@bridge_gpt/mcp-server 0.2.44 → 0.2.45

package/build/merge-pull-request.js

@@ -75,6 +75,7 @@
  * privileged write subtly wrong.
  */
 import { DEFAULT_GATE_NAME, REQUIRED_CI_CHECKS_GREEN, REVIEW_STATE, normalizeCheckName, } from "./conductor/git-ci-types.js";
+import { MERGE_REVIEW_WAIVED_BY_DEGRADATION_REASON, VERDICTLESS_DISPOSITION_FAIL_OPEN, VERDICTLESS_DISPOSITION_PARK, } from "./conductor/git-ci-types.js";
 import { evaluateReviewCondition, normalizeReviewSnapshot, parseDoneGateConfig, } from "./conductor/done-gate.js";
 import { buildGateIdentity, makeMergeActionKey } from "./conductor/merge-identity.js";
 import { resolveLocalMergeMethod, runApprovedLocalMerge, } from "./conductor/local-merge.js";
@@ -135,6 +136,10 @@ function envelope(merged, outcome, reason, retryHint, evaluatedHeadSha, prNumber
         result.http_status = diagnostics.http_status;
     if (diagnostics.completion !== undefined)
         result.completion = diagnostics.completion;
+    // BAPI-915: appended LAST, after every pre-existing optional diagnostic, so the
+    // serialized key order of every envelope that carries no waiver is unchanged.
+    if (diagnostics.review_waiver !== undefined)
+        result.review_waiver = diagnostics.review_waiver;
     return result;
 }
 // ---------------------------------------------------------------------------
@@ -310,13 +315,94 @@ const SUPPORTED_REVIEW_SOURCES = new Set(["verdict_protocol", "native_review_dec
 const REVIEW_UNAVAILABLE_REASON = "review_unavailable";
 const REVIEW_SOURCE_UNSUPPORTED_REASON = "review_source_unsupported";
 const HEAD_SHA_DRIFT_REASON = "head_sha_drift";
+/** Wrap a refusal envelope as a pre-check decision. */
+function refuse(env) {
+    return { kind: "refused", envelope: env };
+}
+/**
+ * Append the waiver marker to an envelope produced AFTER a waived pre-check.
+ *
+ * Applied at the handler's return seam rather than threaded through
+ * `interpretMergeResponse` and `executeApprovedLocalMerge`, both of which build
+ * envelopes on many internal branches — one seam is auditable, a dozen threaded
+ * parameters are not. Every envelope downstream of a waiver carries it,
+ * including one that a LATER guard refused: the waiver really was applied, and
+ * hiding it on the refusal would leave the operator reading a `ci_not_green`
+ * with no idea the review had been waived to get there. This mirrors the server
+ * service, which folds the same marker into every post-review evidence bundle.
+ *
+ * Key order is preserved: the spread keeps the existing keys in place and the
+ * new one lands last, exactly where `envelope()` would have put it.
+ */
+function withReviewWaiver(env, waiver) {
+    if (waiver === undefined)
+        return env;
+    return { ...env, review_waiver: waiver };
+}
+/**
+ * True only when the review carries NO verdict AT ALL for the configured source.
+ *
+ * This is narrower than "the evaluation did not pass", and the gap between the two
+ * is a real hole. Under `verdict_protocol` the server resolves the sticky comment
+ * to `null` when no comment was ever posted, but to the string `"unknown"` for
+ * FOUR different ambiguities: two same-head comments that contradict each other
+ * (BAPI-733), a stale `Reviewed-SHA`, a malformed one, and an unresolvable head.
+ * `evaluateReviewCondition` flattens all five into
+ * `{passed: false, changesRequested: false}`, so waiving on that result alone
+ * would waive a CONTRADICTION — and a contradiction can contain a
+ * changes-requested comment that merely lost the tie-break. That is precisely the
+ * human-escalation case, and waiving it would contradict this feature's own claim
+ * that an objection is never waivable.
+ *
+ * So the waiver mirrors the Python seam field for field: `api/library/vcs/epic_observers.py`
+ * routes `sticky is None` to `PENDING` (waivable) and EVERY `"unknown"` to
+ * `UNKNOWN` (never waivable), and `conductor_merge_service` admits only `PENDING`.
+ * No new server field is needed to do this — `sticky_verdict` already carries the
+ * distinction on the wire, and `normalizeReviewSnapshot` already preserves it.
+ *
+ * The raw body is consulted too, because the normalizer maps an UNRECOGNIZED
+ * `sticky_verdict` to `null` as well. A value outside the server's own closed
+ * vocabulary is not evidence that no verdict exists, so it does not get waived.
+ *
+ * `native_review_decision` has no ambiguity channel of its own — GitHub returns a
+ * single authoritative decision, and a non-approving, non-rejecting one genuinely
+ * means no decision was given — so it needs no extra guard.
+ */
+function verdictIsGenuinelyAbsent(condition, snapshot, rawBody) {
+    if (condition.source !== "verdict_protocol")
+        return true;
+    // `"unknown"` (and anything else non-null) is an unresolved verdict, not a
+    // missing one.
+    if (snapshot.sticky_verdict !== null)
+        return false;
+    const detail = isPlainObject(rawBody) && isPlainObject(rawBody.detail) ? rawBody.detail : null;
+    if (detail === null)
+        return false;
+    const raw = detail.sticky_verdict;
+    return raw === null || raw === undefined;
+}
+/**
+ * The condition's disposition, with the effective default applied.
+ *
+ * ABSENT means `park`, and the default is resolved HERE rather than materialized
+ * onto the parsed condition, so a config that never carried the field keeps its
+ * byte-identical `config_hash` and therefore its merge action key.
+ */
+function effectiveDisposition(condition) {
+    return condition.verdictless_disposition ?? VERDICTLESS_DISPOSITION_PARK;
+}
 /**
  * Evaluate the configured `review_state` condition before the merge is sent.
  *
- * Returns a refusal envelope, or `null` meaning "nothing objected — continue".
- * Every failure direction is contained here and every one of them is a refusal:
- * a review this side cannot read, cannot parse, or cannot evaluate is not a
- * review that approved anything.
+ * Returns a {@link ReviewPrecheckDecision}: a refusal, an ordinary continuation,
+ * or a continuation carrying the bounded waiver diagnostic. Every failure
+ * direction is contained here and every one of them is a refusal: a review this
+ * side cannot read, cannot parse, or cannot evaluate is not a review that
+ * approved anything — and BAPI-915 changed none of that. The single direction it
+ * added is a review that WAS read, at this head, under an explicitly configured
+ * `fail_open`, carrying no objection and NO VERDICT AT ALL — not merely a verdict
+ * this side could not resolve. See {@link verdictIsGenuinelyAbsent} for why that
+ * distinction is load-bearing rather than pedantic.
  *
  * `min_approvals` and `combination` are refused OUTRIGHT rather than approximated
  * with a weaker rule. The server refuses them too, for the same reason: silently
@@ -325,9 +411,9 @@ const HEAD_SHA_DRIFT_REASON = "head_sha_drift";
  */
 async function precheckReviewCondition(deps, condition, prNumber, expectedHeadSha) {
     if (!SUPPORTED_REVIEW_SOURCES.has(condition.source)) {
-        return envelope(false, "review_source_unsupported", REVIEW_SOURCE_UNSUPPORTED_REASON, "needs_human", expectedHeadSha, prNumber);
+        return refuse(envelope(false, "review_source_unsupported", REVIEW_SOURCE_UNSUPPORTED_REASON, "needs_human", expectedHeadSha, prNumber));
     }
-    const unavailable = () => envelope(false, "review_unavailable", REVIEW_UNAVAILABLE_REASON, "needs_human", expectedHeadSha, prNumber);
+    const unavailable = () => refuse(envelope(false, "review_unavailable", REVIEW_UNAVAILABLE_REASON, "needs_human", expectedHeadSha, prNumber));
     // URL and header construction sit OUTSIDE the try, matching the required-check
     // resolver: a failure there is a broken dependency, not an unreadable review,
     // and it belongs to the handler's outer containment boundary. The repository
@@ -350,7 +436,12 @@ async function precheckReviewCondition(deps, condition, prNumber, expectedHeadSh
     // `normalizeReviewSnapshot` returns null for `available: false` and for any
     // body it cannot read as a review snapshot — the same answer, because both
     // mean the same thing here.
-    const snapshot = normalizeReviewSnapshot(await readJson(reviewResp));
+    //
+    // The raw body is kept as well: `verdictIsGenuinelyAbsent` below has to tell an
+    // ABSENT `sticky_verdict` from one the normalizer could not recognize, and the
+    // normalized snapshot maps both to `null`.
+    const reviewBody = await readJson(reviewResp);
+    const snapshot = normalizeReviewSnapshot(reviewBody);
     if (snapshot === null)
         return unavailable();
     // Head equality is checked BEFORE the evaluator, and takes precedence over an
@@ -362,16 +453,42 @@ async function precheckReviewCondition(deps, condition, prNumber, expectedHeadSh
         if (typeof snapshot.head_sha === "string" && snapshot.head_sha.length > 0) {
             diagnostics.actual_head_sha = snapshot.head_sha;
         }
-        return envelope(false, "refused", HEAD_SHA_DRIFT_REASON, "needs_human", expectedHeadSha, prNumber, diagnostics);
+        return refuse(envelope(false, "refused", HEAD_SHA_DRIFT_REASON, "needs_human", expectedHeadSha, prNumber, diagnostics));
     }
     const evaluation = evaluateReviewCondition(condition, snapshot);
     if (!evaluation.passed) {
+        // BAPI-915 — the ONE waivable direction, and every guard that narrows it has
+        // already run above: the source is supported, the response was readable, the
+        // envelope was not `available: false`, and the snapshot is bound to THIS
+        // head. What remains is a review that was read and carries NO VERDICT AT
+        // ALL — the shape `claude-review` leaves behind when it dies during
+        // synthesis, having posted nothing.
+        //
+        // `changesRequested` is excluded explicitly: a human objected to this exact
+        // head, and no configuration waives an objection. Head drift is excluded by
+        // construction, because the head check above returns before the evaluator
+        // ever runs — that ordering is load-bearing and must not be folded in.
+        //
+        // `verdictIsGenuinelyAbsent` is the third guard and it is NOT redundant with
+        // the evaluator: the evaluator reports the same
+        // `{passed: false, changesRequested: false}` for "nobody posted anything" and
+        // for "two same-head comments contradict each other", and only the first may
+        // ever be waived.
+        //
+        // The disposition is compared for EXACT equality with `fail_open`. An absent
+        // field and an explicit `park` both fall through to the byte-identical
+        // pre-BAPI-915 refusal below.
+        if (effectiveDisposition(condition) === VERDICTLESS_DISPOSITION_FAIL_OPEN &&
+            evaluation.changesRequested === false &&
+            verdictIsGenuinelyAbsent(condition, snapshot, reviewBody)) {
+            return { kind: "waived", waiver: MERGE_REVIEW_WAIVED_BY_DEGRADATION_REASON };
+        }
         // A wait, not a park: a verdict for THIS head may still be posted. The
         // evaluator's own reason is forwarded verbatim rather than flattened, so the
         // caller can tell "no verdict yet" from "changes requested".
-        return envelope(false, "review_not_approved", evaluation.reason, "retry_later", expectedHeadSha, prNumber);
+        return refuse(envelope(false, "review_not_approved", evaluation.reason, "retry_later", expectedHeadSha, prNumber));
     }
-    return null;
+    return { kind: "proceed" };
 }
 // ---------------------------------------------------------------------------
 // Server-response interpretation
@@ -691,10 +808,18 @@ export async function mergePullRequestHandler(deps, args) {
         // carries a `review_state` condition, and it returns BEFORE the pre-POST
         // section below — so a refusal here constructs no merge URL, no merge
         // headers, no action key, and sends no merge request.
+        //
+        // BAPI-915: the decision is now three-valued. A refusal still returns before
+        // anything below runs; a waiver continues into the identical merge path and
+        // is carried through to the reported envelope so the operator can see that
+        // the merge advanced on CI evidence alone.
+        let reviewWaiver;
         if (resolution.reviewCondition !== null) {
-            const refusal = await precheckReviewCondition(deps, resolution.reviewCondition, prNumber, expectedHeadSha);
-            if (refusal !== null)
-                return text(refusal);
+            const decision = await precheckReviewCondition(deps, resolution.reviewCondition, prNumber, expectedHeadSha);
+            if (decision.kind === "refused")
+                return text(decision.envelope);
+            if (decision.kind === "waived")
+                reviewWaiver = decision.waiver;
         }
         // --- pre-POST section ---------------------------------------------------
         const gateIdentity = buildGateIdentity(DEFAULT_GATE_NAME, resolution.configHash);
@@ -729,6 +854,7 @@ export async function mergePullRequestHandler(deps, args) {
         catch {
             return text(envelope(false, "unknown", "merge_request_not_observed", "retry_later", expectedHeadSha, prNumber, {
                 hint: UNKNOWN_HINT,
+                review_waiver: reviewWaiver,
             }));
         }
         if (!mergeResp.ok) {
@@ -736,10 +862,11 @@ export async function mergePullRequestHandler(deps, args) {
             // status only — raw upstream error text is never forwarded to the agent.
             await deps.handleResponse(mergeResp).catch(() => "");
             if (mergeResp.status === 409) {
-                return text(envelope(false, "action_key_mismatch", "action_key_mismatch", "needs_human", expectedHeadSha, prNumber));
+                return text(envelope(false, "action_key_mismatch", "action_key_mismatch", "needs_human", expectedHeadSha, prNumber, { review_waiver: reviewWaiver }));
             }
             return text(envelope(false, "error", "merge_request_failed", "needs_human", expectedHeadSha, prNumber, {
                 http_status: mergeResp.status,
+                review_waiver: reviewWaiver,
             }));
         }
         const mergeJson = await readJson(mergeResp);
@@ -749,9 +876,9 @@ export async function mergePullRequestHandler(deps, args) {
         if (executionMode === "local" &&
             isPlainObject(mergeJson) &&
             mergeJson.status === LOCAL_APPROVAL_STATUS) {
-            return text(await executeApprovedLocalMerge(deps, mergeJson, prNumber, expectedHeadSha, actionKey));
+            return text(withReviewWaiver(await executeApprovedLocalMerge(deps, mergeJson, prNumber, expectedHeadSha, actionKey), reviewWaiver));
         }
-        return text(interpretMergeResponse(mergeJson, expectedHeadSha, prNumber));
+        return text(withReviewWaiver(interpretMergeResponse(mergeJson, expectedHeadSha, prNumber), reviewWaiver));
     }
     catch {
         // Containment: never throw through the MCP transport, and never serialize the