@bridge_gpt/mcp-server 0.2.38 → 0.2.41

package/build/conductor/bridge-api-client.js

@@ -1418,6 +1418,12 @@ export async function transitionJiraStatus(access, ticketNumber, targetStatus =
         throw err;
     }
 }
+export const CONDUCTOR_REVIEW_ALIGNMENT_STATUSES = new Set([
+    "aligned",
+    "divergent",
+    "not_configured",
+    "invalid",
+]);
 const READINESS_SOURCES = new Set(["epic", "project_default", "none"]);
 const ACTIONS_LEVELS = new Set(["write", "read", "none", "unknown"]);
 function readinessShapeError() {
@@ -1469,6 +1475,31 @@ function requireNullableBool(o, key) {
         throw readinessShapeError();
     return v;
 }
+/**
+ * Parse the optional alignment block (BAPI-694).
+ *
+ * ABSENT — the key is missing or null — yields `null`, which is how a CLI newer
+ * than the server degrades: alignment is advisory, and hard-failing a readiness
+ * read over a field the server has never heard of would break every operator on
+ * an older deploy. PRESENT-but-malformed still throws, because a body that
+ * claims to carry an alignment verdict and cannot be read is exactly the case
+ * the fail-closed parser exists for.
+ */
+function parseReviewPolicyAlignment(o) {
+    const raw = o.review_policy_alignment;
+    if (raw === undefined || raw === null)
+        return null;
+    const a = requireObject(raw);
+    const explanation = a.explanation;
+    if (typeof explanation !== "string")
+        throw readinessShapeError();
+    return {
+        status: requireEnum(a, "status", CONDUCTOR_REVIEW_ALIGNMENT_STATUSES),
+        repo_review_signal: requireNullableString(a, "repo_review_signal"),
+        done_gate_review_signal: requireNullableString(a, "done_gate_review_signal"),
+        explanation,
+    };
+}
 function requireEnum(o, key, allowed) {
     const v = o[key];
     if (typeof v !== "string" || !allowed.has(v))
@@ -1509,6 +1540,9 @@ export function parseConductorReadinessResponse(body) {
             required_checks_empty: requireBool(sup, "required_checks_empty"),
             auto_merge_enabled: requireBool(sup, "auto_merge_enabled"),
             merge_approval_required_set: requireBool(sup, "merge_approval_required_set"),
+            review_policy_alignment: parseReviewPolicyAlignment(sup),
+            // Absent on a pre-BAPI-694 server, where no repository default can exist.
+            review_policy_present: sup.review_policy_present === true,
         },
         github: {
             credentials_readable: requireBool(gh, "credentials_readable"),
@@ -1582,8 +1616,9 @@ export function parseConductorSupervisorBootstrapResponse(body) {
 /**
  * POST `/jira/epic-runs/supervisor-bootstrap?repo_name=<repo>`.
  *
- * The ONLY write this client performs. Deliberately carries no `review_policy`
- * field: repository-default review policy is owned by BAPI-694.
+ * The ONLY write this client performs. Since BAPI-694 it may also carry the
+ * optional repository-default `review_policy`; omitting that field stores no
+ * default rather than a neutral one.
  */
 export async function bootstrapConductorSupervisorDefaults(access, request, fetchImpl) {
     const url = buildConductorJiraUrl(access.baseUrl, `${EPIC_RUNS_API_PREFIX}/supervisor-bootstrap`, {

package/build/conductor/doctor.js

@@ -9,7 +9,10 @@
  */
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
+import { readFile as readFileAsync } from "node:fs/promises";
+import os from "node:os";
 import { doctorConductorLedger } from "./store.js";
+import { detectClaudeLogin, formatClaudeLoginAdvisory } from "../claude-login.js";
 import { inspectConductorGitHooks } from "./git-hooks.js";
 import { resolveMcpShimInvocationForRuntime, resolvePackageRootFromModuleUrl, } from "../mcp-server-invocation.js";
 /**
@@ -284,6 +287,10 @@ export async function buildConductorDoctorReport(deps = {}) {
     const deny_enforcement = deps.skipDenyProbe
         ? skippedDenyEnforcementResult()
         : await inspectDenyEnforcementSafe(deps.inspectDenyEnforcement);
+    const claude_login = await detectClaudeLogin({
+        homedir: deps.claudeLoginDeps?.homedir ?? os.homedir,
+        readFile: deps.claudeLoginDeps?.readFile ?? ((p) => readFileAsync(p, "utf-8")),
+    });
     return {
         ledger,
         git_hooks: inspectHooks(deps.hooksDeps),
@@ -292,6 +299,7 @@ export async function buildConductorDoctorReport(deps = {}) {
         local_merge: inspectLocalMerge(deps.runCommand),
         native_ledger,
         deny_enforcement,
+        claude_login,
     };
 }
 /**
@@ -329,7 +337,7 @@ async function inspectDenyEnforcementSafe(inspect) {
  * status tags consistent with the git hooks section's visual hierarchy.
  */
 export function formatConductorDoctorReport(report) {
-    const { ledger, git_hooks, epic_tick, mcp_profile, local_merge, native_ledger, deny_enforcement } = report;
+    const { ledger, git_hooks, epic_tick, mcp_profile, local_merge, native_ledger, deny_enforcement, claude_login } = report;
     const lines = [
         "Conductor ledger doctor",
         "───────────────────────",
@@ -462,5 +470,7 @@ export function formatConductorDoctorReport(report) {
         for (const w of deny_enforcement.warnings)
             lines.push(`  - ${w}`);
     }
+    lines.push("");
+    lines.push(formatClaudeLoginAdvisory(claude_login));
     return lines.join("\n");
 }

package/build/conductor/install-doctor.js

@@ -30,15 +30,22 @@ import { ConductorBridgeApiError, fetchConductorReadiness, } from "./bridge-api-
 /** Operator runbook pointer surfaced beside the executor gap. */
 export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-conductor-v2-operator-runbook.md";
 /**
- * Capability-matrix guidance for the executor leg (BAPI-688 shipped in the same
- * build as BAPI-679): a persistent unit is *generated* by `executor
- * install-service`, but starting/stopping it stays operator-managed, so the
- * executor is never claimed as provisioned by a bootstrap alone.
+ * Capability-matrix guidance for the executor leg.
+ *
+ * Amended by BAPI-779 (R-1): `install conductor` can now write the unit AND
+ * start it, each behind its own consent. What did NOT change is the readiness
+ * rule — `executor_ready` still comes only from a live server observation, so
+ * neither a written unit nor a successful local start may produce that claim.
  */
-export const EXECUTOR_PROVISIONING_GUIDANCE = "generate a unit with `executor install-service`; start/stop stays operator-managed";
+export const EXECUTOR_PROVISIONING_GUIDANCE = "`install conductor` writes the unit and starts it, each behind its own consent; " +
+    "readiness still comes only from a live server observation";
 /** Remediation surfaced whenever no healthy generated service unit is detected. */
-export const EXECUTOR_INSTALL_SERVICE_REMEDIATION = "generate a persistent unit with `executor install-service` (or run the executor by hand) — " +
+export const EXECUTOR_INSTALL_SERVICE_REMEDIATION = "generate a persistent unit with `install conductor --executor-id <id>` or " +
+    "`executor install-service` (or run the executor by hand) — " +
     `see ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}.`;
+/** Remediation for a unit that exists but whose service is not running. */
+export const EXECUTOR_SERVICE_START_REMEDIATION = "start the service (re-run `install conductor` and accept the start consent, or run the " +
+    `printed launchctl/systemctl command by hand) — see ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}.`;
 // ---------------------------------------------------------------------------
 // Section builders
 // ---------------------------------------------------------------------------
@@ -83,6 +90,45 @@ function supervisorSection(readiness) {
             status: "ok",
             detail: `${s.required_checks_count} required check(s) configured`,
         });
+    // BAPI-694 (R5) — its OWN section, and WARN-ONLY.
+    //
+    // `degraded`, never `fatal`: a divergence between the code_review gate's
+    // signal and the merge path's may be exactly what the operator intended, and
+    // blocking an install over a legitimate posture would be worse than the
+    // silence this replaces. It also changes no gate: both settings are reported,
+    // neither is coerced into the other's vocabulary.
+    //
+    // Absent (`null`) means the server predates BAPI-694 and cannot report
+    // alignment, so no section is emitted at all — an advisory addition must not
+    // manufacture a finding out of a server that never answered.
+    const alignment = s.review_policy_alignment;
+    if (alignment !== null) {
+        if (alignment.status === "divergent" || alignment.status === "invalid") {
+            sections.push({
+                id: "supervisor-review-alignment",
+                label: "Supervisor review-policy alignment",
+                status: "degraded",
+                detail: alignment.explanation,
+                remediation: alignment.status === "invalid"
+                    ? "fix the done gate's review_state condition — review configuration " +
+                        "exists but cannot be read, so the merge path refuses rather than merges."
+                    : "set the repository review-policy default and the done gate's " +
+                        "review_state condition to the same signal, or confirm the difference " +
+                        `is intended — see ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}.`,
+            });
+        }
+        else {
+            // `aligned` and `not_configured` are both non-warning states, and are
+            // reported separately: "they agree" and "neither is set" are different
+            // facts, and collapsing them would imply a stored default that is absent.
+            sections.push({
+                id: "supervisor-review-alignment",
+                label: "Supervisor review-policy alignment",
+                status: "ok",
+                detail: alignment.explanation,
+            });
+        }
+    }
     return sections;
 }
 function githubCredentialsSection(readiness) {
@@ -202,9 +248,13 @@ function workflowSection(presence, reviewPolicySource) {
  * Real detection of BAPI-688 generated service units, composed from
  * `collectExecutorServiceDiagnostics`. Never `fatal` (a missing unit is a
  * repairable gap, and blocking every install on it would be wrong) and never
- * omitted (the flow must not read as fully provisioned by silence). A healthy
- * unit reports `ok` for *provisioning* only — whether the service is running is
- * the capability matrix's `executor_ready`, observed server-side.
+ * omitted (the flow must not read as fully provisioned by silence).
+ *
+ * This section reports UNIT PRESENCE and nothing else (BAPI-779). Whether the
+ * service manager is actually running the unit is
+ * {@link executorServiceStateSection}, and whether the SERVER has observed an
+ * executor is {@link executorObservationSection}. Three separate facts, three
+ * separate sections — a healthy unit here proves only that a file exists.
  */
 function executorProvisioningSection(diagnostics) {
     const base = { id: "executor-provisioning", label: "Executor provisioning" };
@@ -234,7 +284,7 @@ function executorProvisioningSection(diagnostics) {
             ...base,
             status: "ok",
             detail: `${diagnostics.units.length} generated service unit(s) found (${ids}); ` +
-                "lifecycle stays operator-managed",
+                "unit presence only — see the service-state and observation sections",
         };
     }
     return {
@@ -246,6 +296,91 @@ function executorProvisioningSection(diagnostics) {
         remediation: EXECUTOR_INSTALL_SERVICE_REMEDIATION,
     };
 }
+/**
+ * Local service-manager state for the units that were discovered (BAPI-779).
+ *
+ * Never `fatal`: this is a diagnostic, and an unreadable service manager is a
+ * gap in the *report*, not a broken install. `unknown` is deliberately not
+ * collapsed into `not-found` — "the probe could not answer" and "the service
+ * manager has no such unit" lead to different operator actions.
+ */
+function executorServiceStateSection(observations, unitsDiscovered, inspectorAvailable) {
+    const base = { id: "executor-service-state", label: "Executor service state" };
+    if (!unitsDiscovered) {
+        return {
+            ...base,
+            status: "degraded",
+            detail: "no generated unit to inspect, so no service state was collected",
+            remediation: EXECUTOR_INSTALL_SERVICE_REMEDIATION,
+        };
+    }
+    if (!inspectorAvailable || observations.length === 0) {
+        return {
+            ...base,
+            status: "degraded",
+            detail: "local service state could not be collected on this host",
+            remediation: EXECUTOR_SERVICE_START_REMEDIATION,
+        };
+    }
+    // Deterministic ordering by executor id so two runs of the same host render
+    // identically regardless of enumeration order.
+    const rendered = [...observations]
+        .sort((a, b) => (a.executorId < b.executorId ? -1 : a.executorId > b.executorId ? 1 : 0))
+        .map((o) => `${o.executorId}=${o.state}`)
+        .join(", ");
+    const allActive = observations.every((o) => o.state === "active");
+    return allActive
+        ? { ...base, status: "ok", detail: `service state: ${rendered}` }
+        : {
+            ...base,
+            status: "degraded",
+            detail: `service state: ${rendered}`,
+            remediation: EXECUTOR_SERVICE_START_REMEDIATION,
+        };
+}
+/**
+ * The AUTHORITATIVE executor fact: what the server has observed (BAPI-779).
+ *
+ * This is the only section permitted to say `executor_ready`, and only for
+ * `readiness.executor.ready === true`. The three not-ready shapes are kept
+ * distinct because they mean different things: `null` is "never observed" (the
+ * executor has not claimed yet), `false` is "observed but stale" (it claimed
+ * once and went quiet), and an unreadable readiness payload is "unknown" (the
+ * doctor cannot say). Collapsing them would let a stale executor read like a
+ * fresh install, or vice versa.
+ */
+function executorObservationSection(readiness) {
+    const base = { id: "executor-observation", label: "Executor server observation" };
+    if (readiness === null || !readiness.executor.liveness_readable) {
+        return {
+            ...base,
+            status: "degraded",
+            detail: "server executor observation is unknown (readiness could not be read)",
+            remediation: "retry once the Bridge API is reachable; no readiness claim is made from local state.",
+        };
+    }
+    const e = readiness.executor;
+    const seen = e.last_seen_at === null
+        ? "never seen"
+        : `last seen ${e.last_seen_at} (${e.last_seen_age_seconds}s ago)`;
+    if (e.ready === true) {
+        return { ...base, status: "ok", detail: `executor_ready — ${seen}` };
+    }
+    if (e.ready === false) {
+        return {
+            ...base,
+            status: "degraded",
+            detail: `observed but stale/not ready — ${seen}`,
+            remediation: EXECUTOR_SERVICE_START_REMEDIATION,
+        };
+    }
+    return {
+        ...base,
+        status: "degraded",
+        detail: `never observed by the server — ${seen}`,
+        remediation: EXECUTOR_SERVICE_START_REMEDIATION,
+    };
+}
 // ---------------------------------------------------------------------------
 // Runner
 // ---------------------------------------------------------------------------
@@ -380,11 +515,36 @@ export async function runConductorInstallDoctor(deps) {
         // section reports the collection gap rather than losing the section.
     }
     sections.push(executorProvisioningSection(executorService));
+    // --- Local service state (BAPI-779): read-only, and ONLY for units that were
+    // actually discovered above. Probing a service manager for a unit this host
+    // never generated would be a speculative query with nothing to report.
+    const discoveredUnits = executorService !== null && executorService.status !== "skipped"
+        ? executorService.units
+        : [];
+    const executorServiceStates = [];
+    if (deps.inspectExecutorServiceState && discoveredUnits.length > 0) {
+        for (const unit of discoveredUnits) {
+            try {
+                const state = await deps.inspectExecutorServiceState({ executorId: unit.executorId });
+                executorServiceStates.push({ executorId: unit.executorId, state });
+            }
+            catch {
+                // An inspector that throws yields `unknown` for that unit rather than
+                // dropping it — a silently missing unit reads as "nothing to see".
+                executorServiceStates.push({ executorId: unit.executorId, state: "unknown" });
+            }
+        }
+    }
+    sections.push(executorServiceStateSection(executorServiceStates, discoveredUnits.length > 0, Boolean(deps.inspectExecutorServiceState)));
+    // --- Server observation: the authoritative executor fact, last so it reads
+    // as the conclusion of the three-part executor story.
+    sections.push(executorObservationSection(readiness));
     return {
         legacyConductor,
         legacyExecutorPreflight,
         legacyInstallChecks,
         executorService,
+        executorServiceStates,
         readiness,
         sections,
     };
@@ -450,6 +610,20 @@ export function formatConductorInstallDoctorReport(report) {
     if (report.executorService) {
         embed("Executor provisioning", () => formatExecutorServiceDiagnosticsReport(report.executorService));
     }
+    // Per-unit local service state (BAPI-779), rendered as its OWN block rather
+    // than folded into the provisioning report above — the whole point of the
+    // three-dimension split is that a reader can see "unit written" and "service
+    // not running" as two separate lines.
+    const states = report.executorServiceStates ?? [];
+    if (states.length > 0) {
+        lines.push("");
+        lines.push("executor service state (local)");
+        lines.push("──────────────────────────────");
+        for (const observation of [...states].sort((a, b) => a.executorId < b.executorId ? -1 : a.executorId > b.executorId ? 1 : 0)) {
+            lines.push(`  ${observation.executorId}: ${observation.state}`);
+        }
+        lines.push("  local state is NOT readiness — only a live server observation produces executor_ready.");
+    }
     return lines.join("\n");
 }
 /** `1` when any section is fatal; `0` for ok/degraded-only reports. */