@bridge_gpt/mcp-server 0.2.38 → 0.2.39

package/build/executor/observation.js

@@ -192,6 +192,171 @@ export function parseClaudeStreamJsonLine(line) {
 function pickString(value) {
     return typeof value === "string" && value.length > 0 ? value : undefined;
 }
+// ---------------------------------------------------------------------------
+// MCP surface assertion (BAPI-790)
+// ---------------------------------------------------------------------------
+/**
+ * Normalize a list of MCP server names to the canonical comparison form: trimmed,
+ * non-empty, deduplicated, and sorted.
+ *
+ * Shared by BOTH sides of the assertion — the expected set read from the
+ * worktree's `.mcp.json` and the observed set read from the worker's init event —
+ * so ordering and duplicate registrations can never produce a false mismatch. Two
+ * separate normalizations would be exactly the kind of drift that turns a safety
+ * assertion into a flake.
+ */
+export function normalizeMcpServerNames(names) {
+    const seen = new Set();
+    for (const value of names) {
+        if (typeof value !== "string")
+            continue;
+        const trimmed = value.trim();
+        if (trimmed.length === 0)
+            continue;
+        seen.add(trimmed);
+    }
+    return [...seen].sort();
+}
+/**
+ * Cap on the partial line the surface observer will buffer, in characters.
+ *
+ * DELIBERATELY MUCH LARGER than the 8 KB stdout excerpt in `process.ts`, and for
+ * the opposite reason. That excerpt is a diagnostic that gets POSTED to the
+ * server, so it is kept small on purpose. This buffer has to hold one complete
+ * `system`/`init` line intact or the assertion cannot read it at all — a
+ * registration with many servers and long names is legitimately several KB — so
+ * the bound exists only to stop unbounded growth, not to trim content. A real
+ * init event is orders of magnitude under this.
+ *
+ * The cap is on ONE un-terminated line, not on total throughput: every newline
+ * clears the buffer, so a normal newline-delimited stream never approaches it.
+ */
+export const MAX_BUFFERED_SURFACE_LINE_CHARS = 1_048_576;
+function sameNameSet(a, b) {
+    return a.length === b.length && a.every((name, index) => name === b[index]);
+}
+/**
+ * Create an observer that asserts the worker's loaded MCP surface against
+ * `expectedServerNames` (which must come from the same `.mcp.json` passed to the
+ * worker as `--mcp-config`).
+ *
+ * Line handling is buffered because stdout arrives in arbitrary chunks: a JSON
+ * event can be split across two reads, and parsing a half-line would classify a
+ * perfectly good init event as malformed. Malformed lines are simply skipped —
+ * the advisory parser's own posture — because the assertion's failure mode must
+ * be "no valid init event was seen" (a warning), never "unparseable text implied
+ * a surface" (a fabrication).
+ */
+export function createMcpSurfaceObserver(expectedServerNames, parseInitEvent) {
+    const expected = normalizeMcpServerNames(expectedServerNames);
+    let settled = null;
+    let buffer = "";
+    /** True while skipping the remainder of a line that blew the size cap. */
+    let discardingOversizedLine = false;
+    /** Sticky: at least one line was dropped for exceeding the cap. */
+    let droppedOversizedLine = false;
+    const consumeLine = (line) => {
+        if (settled !== null)
+            return;
+        const trimmed = line.trim();
+        if (trimmed.length === 0)
+            return;
+        // The ADAPTER reads its own runtime's event shape; the executor reads none.
+        // A parser that throws is treated exactly like a line that said nothing —
+        // an adapter defect must not be able to settle the verdict, in either
+        // direction.
+        let result;
+        try {
+            result = parseInitEvent(trimmed);
+        }
+        catch {
+            return;
+        }
+        if (!result || result.kind === "not-init")
+            return;
+        if (result.kind === "malformed-init") {
+            // A valid init event we cannot read is unverifiable, and unverifiable
+            // containment is not containment.
+            settled = { kind: "mismatch", expected, observed: [] };
+            return;
+        }
+        // Normalize the ADAPTER-SUPPLIED names through the same function that
+        // normalized the expected set. Comparing two differently-normalized lists is
+        // exactly the drift that turns a safety assertion into a flake.
+        const observed = normalizeMcpServerNames(result.serverNames);
+        settled = sameNameSet(expected, observed)
+            ? { kind: "match", observed }
+            : { kind: "mismatch", expected, observed };
+    };
+    return {
+        observeStdout(chunk) {
+            if (settled !== null)
+                return;
+            if (typeof chunk !== "string" || chunk.length === 0)
+                return;
+            let input = chunk;
+            // Still skipping past a line that already blew the cap. Everything up to
+            // the next newline belongs to that dead line — RESYNCING on the newline
+            // rather than just clearing the buffer is what stops the line's tail from
+            // being parsed as if it were a fresh event.
+            if (discardingOversizedLine) {
+                const resyncAt = input.indexOf("\n");
+                if (resyncAt === -1)
+                    return;
+                discardingOversizedLine = false;
+                input = input.slice(resyncAt + 1);
+            }
+            buffer += input;
+            let newlineAt = buffer.indexOf("\n");
+            while (newlineAt !== -1) {
+                consumeLine(buffer.slice(0, newlineAt));
+                buffer = buffer.slice(newlineAt + 1);
+                if (settled !== null) {
+                    buffer = "";
+                    return;
+                }
+                newlineAt = buffer.indexOf("\n");
+            }
+            // A residual partial line past the cap is not a line we could ever parse.
+            // Drop it and keep scanning the stream: a LATER valid init event still
+            // settles the verdict normally, so one pathological line cannot disable
+            // the assertion for the rest of the run.
+            if (buffer.length > MAX_BUFFERED_SURFACE_LINE_CHARS) {
+                buffer = "";
+                discardingOversizedLine = true;
+                droppedOversizedLine = true;
+            }
+        },
+        shouldTerminate() {
+            return settled !== null && settled.kind === "mismatch";
+        },
+        verdict() {
+            // Try the residual partial line. A stream that ends without a trailing
+            // newline would otherwise strand its final event in the buffer and report
+            // `absent` for a surface we actually observed.
+            //
+            // The buffer is deliberately NOT cleared here. `verdict()` may legitimately
+            // be called mid-stream, and consuming the partial line destructively would
+            // drop the first half of an event that was merely split across two stdout
+            // chunks — turning a real init event into `absent`. Re-parsing the same
+            // residual on a later call is harmless: `consumeLine` only settles on a
+            // valid init event, and a settled verdict is never revisited.
+            if (settled === null && buffer.length > 0) {
+                consumeLine(buffer);
+            }
+            if (settled !== null)
+                return settled;
+            // An oversized drop is reported as its own reason rather than folded into
+            // the ordinary no-init case. Both warn and neither fails the job, but they
+            // are different facts: one says the worker never told us, the other says we
+            // could not keep what it told us.
+            return {
+                kind: "absent",
+                reason: droppedOversizedLine ? "oversized-line" : "no-init-event",
+            };
+        },
+    };
+}
 /**
  * Create the observation state. When `advisoryParserEnabled` is false, stdout is
  * still timestamped (`last_stdout_at`) but never parsed — proving the advisory

package/build/executor/permissions.js

@@ -15,13 +15,21 @@
  * through the separately launched `mcp-invoke` shim process, which resolves the
  * credential itself — the model process never reads it directly.
  *
- * BAPI-740/F2: worker-config isolation seeds a repo-scoped copy of that store
- * INSIDE the per-job isolation directory (`bapi-conductor-claude-cfg-*` under the
- * executor tmp root — see `worker-config-isolation.ts`), where the `~/.config`
- * rule cannot reach it. A prefix glob denies model reads under any isolation
- * directory so the seeded `credentials.json` gets the same shielding as the
- * operator store. The shim still reads it: the shim is a separate process, not
- * the model.
+ * BAPI-790: the two isolation-directory credential rules that BAPI-740/F2 added
+ * are gone, because the per-job isolation directory they guarded no longer
+ * exists. `~/.config/bridge/**` is once again the single Bridge-credential deny,
+ * and it is sufficient: the shim resolves the operator's real store in its own
+ * process, and the model cannot read it.
+ *
+ * Architecture Miss 23 (2026-08-14) is worth keeping in view even though its
+ * specific rules are retired, because the lesson generalizes: a deny glob must
+ * target the ASSET, never a directory that also holds the worker's own working
+ * state. The isolation-directory deny was originally written as a
+ * whole-directory glob, and because `CLAUDE_CONFIG_DIR` pointed at that same
+ * directory, it silently truncated every oversized tool result the CLI persisted
+ * there for read-back (a worker lost 96.5% of its `get_pipeline_recipe`). No
+ * permission posture bypasses a deny rule, so the damage was invisible. Any
+ * future rule added here inherits that constraint.
  *
  * The Wave-1 probe on the target machine reports enforcement layer `settings-deny`
  * (claude 2.1.201), so plain `permissions.deny` is provisioned; the PreToolUse
@@ -29,16 +37,21 @@
  */
 import path from "node:path";
 import { mergeClaudeSettingsWithCommandHook, provisionClaudeSettingsForWorktree, DEFAULT_PRE_TOOL_USE_MATCHER, } from "../claude-settings.js";
-import { ISOLATION_DIR_PREFIX } from "./worker-config-isolation.js";
 /**
  * The stable executor deny rules. Grammar mirrors the deny-enforcement probe's
  * `Bash(<cmd>:<args-glob>)` / `Read(<path-glob>)` form. Covers: reads under
  * ~/.ssh, ~/.aws, and keychain paths; the user-scoped Bridge credential store
  * (BAPI-724 — the model is denied direct reads, while the separately launched
- * `mcp-invoke` shim process still resolves it); the per-job isolation directory
- * (BAPI-740/F2 — the seeded repo-scoped `credentials.json` lives there, outside
- * the `~/.config` rule's reach); force-push to the base branch; and destructive
- * `rm -rf` outside the worktree.
+ * `mcp-invoke` shim process still resolves it); force-push to the base branch;
+ * and destructive `rm -rf` outside the worktree.
+ *
+ * BAPI-790 removed the two per-job isolation-directory credential rules. They
+ * guarded a repo-scoped `credentials.json` that the executor seeded into a
+ * per-job Claude configuration directory; no such directory or seeded file
+ * exists any more, so the rules matched nothing. `Read(~/.config/bridge/**)`
+ * carries the whole Bridge-credential guarantee again, exactly as it did before
+ * BAPI-731: the shim resolves the operator's real store in its own process, and
+ * the model cannot read it.
  */
 export function executorDenyRules(inputs) {
     return [
@@ -47,10 +60,6 @@ export function executorDenyRules(inputs) {
         "Read(~/Library/Keychains/**)",
         "Read(/etc/shadow)",
         "Read(~/.config/bridge/**)",
-        // Any path under any per-job isolation directory, wherever the executor's
-        // tmp root lives (`//` anchors at the filesystem root; the prefix constant
-        // is shared with `worker-config-isolation.ts` so they cannot drift).
-        `Read(//**/${ISOLATION_DIR_PREFIX}*/**)`,
         `Bash(git push:*--force*${inputs.baseBranch}*)`,
         "Bash(git push:*--force*)",
         "Bash(rm:*-rf /*)",
@@ -84,8 +93,45 @@ export function mergeExecutorDenySettings(existing, inputs) {
  */
 export const EXECUTOR_SETTINGS_EXCLUDE_LINE = ".claude/settings.local.json";
 /**
- * Keep the executor-owned `.claude/settings.local.json` out of worker commits
- * (BAPI-740/F2). Worker-config isolation redirects `XDG_CONFIG_HOME`, so the
+ * The executor-owned conductor artifact directory (BAPI-814/D2).
+ *
+ * Excluded through the SAME per-worktree mechanism rather than through a
+ * `.gitignore` edit, because that mechanism is the only one that travels. This
+ * repository's committed `.gitignore` already carries `.conductor/`, but the
+ * executor also drives foreign repositories that never will, and branches cut
+ * before that entry landed do not have it either. A `.git/info/exclude` line is
+ * invisible to the diff, belongs to the checkout rather than to the tree, and
+ * therefore protects all three cases without the executor ever editing a
+ * repository's tracked ignore file.
+ */
+export const EXECUTOR_CONDUCTOR_EXCLUDE_LINE = ".conductor/";
+/**
+ * Every line the executor provisions into a worktree's `.git/info/exclude`, in
+ * the order they are appended. Named once so the writer and its tests cannot
+ * disagree about the set.
+ */
+export const EXECUTOR_EXCLUDE_LINES = [
+    EXECUTOR_SETTINGS_EXCLUDE_LINE,
+    EXECUTOR_CONDUCTOR_EXCLUDE_LINE,
+];
+/**
+ * Build the one bounded shape every exclude-provisioning warning takes: a
+ * failure CATEGORY plus the affected worktree path, and nothing else.
+ *
+ * `category` is always a fixed string chosen by this module — never an error
+ * message, a `.git` line, a filesystem path from an exception, or anything a
+ * worker or an operator's environment could influence. Callers log this text
+ * verbatim, so the bound is enforced here rather than trusted at each site.
+ */
+function excludeWarning(worktreePath, category) {
+    return (`worktree git-exclude provisioning did not complete for ${worktreePath}: ${category}. ` +
+        `${EXECUTOR_EXCLUDE_LINES.join(" and ")} are not protected from worker commits on this ` +
+        "worktree; inspect it before trusting the worktree's staged changes; continuing fail-open.");
+}
+/**
+ * Keep the executor-owned `.claude/settings.local.json` and the conductor's
+ * `.conductor/` artifacts out of worker commits (BAPI-740/F2, BAPI-814/D2).
+ * Worker-config isolation redirects `XDG_CONFIG_HOME`, so the
  * operator's global git excludes (`~/.config/git/ignore`) no longer apply inside
  * a worker — empirically, a worker `git add -A` commits the deny-layer file this
  * module just wrote. A per-worktree `.git/info/exclude` entry is invisible to
@@ -95,9 +141,29 @@ export const EXECUTOR_SETTINGS_EXCLUDE_LINE = ".claude/settings.local.json";
  * A linked worktree's `.git` is a FILE containing `gitdir: <path>` pointing at
  * the main repository's per-worktree gitdir; that indirection is resolved rather
  * than assuming a directory (`EISDIR` on the read identifies a real main-checkout
- * `.git` directory). Idempotent: the line is appended once, never duplicated.
- * Fail-open, matching the rest of this module: unresolvable git metadata is a
- * silent skip, and an exclude-write failure returns a warning — never a block.
+ * `.git` directory). The per-worktree gitdir is then resolved onward to the
+ * COMMON dir, because that — not the per-worktree dir — is where git reads
+ * `info/exclude` from; see the comment at the resolution site. Idempotent: the
+ * line is appended once, never duplicated.
+ *
+ * Fail-open at every step, matching the rest of this module — but NOT silent
+ * (BAPI-815/R2). Two outcomes that used to be the same `{ ok: true }` are now
+ * told apart:
+ *
+ *   - **No checkout at all** (`ENOENT` on `.git`) — a benign no-op. There is
+ *     nothing to protect, so there is nothing to warn about.
+ *   - **Present but unresolvable** (`.git` exists but carries no `gitdir:`
+ *     pointer, or cannot be read) — non-blocking, but WARNED. Git metadata is
+ *     there and the executor could not use it, which means the settings file is
+ *     unprotected on this worktree and a human should look.
+ *
+ * That distinction is the whole fix: a total failure to ever write was invisible
+ * precisely because "could not resolve" and "nothing to do" returned the same
+ * silent success.
+ *
+ * Warnings are bounded to a failure category plus the affected worktree path.
+ * They never carry `.git` contents, exception text, environment values, or
+ * settings-file content.
  */
 async function provisionWorktreeSettingsExclude(worktreePath, deps) {
     const gitPath = path.join(worktreePath, ".git");
@@ -107,8 +173,12 @@ async function provisionWorktreeSettingsExclude(worktreePath, deps) {
         const match = /^gitdir:\s*(.+?)\s*$/m.exec(raw);
         if (!match) {
             // A readable `.git` file with no gitdir pointer is not git metadata this
-            // function understands; do not guess at a location to write into.
-            return { ok: true };
+            // function understands; do not guess at a location to write into. Present
+            // but unusable — degrade loudly rather than reporting a clean success.
+            return {
+                ok: true,
+                warning: excludeWarning(worktreePath, "git metadata carries no gitdir pointer"),
+            };
         }
         const target = match[1];
         gitDir = path.isAbsolute(target) ? target : path.resolve(worktreePath, target);
@@ -119,13 +189,48 @@ async function provisionWorktreeSettingsExclude(worktreePath, deps) {
             // Main-checkout shape: `.git` is a real directory.
             gitDir = gitPath;
         }
-        else {
-            // No readable git metadata at all (e.g. ENOENT) — nothing to protect.
+        else if (code === "ENOENT") {
+            // No git checkout here at all — nothing to protect, nothing to report.
             return { ok: true };
         }
+        else {
+            // Git metadata is present but could not be read (EACCES, EIO, …). The
+            // error CODE is a bounded category; the exception itself never escapes.
+            return {
+                ok: true,
+                warning: excludeWarning(worktreePath, "git metadata could not be read"),
+            };
+        }
     }
+    // Resolve the COMMON directory before choosing where to write (BAPI-815/R2).
+    //
+    // THIS IS THE DEFECT THAT MADE THE WHOLE MECHANISM A NO-OP. `info/` is one of
+    // git's COMMON-dir files, not a per-worktree one: git reads exclusions from
+    // `<common>/info/exclude`, and for a linked worktree the common dir is the
+    // MAIN repository's `.git`, not `<main>/.git/worktrees/<name>`. Writing to
+    // the per-worktree gitdir put the rule somewhere git never looks, so
+    // `.claude/settings.local.json` stayed stageable in every linked worktree
+    // regardless of this function succeeding. Trees looked clean only because the
+    // operator's `~/.config/git/ignore` carried the same rule — the protection
+    // built to be machine-independent was supplied entirely by machine-specific
+    // config, and the day that global ignore is absent a worker commits the file.
+    //
+    // `<gitdir>/commondir` holds the pointer (usually the relative `../..`), and
+    // it is a plain file, so this needs no new command-runner dependency. Its
+    // absence means this IS the common dir (a main checkout), which is why the
+    // fallback is `gitDir` itself rather than an error.
+    let commonDir = gitDir;
     try {
-        const infoDir = path.join(gitDir, "info");
+        const pointer = (await deps.readFile(path.join(gitDir, "commondir"))).trim();
+        if (pointer.length > 0) {
+            commonDir = path.isAbsolute(pointer) ? pointer : path.resolve(gitDir, pointer);
+        }
+    }
+    catch {
+        /* no commondir pointer: `gitDir` is already the common dir */
+    }
+    try {
+        const infoDir = path.join(commonDir, "info");
         await deps.mkdir(infoDir, { recursive: true });
         const excludePath = path.join(infoDir, "exclude");
         let existing = "";
@@ -135,18 +240,30 @@ async function provisionWorktreeSettingsExclude(worktreePath, deps) {
         catch {
             existing = "";
         }
-        if (existing.split(/\r?\n/).includes(EXECUTOR_SETTINGS_EXCLUDE_LINE)) {
+        // Idempotent per LINE, not per file: the settings entry predates the
+        // `.conductor/` one, so a worktree provisioned by an earlier executor build
+        // already contains the first and still needs the second. A single
+        // "does the file mention anything of ours?" check would skip it forever.
+        const present = new Set(existing.split(/\r?\n/));
+        const missing = EXECUTOR_EXCLUDE_LINES.filter((line) => !present.has(line));
+        if (missing.length === 0) {
             return { ok: true };
         }
+        // One write. Unrelated user-authored entries are preserved verbatim, and a
+        // file that did not end in a newline gets one first so the appended lines
+        // cannot fuse onto the operator's last entry.
         const prefix = existing.length === 0 || existing.endsWith("\n") ? existing : `${existing}\n`;
-        await deps.writeFile(excludePath, `${prefix}${EXECUTOR_SETTINGS_EXCLUDE_LINE}\n`);
+        await deps.writeFile(excludePath, `${prefix}${missing.map((line) => `${line}\n`).join("")}`);
         return { ok: true };
     }
     catch {
+        // The gitdir resolved but the exclude could not be written. Unlike the
+        // resolution failures above this keeps `ok: false`, because the caller's
+        // established contract treats a failed WRITE as the degraded case worth
+        // aggregating into the deny layer's own result.
         return {
             ok: false,
-            warning: "worktree git-exclude provisioning did not complete " +
-                `(${EXECUTOR_SETTINGS_EXCLUDE_LINE} may appear in worker commits); continuing fail-open`,
+            warning: excludeWarning(worktreePath, "the exclude file could not be written"),
         };
     }
 }
@@ -173,13 +290,23 @@ export async function provisionExecutorDenyLayer(worktreePath, options, deps) {
     // may already exist from an earlier provisioning, so it runs even when the
     // merge-write was refused or failed.
     const exclude = await provisionWorktreeSettingsExclude(worktreePath, deps);
-    const warnings = [];
+    // `blocking` and `advisory` are kept apart on purpose. A blocking warning
+    // flips `ok` (the established contract, which existing callers and tests
+    // read); an advisory one rides along on `ok: true` so a degraded-but-
+    // non-failing outcome is still logged instead of vanishing (BAPI-815/R2).
+    const blocking = [];
+    const advisory = [];
     if (!result.ok) {
-        warnings.push(`deny-layer provisioning did not complete (${result.reason}); continuing fail-open`);
+        blocking.push(`deny-layer provisioning did not complete (${result.reason}); continuing fail-open`);
     }
     if (!exclude.ok)
-        warnings.push(exclude.warning);
-    if (warnings.length === 0)
-        return { ok: true };
-    return { ok: false, warning: warnings.join("; ") };
+        blocking.push(exclude.warning);
+    else if (exclude.warning)
+        advisory.push(exclude.warning);
+    if (blocking.length > 0) {
+        return { ok: false, warning: [...blocking, ...advisory].join("; ") };
+    }
+    if (advisory.length > 0)
+        return { ok: true, warning: advisory.join("; ") };
+    return { ok: true };
 }

package/build/executor/platform.js

@@ -0,0 +1,54 @@
+/**
+ * Executor platform policy (BAPI-790).
+ *
+ * WHY THIS MODULE EXISTS SEPARATELY. The darwin/linux gate used to live inside
+ * `worker-config-isolation.ts`, where it was one clause of an
+ * "is isolation establishable here?" question. BAPI-790 retires isolation, and
+ * the platform restriction must NOT be retired with it: Windows worker spawning
+ * was never measured, and enabling it is explicit follow-on scope rather than
+ * something a containment change unlocks as a side effect. Hoisting the gate
+ * into its own module is what lets the isolation module shrink without silently
+ * widening the supported-platform set.
+ *
+ * The gate is a PLATFORM check only. It deliberately does not consider
+ * credentials: a worker now authenticates through the operator's interactive
+ * Claude login (inventory Finding 6), so requiring an `ANTHROPIC_API_KEY` or a
+ * `CLAUDE_CODE_OAUTH_TOKEN` before an otherwise-runnable host may claim work
+ * would reintroduce exactly the onboarding barrier this epic removes.
+ *
+ * PURE. Nothing here reads the filesystem, the environment, or a credential.
+ * The returned reason is a fixed sentence plus the platform name — never a host
+ * path, an environment value, or raw exception text.
+ */
+/**
+ * Platforms on which a conductor worker may be spawned.
+ *
+ * `darwin` is measured (inventory findings 1–6). `linux` is inferred from the
+ * same CLI and the same argv/env handling and has not been measured directly.
+ * Everything else — `win32` included — is unsupported and fails closed.
+ */
+export const SUPPORTED_EXECUTOR_PLATFORMS = ["darwin", "linux"];
+/**
+ * Render the fixed, secret-free unsupported-platform sentence.
+ *
+ * Exported so the preflight refusal and any diagnostic render byte-identical
+ * text; two copies of this sentence would drift.
+ */
+export function formatUnsupportedExecutorPlatform(platform) {
+    return (`the conductor executor does not support platform '${platform}': worker spawning is ` +
+        "supported on darwin and linux only (Windows support is explicit follow-on scope, not " +
+        "implied by the current worker containment mechanism)");
+}
+/**
+ * Decide whether the executor may run on `platform`.
+ *
+ * Fail-closed on anything unrecognized: an unmeasured platform is never
+ * optimistically assumed to work.
+ */
+export function evaluateExecutorPlatform(platform) {
+    const name = String(platform);
+    if (SUPPORTED_EXECUTOR_PLATFORMS.includes(platform)) {
+        return { supported: true, platform: name };
+    }
+    return { supported: false, platform: name, message: formatUnsupportedExecutorPlatform(name) };
+}