@bridge_gpt/mcp-server 0.2.51 → 0.2.52

package/build/conductor/deny-enforcement-preflight.js

@@ -1,10 +1,15 @@
 /**
  * Executor deny-enforcement preflight (TDD §7 / §11, R8).
  *
- * v2's permission model is "skip-permissions + a deterministic deny-layer": workers
- * run `claude -p … --dangerously-skip-permissions` with a small stable deny set. But
- * whether `permissions.deny` is actually enforced under `--dangerously-skip-permissions`
- * is version-specific and must be PROBED, never assumed. This module exports the single
+ * v2's permission model since BAPI-1020 is "the `auto` posture + a deterministic
+ * deny layer + an always-on argument guard": workers run
+ * `claude -p … --permission-mode auto` with a small stable deny set, and
+ * `--dangerously-skip-permissions` is the explicit REVERT value rather than the
+ * default. Whether `permissions.deny` is actually enforced under a given posture is
+ * version-specific and must be PROBED, never assumed — and BOTH postures are probed,
+ * for different reasons: `auto` because it is what every worker runs under, and
+ * bypass because it stays selectable and must stay guarded. A posture that is not
+ * enforced is fatal regardless of which one it is. This module exports the single
  * reusable predicate the T3a executor's claim loop calls at startup/preflight before
  * claiming any job: on a failed deny probe with no working fallback it returns
  * `enforced: false`, and the executor must refuse to claim jobs (a fatal finding).
@@ -19,15 +24,28 @@ import { resolveAgentSpec } from "../agent-registry.js";
 import { createProbeContext } from "../agent-capabilities/probe-context.js";
 import { createDefaultAgentCapabilitiesDeps } from "../agent-capabilities/default-deps.js";
 import { runDenyEnforcementCheck } from "../agent-capabilities/probes.js";
+/**
+ * The postures probed when a caller names none (BAPI-1020).
+ *
+ * `auto` FIRST, deliberately: it is the posture every worker runs under, so when
+ * enforcement is broken the run that proves it is the one that matters, and the
+ * short-circuit below then skips the second probe entirely rather than spending
+ * minutes of real headless Claude runs re-confirming a fatal result.
+ */
+export const REQUIRED_DENY_ENFORCEMENT_POSTURES = [
+    "auto",
+    "skip_permissions",
+];
 /** Canonical refuse-to-claim directive included in every fatal/degraded-fatal result. */
 const REFUSE_TO_CLAIM_WARNING = "The executor claim loop MUST refuse to claim jobs until settings permissions.deny " +
     "or the PreToolUse fallback enforces the deny layer.";
 /**
- * Run the deny-enforcement preflight and map the shared deny-check outcome onto the
- * standard inspection shape. Never throws — unexpected exceptions become a fatal
- * `enforced: false` result. Always cleans up the probe context's temp dirs.
+ * Run the deny-enforcement preflight for ONE posture and map the shared
+ * deny-check outcome onto the standard inspection shape. Never throws —
+ * unexpected exceptions become a fatal `enforced: false` result. Always cleans up
+ * the probe context's temp dirs.
  */
-export async function runDenyEnforcementPreflight(opts = {}) {
+async function runDenyEnforcementPreflightForPosture(posture, opts) {
     try {
         const agent = resolveAgentSpec("claude");
         if (!agent) {
@@ -47,7 +65,7 @@ export async function runDenyEnforcementPreflight(opts = {}) {
             const { result, layer } = await runDenyEnforcementCheck(ctx, {
                 model: opts.model,
                 timeoutMs: opts.timeoutMs,
-                permissionPosture: opts.permissionPosture,
+                permissionPosture: posture,
             });
             if (result.status === "pass" && layer === "settings-deny") {
                 return {
@@ -65,7 +83,8 @@ export async function runDenyEnforcementPreflight(opts = {}) {
                     layer: "pretooluse-hook",
                     degraded: true,
                     warnings: [
-                        "settings permissions.deny was not enforced under --dangerously-skip-permissions; relying on PreToolUse fallback.",
+                        `settings permissions.deny was not enforced under the ${posture ?? "skip_permissions"} ` +
+                            "posture; relying on PreToolUse fallback.",
                     ],
                     status: result.status,
                     detail: result.detail,
@@ -95,3 +114,81 @@ export async function runDenyEnforcementPreflight(opts = {}) {
         };
     }
 }
+/**
+ * Run the deny-enforcement preflight and return the executor's claim gate.
+ *
+ * With an explicit `permissionPosture`, probes exactly that posture and returns
+ * its result unchanged — the single-posture behavior every existing caller and
+ * test seam relies on.
+ *
+ * With no posture named, probes {@link REQUIRED_DENY_ENFORCEMENT_POSTURES} in
+ * order and combines (BAPI-1020). Three properties of that combination matter:
+ *
+ *   - FATAL IF EITHER FAILS. `enforced` is the conjunction, so a posture that is
+ *     not enforced blocks claiming even when the other one is. There is no
+ *     "mostly enforced".
+ *   - SHORT-CIRCUITS ON THE FIRST FAILURE. Each posture costs several real
+ *     headless Claude runs and takes minutes; once the answer is fatal, the
+ *     remaining postures cannot change it, and burning the time to re-confirm it
+ *     would delay every claim on a machine that is already refusing to claim.
+ *   - REPORTS EACH POSTURE SEPARATELY. `postures` carries every probed posture's
+ *     own layer and detail. The top-level `layer` is the FIRST required posture's
+ *     (`auto`, the one workers run under) rather than a merged string, so the
+ *     existing consumers — which read `layer` as "what enforced for a worker" —
+ *     keep reading a true answer, and the per-posture facts stay available beside
+ *     it instead of being collapsed into it.
+ */
+export async function runDenyEnforcementPreflight(opts = {}) {
+    if (opts.permissionPosture !== undefined) {
+        return runDenyEnforcementPreflightForPosture(opts.permissionPosture, opts);
+    }
+    const postures = [];
+    const warnings = [];
+    let combined;
+    let degraded = false;
+    for (const posture of REQUIRED_DENY_ENFORCEMENT_POSTURES) {
+        const result = await runDenyEnforcementPreflightForPosture(posture, opts);
+        postures.push({
+            posture,
+            enforced: result.enforced,
+            layer: result.layer,
+            ...(result.status === undefined ? {} : { status: result.status }),
+            ...(result.detail === undefined ? {} : { detail: result.detail }),
+        });
+        for (const warning of result.warnings) {
+            if (!warnings.includes(warning))
+                warnings.push(warning);
+        }
+        if (result.degraded)
+            degraded = true;
+        if (combined === undefined)
+            combined = result;
+        if (!result.enforced) {
+            // Fatal already. Naming the posture is the diagnostic that matters: "deny is
+            // unenforced" is not actionable until an operator knows WHICH posture, since
+            // the fix for the worker default and the fix for the revert value differ.
+            return {
+                enforced: false,
+                layer: result.layer,
+                degraded: true,
+                warnings: [
+                    `Deny-layer enforcement is not verified for the '${posture}' permission posture.`,
+                    ...warnings,
+                ],
+                ...(result.status === undefined ? {} : { status: result.status }),
+                ...(result.detail === undefined ? {} : { detail: result.detail }),
+                postures,
+            };
+        }
+    }
+    const primary = combined;
+    return {
+        enforced: true,
+        layer: primary.layer,
+        degraded,
+        warnings,
+        ...(primary.status === undefined ? {} : { status: primary.status }),
+        ...(primary.detail === undefined ? {} : { detail: primary.detail }),
+        postures,
+    };
+}

package/build/conductor/local-merge.js

@@ -35,20 +35,26 @@
 import { spawn } from "child_process";
 import { pollCiChecksForCommit, ConductorBridgeApiError, safeDiagnosticMessage, } from "./bridge-api-client.js";
 import { isLikelyGhMergeConflictOutput, isPrMergeConflict, parseGhPrMergeabilityFields, } from "./github-mergeability.js";
-import { selectLatestChecksByName } from "./latest-check-selector.js";
+import { normalizeSelectorCheckName, selectLatestChecksByName } from "./latest-check-selector.js";
 const MERGE_METHODS = new Set(["squash", "merge", "rebase"]);
 /**
  * `gh pr view` field set for a merged-state / head-drift read. Includes
  * `mergeCommit` so an already-merged PR can be detected (and its merge commit
  * SHA recorded) directly from the same read that guards head drift.
+ *
+ * BAPI-1021: also includes `baseRefName`/`headRefName` so the ref-verification
+ * guard (AC-11) can compare the PR's CURRENT base/head branches against the
+ * caller's expectations from the same single read — no extra `gh pr view`
+ * subprocess is added solely for ref verification.
  */
-const PR_STATE_JSON = "headRefOid,state,mergeCommit";
+const PR_STATE_JSON = "headRefOid,state,mergeCommit,baseRefName,headRefName";
 /**
  * Broader `gh pr view` field set used only for the post-merge-failure re-read:
  * it must detect BOTH "already merged at the expected head" and a merge conflict
- * (`mergeable` / `mergeStateStatus`) from a single read.
+ * (`mergeable` / `mergeStateStatus`) from a single read. BAPI-1021: also carries
+ * `baseRefName`/`headRefName` for the same ref-verification reason as above.
  */
-const PR_STATE_MERGEABILITY_JSON = "headRefOid,state,mergeCommit,mergeable,mergeStateStatus";
+const PR_STATE_MERGEABILITY_JSON = "headRefOid,state,mergeCommit,mergeable,mergeStateStatus,baseRefName,headRefName";
 /**
  * Hard wall-clock cap on every `gh` subprocess. The epic-tick runs in a single
  * stateless process — a `gh` call that hangs (network stall, an auth prompt that
@@ -166,12 +172,50 @@ function buildResponse(request, status, reason, terminal, ledgerEvents) {
         ledger_events: ledgerEvents,
     };
 }
+/**
+ * BAPI-1001 — check-run conclusions GitHub itself treats as NEUTRAL. A required
+ * check concluding `skipped` or `neutral` does not hold a pull request back on
+ * GitHub, which reports it CLEAN/MERGEABLE. Deliberately NOT a catch-all for
+ * "not success": `failure`, `cancelled`, `timed_out`, `action_required`, every
+ * pending/queued state, and every unrecognized conclusion stay non-green.
+ *
+ * Kept LOCAL to merge admission rather than pushed into the shared selector: the
+ * selector's other consumers render CI state for humans, where a skipped check
+ * is worth showing as skipped rather than silently folded into "pass".
+ */
+const NEUTRAL_CHECK_CONCLUSIONS = new Set(["skipped", "neutral"]);
+/** True when a check record's `conclusion` is one GitHub treats as neutral. */
+function isNeutralCheckRecord(record) {
+    if (!record)
+        return false;
+    const conclusion = typeof record.conclusion === "string" ? record.conclusion.trim().toLowerCase() : "";
+    return NEUTRAL_CHECK_CONCLUSIONS.has(conclusion);
+}
 /**
  * Decide whether every required CI check is green for the polled head SHA. When
  * the gate lists no required checks, fall back to the poll's `all_passed` flag.
  * Defensive against the poll response's exact shape: a check counts as green if
  * any of `conclusion==="success"`, `status==="success"`, `green===true`, or
  * `bucket==="pass"`.
+ *
+ * BAPI-1001 adds neutral arbitration AHEAD of the BAPI-933 latest-wins selection.
+ * Four outcomes, and each is a distinct case:
+ *
+ * - `success` (by any of the four spellings above) — green, unchanged.
+ * - `skipped` / `neutral` — non-blocking. It never becomes the selected record
+ *   for a name that also carries a meaningful observation, and when it is the
+ *   ONLY observation for a required name it passes, because GitHub admits it.
+ * - a meaningful failure (`failure`, `cancelled`, `timed_out`,
+ *   `action_required`, an unorderable conflict) — non-green, unchanged. A
+ *   neutral duplicate can never hide one, because neutral records are the ones
+ *   dropped, never the meaningful ones.
+ * - pending, queued, missing, malformed — non-green, unchanged.
+ *
+ * The defect this closes: BAPI-996's PR #1177 carried two `claude-review`
+ * check-runs at the head, one `success` and one NEWER `skipped`. Latest-wins
+ * selected the `skipped` record, `isGreen` read it as not-green, and the bounded
+ * CI-green wait refused a CLEAN/MERGEABLE pull request with `ci_not_green` until
+ * the merge re-fire budget parked the ticket.
  */
 export function allRequiredChecksGreen(pollResponse, requiredChecks) {
     if (pollResponse === null || typeof pollResponse !== "object")
@@ -198,14 +242,43 @@ export function allRequiredChecksGreen(pollResponse, requiredChecks) {
     // reported MERGEABLE/CLEAN (BAPI-912 / PR #1107, three parked attempts).
     // `selectLatestChecksByName` also OMITS a name whose duplicates could not be
     // ordered, so the `every(...)` below fails it closed as a missing context.
-    const { byName } = selectLatestChecksByName(rawChecks);
+    // Neutral arbitration runs BEFORE selection, because recency cannot arbitrate
+    // between "a verdict" and "no verdict". A neutral duplicate is withheld from
+    // the selector whenever the same name also carries a meaningful observation,
+    // so latest-wins then arbitrates only among records that actually decided
+    // something. Names with nothing but neutral records keep them and are judged
+    // by `isGreen` below; every meaningful record is passed through untouched, so
+    // the selector's ambiguity/fail-closed handling is unchanged.
+    const meaningfulNames = new Set();
+    for (const record of rawChecks) {
+        if (record === null || typeof record !== "object" || Array.isArray(record))
+            continue;
+        const name = normalizeSelectorCheckName(record.name);
+        if (name !== null && !isNeutralCheckRecord(record))
+            meaningfulNames.add(name);
+    }
+    const arbitrated = rawChecks.filter((record) => {
+        if (record === null || typeof record !== "object" || Array.isArray(record))
+            return true;
+        const name = normalizeSelectorCheckName(record.name);
+        if (name === null)
+            return true;
+        return !(isNeutralCheckRecord(record) && meaningfulNames.has(name));
+    });
+    const { byName } = selectLatestChecksByName(arbitrated);
     const isGreen = (c) => {
         if (!c)
             return false;
         const conclusion = typeof c.conclusion === "string" ? c.conclusion.toLowerCase() : "";
         const status = typeof c.status === "string" ? c.status.toLowerCase() : "";
         const bucket = typeof c.bucket === "string" ? c.bucket.toLowerCase() : "";
-        return c.green === true || conclusion === "success" || status === "success" || bucket === "pass";
+        return (c.green === true ||
+            conclusion === "success" ||
+            status === "success" ||
+            bucket === "pass" ||
+            // Only reachable when the name carried no meaningful observation at all;
+            // otherwise the arbitration above already removed this record.
+            isNeutralCheckRecord(c));
     };
     return requiredChecks.every((name) => isGreen(byName.get(name)));
 }
@@ -229,11 +302,26 @@ function isMergedAtExpectedHead(state, headOid, expectedSha) {
         headOid.toLowerCase() === expectedSha.toLowerCase());
 }
 /**
- * Read the PR's `headRefOid` + `state` + `mergeCommit` via `gh pr view`. Extracted
- * so the head-drift / not-open / already-merged guard can run BOTH before the CI
- * wait and again right before provider merge (BAPI-566 Bug B: the head can drift
- * while we wait for CI). Returns the raw parsed values; the caller applies the
- * MERGED-at-head / OPEN / exact-head checks.
+ * Coerce a parsed `gh pr view` field to a bounded, nonblank ref name, or
+ * `undefined` when the field is absent, not a string, or whitespace-only.
+ * BAPI-1021: an unusable observed ref must be treated by the ref-verification
+ * guard as a MISMATCH when the caller supplied an expectation, never silently
+ * skipped — this coercion just normalizes the raw value, it does not decide
+ * that policy.
+ */
+function readBoundedRefName(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/**
+ * Read the PR's `headRefOid` + `state` + `mergeCommit` + `baseRefName` +
+ * `headRefName` via `gh pr view`. Extracted so the head-drift / not-open /
+ * already-merged / ref-mismatch guard can run BOTH before the CI wait and
+ * again right before provider merge (BAPI-566 Bug B: the head can drift while
+ * we wait for CI). Returns the raw parsed values; the caller applies the
+ * MERGED-at-head / OPEN / exact-head / matching-ref checks.
  */
 async function readPrMergeState(run, ghEnv, pr, json = PR_STATE_JSON) {
     const view = await run("gh", ["pr", "view", String(pr), "--json", json], ghEnv);
@@ -248,6 +336,8 @@ async function readPrMergeState(run, ghEnv, pr, json = PR_STATE_JSON) {
             headOid: parsed.headRefOid,
             state: parsed.state,
             mergeCommitOid: extractMergeCommitOid(parsed),
+            baseRefName: readBoundedRefName(parsed.baseRefName),
+            headRefName: readBoundedRefName(parsed.headRefName),
             raw: parsed,
         };
     }
@@ -381,6 +471,8 @@ async function waitForRequiredChecksGreen(pollCi, access, expectedSha, requiredC
  */
 export function makeLocalMergeExecutor(options = {}, deps = {}) {
     const method = resolveLocalMergeMethod(options.method);
+    const expectedBaseBranch = readBoundedRefName(options.expectedBaseBranch);
+    const expectedHeadBranch = readBoundedRefName(options.expectedHeadBranch);
     const rawRun = deps.runCommand ?? defaultRunCommand;
     // Always await the runner: the production default is async (a hung `gh` would
     // otherwise block the event loop and starve the executor heartbeat), and
@@ -479,6 +571,15 @@ export function makeLocalMergeExecutor(options = {}, deps = {}) {
         if (isMergedAtExpectedHead(firstRead.state, firstRead.headOid, expectedSha)) {
             return buildAlreadyMergedResponse(request, baseDetails, firstRead.mergeCommitOid);
         }
+        // 2b. BAPI-1021 (AC-11) — refuse before any provider merge if the PR's current
+        //     base or head branch does not match the caller's expectation. Ordered
+        //     after the already-merged short-circuit (an idempotent success must not
+        //     be turned into a refusal by a since-changed ref) and before the
+        //     head-drift / pr_not_open guards below.
+        const firstRefMismatch = findRefMismatch(expectedBaseBranch, expectedHeadBranch, firstRead);
+        if (firstRefMismatch) {
+            return buildRefMismatchResponse(request, baseDetails, firstRefMismatch);
+        }
         if (typeof firstRead.headOid !== "string" || firstRead.headOid.toLowerCase() !== expectedSha.toLowerCase()) {
             return fail("head_drift");
         }
@@ -517,6 +618,13 @@ export function makeLocalMergeExecutor(options = {}, deps = {}) {
             if (isMergedAtExpectedHead(secondRead.state, secondRead.headOid, expectedSha)) {
                 return buildAlreadyMergedResponse(request, baseDetails, secondRead.mergeCommitOid);
             }
+            // 3c. BAPI-1021 (AC-11) — repeat the ordered ref guard here too, so a PR
+            //     retargeted while CI was pending cannot reach the merge command. Same
+            //     ordering rationale as the first-read guard above.
+            const secondRefMismatch = findRefMismatch(expectedBaseBranch, expectedHeadBranch, secondRead);
+            if (secondRefMismatch) {
+                return buildRefMismatchResponse(request, baseDetails, secondRefMismatch);
+            }
             if (typeof secondRead.headOid !== "string" || secondRead.headOid.toLowerCase() !== expectedSha.toLowerCase()) {
                 return fail("head_drift");
             }
@@ -625,6 +733,57 @@ function buildConflictResponse(request, baseDetails, expectedSha, mergeability)
         { type: "merge.conflict", status: "failed", reason, details: conflictDetails },
     ]);
 }
+/**
+ * Compare the PR's CURRENT base/head refs (from a {@link readPrMergeState}
+ * read) against the caller's supplied expectations. Returns the first
+ * mismatch found (base checked before head), or `undefined` when every
+ * supplied expectation matches.
+ *
+ * An expectation with no corresponding usable actual ref — absent, not a
+ * string, or whitespace-only, already normalized to `undefined` by
+ * {@link readBoundedRefName} — counts as a MISMATCH, never a skip. Silently
+ * treating an unreadable ref as "nothing to check" would let exactly the
+ * unverifiable case slip through the guard it exists to provide.
+ */
+function findRefMismatch(expectedBaseBranch, expectedHeadBranch, actual) {
+    if (expectedBaseBranch !== undefined && actual.baseRefName !== expectedBaseBranch) {
+        return { field: "base", expected: expectedBaseBranch, actual: actual.baseRefName ?? "" };
+    }
+    if (expectedHeadBranch !== undefined && actual.headRefName !== expectedHeadBranch) {
+        return { field: "head", expected: expectedHeadBranch, actual: actual.headRefName ?? "" };
+    }
+    return undefined;
+}
+/**
+ * Build a `ref_mismatch` failure (AC-11): a deliberate, terminal safety
+ * refusal issued BEFORE any provider-merge subprocess when the PR's current
+ * base or head branch does not match the caller's expectation.
+ *
+ * Details are allowlisted to the expected/actual branch values only — never
+ * raw `gh` output, stderr, response bodies, credentials, or exception text,
+ * mirroring {@link buildConflictResponse}'s secret-safety contract. The
+ * message states plainly that no provider merge was attempted and directs the
+ * operator to rebuild or cherry-pick the change against the expected run base
+ * — retargeting the pull request in the GitHub UI would only relabel a branch
+ * that has already drifted from what the run actually intends to merge, not
+ * fix it.
+ */
+function buildRefMismatchResponse(request, baseDetails, mismatch) {
+    const reason = "ref_mismatch";
+    const details = {
+        ...baseDetails,
+        mismatched_field: mismatch.field,
+        [`expected_${mismatch.field}_branch`]: mismatch.expected,
+        [`actual_${mismatch.field}_branch`]: mismatch.actual,
+        message: `No provider merge was attempted: the pull request's current ${mismatch.field} branch ` +
+            `does not match the run's expected ${mismatch.field} branch. Rebuild or cherry-pick the ` +
+            "change against the expected run base rather than retargeting the pull request in the " +
+            "GitHub UI.",
+    };
+    return buildResponse(request, "failed", reason, false, [
+        { type: "merge.failed", status: "failed", reason, details },
+    ]);
+}
 /**
  * Probe whether this host can merge with `gh` at all, BEFORE any merge is
  * attempted.