never spawn a real headless `claude`; the default is the real
- * `runDenyEnforcementPreflight` from the conductor deny-enforcement module (an
- * allowed reuse surface — it does not pull the v1 event/ledger graph).
- */
-import { runDenyEnforcementPreflight } from "../conductor/deny-enforcement-preflight.js";
 import { DEFAULT_PROBE_TIMEOUT_MS } from "../agent-capabilities/types.js";
-import { evaluateClaudeMcpShadowingPolicy, inspectClaudeUserConfigForMcpShadowing, resolveClaudeUserConfigPath, } from "../claude-user-config-doctor.js";
+import { inspectExecutorAgentAdapter, inspectionForFailedResolution, } from "../agent-launchers/executor-adapter-inspection.js";
+import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter-registry.js";
+import { resolveExecutorAgentId } from "./agent-identity.js";
 import { resolveAllExecutorApiAccess, resolveBaseUrl, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
-const VERSION_DETAIL_MAX = 200;
 /**
  * Environment override for the deny probe's headless timeout (BAPI-722).
  *
@@ -79,17 +64,108 @@ export function createDenyProbeCache() {
         },
     };
 }
-function normalizeVersion(stdout, stderr) {
-    return (stdout || stderr || "").trim().slice(0, VERSION_DETAIL_MAX);
+/** Fail-fast report shape for a preflight that refused before probing. */
+function refusedPreflight(fatalFindings, warnings, adapter) {
+    return {
+        ok: false,
+        fatalFindings,
+        warnings,
+        agentVersion: "",
+        wtVersion: "",
+        diskFreeGb: null,
+        ghAuthed: false,
+        denyEnforced: false,
+        adapter,
+    };
 }
 /**
  * Collect the executor preflight report. Populates the manifest fields and
  * accumulates fatal findings — the runner refuses to claim when any exist.
+ *
+ * ADAPTER RESOLUTION IS THE FIRST OPERATION (BAPI-781), and a failure returns
+ * immediately without running a single probe. That fail-fast is a real
+ * guarantee, not an optimization: every probe below spawns something or touches
+ * the filesystem, and an executor whose agent has no usable adapter cannot run
+ * work no matter what those probes report. Spending them would also make the
+ * report describe a host configuration nobody can use.
  */
 export async function collectExecutorPreflight(options, deps, seams = {}) {
     const fatalFindings = [];
     const warnings = [];
+    // --- Executor adapter (fatal, FIRST, BAPI-781) ------------------------
+    const agentId = resolveExecutorAgentId(options.agentId);
+    const resolveAdapter = seams.resolveAdapter ??
+        ((id) => resolveExecutorAgentAdapter(id, {
+            // The adapter's advisory inspection needs a read boundary. Supplying
+            // preflight's own injected `readFile` keeps the inspection hermetic in
+            // tests and read-only in production — the adapter never opens a file
+            // handle this module did not hand it.
+            claude: { readFile: deps.readFile },
+        }));
+    const resolution = resolveAdapter(agentId);
+    if (!resolution.supported) {
+        return refusedPreflight([resolution.message], warnings, inspectionForFailedResolution(agentId, resolution));
+    }
+    const adapter = resolution.adapter;
+    // --- Supported platform (fatal, BAPI-790 → adapter-declared, BAPI-781) --
+    // Still second, and still before every probe: this is a property of the host,
+    // so nothing below it needs to run to know the answer. What changed is WHO
+    // declares it. The gate used to be the executor's own hard-coded darwin/linux
+    // policy; it is now the resolved adapter's declared platform capability, so a
+    // future agent supported on a different set is not silently held to Claude's.
+    // It remains a PLATFORM check only — it does not require a credential, because
+    // a worker authenticates through the operator's interactive login.
+    const adapterInspection = await inspectExecutorAgentAdapter(adapter, deps, {
+        probeExecutable: true,
+    });
+    const platformSupport = adapterInspection.inspection.platform;
+    if (platformSupport && !platformSupport.supported) {
+        return refusedPreflight([platformSupport.message], warnings, adapterInspection.inspection);
+    }
+    // --- Agent executable (fatal) -----------------------------------------
+    // Probed BY THE ADAPTER's declaration — its executable name and its version
+    // argv — rather than by a literal `claude --version`. `agentVersion` keeps its
+    // existing normalized value so the HTTP claim manifest stays wire-compatible.
+    const executableReport = adapterInspection.inspection.executable;
+    const agentVersion = executableReport?.version ?? "";
+    if (!executableReport || !executableReport.probed || executableReport.failure !== null) {
+        const command = executableReport?.command ?? agentId;
+        fatalFindings.push(`${command} (headless agent) is not available on PATH`);
+    }
+    // --- Lifecycle declaration (fatal when absent, BAPI-781) --------------
+    // An adapter that declares `{ kind: "none" }` is fine — Claude genuinely has
+    // no cleanup left after BAPI-790. An adapter that declares nothing is refused,
+    // because "no lifecycle work" and "nobody specified the lifecycle" must not
+    // look the same to the runner that has to decide whether to sweep.
+    if (adapterInspection.inspection.lifecycleKind === null) {
+        fatalFindings.push("executor adapter declares no lifecycle behavior; refusing to claim (an explicit " +
+            "no-op lifecycle is required, absence is not treated as no-op)");
+    }
+    // --- Declared Bridge-managed auth carriers (BAPI-781) -----------------
+    // Validated ONLY when declared. Claude declares zero, so this loop does
+    // nothing for it — and that is the intended shape: there is no login gate, no
+    // credential-store read, and no pre-spawn authentication check for an agent
+    // whose workers inherit the operator's own login.
+    const authCapability = adapter.auth;
+    if (authCapability?.supported === true) {
+        for (const carrier of authCapability.value.managedAuthCarriers) {
+            try {
+                const validation = await carrier.validate(deps.env);
+                if (!validation.valid) {
+                    fatalFindings.push(`declared auth carrier '${validation.carrierId}' failed validation: ${validation.detail}`);
+                }
+            }
+            catch {
+                fatalFindings.push(`declared auth carrier '${carrier.carrierId}' could not be validated; refusing to claim`);
+            }
+        }
+    }
     // --- Tooling probes ---------------------------------------------------
+    // Worktrunk is executor infrastructure, not an agent, so its version probe
+    // stays here rather than moving behind the adapter. It keeps its own bounded
+    // normalization for exactly the reason the agent probe had one: the value
+    // travels onto the wire in the claim manifest.
+    const normalizeVersion = (stdout, stderr) => (stdout || stderr || "").trim().slice(0, 200);
     let wtVersion = "";
     try {
         const wt = await deps.runCommand(options.worktrunkBinary, ["--version"]);
@@ -111,19 +187,6 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
     catch {
         fatalFindings.push("git could not be probed");
     }
-    let agentVersion = "";
-    try {
-        const claude = await deps.runCommand("claude", ["--version"]);
-        if (claude.exitCode === 0) {
-            agentVersion = normalizeVersion(claude.stdout, claude.stderr);
-        }
-        else {
-            fatalFindings.push("claude (headless agent) is not available on PATH");
-        }
-    }
-    catch {
-        fatalFindings.push("claude could not be probed");
-    }
     // --- Explicit base URL (fatal; never defaults to production, BAPI-676) ---
     // Resolved before per-repo credentials so a missing URL reports ONCE rather
     // than once per repo. The remaining probes still run and accumulate findings.
@@ -182,9 +245,36 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
         if (cachedDeny !== undefined) {
             deny = cachedDeny;
         }
+        else if (seams.runDenyPreflight) {
+            // An explicitly injected probe still wins, so every existing test seam
+            // keeps working unchanged across the extraction.
+            deny = await seams.runDenyPreflight({ timeoutMs: resolveDenyProbeTimeoutMs(deps.env) });
+            seams.denyProbeCache?.set(deny);
+        }
         else {
-            const denyProbe = seams.runDenyPreflight ?? runDenyEnforcementPreflight;
-            deny = await denyProbe({ timeoutMs: resolveDenyProbeTimeoutMs(deps.env) });
+            // Otherwise the ADAPTER's declared deny hook probes. The verdict is mapped
+            // back onto the established result shape so the cache, the fatal findings,
+            // and the claim manifest all keep their existing semantics — only who owns
+            // the probe changed.
+            //
+            // The capability is re-narrowed rather than asserted: validation already
+            // proved it supported, but a non-null assertion here would silently become
+            // a crash if the required-capability list ever changed. A refusal is the
+            // correct failure, and it costs one branch.
+            const denyCapability = adapter.denyEnforcement;
+            if (denyCapability?.supported !== true) {
+                throw new Error("adapter declares no deny-enforcement capability");
+            }
+            const verdict = await denyCapability.value.probeEnforcement({
+                timeoutMs: resolveDenyProbeTimeoutMs(deps.env),
+            });
+            deny = {
+                enforced: verdict.enforced,
+                layer: verdict.layer,
+                degraded: verdict.degraded,
+                warnings: verdict.warnings,
+                detail: verdict.detail,
+            };
             // `set` itself refuses anything that is not a genuine success, so a failure
             // cannot become sticky even if this call site were later moved.
             seams.denyProbeCache?.set(deny);
@@ -202,37 +292,44 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
     catch {
         fatalFindings.push("deny-layer enforcement probe failed; refusing to claim");
     }
-    // --- Claude user-config MCP shadowing (fatal by default, BAPI-727) ----
-    // REFUSAL BY DEFAULT is the whole point. A `bridge-api` entry in the machine's
-    // ~/.claude.json was observed to win over a linked worktree's provisioned
-    // `.mcp.json`, so the worker silently talks to whatever endpoint that entry
-    // names instead of the one the executor provisioned — a production-integrity
-    // failure that produces no error, only wrong work. A warning-only check would
-    // preserve exactly that silence; the explicit
-    // BAPI_CONDUCTOR_ALLOW_CLAUDE_MCP_SHADOWING override is the deliberate operator
-    // escape hatch for the cases where the collision is known and intended.
+    // --- Advisory MCP-shadowing inspection (BAPI-727 → BAPI-790 → BAPI-781) --
+    // This was a refusal under BAPI-727, because a `bridge-api` entry in the
+    // machine's ~/.claude.json was observed to win over a linked worktree's
+    // provisioned `.mcp.json`. Under BAPI-790 it cannot: every worker is spawned
+    // with `--strict-mcp-config --mcp-config <worktree>/.mcp.json`, so an operator
+    // registration of the same name is not loaded at all (inventory Finding 6),
+    // and the per-spawn init-event assertion verifies that on every single spawn
+    // rather than trusting the flag. The collision is therefore worth REPORTING —
+    // it is still confusing, and an operator generally wants it gone — but it can
+    // no longer produce wrong work, so refusing to claim over it would block a
+    // host for a condition that has no effect.
     //
-    // Inconclusive states (unreadable/malformed config) are warnings, never fatal:
-    // "could not look" must not become "found a collision".
-    try {
-        const inspect = seams.inspectClaudeUserConfig ?? inspectClaudeUserConfigForMcpShadowing;
-        const inspection = await inspect({
-            claudeConfigPath: resolveClaudeUserConfigPath(deps.homedir(), deps.platform),
-            platform: deps.platform,
-            cwd: deps.cwd,
-            // The executor's own checkout is the main repository. Preflight runs
-            // before any job, so there is no prepared worktree to name here — the
-            // per-job check in `job-runner.ts` covers that scope.
-            mainRepositoryPath: deps.cwd,
-        }, { readFile: deps.readFile });
-        const policy = evaluateClaudeMcpShadowingPolicy(inspection, deps.env);
-        warnings.push(...policy.warnings);
-        if (!policy.ok)
-            fatalFindings.push(...policy.refusals);
-    }
-    catch {
-        warnings.push("Claude user-config MCP shadowing check did not complete; could not verify worker MCP integrity");
+    // BAPI-781 routes it through the ADAPTER's advisory hook, so this module no
+    // longer imports Claude's user-config inspector. The capability is optional by
+    // design: an adapter without one produces no warnings, which is correct —
+    // making it required would turn an advisory nicety into a claim gate.
+    //
+    // Inconclusive states (unreadable/malformed config) remain warnings for the
+    // same reason they always were: "could not look" must not become "found a
+    // collision".
+    const advisory = adapter.advisoryMcpInspection;
+    if (advisory?.supported === true) {
+        try {
+            const result = await advisory.value.inspect({
+                platform: deps.platform,
+                homedir: deps.homedir(),
+                // The executor's own checkout is the main repository. Preflight runs
+                // before any job, so there is no prepared worktree to name here — the
+                // per-job check in `job-runner.ts` covers that scope.
+                cwd: deps.cwd,
+            });
+            warnings.push(...result.warnings);
+        }
+        catch {
+            warnings.push("advisory worker-MCP inspection did not complete; could not verify worker MCP integrity");
+        }
     }
+    warnings.push(...adapterInspection.inspection.warnings);
     return {
         ok: fatalFindings.length === 0,
         fatalFindings,
@@ -242,12 +339,22 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
         diskFreeGb,
         ghAuthed,
         denyEnforced,
+        adapter: adapterInspection.inspection,
     };
 }
 /**
- * Build the HTTP claim manifest — EXACTLY the eight T2-accepted keys. `free_slots`
- * is supplied by the runner (dynamic). The internal-only `gh` auth capability is
- * intentionally NOT included (not accepted by the T2 request schema in this slice).
+ * Build the HTTP claim manifest — the eight original T2-accepted keys, plus the
+ * optional ninth `epic_run_ids` key (BAPI-794) when the executor was configured
+ * with one or more `--epic-run-id` flags. `free_slots` is supplied by the runner
+ * (dynamic). The internal-only `gh` auth capability is intentionally NOT included
+ * (not accepted by the T2 request schema in this slice).
+ *
+ * `epic_run_ids` is added via a conditional spread, not a bare property
+ * assignment: `{ epic_run_ids: options.epicRunIds }` would still create the key
+ * (with value `undefined`) when unscoped, which `Object.keys()` — unlike
+ * `JSON.stringify` — does NOT drop. The eight-key compatibility contract is
+ * pinned on `Object.keys()`, so the key must be truly absent, not merely
+ * `undefined`-valued.
  */
 export function buildClaimManifest(report, options, freeSlots) {
     return {
@@ -259,5 +366,6 @@ export function buildClaimManifest(report, options, freeSlots) {
         max_concurrent: options.maxConcurrent,
         free_slots: freeSlots,
         disk_free_gb: report.diskFreeGb ?? 0,
+        ...(options.epicRunIds !== undefined ? { epic_run_ids: options.epicRunIds } : {}),
     };
 }

package/build/executor/process.js

@@ -30,28 +30,53 @@ async function pump(iterable, onChunk) {
  * On timeout: SIGTERM, then SIGKILL after the grace period if still alive;
  * classification `timeout`. On normal exit: `clean_exit` (code 0) or `crashed`
  * (non-zero). Retained stdout/stderr excerpts are bounded.
+ *
+ * BAPI-790: a stdout observer may also request termination mid-run (the MCP
+ * surface assertion). That path REUSES the timeout path's exact TERM → grace →
+ * KILL mechanics rather than introducing a second way to signal a process — one
+ * escalation implementation means one place where the grace period, the kill
+ * escalation, and the "already terminating" guard can be reasoned about.
+ * `terminationRequested` is reported alongside the classification for the same
+ * reason `serverStopRequested` is: the caller needs to distinguish a deliberate
+ * contract termination from a worker that merely died.
  */
 export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options = {}) {
     const termGraceMs = options.termGraceMs ?? DEFAULT_TERM_GRACE_MS;
     const limit = options.excerptLimitBytes ?? DEFAULT_EXCERPT_BYTES;
     let stdoutExcerpt = "";
     let stderrExcerpt = "";
+    let terminationRequested = false;
+    let terminating = false;
+    let graceTimer;
+    /** TERM now, KILL after the grace period. Idempotent — never signals twice. */
+    const terminate = () => {
+        if (terminating)
+            return;
+        terminating = true;
+        proc.kill("SIGTERM");
+        graceTimer = deps.setTimer(() => {
+            proc.kill("SIGKILL");
+        }, termGraceMs);
+    };
     const pumpStdout = pump(proc.stdout, (chunk) => {
+        // Advisory observation ALWAYS runs first and always runs: the tee and the
+        // telemetry must see every chunk regardless of what the assertion decides.
         options.onStdout?.(chunk);
         stdoutExcerpt = appendBounded(stdoutExcerpt, chunk, limit);
+        if (options.onStdoutTerminationCheck?.(chunk) === true && !terminationRequested) {
+            terminationRequested = true;
+            terminate();
+        }
     });
     const pumpStderr = pump(proc.stderr, (chunk) => {
         stderrExcerpt = appendBounded(stderrExcerpt, chunk, limit);
     });
     let timedOut = false;
-    let graceTimer;
     const timeoutTimer = deps.setTimer(() => {
         timedOut = true;
-        proc.kill("SIGTERM");
-        graceTimer = deps.setTimer(() => {
-            // Still alive after the grace period — escalate.
-            proc.kill("SIGKILL");
-        }, termGraceMs);
+        // Same escalation the assertion uses; the guard inside makes a timeout that
+        // races an already-requested termination a no-op rather than a double signal.
+        terminate();
     }, timeoutSeconds * 1000);
     const { exitCode, signal } = await proc.wait();
     deps.clearTimer(timeoutTimer);
@@ -69,7 +94,14 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
     else {
         classification = "crashed";
     }
-    return { classification, exitCode, signal, stdoutExcerpt, stderrExcerpt };
+    return {
+        classification,
+        exitCode,
+        signal,
+        stdoutExcerpt,
+        stderrExcerpt,
+        ...(terminationRequested ? { terminationRequested: true } : {}),
+    };
 }
 /**
  * Immediately SIGKILL an owned process for a stale-claim or dead-man abandonment.

package/build/executor/runner.js

@@ -28,6 +28,15 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
             platform: deps.platform,
         }));
     const active = new Map();
+    // BAPI-794 — process-local cross-run claim observability. Retains only the
+    // last successfully claimed job's `epic_run_id` (never job payloads,
+    // credentials, or arguments) so an unintended repo-wide move between epic
+    // runs is VISIBLE without changing queue scheduling: this state is read-only
+    // diagnostics and never feeds back into claim eligibility, fairness, retries,
+    // or any cross-process coordination — the backend's claim predicate remains
+    // the sole eligibility authority. Declared here, outside both loops below, so
+    // it persists across poll cycles for the lifetime of this `runExecutor` call.
+    let lastClaimedEpicRunId = null;
     // BAPI-722: ONE deny-probe cache per `runExecutor` invocation, created OUTSIDE
     // the claim loop below — that scope is the whole feature. A cache created inside
     // the loop would be discarded every cycle and re-probe exactly as before; a
@@ -92,6 +101,16 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
                 const manifest = buildClaimManifest(report, options, freeSlots);
                 const result = await httpClient.claim(manifest);
                 if (result.kind === "claimed") {
+                    const currentEpicRunId = result.job.epic_run_id ?? null;
+                    if (lastClaimedEpicRunId !== null &&
+                        currentEpicRunId !== null &&
+                        currentEpicRunId !== lastClaimedEpicRunId) {
+                        deps.errorLog(`executor claimed a job for a different epic run than the previous claim ` +
+                            `(repo=${result.job.repo_name} previous_epic_run_id=${lastClaimedEpicRunId} ` +
+                            `current_epic_run_id=${currentEpicRunId} scoped=${options.epicRunIds !== undefined})`);
+                    }
+                    if (currentEpicRunId !== null)
+                        lastClaimedEpicRunId = currentEpicRunId;
                     dispatch(result.job, report);
                 }
                 else if (result.kind === "none") {