@bridge_gpt/mcp-server 0.2.39 → 0.2.42

package/build/conductor/local-merge.js

@@ -485,38 +485,42 @@ export function makeLocalMergeExecutor(options = {}, deps = {}) {
         }
         // 3. Revalidate required CI green for the EXACT expected head, waiting briefly
         //    for transient post-remediation CI to turn green before failing ci_not_green.
-        const ciWait = await waitForRequiredChecksGreen(pollCi, access, expectedSha, requiredChecks, ciWaitTimeoutMs, ciWaitPollIntervalMs, sleep, now, signal);
-        if (!ciWait.ok) {
-            // Any `ci_poll_*` reason (the legacy `ci_poll_failed` plus the distinct
-            // BAPI-577 kinds) is an AMBIGUOUS infrastructure read failure — a merge that
-            // GitHub already accepted could be masked by a flaky poll. Re-verify the
-            // merged state before reporting. ci_not_green and merge_aborted are
-            // deterministic (CI is red / the job was aborted); they never verify and
-            // never proceed to a provider merge.
-            if (isAmbiguousCiPollFailureReason(ciWait.reason)) {
+        //    Skipped under `skipCiWait` (BAPI-832), where the server's approval tail
+        //    revalidated these same checks for this same head moments ago.
+        if (!options.skipCiWait) {
+            const ciWait = await waitForRequiredChecksGreen(pollCi, access, expectedSha, requiredChecks, ciWaitTimeoutMs, ciWaitPollIntervalMs, sleep, now, signal);
+            if (!ciWait.ok) {
+                // Any `ci_poll_*` reason (the legacy `ci_poll_failed` plus the distinct
+                // BAPI-577 kinds) is an AMBIGUOUS infrastructure read failure — a merge that
+                // GitHub already accepted could be masked by a flaky poll. Re-verify the
+                // merged state before reporting. ci_not_green and merge_aborted are
+                // deterministic (CI is red / the job was aborted); they never verify and
+                // never proceed to a provider merge.
+                if (isAmbiguousCiPollFailureReason(ciWait.reason)) {
+                    const verified = await verifyMergedStateAfterAmbiguousFailure();
+                    if (verified)
+                        return verified;
+                }
+                return fail(ciWait.reason, ciWait.pollFailure);
+            }
+            // 3b. Re-read PR head/state after the CI wait — the head can drift, the PR can
+            //     close, or the merge can already have landed while we waited for CI.
+            const secondRead = await readPrMergeState(run, ghEnv, pr);
+            if (!secondRead.ok) {
                 const verified = await verifyMergedStateAfterAmbiguousFailure();
                 if (verified)
                     return verified;
+                return fail(secondRead.reason);
+            }
+            if (isMergedAtExpectedHead(secondRead.state, secondRead.headOid, expectedSha)) {
+                return buildAlreadyMergedResponse(request, baseDetails, secondRead.mergeCommitOid);
+            }
+            if (typeof secondRead.headOid !== "string" || secondRead.headOid.toLowerCase() !== expectedSha.toLowerCase()) {
+                return fail("head_drift");
+            }
+            if (typeof secondRead.state === "string" && secondRead.state.toUpperCase() !== "OPEN") {
+                return fail("pr_not_open");
             }
-            return fail(ciWait.reason, ciWait.pollFailure);
-        }
-        // 3b. Re-read PR head/state after the CI wait — the head can drift, the PR can
-        //     close, or the merge can already have landed while we waited for CI.
-        const secondRead = await readPrMergeState(run, ghEnv, pr);
-        if (!secondRead.ok) {
-            const verified = await verifyMergedStateAfterAmbiguousFailure();
-            if (verified)
-                return verified;
-            return fail(secondRead.reason);
-        }
-        if (isMergedAtExpectedHead(secondRead.state, secondRead.headOid, expectedSha)) {
-            return buildAlreadyMergedResponse(request, baseDetails, secondRead.mergeCommitOid);
-        }
-        if (typeof secondRead.headOid !== "string" || secondRead.headOid.toLowerCase() !== expectedSha.toLowerCase()) {
-            return fail("head_drift");
-        }
-        if (typeof secondRead.state === "string" && secondRead.state.toUpperCase() !== "OPEN") {
-            return fail("pr_not_open");
         }
         // 4. Provider merge. Final abort guard: if the overall timeout / ownership
         //    abandonment fired during the CI wait or the post-CI re-read, do NOT fire
@@ -619,3 +623,101 @@ function buildConflictResponse(request, baseDetails, expectedSha, mergeability)
         { type: "merge.conflict", status: "failed", reason, details: conflictDetails },
     ]);
 }
+/**
+ * Probe whether this host can merge with `gh` at all, BEFORE any merge is
+ * attempted.
+ *
+ * Without this the two operator-fixable failures are invisible: a missing `gh`
+ * and a logged-out `gh` both make `gh pr view` exit non-zero, which this module
+ * reports as `gh_pr_view_failed` — a reason that names no fix. Splitting them
+ * out is the difference between "run `gh auth login`" and "something went wrong
+ * reading the pull request".
+ *
+ * Deliberately async and built on the same `run` seam as the merge itself. The
+ * read-only equivalent in `conductor/doctor.ts` (`inspectLocalMerge`) probes
+ * synchronously, which is fine for a diagnostic command but would block the MCP
+ * server's event loop for up to its full timeout in the middle of a tool call.
+ * (This module's static contract forbids synchronous process execution outright,
+ * so the token itself cannot appear here — not even in a comment.)
+ */
+export async function preflightLocalGh(run, ghEnv) {
+    let version;
+    try {
+        version = await run("gh", ["--version"], ghEnv);
+    }
+    catch {
+        return { ok: false, reason: "local_gh_unavailable" };
+    }
+    if (version.status !== 0)
+        return { ok: false, reason: "local_gh_unavailable" };
+    let auth;
+    try {
+        auth = await run("gh", ["auth", "status"], ghEnv);
+    }
+    catch {
+        return { ok: false, reason: "local_gh_unauthenticated" };
+    }
+    if (auth.status !== 0)
+        return { ok: false, reason: "local_gh_unauthenticated" };
+    return { ok: true };
+}
+/**
+ * Execute a merge the server has ALREADY approved, using the operator's `gh`.
+ *
+ * This is the local half of BAPI-832's split: the server ran the whole
+ * deterministic decision tail (action key, lease, head-SHA drift guard, review
+ * gate, workflow-file guard, CI revalidation) and returned
+ * `approved_for_local_execution` because its GitHub App installation is
+ * `contents: read` and cannot perform the write. Only the write happens here.
+ *
+ * It reuses {@link makeLocalMergeExecutor} rather than reimplementing the merge,
+ * so the head-drift guard, the `--match-head-commit` binding, and the entire
+ * ambiguity-resolution ladder are the same proven code v2's `merge` job runs.
+ * `skipCiWait` is set because the server revalidated CI moments ago.
+ *
+ * This function grants no authority of its own. It must only ever be called with
+ * a request built from a live approval for that exact PR and head SHA.
+ */
+export async function runApprovedLocalMerge(request, options = {}, deps = {}) {
+    const ghEnv = {
+        ...deps.env,
+        GH_PROMPT_DISABLED: "1",
+        GH_NO_UPDATE_NOTIFIER: "1",
+    };
+    const rawRun = deps.runCommand ?? defaultRunCommand;
+    const run = (cmd, args, env) => Promise.resolve(rawRun(cmd, args, env, deps.signal));
+    const preflight = await preflightLocalGh(run, ghEnv);
+    if (!preflight.ok) {
+        return buildResponse(request, "failed", preflight.reason, false, [
+            {
+                type: "merge.failed",
+                status: "failed",
+                reason: preflight.reason,
+                details: {
+                    action_key: request.action_key,
+                    repo: request.repo_name,
+                    pr_number: request.pr_number,
+                    expected_head_sha: request.expected_head_sha,
+                    executor: "local",
+                },
+            },
+        ]);
+    }
+    const executor = makeLocalMergeExecutor({ method: options.method, skipCiWait: true }, deps);
+    // `access` is only ever used by the CI poll, which `skipCiWait` bypasses. The
+    // throwing stub makes that structural, not a comment: if a future edit ever
+    // reaches the poll from this path, it fails loudly in tests instead of
+    // silently polling with an unusable access record.
+    const unusedAccess = {
+        get baseUrl() {
+            throw new Error("runApprovedLocalMerge must not poll CI");
+        },
+        get apiKey() {
+            throw new Error("runApprovedLocalMerge must not poll CI");
+        },
+        get repoName() {
+            throw new Error("runApprovedLocalMerge must not poll CI");
+        },
+    };
+    return executor(unusedAccess, request);
+}

package/build/conductor/tools.js

@@ -10,7 +10,7 @@
  */
 import { z } from "zod";
 import { SEMANTIC_EVENT_TYPES } from "./taxonomy.js";
-import { ConductorValidationError, toConductorErrorEnvelope } from "./errors.js";
+import { ConductorValidationError, ConductorWorkerContextRequiredError, toConductorErrorEnvelope, } from "./errors.js";
 import { emitConductorEvent, pollConductorEvents, waitForConductorEvent, getSupervisorSnapshot, sendWorkerMessage, } from "./store.js";
 import { normalizePrNumber, normalizeSha } from "./git-ci-types.js";
 import { waitForDoneGate, resolveDispatchRunIdForBinding } from "./pr-ci-producer.js";
@@ -266,6 +266,15 @@ function registerWaitForDoneGateTool(registerTool) {
             // deterministic id are derived purely and the id is forwarded to the CLI,
             // so dedup happens server-side on the events.id UNIQUE constraint — the
             // worker path performs NO in-process ledger read or write.
+            //
+            // BAPI-772: this emit leg inherits the runtime contract from
+            // `resolveWorkerLedgerCliRuntime`, which is reached only when an emit is
+            // actually attempted — read-only gate work (binding resolution, CI
+            // polling) is never preemptively rejected. In a plain session with no
+            // worker env at all, that resolver raises WORKER_CONTEXT_REQUIRED, so the
+            // gate explains itself instead of surfacing an opaque 503; a partially
+            // configured or corrupted worker runtime still fails loud with
+            // LEDGER_SUBPROCESS_RUNTIME_UNAVAILABLE. Nothing falls back in-process.
             emitIfNew: (input, dimensions) => emitConductorEventIfNewViaCli(input, dimensions),
         });
         return jsonResult({
@@ -351,8 +360,28 @@ function registerCheckMessagesTool(registerTool) {
             limit: z.number().int().positive().max(100).optional().describe("Max messages to deliver/ack (default 10, max 100)."),
         },
     }, withConductorToolErrorHandling(async (args) => {
-        const runId = args.run_id ?? process.env.BAPI_CONDUCTOR_RUN_ID ?? "";
-        const workerId = args.worker_id ?? process.env.BAPI_CONDUCTOR_WORKER_ID ?? "";
+        const runIdArg = args.run_id;
+        const workerIdArg = args.worker_id;
+        const runIdEnv = process.env.BAPI_CONDUCTOR_RUN_ID;
+        const workerIdEnv = process.env.BAPI_CONDUCTOR_WORKER_ID;
+        // BAPI-772: a call with NEITHER argument supplied and NEITHER env var set is
+        // a plain MCP session — nothing is broken, the tool is simply worker-scoped.
+        // Return the typed guidance envelope instead of an opaque validation error.
+        // Any other shape (an explicit blank id, one id present and the other not, a
+        // partially-set worker env) is still malformed identity and keeps the
+        // existing fail-loud VALIDATION_ERROR: a broken worker context must never be
+        // relabeled as an ordinary session.
+        if (runIdArg === undefined &&
+            workerIdArg === undefined &&
+            runIdEnv === undefined &&
+            workerIdEnv === undefined) {
+            throw new ConductorWorkerContextRequiredError([
+                "BAPI_CONDUCTOR_RUN_ID",
+                "BAPI_CONDUCTOR_WORKER_ID",
+            ]);
+        }
+        const runId = runIdArg ?? runIdEnv ?? "";
+        const workerId = workerIdArg ?? workerIdEnv ?? "";
         if (runId.trim().length === 0 || workerId.trim().length === 0) {
             throw new ConductorValidationError("Conductor worker identity is unavailable: provide run_id + worker_id, or set BAPI_CONDUCTOR_RUN_ID and BAPI_CONDUCTOR_WORKER_ID.");
         }

package/build/conductor/worker-ledger-cli.js

@@ -16,6 +16,12 @@
  * to the worker's own `process.execPath`. Falling back would re-introduce the
  * native load into the worker Node — the exact failure mode this slice removes.
  *
+ * BAPI-772 adds ONE distinction on top of that contract, and it changes no
+ * fallback behavior: when BOTH worker variables are undefined there is no worker
+ * at all (a plain MCP session), which raises the typed
+ * {@link ConductorWorkerContextRequiredError} guidance envelope instead. Every
+ * partially-configured or invalid runtime keeps failing loud exactly as before.
+ *
  * Security: argv is always a fixed LIST (`execFile`, never `shell: true`, never a
  * command string). Event JSON payloads cross via STDIN (`--data-json-stdin`), so
  * raw payloads/secrets never enter the process argument list. Every failure is
@@ -24,7 +30,7 @@
  */
 import * as nodeChildProcess from "node:child_process";
 import { isAbsolute as pathIsAbsolute } from "node:path";
-import { ConductorLedgerSubprocessRuntimeError, } from "./errors.js";
+import { ConductorLedgerSubprocessRuntimeError, ConductorWorkerContextRequiredError, } from "./errors.js";
 import { makeProducerDedupeKey, makeStableProducerEventId, } from "./producer-ledger.js";
 /** The env key that carries the captured conductor Node executable path. */
 export const CONDUCTOR_NODE_PATH_ENV = "CONDUCTOR_NODE_PATH";
@@ -60,10 +66,30 @@ function nonEmpty(value) {
  * non-empty. On any failure this throws a typed
  * {@link ConductorLedgerSubprocessRuntimeError}; it NEVER falls back to
  * `process.execPath`.
+ *
+ * BAPI-772 splits ABSENCE from BREAKAGE, and only at the top:
+ *
+ *   - BOTH variables undefined → {@link ConductorWorkerContextRequiredError}.
+ *     There is no worker runtime because there is no worker: this is a plain MCP
+ *     session, and the caller deserves guidance, not a 503.
+ *   - anything else — one variable present and the other not, an empty or
+ *     whitespace-only value, a relative path, an unusable CLI file — keeps the
+ *     existing fail-loud `LEDGER_SUBPROCESS_RUNTIME_UNAVAILABLE` mapping. A
+ *     half-configured or corrupted worker runtime is a real fault and must never
+ *     be relabeled as an ordinary plain session.
  */
 export function resolveWorkerLedgerCliRuntime(deps = {}) {
     const env = deps.env ?? process.env;
     const isAbsolute = deps.isAbsolute ?? pathIsAbsolute;
+    // `undefined` specifically — an env var SET to "" is present-but-invalid and
+    // falls through to the fail-loud path below.
+    if (env[CONDUCTOR_NODE_PATH_ENV] === undefined &&
+        env[BAPI_CONDUCTOR_CLI_FILE_ENV] === undefined) {
+        throw new ConductorWorkerContextRequiredError([
+            CONDUCTOR_NODE_PATH_ENV,
+            BAPI_CONDUCTOR_CLI_FILE_ENV,
+        ]);
+    }
     const nodePathRaw = env[CONDUCTOR_NODE_PATH_ENV];
     if (!nonEmpty(nodePathRaw)) {
         throw new ConductorLedgerSubprocessRuntimeError("missing", CONDUCTOR_NODE_PATH_ENV);