@bridge_gpt/mcp-server 0.2.49 → 0.2.51

package/build/epic-integration-pr.js

@@ -0,0 +1,280 @@
+/**
+ * Shared, non-throwing helper that ensures a draft epic-integration PR exists
+ * (BAPI-951).
+ *
+ * Local `gh` is used deliberately here: the Bridge/server pull-request seam has
+ * no `draft` parameter and cannot distinguish GitHub's "no commits between
+ * branches" 422 from a credential or provider failure — both of which this
+ * helper must classify without throwing.
+ *
+ * A draft PR still receives the `conductor-ci / gate` required check (BAPI-949's
+ * trigger has no draft exclusion), while `claude-review.yml` excludes drafts
+ * until the PR is marked ready. So opening the integration PR as a draft earns
+ * the epic branch its required CI immediately, without paying for a paid review
+ * nobody can act on until a human decides the epic is ready.
+ */
+import { execFile as nodeExecFile } from "node:child_process";
+/** Bounded read timeout — matches the existing 5s GitHub probe limit (pr-discovery.ts). */
+export const EPIC_INTEGRATION_PR_READ_TIMEOUT_MS = 5_000;
+/** Separate, larger bounded timeout for the two write operations (`pr create`, `pr ready`). */
+export const EPIC_INTEGRATION_PR_WRITE_TIMEOUT_MS = 20_000;
+/** Bounded result count for the existence probe. */
+const LIST_LIMIT = 20;
+const PR_LIST_JSON_FIELDS = "number,headRefName,baseRefName,isDraft";
+/** The production call sites this helper is invoked from. */
+export const EPIC_INTEGRATION_PR_COMMANDS = [
+    "setup-epic",
+    "conduct-epic init",
+    "conduct-epic catch-up",
+    "conduct-epic finish",
+    "executor merge",
+];
+/** Only the sanctioned safe fields. Never raw command output. */
+export function formatEpicIntegrationPullRequestOutcome(outcome) {
+    if (outcome.kind === "already_open" || outcome.kind === "created") {
+        return {
+            kind: outcome.kind,
+            reason: outcome.reason,
+            pr_number: outcome.prNumber,
+            readiness: outcome.readiness,
+        };
+    }
+    return { kind: outcome.kind, reason: outcome.reason };
+}
+/** A concise, epic-specific PR title. Does not depend on `gh`. */
+export function buildEpicIntegrationPullRequestTitle(epicKey) {
+    return `${epicKey}: epic integration branch`;
+}
+/** A non-empty, epic-specific PR body. Does not depend on `gh`. */
+export function buildEpicIntegrationPullRequestBody(epicKey, command) {
+    return [
+        `\`${command}\` opened this pull request automatically.`,
+        "",
+        `It exists so the \`conductor-ci / gate\` required check runs for the ${epicKey} ` +
+            "epic integration branch (BAPI-949). Draft status postpones the paid Claude " +
+            "review until a human marks this pull request ready for review.",
+        "",
+        "Only a human merges an epic integration branch — the conductor never merges it.",
+    ].join("\n");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Bounded diagnostics to distinguish "no local gh", "not authenticated", and "inconclusive". */
+async function classifyGhUnavailable(gh, cwd) {
+    let version;
+    try {
+        version = await gh(["--version"], { cwd, timeoutMs: EPIC_INTEGRATION_PR_READ_TIMEOUT_MS });
+    }
+    catch {
+        return "gh_unavailable";
+    }
+    if (version.exitCode !== 0)
+        return "gh_unavailable";
+    let auth;
+    try {
+        auth = await gh(["auth", "status"], { cwd, timeoutMs: EPIC_INTEGRATION_PR_READ_TIMEOUT_MS });
+    }
+    catch {
+        return "probe_inconclusive";
+    }
+    if (auth.exitCode !== 0)
+        return "gh_unauthenticated";
+    return "probe_inconclusive";
+}
+/**
+ * Existence probe: `gh pr list` constrained by BOTH head and base. Only a
+ * successful, valid, empty JSON array is confirmed absence — anything else
+ * (non-zero exit, unparseable output, a non-array shape, an item with an
+ * invalid number, or a record whose head/base do not match) is `unavailable`,
+ * never treated as absence.
+ */
+async function probeMatchingOpenPr(gh, epicBranch, baseBranch, cwd) {
+    const args = [
+        "pr",
+        "list",
+        "--state",
+        "open",
+        "--head",
+        epicBranch,
+        "--base",
+        baseBranch,
+        "--json",
+        PR_LIST_JSON_FIELDS,
+        "--limit",
+        String(LIST_LIMIT),
+    ];
+    let result;
+    try {
+        result = await gh(args, { cwd, timeoutMs: EPIC_INTEGRATION_PR_READ_TIMEOUT_MS });
+    }
+    catch {
+        return { kind: "unavailable", reason: await classifyGhUnavailable(gh, cwd) };
+    }
+    if (result.exitCode !== 0) {
+        return { kind: "unavailable", reason: await classifyGhUnavailable(gh, cwd) };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(result.stdout);
+    }
+    catch {
+        return { kind: "unavailable", reason: "probe_malformed" };
+    }
+    if (!Array.isArray(parsed)) {
+        return { kind: "unavailable", reason: "probe_malformed" };
+    }
+    if (parsed.length === 0) {
+        return { kind: "absent" };
+    }
+    for (const item of parsed) {
+        if (!isRecord(item))
+            continue;
+        const number = item.number;
+        const head = item.headRefName;
+        const base = item.baseRefName;
+        const isDraft = item.isDraft;
+        if (typeof number === "number" &&
+            Number.isInteger(number) &&
+            number > 0 &&
+            head === epicBranch &&
+            base === baseBranch &&
+            typeof isDraft === "boolean") {
+            return { kind: "found", number, isDraft };
+        }
+    }
+    // Records exist but none matches both head and base exactly, or the shape is
+    // unexpected — never treated as absence.
+    return { kind: "unavailable", reason: "probe_malformed" };
+}
+const NO_COMMITS_BETWEEN_PATTERN = /no commits between/i;
+/** Strict positive numeric suffix of a normal `https://…/pull/<n>` URL, else `null`. */
+function extractPrNumberFromCreateOutput(stdout) {
+    const match = stdout.trim().match(/\/pull\/(\d+)\s*$/);
+    if (!match)
+        return null;
+    const n = Number(match[1]);
+    return Number.isInteger(n) && n > 0 ? n : null;
+}
+async function createDraftPr(gh, epicKey, epicBranch, baseBranch, command, cwd) {
+    const title = buildEpicIntegrationPullRequestTitle(epicKey);
+    const body = buildEpicIntegrationPullRequestBody(epicKey, command);
+    const args = [
+        "pr",
+        "create",
+        "--draft",
+        "--base",
+        baseBranch,
+        "--head",
+        epicBranch,
+        "--title",
+        title,
+        "--body",
+        body,
+    ];
+    let result;
+    try {
+        result = await gh(args, { cwd, timeoutMs: EPIC_INTEGRATION_PR_WRITE_TIMEOUT_MS });
+    }
+    catch {
+        return { kind: "create_failed" };
+    }
+    if (result.exitCode === 0) {
+        return { kind: "created", numberHint: extractPrNumberFromCreateOutput(result.stdout) };
+    }
+    const combined = `${result.stdout}\n${result.stderr}`;
+    if (NO_COMMITS_BETWEEN_PATTERN.test(combined)) {
+        return { kind: "no_commits" };
+    }
+    return { kind: "create_failed" };
+}
+async function maybeMakeReady(gh, prNumber, isDraft, requestReady, cwd) {
+    if (!requestReady)
+        return "not_requested";
+    if (prNumber === null)
+        return "ready_failed";
+    if (!isDraft)
+        return "already_ready";
+    try {
+        const result = await gh(["pr", "ready", String(prNumber)], {
+            cwd,
+            timeoutMs: EPIC_INTEGRATION_PR_WRITE_TIMEOUT_MS,
+        });
+        return result.exitCode === 0 ? "made_ready" : "ready_failed";
+    }
+    catch {
+        return "ready_failed";
+    }
+}
+async function ensureEpicIntegrationPullRequestInner(options) {
+    const { epicKey, epicBranch, baseBranch, command, gh, cwd, requestReady } = options;
+    const probe = await probeMatchingOpenPr(gh, epicBranch, baseBranch, cwd);
+    if (probe.kind === "unavailable") {
+        return { kind: "unavailable", reason: probe.reason };
+    }
+    if (probe.kind === "found") {
+        const readiness = await maybeMakeReady(gh, probe.number, probe.isDraft, requestReady, cwd);
+        return { kind: "already_open", reason: "already_open", prNumber: probe.number, readiness };
+    }
+    // Confirmed absent: create.
+    const created = await createDraftPr(gh, epicKey, epicBranch, baseBranch, command, cwd);
+    if (created.kind === "no_commits") {
+        return { kind: "deferred", reason: "no_commits_between_branches" };
+    }
+    if (created.kind === "created") {
+        // Resolve the number through a fresh matching probe first; fall back to the
+        // strict URL-derived hint only when the probe cannot confirm it.
+        const reprobe = await probeMatchingOpenPr(gh, epicBranch, baseBranch, cwd);
+        const prNumber = reprobe.kind === "found" ? reprobe.number : created.numberHint;
+        const isDraft = reprobe.kind === "found" ? reprobe.isDraft : true;
+        const readiness = await maybeMakeReady(gh, prNumber, isDraft, requestReady, cwd);
+        return { kind: "created", reason: "created", prNumber, readiness };
+    }
+    // Generic create failure: resolve a possible concurrent creator once, never more.
+    const race = await probeMatchingOpenPr(gh, epicBranch, baseBranch, cwd);
+    if (race.kind === "found") {
+        const readiness = await maybeMakeReady(gh, race.number, race.isDraft, requestReady, cwd);
+        return { kind: "already_open", reason: "already_open", prNumber: race.number, readiness };
+    }
+    return { kind: "unavailable", reason: "create_unavailable" };
+}
+/**
+ * Ensure a matching draft epic-integration pull request exists. Idempotent and
+ * never throws or rejects — every internal failure, including an injected
+ * runner throwing, resolves to `{ kind: "unavailable", ... }`.
+ */
+export async function ensureEpicIntegrationPullRequest(options) {
+    try {
+        return await ensureEpicIntegrationPullRequestInner(options);
+    }
+    catch {
+        return { kind: "unavailable", reason: "probe_inconclusive" };
+    }
+}
+/**
+ * Build the production `gh` runner. Uses `execFile` (never a shell, never
+ * interpolated argv), ignores stdin, captures stdout/stderr, and bounds both
+ * the timeout and the output buffer. Every process-level failure (missing
+ * binary, timeout, spawn error) resolves a non-zero/timed-out result rather
+ * than rejecting.
+ */
+export function createProductionEpicIntegrationGhRunner(execFileImpl = nodeExecFile) {
+    return (args, options) => new Promise((resolve) => {
+        execFileImpl("gh", args, {
+            cwd: options.cwd,
+            timeout: options.timeoutMs,
+            maxBuffer: 4 * 1024 * 1024,
+            encoding: "utf-8",
+            shell: false,
+            stdio: ["ignore", "pipe", "pipe"],
+        }, (error, stdout, stderr) => {
+            if (error) {
+                const timedOut = error.killed === true;
+                const code = typeof error.code === "number" ? error.code : null;
+                resolve({ exitCode: code, stdout: stdout ?? "", stderr: stderr ?? "", timedOut });
+                return;
+            }
+            resolve({ exitCode: 0, stdout: stdout ?? "", stderr: stderr ?? "", timedOut: false });
+        });
+    });
+}

package/build/executor/job-runner.js

@@ -392,7 +392,7 @@ async function checkAdapterMcpAdvisoryForPreparedWorktree(worktreePath, deps, ad
  * `controls.signal` (overall-timeout abort) is threaded into local merge deps
  * without changing the local `gh` credential model.
  */
-export async function defaultRunMergeForClaimed(job, deps, _options, controls) {
+export async function defaultRunMergeForClaimed(job, deps, options, controls) {
     const accessResult = await buildConductorMergeAccessForExecutorJob({
         env: deps.env,
         cwd: deps.cwd,
@@ -419,6 +419,12 @@ export async function defaultRunMergeForClaimed(job, deps, _options, controls) {
         // Thread the overall-timeout abort signal into local merge deps WITHOUT
         // changing the local `gh` credential model (the signal is not a credential).
         localMergeDeps: buildDefaultMergeLocalDeps(deps, controls?.signal),
+        // BAPI-951: the executor's own configured base — resolveExecutorJobBaseBranch
+        // (called inside runExecutorMergeJob) resolves the CHILD PR's base from the
+        // job's persisted run base, falling back to this value for a legacy job.
+        repositoryBaseBranch: options.baseBranch,
+        epicIntegrationAdvisoryLog: deps.errorLog,
+        cwd: deps.cwd,
     });
 }
 /** An in-memory owned process for the no-op `smoke` acceptance job. */

package/build/executor/merge-job.js

@@ -23,7 +23,11 @@
  */
 import { makeLocalMergeExecutor, resolveLocalMergeMethod, } from "../conductor/local-merge.js";
 import { resolveConductorBridgeApiAccess, } from "../conductor/bridge-api-client.js";
+import { createProductionEpicIntegrationGhRunner, ensureEpicIntegrationPullRequest, formatEpicIntegrationPullRequestOutcome, } from "../epic-integration-pr.js";
 import { secretFreeErrorMessage } from "./job-errors.js";
+import { resolveExecutorJobBaseBranch } from "./base-branch.js";
+/** `epic/<KEY>` prefix a child PR's base branch carries under BAPI-949/BAPI-950. */
+const EPIC_BRANCH_PREFIX = "epic/";
 function positiveIntOrNull(value) {
     return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
 }
@@ -173,6 +177,43 @@ export function buildMergeJobFailure(response) {
         classification: "crashed",
     };
 }
+/**
+ * Post-merge draft epic-integration-PR retry (BAPI-951). Invoked ONLY after a
+ * successful ticket-bound merge whose child PR based on `epic/<EPIC>` — never
+ * for a `main`/other-based merge, and never for any failed merge. Wrapped in
+ * its own try/catch (the shared helper is already non-throwing, but this
+ * guards against a future/injected implementation replacing an already-decided
+ * merge outcome). NEVER changes the returned result, the `error_kind`, or the
+ * `/complete` payload — only emits a sanitized advisory line.
+ */
+async function tryEnsurePostMergeEpicIntegrationPr(job, seams) {
+    if (seams.repositoryBaseBranch === undefined)
+        return;
+    try {
+        const baseResolution = resolveExecutorJobBaseBranch(job, seams.repositoryBaseBranch);
+        if (!baseResolution.ok)
+            return;
+        const childBaseBranch = baseResolution.baseBranch;
+        if (!childBaseBranch.startsWith(EPIC_BRANCH_PREFIX))
+            return;
+        const epicKey = childBaseBranch.slice(EPIC_BRANCH_PREFIX.length);
+        if (epicKey.length === 0)
+            return;
+        const gh = seams.epicIntegrationGh ?? createProductionEpicIntegrationGhRunner();
+        const outcome = await ensureEpicIntegrationPullRequest({
+            epicKey,
+            epicBranch: childBaseBranch,
+            baseBranch: seams.repositoryBaseBranch,
+            command: "executor merge",
+            gh,
+            cwd: seams.cwd,
+        });
+        seams.epicIntegrationAdvisoryLog?.(`epic integration pr: ${JSON.stringify(formatEpicIntegrationPullRequestOutcome(outcome))}`);
+    }
+    catch {
+        // Advisory-only: never allowed to affect the already-decided merge outcome.
+    }
+}
 /**
  * Run the deterministic merge. NEVER ensures/recreates a worktree and NEVER
  * spawns a worker. Returns a completion result on a succeeded merge, else a
@@ -213,7 +254,11 @@ export async function runExecutorMergeJob(job, seams) {
         };
     }
     if (response.status === "succeeded") {
-        return { ok: true, result: buildMergeJobResult(response, fields) };
+        // Build the successful outcome COMPLETELY first — enrichment can only ever
+        // add an advisory log line, never alter what is returned.
+        const result = buildMergeJobResult(response, fields);
+        await tryEnsurePostMergeEpicIntegrationPr(job, seams);
+        return { ok: true, result };
     }
     return { ok: false, failure: buildMergeJobFailure(response) };
 }

package/build/executor/worktree.js

@@ -6,7 +6,9 @@
  * construction or Worktrunk JSON path parsing here. Per-job create failures are
  * returned as structured job failures (→ `/fail`), never thrown.
  */
-import { fetchAndResolveBaseSha } from "../base-ref.js";
+import { fetchAndResolveBaseSha, probeClaudeReviewWorkflowDrift, resolveRepositoryDefaultBranch } from "../base-ref.js";
+// BAPI-941: the shared drift diagnostic formatter (a leaf module — no cycle).
+import { formatClaudeReviewWorkflowDriftDiagnostic } from "../claude-review-workflow-drift.js";
 import { commandSucceeded } from "../start-tickets-prereqs.js";
 import { createWorktreeForTicket } from "../worktree-core.js";
 import { provisionCommandsForWorktree } from "../command-provisioning.js";
@@ -27,6 +29,31 @@ export function resolveExecutorBranch(job) {
         return { ok: true, branch: `feature/${ticketKey}` };
     return { ok: false, error: "no branch could be resolved (no expected_branch and no ticket_key)" };
 }
+/**
+ * BAPI-941: emit the per-spawn `claude-review` workflow-drift advisory for an
+ * executor worker. Returns `void` and swallows everything — a diagnostic that
+ * could abort the run it is describing would be strictly worse than none.
+ *
+ * Silent when the base is aligned; INFO when the comparison is unavailable;
+ * WARNING, naming the stale base and the remedy, when drift is confirmed.
+ */
+async function emitExecutorWorkflowDriftAdvisory(deps, baseBranch) {
+    try {
+        const probeDeps = { runCommand: deps.runCommand, cwd: deps.cwd };
+        const defaultRef = await resolveRepositoryDefaultBranch(probeDeps);
+        const classification = await probeClaudeReviewWorkflowDrift(probeDeps, {
+            baseRef: baseBranch,
+            defaultRef,
+        });
+        if (classification.state === "aligned")
+            return;
+        deps.errorLog?.(formatClaudeReviewWorkflowDriftDiagnostic(classification));
+    }
+    catch {
+        // A thrown probe is itself an unavailable comparison. Stay silent about the
+        // exception (it can echo absolute paths) and never let it reach the caller.
+    }
+}
 /** Build the lean shared-worktree deps from the executor deps. */
 function toWorktreeCoreDeps(deps) {
     return {
@@ -183,6 +210,24 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
         };
     }
     const baseSha = resolvedBase.base_sha;
+    // BAPI-941: the `claude-review` workflow-drift advisory, emitted once per
+    // executor worker spawn — after the base is resolved and before the worktree
+    // exists, matching the interactive `start-tickets` choke point.
+    //
+    // This path matters MORE than the interactive one, not less. A human whose
+    // `claude-review` check goes red can merge past it; a conductor-driven epic
+    // cannot, so it burns the full 60-minute review ceiling and parks at
+    // `needs_human` with `review_verdictless_ceiling_reached` having produced no
+    // verdict at any point. The refs were just refreshed by the fetch above, so
+    // the comparison is local and costs no extra network round trip.
+    //
+    // ADVISORY ONLY. It writes to the executor's stderr logger and the spawn
+    // proceeds regardless — including when the comparison cannot be completed.
+    // It is not a `RunPolicy` key and not a worker-emitted control signal (R14
+    // rules 2 and 3 govern the conductor's decision surface; a spawner's warning
+    // is neither), and it never contributes to the fail-CLOSED base-resolution
+    // decision above.
+    await emitExecutorWorkflowDriftAdvisory(deps, options.baseBranch);
     const row = await createWorktreeForTicket(toWorktreeCoreDeps(deps), key, { [key]: branch }, options.worktrunkBinary, baseSha, guardStaleWorktree, {
         alignExistingBranchTo: baseSha,
         verifyHeadMatches: baseSha,