@bridge_gpt/mcp-server 0.2.38 → 0.2.41

package/build/run-unit-tests-launcher.js

@@ -65,6 +65,7 @@ export const MODULE_MOCK_MANIFEST = [
     "build/sfcc/reads-site-preference.test.js",
     "build/sfcc/reads-system-object.test.js",
     "build/sfcc/register.test.js",
+    "build/sfcc/registration-boundary.test.js",
     "build/sfcc/setup-status.test.js",
     "build/sfcc/tool-wrapper.test.js",
     "build/sfcc/write-gate-rejection.test.js",
@@ -96,14 +97,24 @@ export const FORCE_EXIT_QUARANTINE = ["build/secret-safety.test.js"];
 // normal unit suite.
 const INTEGRATION_DIR_PREFIX = "build/integration/";
 const INTEGRATION_DIR_ALLOWLIST = new Set(["build/integration/measure-tools.test.js"]);
-// Pre-existing compiled test files that were not wired into ANY script before
-// this launcher existed (discovered while building it). BAPI-683 preserves
-// the exact current running test set rather than silently picking these up —
-// see docs/BAPI-683-mcp-ci-windows-npm-test-launcher.md for the follow-up.
-const KNOWN_UNREGISTERED_ORPHANS = new Set([
+// Compiled test files that live OUTSIDE build/integration/ but still belong to
+// the separately-invoked `npm run test:integration` lane, so the unit lane must
+// skip them. BAPI-683 originally introduced this set as
+// KNOWN_UNREGISTERED_ORPHANS: two pre-existing files that were wired into no
+// script at all, preserved as-is rather than silently picked up. BAPI-822
+// retired that state — every entry here is now named explicitly by
+// scripts.test:integration, and validateManifest below fails if an entry
+// disappears from the build output.
+//
+// Only add a file here when it genuinely needs the integration lane (an
+// MCP_INTEGRATION=1 gate, real subprocesses, or an optional native dependency
+// like better-sqlite3). A plain compiled test outside build/integration/ is
+// discovered into the unit lane automatically and needs no registration —
+// tests/pytest/mcp/test_mcp_server_test_registration_multicomponent.py fails if
+// a *.integration.test.ts ends up in neither lane.
+export const INTEGRATION_LANE_ONLY = [
     "build/conductor/conductor-runtime.integration.test.js",
-    "build/sfcc/register-site-preference.integration.test.js",
-]);
+];
 /** Recursively lists compiled `*.test.js` files under `<root>/<buildDir>`, sorted and package-relative. */
 export function discoverTestFiles(options) {
     const { root, buildDir = DEFAULT_BUILD_DIR, fsImpl = { readdirSync } } = options;
@@ -133,7 +144,7 @@ export function discoverTestFiles(options) {
     results.sort();
     return results;
 }
-/** Throws if the module-mock or force-exit-quarantine manifest has drifted from the discovered build output. */
+/** Throws if the module-mock, force-exit-quarantine, or integration-lane manifest has drifted from the discovered build output. */
 export function validateManifest(discovered) {
     const discoveredSet = new Set(discovered);
     const seen = new Set();
@@ -157,6 +168,21 @@ export function validateManifest(discovered) {
                 `(rebuild with 'npm run build', or remove it from FORCE_EXIT_QUARANTINE if the file was deleted/renamed)`);
         }
     }
+    // The integration-lane set is the one exclusion that removes a discovered
+    // file from every unit batch, so a stale entry is invisible by construction:
+    // the excluded file simply stops running and nothing reports it. Validating
+    // it against the build output turns that into a loud failure (BAPI-822).
+    for (const entry of INTEGRATION_LANE_ONLY) {
+        if (seen.has(entry)) {
+            throw new Error(`run-unit-tests: integration-lane entry duplicated or also present in another manifest: ${entry}`);
+        }
+        seen.add(entry);
+        if (!discoveredSet.has(entry)) {
+            throw new Error(`run-unit-tests: integration-lane entry not found in build output: ${entry} ` +
+                `(rebuild with 'npm run build', or remove it from INTEGRATION_LANE_ONLY — and from ` +
+                `scripts.test:integration — if the file was deleted/renamed)`);
+        }
+    }
 }
 /** Selects and validates the requested group's file list from the discovered inventory. */
 export function selectTestGroup(mode, discovered) {
@@ -165,12 +191,13 @@ export function selectTestGroup(mode, discovered) {
     }
     validateManifest(discovered);
     const moduleMockSet = new Set(MODULE_MOCK_MANIFEST);
+    const integrationLaneSet = new Set(INTEGRATION_LANE_ONLY);
     const normal = discovered.filter((file) => {
         if (moduleMockSet.has(file))
             return false;
         if (file.startsWith(INTEGRATION_DIR_PREFIX) && !INTEGRATION_DIR_ALLOWLIST.has(file))
             return false;
-        if (KNOWN_UNREGISTERED_ORPHANS.has(file))
+        if (integrationLaneSet.has(file))
             return false;
         return true;
     });

package/build/setup-epic.js

@@ -38,6 +38,10 @@ import os from "node:os";
 import readline from "node:readline";
 import { approveEpicPlan, createEpicRunWithDisposition, fetchEpicRunState, replaceEpicRunPolicy, resolveConductorBridgeApiAccess, storeEpicPlan, validateEpicPlan, ConductorBridgeApiError, } from "./conductor/bridge-api-client.js";
 import { validateBranchName } from "./base-ref.js";
+// BAPI-814/E1a: reused from the conduct-epic client on purpose. The override is
+// ONE repository-wide row with ONE reader; adding a second wrapper under
+// `conductor/` would give the v2 path its own copy to drift from.
+import { getIndexBranch } from "./conduct-epic/bridge-client.js";
 import { hashPlan } from "./conductor/plan.js";
 /** Accepted `policy_json.review_policy.source` values (the `ReviewPolicy` surface). */
 export const SETUP_EPIC_REVIEW_POLICY_SOURCES = [
@@ -45,6 +49,36 @@ export const SETUP_EPIC_REVIEW_POLICY_SOURCES = [
     "native_review_decision",
     "none",
 ];
+/**
+ * The warning lines for an active repository-wide index-branch override, or an
+ * empty array when there is nothing to say (BAPI-814/E1a).
+ *
+ * Fail-open by construction. This is optional enrichment layered onto a command
+ * whose real job is creating an epic run, so an unreadable override must not
+ * become a preflight failure: an unavailable lookup produces one bounded,
+ * sanitized diagnostic and `setup-epic` continues. The client already returns a
+ * sanitized `error` string and never the raw service body, so nothing further
+ * needs stripping here.
+ */
+async function describeActiveIndexOverride(access, deps) {
+    const result = await getIndexBranch(access, deps.fetch);
+    if (!result.ok) {
+        return [
+            `  [warn] The repository's indexed-branch override could not be read: ${result.error}. ` +
+                `Continuing — this is optional context, not a prerequisite.`,
+        ];
+    }
+    const override = result.value.override;
+    if (override === null)
+        return [];
+    return [
+        `  [warn] ${access.repoName} has an ACTIVE index-branch override: ` +
+            `'${override.override_branch}'. Repository parses currently index that branch, ` +
+            `and the base-branch config field this run may fall back on resolves through the ` +
+            `same override.`,
+        `         Setup is CONTINUING — this is a warning, not a refusal.`,
+    ];
+}
 /** Echoed single-line prompt on stderr (mirrors connect-github's helper). */
 function defaultPromptLine(promptText) {
     return new Promise((resolve) => {
@@ -102,9 +136,13 @@ export function getSetupEpicUsage() {
         "  --review-policy <src>  PER-RUN review policy source, one of:",
         `                         ${SETUP_EPIC_REVIEW_POLICY_SOURCES.join(", ")}.`,
         "                         Composed into policy_json.review_policy on create.",
-        "                         This setting is per-run: repository-level review-policy",
-        "                         defaults are NOT persisted in supervisor project",
-        "                         defaults yet — that is BAPI-694.",
+        "                         This flag sets the policy for THIS run only and never",
+        "                         changes a repository default. To persist one, pass",
+        "                         --review-policy to `install-bridge conductor`, which",
+        "                         stores it as the supervisor project default; that",
+        "                         default is stamped into a new run only when the run",
+        "                         sets no review policy of its own, so a value supplied",
+        "                         here always wins.",
         "  --json                 Emit a single JSON result object on stdout",
         "  -h, --help             Show this help",
         "",
@@ -981,6 +1019,21 @@ export async function runSetupEpicCli(argv, overrides = {}) {
     say(`Local hash: ${localHash}`);
     for (const w of warnings)
         say(`  [warn] ${w}`);
+    // --- Active index-branch override (BAPI-814/E1a) -------------------------
+    // Non-mutating enrichment, placed once credentials and repository identity are
+    // both known and before any run-state read or mutating request.
+    //
+    // WARNING ONLY, never a refusal. The override is repository-wide: while it is
+    // active every parse indexes that branch, and the create-PR config-field
+    // fallback and feature-branch provisioning read the same overridden
+    // `config_code_repositories.base_branch`. A v2 operator setting up an epic in
+    // that repository needs to know, but the condition is legitimate — it is
+    // usually another epic mid-flight — so setup continues.
+    //
+    // Emitted in `--dry-run` too: the condition already exists in the repository
+    // and is independent of whether this invocation writes anything.
+    for (const line of await describeActiveIndexOverride(access, deps))
+        say(line);
     // --- Feature branch selection (BAPI-655) --------------------------------
     // Resolved AFTER local/access context is known but BEFORE any run-state read
     // or mutating request, so malformed interactive input fails before network
@@ -1171,7 +1224,7 @@ export async function runSetupEpicCli(argv, overrides = {}) {
             say(`  - feature branch: ${featureBranch} (create from repository base branch; no request made in dry-run)`);
         }
         if (opts.reviewPolicy !== undefined) {
-            say(`  - review policy: ${opts.reviewPolicy} (per-run policy_json.review_policy; not persisted as a repository default until BAPI-694)`);
+            say(`  - review policy: ${opts.reviewPolicy} (per-run policy_json.review_policy; sets no repository default — use \`install-bridge conductor --review-policy\` for that)`);
         }
         say(`  - POST /jira/epic-runs/runs/${opts.epicKey}/plan          (v${plan.plan_version})`);
         say(`  - POST /jira/epic-runs/runs/${opts.epicKey}/approve-plan  (v${plan.plan_version})`);

package/build/sfcc/permissions.js

@@ -3,8 +3,8 @@
  *
  * Issues a harmless GET /system_object_definitions probe. On 200: reports the
  * detected OCAPI version. On 401/403: prints the exact OCAPI Settings JSON to
- * paste in Business Manager, split into read-only (v1) vs. write/import (v2)
- * grant blocks.
+ * paste in Business Manager, split into read/search grants (for the `sfcc` read
+ * tools) and mutation grants (for the nine shipped `sfcc-write` tools).
  */
 import { ocapiGet } from "./client.js";
 import { normalizeOcapiPage } from "./ocapi-shape.js";
@@ -14,7 +14,7 @@ import { formatOcapiWriteGrantJson } from "./write-grants.js";
 // OCAPI Settings JSON template
 // Operators paste this in: Administration > Site Development > Open Commerce API Settings → Data API tab.
 // ---------------------------------------------------------------------------
-const OCAPI_SETTINGS_READ_ONLY = (ocapiVersion) => JSON.stringify({
+const OCAPI_SETTINGS_READ_SEARCH = (ocapiVersion) => JSON.stringify({
     _v: ocapiVersion,
     clients: [
         {
@@ -138,12 +138,31 @@ function formatProbeCount(normalized) {
     }
     return `${returned} items returned on this page (OCAPI did not provide the instance total)`;
 }
+/**
+ * Render the two grant blocks an operator pastes in Business Manager.
+ *
+ * Both labels were wrong before BAPI-817, in opposite directions:
+ *
+ *   - The first block was labelled **"READ-ONLY GRANTS"** while actually
+ *     granting `methods: ["get","post"]` with `write_attributes: "(**)"` across
+ *     three resource families. An operator pasted a grant they had been told was
+ *     read-only. It is renamed to read/search, which is what it is — the `post`
+ *     is OCAPI's search convention (`*_search` endpoints are POSTs), not a
+ *     mutation, but calling that "read-only" is still a claim about a grant the
+ *     operator cannot verify without reading OCAPI's own semantics.
+ *   - The second was labelled **"v2 — forward-looking"** for capabilities that
+ *     had already shipped. All nine write tools exist; the grant is required
+ *     today by anyone enabling `sfcc-write`, not speculative future work.
+ *
+ * A label that understates a grant is worse than no label, because the operator
+ * stops reading the JSON once the heading has told them it is safe.
+ */
 function ocapiSettingsInstructions(ocapiVersion) {
     return (`To grant OCAPI access, paste the JSON below in Business Manager:\n` +
         `  Administration > Site Development > Open Commerce API Settings → Data API tab\n\n` +
-        `--- READ-ONLY GRANTS (v1 — required now) ---\n` +
-        `${OCAPI_SETTINGS_READ_ONLY(ocapiVersion)}\n\n` +
-        `--- WRITE/IMPORT GRANTS (v2 — forward-looking, paste once) ---\n` +
+        `--- READ/SEARCH TOOL GRANTS (required for the sfcc read tools) ---\n` +
+        `${OCAPI_SETTINGS_READ_SEARCH(ocapiVersion)}\n\n` +
+        `--- MUTATION GRANTS (required for the nine sfcc-write tools) ---\n` +
         `${OCAPI_SETTINGS_WRITE_IMPORT(ocapiVersion)}\n\n` +
         `Replace <YOUR_CLIENT_ID> with the client_id from your dw.json.`);
 }

package/build/sfcc/reads-site-preference.js

@@ -113,6 +113,12 @@ async function saveAndReturn(text, dir, filename, page) {
  * an API version while OCAPI simultaneously reports `_v: "25.6"` in the same
  * session; the constraint belongs to this Bridge tool, not to a version. The
  * status, code, source, decision, and `details` payload are untouched.
+ *
+ * ⚠️ BAPI-817: like `write-guard.ts#rejectIfNotSandboxForWrite`, this checks a
+ * caller-supplied OCAPI instance-CONTEXT argument, NOT the host that will be
+ * contacted. It is secondary. The instance actually reached is decided by the
+ * resolved-hostname boundary in `tool-wrapper.ts`, which runs before this and
+ * does not consult `instance`.
  */
 function rejectIfNotSandbox(instance) {
     if (instance !== "sandbox") {

package/build/sfcc/register.js

@@ -5,10 +5,32 @@
  * SFCC tools with a single call adjacent to `registerConductorTools`. All
  * SFCC business logic lives inside the sfcc/ module; index.ts stays a
  * thin registration/composition layer.
+ *
+ * ---------------------------------------------------------------------------
+ * Two structural properties this module owns (BAPI-817)
+ * ---------------------------------------------------------------------------
+ *
+ * **1. The target boundary is unavoidable.** The raw host registrar is used in
+ * exactly one place — `registerSfccTool`, the adapter below — and every other
+ * registration in this module and in every child registrar goes through that
+ * adapter. So the resolved-hostname sandbox check runs for all twenty tools:
+ * the two always-on diagnostics, the eight reads (including the five with no
+ * `instance` parameter at all), the nine writes, and `sfcc_log_query`. Asking
+ * each handler to remember a check is what produced the unguarded reads in the
+ * first place; wrapping the registrar removes the opportunity to forget.
+ *
+ * **2. Reads and writes are separately gated.** Before BAPI-817 one boolean
+ * (`includeReadTools`, from `ACTIVE_GROUPS.has("sfcc")`) registered eighteen
+ * tools, nine of them destructive — while the README described the group as
+ * "the 7 heavy SFCC read tools" and stated "All SFCC tools are read-only".
+ * Enabling introspection silently enabled mutation. This module now takes two
+ * independent flags so the `sfcc` profile is genuinely read-oriented and the
+ * nine writes require the deliberate `sfcc-write` opt-in (the ticket's
+ * Decision 2(c)).
  */
 import { z } from "zod";
 import { buildSfccSetupStatusHandler } from "./setup-status.js";
-import { withSfccGate } from "./tool-wrapper.js";
+import { withSfccGate, withSfccTargetBoundary } from "./tool-wrapper.js";
 import { checkPermissionsTool } from "./permissions.js";
 import { registerSystemObjectReadTools } from "./reads-system-object.js";
 import { registerSfccCustomObjectDefReadTools } from "./reads-custom-object-def.js";
@@ -22,7 +44,9 @@ import { registerSfccLogQueryTool } from "./log-query.js";
  * Register all SFCC tools through the host's registerTool wrapper.
  *
  * Call this once in index.ts, immediately after `registerConductorTools(registerTool)`.
- * Sub-task tickets (2–4) add their read tools here; they never touch index.ts.
+ * Read and write surfaces are selected independently by `deps.includeReadTools`
+ * and `deps.includeWriteTools`; the two always-on diagnostics register
+ * regardless. Every path goes through `registerSfccTool`.
  */
 export function registerSfccTools(registerTool, deps) {
     const gateDeps = {
@@ -30,8 +54,17 @@ export function registerSfccTools(registerTool, deps) {
         getGetHeaders: deps.getGetHeaders,
         repoName: deps.repoName,
     };
+    /**
+     * The one and only bridge between the host registrar and the SFCC surface.
+     *
+     * Every SFCC tool is registered through this, so every SFCC tool crosses the
+     * resolved-hostname boundary before its own handler runs. `registerTool` (the
+     * raw host registrar) must not be referenced anywhere else in this module or
+     * passed to a child registrar — `registration-boundary.test.ts` pins that.
+     */
+    const registerSfccTool = (name, config, handler) => registerTool(name, config, withSfccTargetBoundary(handler));
     // sfcc_setup_status — aggregate prerequisite reporter.
-    registerTool("sfcc_setup_status", {
+    registerSfccTool("sfcc_setup_status", {
         description: "Report on every SFCC prerequisite: Bridge API key, repo name, version config, " +
             "dw.json presence/uniqueness, and AM token acquisition. Always-registered; " +
             "returns status without requiring full SFCC configuration to be complete.",
@@ -40,53 +73,58 @@ export function registerSfccTools(registerTool, deps) {
     }, buildSfccSetupStatusHandler(deps.buildGetUrl, deps.getGetHeaders, deps.repoName, deps.getResolvedApiKey));
     // check_permissions — OCAPI access probe + settings JSON printer.
     const gatedCheckPermissions = withSfccGate(gateDeps, async (_args, credentials) => checkPermissionsTool(credentials));
-    registerTool("check_permissions", {
+    registerSfccTool("check_permissions", {
         description: "Probe SFCC OCAPI access via GET /system_object_definitions. " +
             "On 200: reports OK and the detected OCAPI version. " +
             "On 401/403: prints the exact OCAPI Settings JSON to paste in Business Manager " +
-            "(split read-only vs. write/import grants).",
+            "(read/search and mutation grants).",
         inputSchema: z.object({
             instance: z
                 .string()
+                .min(1)
                 .optional()
-                .describe("Explicit sandbox hostname to use instead of dw.json auto-detection."),
+                .describe("Sandbox hostname to use instead of dw.json. Still sandbox-validated."),
         }),
         annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     }, gatedCheckPermissions);
-    // Heavy read tools are gated behind ACTIVE_GROUPS.has("sfcc") (BAPI-453).
-    // sfcc_setup_status and check_permissions above remain always-on (D-4 decision).
+    // The read profile — eight OCAPI reads plus sfcc_log_query — is gated behind
+    // ACTIVE_GROUPS.has("sfcc") (BAPI-453). sfcc_setup_status and
+    // check_permissions above remain always-on (D-4 decision).
     if (deps.includeReadTools) {
         // system_object_list, system_object_get, system_object_attribute_search (BAPI-401 T1–T3)
-        registerSystemObjectReadTools(registerTool, {
+        registerSystemObjectReadTools(registerSfccTool, {
             gateDeps,
             getDocsDir: deps.getDocsDir,
         });
         // custom_object_definition_attributes_get, custom_object_definition_attribute_search (BAPI-402 T4–T5)
-        registerSfccCustomObjectDefReadTools(registerTool, {
-            gateDeps,
-            getDocsDir: deps.getDocsDir,
-        });
-        // site_preference_get, site_preference_search (BAPI-403 T6 — optional)
-        registerSitePreferenceTools(registerTool, {
+        registerSfccCustomObjectDefReadTools(registerSfccTool, {
             gateDeps,
             getDocsDir: deps.getDocsDir,
         });
-        // SFCC write registration seam (BAPI-582). No write tools ship yet — future
-        // write-surface tickets register here. Gated behind the same includeReadTools
-        // branch so writes become default-on with reads whenever the sfcc profile
-        // group is active.
-        registerSfccWriteTools(registerTool, {
+        // site_preference_group_list, site_preference_get, site_preference_search (BAPI-403 T6)
+        registerSitePreferenceTools(registerSfccTool, {
             gateDeps,
             getDocsDir: deps.getDocsDir,
         });
         // sfcc_log_query (BAPI-556 T7) — gated, on-demand redacted/filtered log query.
-        // Uses its OWN call-time gate (log capability = WebDAV Basic auth), NOT the
-        // OCAPI version/dw.json/AM-token gate above.
-        registerSfccLogQueryTool(registerTool, {
+        // Uses its OWN call-time capability gate (log capability = WebDAV Basic
+        // auth), NOT the OCAPI version/dw.json/AM-token gate above. It is read-only,
+        // so it belongs to the read profile.
+        registerSfccLogQueryTool(registerSfccTool, {
             buildGetUrl: deps.buildGetUrl,
             getGetHeaders: deps.getGetHeaders,
             getPostHeaders: deps.getPostHeaders,
             repoName: deps.repoName,
         });
     }
+    // The nine destructive write tools are gated INDEPENDENTLY, behind
+    // ACTIVE_GROUPS.has("sfcc-write") (BAPI-817). This branch is deliberately not
+    // nested inside the read branch: `sfcc-write` alone is a valid selection, and
+    // `sfcc` alone must never register a tool carrying WRITE_ANNOTATIONS.
+    if (deps.includeWriteTools) {
+        registerSfccWriteTools(registerSfccTool, {
+            gateDeps,
+            getDocsDir: deps.getDocsDir,
+        });
+    }
 }

package/build/sfcc/registration-inventory.js

@@ -0,0 +1,89 @@
+/**
+ * Canonical inventory of every SFCC MCP tool name, by registration mode
+ * (BAPI-816).
+ *
+ * `register.ts` (`registerSfccTools`) decides WHICH tools register; this
+ * module is the single readable description of what that decision produces.
+ * Registrar tests compare captured registrations against these composed
+ * arrays instead of independently maintained numeric pins, which is exactly
+ * what let `register-site-preference.integration.test.ts` pin a stale `10`
+ * while the real registrar had already grown to 20 — a full write surface's
+ * worth of drift that no test caught (BAPI-816).
+ *
+ * `includeReadTools` is the legacy `SfccHostDeps` flag name (`register.ts`).
+ * Since BAPI-817 it gates the READ profile only — the eight OCAPI reads plus
+ * the log-query tool — while `includeWriteTools` independently gates the nine
+ * writes. The name predates both surfaces and was kept for call-site stability.
+ */
+import { SFCC_WRITE_TOOL_NAMES } from "./writes.js";
+/**
+ * Registered unconditionally, regardless of `includeReadTools` (D-4 decision
+ * in register.ts): the aggregate prerequisite reporter and the OCAPI access
+ * probe.
+ */
+export const SFCC_ALWAYS_REGISTERED_TOOL_NAMES = [
+    "sfcc_setup_status",
+    "check_permissions",
+];
+/**
+ * The eight read tools registered by the three read-module registrars
+ * (`registerSystemObjectReadTools`, `registerSfccCustomObjectDefReadTools`,
+ * `registerSitePreferenceTools`) when `includeReadTools` is true.
+ */
+export const SFCC_READ_TOOL_NAMES = [
+    "system_object_list",
+    "system_object_get",
+    "system_object_attribute_search",
+    "custom_object_definition_attributes_get",
+    "custom_object_definition_attribute_search",
+    "site_preference_group_list",
+    "site_preference_get",
+    "site_preference_search",
+];
+/** The on-demand redacted/filtered log-query tool (BAPI-556 T7). */
+export const SFCC_LOG_QUERY_TOOL_NAME = "sfcc_log_query";
+/**
+ * The `sfcc` READ profile: the eight OCAPI reads plus the log-query tool
+ * (BAPI-817).
+ *
+ * This is the exact set `includeReadTools` registers. Every member is read-only
+ * and carries read-only annotations; by construction no tool annotated
+ * `WRITE_ANNOTATIONS` can appear here, which is what makes "enabling `sfcc`
+ * cannot enable a mutation" checkable rather than merely intended.
+ */
+export const SFCC_READ_PROFILE_TOOL_NAMES = [
+    ...SFCC_READ_TOOL_NAMES,
+    SFCC_LOG_QUERY_TOOL_NAME,
+];
+/**
+ * The `sfcc-write` WRITE profile: the nine destructive tools (BAPI-817).
+ *
+ * Reused from `writes.ts#SFCC_WRITE_TOOL_NAMES` rather than duplicated, so the
+ * profile inventory and the registrar's own list cannot drift apart.
+ */
+export const SFCC_WRITE_PROFILE_TOOL_NAMES = [
+    ...SFCC_WRITE_TOOL_NAMES,
+];
+/**
+ * Every profile-gated tool, across both groups.
+ *
+ * Retained as the aggregate for consumers that care about "gated vs always-on"
+ * rather than which group gates it — but composed from the two profile
+ * inventories above, never hand-maintained. Order matches registration order in
+ * `register.ts`: the read branch runs first, then the write branch.
+ */
+export const SFCC_PROFILE_GATED_TOOL_NAMES = [
+    ...SFCC_READ_PROFILE_TOOL_NAMES,
+    ...SFCC_WRITE_PROFILE_TOOL_NAMES,
+];
+/**
+ * The complete SFCC registration surface: always-on plus both gated profiles.
+ *
+ * This is the twenty-tool surface a `BRIDGE_MCP_PROFILE=sfcc,sfcc-write` (or
+ * `full`) session exposes, and the iteration source for the boundary-coverage
+ * test — so a newly added tool cannot silently evade that coverage.
+ */
+export const SFCC_ALL_REGISTERED_TOOL_NAMES = [
+    ...SFCC_ALWAYS_REGISTERED_TOOL_NAMES,
+    ...SFCC_PROFILE_GATED_TOOL_NAMES,
+];

package/build/sfcc/setup-status.js

@@ -6,7 +6,6 @@
  * prevent the others from running.
  */
 import { SFCC_VERSIONS, getSfccVersionConfig } from "./config.js";
-import { resolveSfccCredentials } from "./credentials.js";
 import { getAmToken } from "./client.js";
 // ---------------------------------------------------------------------------
 // Implementation
@@ -57,39 +56,20 @@ export async function sfccSetupStatusTool(deps) {
         versionStatus = "— Skipped (Bridge API not configured)";
     }
     lines.push(`3. SFCC Version: ${versionStatus}`);
-    // 4. dw.json / credential resolution
-    let credStatus = "✗ Missing";
-    let resolvedCredentials = null;
-    try {
-        const result = await resolveSfccCredentials();
-        if (result.ok) {
-            // Report source and instance ID only — never the secret values.
-            resolvedCredentials = {
-                hostname: result.credentials.hostname.split(".")[0] ?? result.credentials.hostname,
-                source: result.credentials.source,
-            };
-            credStatus = `✓ Found (${resolvedCredentials.source})`;
-        }
-        else {
-            credStatus = `✗ ${result.error}`;
-        }
-    }
-    catch (err) {
-        credStatus = `✗ Resolution error: ${err instanceof Error ? err.message : String(err)}`;
-    }
-    lines.push(`4. dw.json / Credentials: ${credStatus}`);
-    // 5. AM token acquisition (only if credentials were resolved)
+    // 4. dw.json / credential resolution — read from the boundary-approved target
+    // rather than resolved again here (BAPI-817).
+    const target = deps.target;
+    // Report source and instance ID only — never the secret values.
+    const instanceLabel = target.approved
+        ? target.hostname.split(".")[0] ?? target.hostname
+        : null;
+    lines.push(`4. dw.json / Credentials: ${target.approved ? `✓ Found (${target.credentials.source})` : `✗ ${target.error}`}`);
+    // 5. AM token acquisition (only when the boundary approved a target).
     let tokenStatus = "— Skipped (credentials not available)";
-    if (resolvedCredentials) {
+    if (target.approved) {
         try {
-            const credResult = await resolveSfccCredentials();
-            if (credResult.ok) {
-                await getAmToken(credResult.credentials);
-                tokenStatus = `✓ Token acquired for instance ${resolvedCredentials.hostname}`;
-            }
-            else {
-                tokenStatus = "✗ Credentials not resolved";
-            }
+            await getAmToken(target.credentials);
+            tokenStatus = `✓ Token acquired for instance ${instanceLabel}`;
         }
         catch (err) {
             // Sanitize: strip any token/secret-looking content from error message.
@@ -135,10 +115,14 @@ export async function sfccSetupStatusTool(deps) {
 }
 /**
  * Build the sfcc_setup_status handler bound to the host's runtime deps.
+ *
+ * The returned handler takes the `SfccTargetContext` the registration-level
+ * sandbox boundary supplies (BAPI-817) and forwards it, so this tool reports on
+ * the same target the boundary approved and never resolves one of its own.
  */
 export function buildSfccSetupStatusHandler(buildGetUrl, getGetHeaders, repoName, getApiKey) {
-    return async (_args) => {
+    return async (_args, target) => {
         const apiKey = await getApiKey();
-        return sfccSetupStatusTool({ buildGetUrl, getGetHeaders, repoName, apiKey });
+        return sfccSetupStatusTool({ buildGetUrl, getGetHeaders, repoName, apiKey, target });
     };
 }