@bridge_gpt/mcp-server 0.2.37 → 0.2.39

package/build/executor/test-clock.js

@@ -1,3 +1,14 @@
+/**
+ * Test-only virtual clock + fake executor deps (BAPI-534).
+ *
+ * NOT a `*.test.ts` (so it is not auto-run) and imports nothing from the v1
+ * conductor graph — it only builds injectable fakes for the executor unit tests.
+ * The virtual clock fires timers in TIME order so concurrent `sleep`s and the
+ * process-timeout/no-op-duration timers interleave deterministically.
+ */
+import { resolveAgentSpec } from "../agent-registry.js";
+import { createClaudeExecutorAdapter } from "../agent-launchers/claude-executor-adapter.js";
+import { validateExecutorAdapterCapabilities } from "../agent-launchers/executor-adapter.js";
 export class VirtualClock {
     t = 0;
     timers = [];
@@ -33,10 +44,38 @@ async function flushMicrotasks() {
     // worker spawn, adding several microtask turns. Drain generously so a
     // `tickUntil` flush still reaches the spawn/exit in one pass (draining an
     // already-empty queue is a harmless no-op).
-    for (let i = 0; i < 64; i++)
+    //
+    // BAPI-791: there is no pre-spawn credential resolution any more — worker
+    // authentication is no longer checked before spawning at all — but the
+    // budget is kept generously wide rather than narrowed back down. The failure
+    // a wide budget prevents is SILENT and misleading — a `tickUntil(() =>
+    // spawned)` that returns before the spawn lets a test register its own timer
+    // FIRST, so the process appears to exit before a timeout that was actually
+    // armed correctly, and a timeout test passes/fails for the wrong reason.
+    for (let i = 0; i < 512; i++)
         await Promise.resolve();
 }
 /** A controllable fake owned process for `implement` spawn tests. */
+/**
+ * The stream-json `system`/`init` line a healthy default worker emits (BAPI-790).
+ *
+ * Its server set matches the default `.mcp.json` fixture served by
+ * `makeFakeExecutorDeps`, so the per-spawn MCP surface assertion sees a MATCH and
+ * stays silent. Without it every unrelated spawn test would trip the advisory
+ * "no init event was observed" warning and start asserting against a log line it
+ * was never written to care about.
+ *
+ * A test that wants the absent/mismatch paths supplies its own stdout.
+ */
+export const DEFAULT_WORKER_INIT_EVENT_LINE = `${JSON.stringify({
+    type: "system",
+    subtype: "init",
+    mcp_servers: [{ name: "bridge-api", status: "connected" }],
+})}\n`;
+/** A single-chunk stdout stream carrying {@link DEFAULT_WORKER_INIT_EVENT_LINE}. */
+async function* defaultWorkerStdout() {
+    yield DEFAULT_WORKER_INIT_EVENT_LINE;
+}
 export function makeControllableProcess(stdout) {
     let resolveWait;
     const waitP = new Promise((r) => {
@@ -47,7 +86,7 @@ export function makeControllableProcess(stdout) {
     return {
         proc: {
             pid: 4242,
-            stdout: stdout ?? null,
+            stdout: stdout ?? defaultWorkerStdout(),
             stderr: null,
             wait: () => waitP,
             kill: (s) => {
@@ -67,17 +106,35 @@ export function makeControllableProcess(stdout) {
 }
 /** Build a full fake `ExecutorDeps`, driven by a `VirtualClock`. */
 export function makeFakeExecutorDeps(clock, overrides = {}) {
+    // BAPI-793: in-memory backing for the exclusive-create boundary the worktree
+    // lock uses. Declared here (not inside `base`) so the create, the read-back,
+    // and the removal all address ONE store — a lock that could be created but
+    // never read back would silently never release, and a second job in the same
+    // test would then see a phantom holder.
+    const exclusiveFiles = new Map();
     const base = {
         runCommand: async () => ({ stdout: "", stderr: "", exitCode: 0 }),
         spawnProcess: () => {
             throw new Error("spawnProcess not configured for this test");
         },
         readFile: async (filePath) => {
-            // BAPI-731: the prepared worktree's own `.mcp.json` must carry the required
-            // `bridge-api` registration or the runner refuses to spawn (an isolated
-            // worker has no operator-scoped registration to fall back to). Serve a
+            // A file this deps object created exclusively (the BAPI-793 worktree lock)
+            // reads back verbatim, so ownership-checked release works against the fake
+            // filesystem exactly as it does against a real one.
+            const exclusive = exclusiveFiles.get(filePath);
+            if (exclusive !== undefined)
+                return exclusive;
+            // The prepared worktree's own `.mcp.json` must carry the required
+            // `bridge-api` registration or the runner refuses to spawn. Serve a
             // minimal valid one so pre-existing spawn tests still reach the spawn they
             // were written to assert on.
+            //
+            // BAPI-790 made this fixture carry MORE weight, deliberately: the same
+            // file is now both the pre-spawn requirement AND the source of the
+            // `--mcp-config` path and the expected server-name set the init-event
+            // assertion checks. A test that wants to model a MISSING or MALFORMED
+            // registration must therefore override this read explicitly — it will not
+            // get that state by accident, which is the point.
             if (typeof filePath === "string" && filePath.endsWith(".mcp.json")) {
                 return JSON.stringify({ mcpServers: { "bridge-api": { command: "node", args: [] } } });
             }
@@ -87,7 +144,30 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
         },
         writeFile: async () => { },
         mkdir: async () => undefined,
-        stat: async () => ({ mode: 0o644 }),
+        // BAPI-793 worktree lock, backed by a per-deps in-memory namespace. Real
+        // exclusivity semantics (a second create for the same path rejects with
+        // EEXIST) so a fixture that genuinely contends behaves like the filesystem,
+        // but scoped to this deps object so the many existing single-job spawn tests
+        // simply acquire, run, and release without touching a real directory.
+        writeFileExclusive: async (filePath, data) => {
+            if (exclusiveFiles.has(filePath)) {
+                throw Object.assign(new Error("EEXIST"), { code: "EEXIST" });
+            }
+            exclusiveFiles.set(filePath, data);
+        },
+        removeFile: async (filePath) => {
+            exclusiveFiles.delete(filePath);
+        },
+        stat: async (filePath) => {
+            // A blanket "every path exists" stat would make an absent credential
+            // store look unreadable instead of simply missing, so report it as
+            // absent by default. Fixtures that want a specific store state inject
+            // this seam explicitly.
+            if (typeof filePath === "string" && filePath.endsWith("credentials.json")) {
+                throw Object.assign(new Error("ENOENT"), { code: "ENOENT" });
+            }
+            return { mode: 0o644 };
+        },
         statfs: async () => ({ bavail: 1_000_000, bsize: 4096 }),
         // BAPI-731 worker config isolation boundaries. In-memory fakes: no test ever
         // creates, permissions, or removes a real directory. Isolation is
@@ -104,14 +184,12 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
         now: clock.now,
         setTimer: clock.setTimer,
         clearTimer: clock.clearTimer,
-        // `ANTHROPIC_API_KEY` is the isolation strategy's required credential source
-        // (see `worker-config-isolation.ts`); without it capability evaluation
-        // reports `unsupported-auth-layout` and no spawn test could run.
-        // `BAPI_API_KEY` is the seed credential for the isolated Bridge store
-        // (BAPI-740/F2); without it the runner refuses pre-spawn with
-        // `ContractError.BridgeCredentialUnavailable` and no spawn test could run.
+        // BAPI-791: there is no pre-spawn Claude authentication check any more —
+        // a worker authenticates (or fails to) at the real spawn, classified
+        // after the fact from its own captured output — so no Anthropic
+        // credential belongs in this default environment at all. `BAPI_API_KEY`
+        // remains a Bridge-only test credential unrelated to worker auth.
         env: {
-            ANTHROPIC_API_KEY: "test-key-not-a-real-credential",
             BAPI_API_KEY: "test-bapi-key-not-a-real-credential",
         },
         cwd: "/repo",
@@ -127,19 +205,19 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
         },
     };
     const merged = { ...base, ...overrides };
-    // BAPI-731: two fail-CLOSED spawn gates depend on ambient fixture state that
-    // predates them, so an override supplied for an unrelated reason would
-    // silently turn a spawn test into a refusal test. Both are re-applied here as
-    // FALLBACKS — an override that deliberately exercises a refusal still wins,
-    // because it either supplies its own key/registration or explicitly omits one.
-    // 1. Isolation needs an Anthropic key, and the Bridge-store seeding refusal
-    //    (BAPI-740/F2) needs a resolvable `BAPI_API_KEY`. A test overriding `env`
-    //    for some other purpose keeps both unless it sets the key itself — an
-    //    override that deliberately exercises a refusal supplies its own value
-    //    (empty string included: presence wins over the fallback).
+    // An override supplied for an unrelated reason must not silently turn a
+    // spawn test into a refusal test, so ambient fixture state a fail-CLOSED
+    // gate depends on is re-applied here as a FALLBACK — an override that
+    // deliberately exercises a refusal still wins, because it either supplies
+    // its own value or explicitly omits one (empty string included: presence
+    // wins over the fallback).
+    // 1. `BAPI_API_KEY` is a Bridge test credential unrelated to worker
+    //    authentication (BAPI-791 removed the pre-spawn Anthropic-credential
+    //    check entirely). A test overriding `env` for some other purpose keeps
+    //    it unless it sets the key itself.
     if (overrides.env) {
         const fallbacks = {};
-        for (const key of ["ANTHROPIC_API_KEY", "BAPI_API_KEY"]) {
+        for (const key of ["BAPI_API_KEY"]) {
             if (!(key in overrides.env))
                 fallbacks[key] = base.env[key];
         }
@@ -148,9 +226,18 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
     // 2. The required-registration check reads the worktree's `.mcp.json`. A test
     //    overriding `readFile` (usually to script command provisioning) still gets
     //    the default registration for that one path when its own read rejects.
+    //
+    //    BAPI-793: the same wrapper also serves back files this deps object created
+    //    exclusively (the worktree lock), BEFORE consulting the override. A test
+    //    that scripts `readFile` for command provisioning has no opinion about the
+    //    lock file, and without this its override would hide the lock from its own
+    //    ownership-checked release.
     if (overrides.readFile) {
         const override = overrides.readFile;
         merged.readFile = async (filePath) => {
+            const exclusive = exclusiveFiles.get(filePath);
+            if (exclusive !== undefined)
+                return exclusive;
             try {
                 return await override(filePath);
             }
@@ -186,3 +273,80 @@ export function makeTestOptions(overrides = {}) {
         ...overrides,
     };
 }
+/**
+ * BAPI-781: hermetic executor-adapter resolution for tests.
+ *
+ * Every spawn test now needs a resolved adapter, and building one inline in each
+ * file would spread the same eight lines across four suites. These helpers live
+ * here for the same reason the rest of this module does: they are injectable
+ * fakes, not production wiring, and they keep the real `agent-registry` →
+ * `createClaudeExecutorAdapter` path under test rather than substituting a
+ * hand-written stand-in for Claude.
+ */
+export function claudeAdapterSeam(claudeDeps = {}) {
+    const spec = resolveAgentSpec("claude");
+    return (agentId) => {
+        const adapter = createClaudeExecutorAdapter(spec, {
+            // Hermetic defaults: an in-memory read boundary and no-op provisioning, so
+            // a test that does not care about deny/advisory behavior still resolves a
+            // COMPLETE adapter rather than tripping the fail-closed capability gate.
+            readFile: async () => "{}",
+            denyProvisioningDeps: {
+                readFile: async () => "{}",
+                writeFile: async () => { },
+                mkdir: async () => { },
+                homedir: () => "/home/test",
+            },
+            ...claudeDeps,
+        });
+        const validation = validateExecutorAdapterCapabilities(adapter);
+        if (!validation.ok) {
+            return {
+                supported: false,
+                kind: "incomplete-capabilities",
+                message: `test Claude adapter incomplete for '${agentId}'`,
+                refusals: validation.refusals,
+            };
+        }
+        return { supported: true, adapter, spec, validation };
+    };
+}
+/**
+ * A resolver that refuses, for the fail-closed cases. Deliberately returns a
+ * REFUSAL rather than throwing: the runner is required to convert a refusal into
+ * a named contract failure, and a thrown resolver would test the generic
+ * exception path instead of the one that matters.
+ */
+export function refusingAdapterSeam(kind, message = "no usable executor adapter for this agent") {
+    return () => ({ supported: false, kind, message });
+}
+/**
+ * Build a synthetic adapter from a complete Claude adapter with individual
+ * capabilities overridden or removed. Used to prove the runner refuses a shape
+ * inconsistent with the declaration, without inventing a whole second agent.
+ */
+export function syntheticAdapterSeam(mutate) {
+    const spec = resolveAgentSpec("claude");
+    return (agentId) => {
+        const base = createClaudeExecutorAdapter(spec, {
+            readFile: async () => "{}",
+            denyProvisioningDeps: {
+                readFile: async () => "{}",
+                writeFile: async () => { },
+                mkdir: async () => { },
+                homedir: () => "/home/test",
+            },
+        });
+        const adapter = mutate(base);
+        const validation = validateExecutorAdapterCapabilities(adapter);
+        if (!validation.ok) {
+            return {
+                supported: false,
+                kind: "incomplete-capabilities",
+                message: `synthetic adapter incomplete for '${agentId}'`,
+                refusals: validation.refusals,
+            };
+        }
+        return { supported: true, adapter, spec, validation };
+    };
+}

package/build/executor/worker-command.js

@@ -1,38 +1,24 @@
 /**
- * Headless Claude worker command construction (BAPI-534, TDD §7).
+ * Executor worker JOB POLICY: prompt resolution and permission posture
+ * (BAPI-534, TDD §7; BAPI-790; narrowed in BAPI-781).
  *
- * Resolves the exact argv, model alias, and prompt for a spawned worker. Model
- * aliases resolve through the agent registry (never a raw untrusted string); no
- * MCP config is ever added. When no safe alias is available, `--model` is omitted.
+ * WHAT THIS MODULE IS NO LONGER. Until BAPI-781 it also built Claude's argv,
+ * resolved Claude's model alias, and named Claude's executable. All three moved
+ * into the Claude executor adapter
+ * (`agent-launchers/claude-executor-adapter.ts`), because each was a statement
+ * about one particular CLI's process shape. What remains here is genuinely
+ * agent-neutral: which prompt a job type gets, and which permission posture it
+ * runs under. Both are decisions about the JOB, and they read identically
+ * whether the worker is Claude, Codex, or cursor-agent.
+ *
+ * The permission posture stays here for a specific reason worth preserving: it
+ * is expressed in the SERVER's snake_case policy vocabulary, not in any CLI's
+ * flag spelling. The adapter translates it. Keeping the policy vocabulary
+ * distinct from the argv vocabulary is what stops a future flag rename in one
+ * agent's CLI from becoming an operator-visible policy break across all of them.
  */
-import { resolveAgentSpec, resolveModelAlias, isModelTier, isValidModelAlias, } from "../agent-registry.js";
 import { ExecutorNamedError } from "./job-errors.js";
 import { isRecoveryJobType } from "./job-types.js";
-/**
- * Resolve the Claude model alias from a job payload. Accepts a direct
- * `model_alias` only when it passes registry alias validation AND the static
- * Claude allowlist; otherwise resolves from a valid `model_tier` through the
- * registry. Returns `null` when no safe alias is available (so `--model` is
- * omitted) — an unsafe/invalid string is never returned.
- */
-export function resolveExecutorModelAlias(payload) {
-    const agent = resolveAgentSpec("claude");
-    if (!agent)
-        return null;
-    const p = payload && typeof payload === "object" ? payload : {};
-    const directRaw = p.model_alias;
-    if (typeof directRaw === "string" && directRaw.trim().length > 0) {
-        const direct = directRaw.trim();
-        const allowed = !agent.staticModelAliasAllowlist || agent.staticModelAliasAllowlist.includes(direct);
-        if (isValidModelAlias(direct) && allowed) {
-            return direct;
-        }
-        // An invalid/disallowed direct alias falls through to the tier path — never
-        // returned as-is.
-    }
-    const tier = isModelTier(p.model_tier) ? p.model_tier : null;
-    return resolveModelAlias(agent, tier, null);
-}
 /**
  * Resolve the worker prompt for the explicit-prompt and legacy synthesis paths.
  * Uses an explicit non-empty `payload.prompt` verbatim; otherwise, for
@@ -137,31 +123,9 @@ export function resolveWorkerPermissionPosture(payload) {
     throw new ExecutorNamedError("ContractError.PermissionPosture", "job payload worker_permission_posture is present but is not a supported posture " +
         "(expected 'skip_permissions' or 'accept_edits').");
 }
-/**
- * Build the exact headless Claude argv. `--model <alias>` is included only when
- * an alias is provided. No MCP config arguments are ever emitted.
- *
- * Exactly ONE permission form is emitted, selected by `posture`:
- * `--dangerously-skip-permissions` for `skip_permissions`, or the two adjacent
- * entries `--permission-mode acceptEdits` for `accept_edits`. They are mutually
- * exclusive by construction — emitting both would let the skip flag win silently
- * and make the policy key look effective while doing nothing.
- *
- * The posture changes how Claude PROMPTS, not what it may do: the deny layer is
- * provisioned by `job-runner.ts` before the spawn in both postures.
- */
-export function buildClaudeExecutorArgv(prompt, alias, posture = DEFAULT_WORKER_PERMISSION_POSTURE) {
-    const argv = ["-p", prompt, "--output-format", "stream-json", "--verbose"];
-    if (alias) {
-        argv.push("--model", alias);
-    }
-    if (posture === "accept_edits") {
-        argv.push("--permission-mode", "acceptEdits");
-    }
-    else {
-        argv.push("--dangerously-skip-permissions");
-    }
-    return argv;
-}
-/** The worker executable is always exactly `claude`. */
-export const CLAUDE_EXECUTABLE = "claude";
+// Argv construction, model-alias resolution, and the worker executable name all
+// live in the resolved executor adapter now (BAPI-781). `job-runner.ts` requests
+// one complete `{ executable, argv, env }` spawn shape from the adapter rather
+// than assembling a Claude-shaped command here. Re-adding a builder to this
+// module would recreate the exact coupling the extraction removed: a generic
+// job-policy module that only works for one CLI.

package/build/executor/worker-log.js

@@ -76,6 +76,88 @@ export async function* teeAsyncIterable(source, tee, stream = "stdout") {
         yield chunk;
     }
 }
+/**
+ * Total bound on how much of a worker log the session-isolation invariant will
+ * scan. A worker log is unbounded (it is the raw stream), and the invariant is a
+ * cheap safety check rather than an analysis pass, so a multi-hundred-megabyte
+ * parse at job completion is not acceptable.
+ *
+ * The budget is split between the START and the END of the log (see
+ * {@link distinctWorkerLogSessionIds}); it is not a prefix.
+ */
+export const MAX_SESSION_SCAN_CHARS = 2_000_000;
+/**
+ * The DISTINCT `session_id` values present in a worker log (BAPI-793).
+ *
+ * The incident signature this exists to catch is two Claude sessions writing
+ * into one worktree's single `.conductor/worker.log`. Every stream-json record a
+ * worker emits carries its `session_id`, so one healthy job produces MANY
+ * records and exactly ONE distinct id — which is why this counts DISTINCT ids
+ * rather than occurrences. A count-based check would flag every normal job.
+ *
+ * Parsing is per line and failure-tolerant: the log interleaves stdout and
+ * stderr and may be truncated mid-line at either end, so an unparseable line is
+ * skipped rather than treated as evidence of anything.
+ *
+ * When the log exceeds {@link MAX_SESSION_SCAN_CHARS} the budget is split
+ * between its HEAD and its TAIL rather than spent entirely on a prefix. A
+ * head-only scan goes blind exactly where the risk is highest: the second worker
+ * is the one that arrives LATE, so its records land at the end of a log whose
+ * size is itself the product of two workers writing into it. Scanning both ends
+ * costs the same bounded work and catches the intruder wherever it entered.
+ *
+ * The middle is deliberately unscanned. Detecting a second session that both
+ * starts and ends inside the gap would require an unbounded parse, and this is a
+ * diagnostic, not the enforcement — the worktree lock is.
+ */
+export function distinctWorkerLogSessionIds(logText) {
+    if (typeof logText !== "string" || logText.length === 0)
+        return [];
+    let scanned;
+    if (logText.length <= MAX_SESSION_SCAN_CHARS) {
+        scanned = logText;
+    }
+    else {
+        const window = Math.floor(MAX_SESSION_SCAN_CHARS / 2);
+        // Joined with a newline so the head's trailing partial line and the tail's
+        // leading partial line stay SEPARATE records. Concatenating them directly
+        // would splice two unrelated fragments into one syntactically-plausible
+        // line, which the parser could then read as a record that never existed.
+        scanned = `${logText.slice(0, window)}\n${logText.slice(logText.length - window)}`;
+    }
+    const seen = new Set();
+    for (const line of scanned.split(/\r?\n/)) {
+        if (line.length === 0 || !line.includes("session_id"))
+            continue;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            continue;
+        const sessionId = value.session_id;
+        if (typeof sessionId === "string" && sessionId.length > 0)
+            seen.add(sessionId);
+    }
+    return [...seen].sort();
+}
+/**
+ * The fixed diagnostic emitted when a completed job's worker log carries more
+ * than one distinct session (BAPI-793 acceptance criterion 3).
+ *
+ * Reports the COUNT, never the ids: a session id identifies a real agent
+ * conversation, and this string goes to the executor's stderr where it may be
+ * shipped to a log aggregator. The count alone is the actionable signal.
+ */
+export function formatWorkerLogSessionInvariantWarning(sessionCount) {
+    return (`worker log session invariant violated: ${sessionCount} distinct Claude sessions wrote to this ` +
+        "job's .conductor/worker.log, so more than one worker was active in this worktree. The " +
+        "worktree lock should have refused the second one — treat this as evidence it was bypassed " +
+        "(a pre-existing stale lock, a worktree entered outside the executor, or a manual claude run).");
+}
 /**
  * Safely finalize a tee. Tolerates a `null`/`undefined` tee and repeated calls;
  * NEVER kills or signals the worker process.