@bridge_gpt/mcp-server 0.2.53 → 0.2.55

package/build/local-artifact-storage.js

@@ -0,0 +1,130 @@
+/**
+ * Structured local artifact persistence primitives (BAPI-1121).
+ *
+ * WHY THIS EXISTS. `wait_for_ticket_review`'s generation-aware artifact gate
+ * (`ticket-review-artifact-gate.ts`) needs a write/removal outcome it can
+ * branch on — did the accepted clarify leg actually land on disk, did the
+ * withheld critique file actually get removed — without parsing a
+ * human-readable note string. The pre-existing `saveLocally` in `index.ts`
+ * returns exactly that kind of note, and every existing artifact tool (the
+ * six single-artifact request/get tools, the BAPI-342 heavy-read saves, the
+ * combined ticket-review fan-out) depends on its exact rendered shape. This
+ * module extracts the underlying write mechanics into one place, so both the
+ * legacy byte-compatible `saveLocally` and the new structured primitives the
+ * gate uses share a single implementation rather than diverging.
+ *
+ * WHY A SEPARATE MODULE. `index.ts` is the file every other module is
+ * imported INTO; a helper defined there cannot be imported back into a module
+ * `index.ts` itself imports without an import cycle. This module has no
+ * dependency on `index.ts`, so `index.ts` imports `saveLocally` from here
+ * (BAPI-1121) instead of defining it locally, and the artifact gate imports
+ * the structured primitives directly.
+ */
+import { writeFile, mkdir, rename, unlink } from "fs/promises";
+import path from "path";
+import { randomUUID } from "node:crypto";
+/**
+ * Write `content` to `dir/filename` via per-file temporary staging followed by
+ * an atomic rename, so a concurrent reader can never observe a partially
+ * written file and a failed write never leaves a corrupt final artifact.
+ *
+ * The staging filename includes a random suffix so concurrent writes to the
+ * same final filename (unusual, but not prevented at this layer) cannot stage
+ * onto the same temporary path.
+ *
+ * Throws on failure — this is the shared low-level primitive both
+ * {@link saveLocally} (byte-compatible legacy notes) and
+ * {@link writeCanonicalArtifact} (sanitized structured outcome) wrap
+ * differently, because they render a failure to their callers in two
+ * deliberately different shapes.
+ */
+async function writeFileAtomic(dir, filename, content) {
+    const finalPath = path.join(dir, filename);
+    const stagingPath = path.join(dir, `.${filename}.${randomUUID()}.tmp`);
+    await mkdir(dir, { recursive: true });
+    try {
+        await writeFile(stagingPath, content, "utf-8");
+        await rename(stagingPath, finalPath);
+    }
+    catch (err) {
+        // Best-effort cleanup of an orphaned staging file. Cleanup failure (or the
+        // staging file never having been created) does not change the outcome
+        // that matters: the original write/rename error propagates below.
+        try {
+            await unlink(stagingPath);
+        }
+        catch {
+            // Nothing to clean up, or cleanup itself failed — either way the
+            // original error is what the caller needs to see.
+        }
+        throw err;
+    }
+    return finalPath;
+}
+/**
+ * Byte-compatible replacement for the pre-BAPI-1121 `saveLocally` in
+ * `index.ts`. Preserves the exact call shape (`dir`, `filename`, `content` ->
+ * a rendered note string) and the exact rendered success/failure notes every
+ * existing artifact-tool caller depends on — including the raw error suffix
+ * on failure, which existing tests assert verbatim. The only behavioral
+ * change is that the write is now staged-then-renamed rather than written
+ * in place, which is externally invisible on success and, on failure, means
+ * no partial file is ever left at `dir/filename` (an improvement, not a
+ * compatibility break).
+ */
+export async function saveLocally(dir, filename, content) {
+    try {
+        const finalPath = await writeFileAtomic(dir, filename, content);
+        return `\n\n---\nSaved to ${finalPath}`;
+    }
+    catch (writeErr) {
+        const filePath = path.join(dir, filename);
+        return `\n\n---\nNote: Failed to save file to ${filePath}: ${writeErr}`;
+    }
+}
+/**
+ * Structured canonical write for the generation-aware artifact gate. Returns
+ * `{ ok, path, message }` rather than throwing or requiring the caller to
+ * parse a note string. The public `message` is sanitized to the path and
+ * outcome only; any detailed local diagnostic (the underlying filesystem
+ * error) goes only to `console.error`, never through MCP.
+ */
+export async function writeCanonicalArtifact(dir, filename, content) {
+    const finalPath = path.join(dir, filename);
+    try {
+        await writeFileAtomic(dir, filename, content);
+        return { ok: true, path: finalPath, message: `Saved to ${finalPath}` };
+    }
+    catch (err) {
+        console.error(`[local-artifact-storage] write failed for ${finalPath}:`, err);
+        return { ok: false, path: finalPath, message: `Failed to save file to ${finalPath}` };
+    }
+}
+/**
+ * Remove the exact canonical path for a withheld or stale artifact.
+ *
+ * Idempotent by design: an already-absent target (`ENOENT`) is reported as a
+ * SUCCESSFUL cleanup outcome, not an error — a retried removal, or a removal
+ * that runs after an earlier successful one, must never report failure. Only
+ * an actual removal failure (permissions, a directory at that path, etc.) is
+ * reported as `ok: false`.
+ *
+ * Removes exactly the given path — no globbing, no directory recursion, no
+ * inference of sibling files to clean up. The caller is responsible for
+ * passing the exact canonical target; this primitive never widens the blast
+ * radius of a removal on its own.
+ */
+export async function removeCanonicalArtifact(targetPath) {
+    try {
+        await unlink(targetPath);
+        return { ok: true, path: targetPath, message: `Removed ${targetPath}` };
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT") {
+            return { ok: true, path: targetPath, message: `${targetPath} was already absent` };
+        }
+        console.error(`[local-artifact-storage] removal failed for ${targetPath}:`, err);
+        return { ok: false, path: targetPath, message: `Failed to remove ${targetPath}` };
+    }
+}

package/build/mcp-host-config.js

@@ -9,17 +9,17 @@
  * Write strategy per target comes from the data-only registry
  * {@link file:./mcp-host-targets.ts}:
  *   - vendor-first — prefer the official vendor CLI, fall back to a safe direct
- *     write (Claude Code, Copilot CLI, Codex).
+ *     write (Claude Code, Codex).
  *   - direct — merge-write the JSON file directly (Cursor, Copilot VS Code).
  *   - manual-instructions — never auto-write; emit redacted instructions
  *     (Windsurf).
  *
  * SECRET DISCIPLINE: the API key lives only inside the logical entry's `env`.
- * When a verified vendor contract delivers it via argv (all three do — none
- * expose a stdin channel), the argv is constructed and spawned INSIDE the vendor
- * adapter and is never stringified, logged, previewed, returned, or interpolated
- * into a warning. Structured outcomes and inspectors carry presence + launcher
- * args only, never env values.
+ * When a verified vendor contract delivers it via argv (neither expose a stdin
+ * channel), the argv is constructed and spawned INSIDE the vendor adapter and is
+ * never stringified, logged, previewed, returned, or interpolated into a
+ * warning. Structured outcomes and inspectors carry presence + launcher args
+ * only, never env values.
  *
  * TOML NOTE: there is no comment-preserving TOML library available, so Codex
  * direct writes render a canonical document for a missing file, APPEND canonical
@@ -30,6 +30,8 @@
 import { VERSION } from "./version.generated.js";
 import { refreshBridgeApiPackageSpec } from "./init.js";
 import { hostAdapterForTarget, } from "./mcp-host-targets.js";
+import { adaptBridgeEntryForHostTarget, } from "./mcp-host-entry-adapter.js";
+export { adaptBridgeEntryForHostTarget, } from "./mcp-host-entry-adapter.js";
 import { LEGACY_SERVER_NAMES, MCP_SERVER_NAME, MCP_PACKAGE_NAME, RECOGNIZED_SERVER_NAMES, resolveRegistrationKey, } from "./mcp-identity.js";
 /**
  * The secret-free, repair-oriented detail every duplicate-registration outcome
@@ -64,31 +66,6 @@ export function resolveTargetAbsPath(target, ctx) {
     return target.absPathResolver(ctx.homedir);
 }
 // ---------------------------------------------------------------------------
-// Entry adaptation
-// ---------------------------------------------------------------------------
-/**
- * Adapt the shared logical entry into a target's physical JSON entry: copy
- * command/args/env, conditionally add the registry `transportType` as `type`,
- * and merge `extraEntryKeys`. Claude Code omits `type`; Cursor/Copilot VS Code
- * use `stdio`; Copilot CLI uses `local` + `tools: ["*"]`.
- */
-export function adaptBridgeEntryForHostTarget(entry, target) {
-    const adapter = hostAdapterForTarget(target);
-    const physical = {};
-    if (adapter.transportType !== undefined) {
-        physical.type = adapter.transportType;
-    }
-    physical.command = entry.command;
-    physical.args = [...entry.args];
-    physical.env = { ...entry.env };
-    if (adapter.extraEntryKeys) {
-        for (const [k, v] of Object.entries(adapter.extraEntryKeys)) {
-            physical[k] = v;
-        }
-    }
-    return physical;
-}
-// ---------------------------------------------------------------------------
 // JSON read / merge / write
 // ---------------------------------------------------------------------------
 function isEnoent(err) {
@@ -153,10 +130,17 @@ export function mergeJsonHostConfig(existing, target, adaptedEntry) {
     // key, so a legacy registration's args are preserved exactly like a canonical
     // one's.
     const prior = root[writeKey];
+    const priorEntry = prior && typeof prior === "object" && !Array.isArray(prior)
+        ? prior
+        : {};
     const preservedArgs = prior && typeof prior === "object" && !Array.isArray(prior)
-        ? refreshBridgeApiPackageSpec(prior.args, currentLauncherSpec())
+        ? refreshBridgeApiPackageSpec(priorEntry.args, currentLauncherSpec())
         : null;
-    root[writeKey] = preservedArgs ? { ...adaptedEntry, args: preservedArgs } : adaptedEntry;
+    root[writeKey] = {
+        ...priorEntry,
+        ...adaptedEntry,
+        ...(preservedArgs ? { args: preservedArgs } : {}),
+    };
     merged[adapter.topLevelKey] = root;
     return { status: "merged", document: merged, registrationKey: writeKey };
 }
@@ -467,7 +451,7 @@ export async function inspectHostEntry(target, ctx, deps) {
  *
  * Deliberately NOT derived from {@link file:./mcp-host-targets.ts}: the merge
  * path's surface is these three files and nothing else, so an inspector built
- * from the wider registry would report on Codex/Copilot hosts the writer never
+ * from the wider registry would report on Codex/Windsurf hosts the writer never
  * touches — and a report implying those hosts gained the token would be wrong.
  */
 export const BRIDGE_PROFILE_TOKEN_CONFIGS = [
@@ -567,12 +551,12 @@ export async function inspectBridgeApiProfileToken(projectRoot, token, deps) {
  * Whether a vendor kind's secret-delivery contract is VERIFIED. Only verified
  * contracts are ever invoked; an uncertain contract falls back to a direct
  * write rather than guessing argv. Verified from empirical probes (BAPI-635):
- * claude `mcp add-json <name> <json>` and copilot `mcp add --env` both deliver
- * the secret through argv. Codex's contract is unverified (binary absent at
- * authoring time) → never invoked; always direct-written.
+ * claude `mcp add-json <name> <json>` delivers the secret through argv.
+ * Codex's contract is unverified (binary absent at authoring time) → never
+ * invoked; always direct-written.
  */
 function isVendorContractVerified(kind) {
-    return kind === "claude-add-json" || kind === "copilot-add";
+    return kind === "claude-add-json";
 }
 /**
  * Build the vendor add invocation for a target. Returns `null` when the
@@ -597,28 +581,6 @@ function buildVendorInvocation(target, entry) {
             args: ["mcp", "add-json", MCP_SERVER_NAME, json, "--scope", "project"],
         };
     }
-    if (vendor.kind === "copilot-add") {
-        // copilot mcp add <name> --tools "*" --env K=V ... -- <command> <args...>
-        // Env pairs (incl BAPI_API_KEY) are secret-bearing argv.
-        const envArgs = [];
-        for (const [k, v] of Object.entries(entry.env)) {
-            envArgs.push("--env", `${k}=${v}`);
-        }
-        return {
-            bin: vendor.bin,
-            args: [
-                "mcp",
-                "add",
-                MCP_SERVER_NAME,
-                "--tools",
-                "*",
-                ...envArgs,
-                "--",
-                entry.command,
-                ...entry.args,
-            ],
-        };
-    }
     return null;
 }
 // ---------------------------------------------------------------------------

package/build/mcp-host-entry-adapter.js

@@ -0,0 +1,18 @@
+import { hostAdapterForTarget, } from "./mcp-host-targets.js";
+/**
+ * Applies only registry-owned physical fields at the host emission boundary.
+ * Logical entries remain portable across host formats.
+ */
+export function adaptBridgeEntryForHostTarget(entry, target) {
+    const adapter = hostAdapterForTarget(target);
+    const physical = {
+        command: entry.command,
+        args: [...entry.args],
+        env: { ...entry.env },
+    };
+    if (adapter.transportType !== undefined)
+        physical.type = adapter.transportType;
+    if (adapter.extraEntryKeys)
+        Object.assign(physical, adapter.extraEntryKeys);
+    return physical;
+}

package/build/mcp-host-targets.js

@@ -51,12 +51,6 @@ export const HOST_ADAPTERS = {
         topLevelKey: "mcp_servers",
         transportType: undefined, // TOML table shape has no `type`.
     },
-    "copilot-cli": {
-        format: "json",
-        topLevelKey: "mcpServers",
-        transportType: "local",
-        extraEntryKeys: { tools: ["*"] },
-    },
 };
 /** Pure typed lookup from a target's declared {@link HostKind} to its adapter. */
 export function hostAdapterForTarget(target) {
@@ -100,7 +94,7 @@ export const MCP_HOST_TARGETS = {
     },
     "copilot-vscode": {
         id: "copilot-vscode",
-        label: "GitHub Copilot (VS Code)",
+        label: "GitHub Copilot",
         scope: "project",
         relPath: ".vscode/mcp.json",
         displayPath: ".vscode/mcp.json",
@@ -109,19 +103,6 @@ export const MCP_HOST_TARGETS = {
         writeStrategy: "direct",
         detect: (ctx) => ctx.exists(joinPath(ctx.cwd, ".vscode")),
     },
-    "copilot-cli": {
-        id: "copilot-cli",
-        label: "GitHub Copilot CLI",
-        scope: "global",
-        absPathResolver: (homedir) => joinPath(homedir, ".copilot/mcp-config.json"),
-        displayPath: "~/.copilot/mcp-config.json",
-        hostKind: "copilot-cli",
-        vendorCli: { bin: "copilot", kind: "copilot-add" },
-        worktreeSupported: false,
-        writeStrategy: "vendor-first",
-        // No existing probe supports Copilot CLI; never a default.
-        detect: () => false,
-    },
     codex: {
         id: "codex",
         label: "OpenAI Codex",
@@ -153,7 +134,6 @@ export const HOST_PLATFORM_ORDER = [
     "claude-code",
     "cursor",
     "copilot-vscode",
-    "copilot-cli",
     "codex",
     "windsurf",
 ];

package/build/merge-pull-request.js

@@ -356,7 +356,7 @@ function withReviewWaiver(env, waiver) {
  *
  * So the waiver mirrors the Python seam field for field: `api/library/vcs/epic_observers.py`
  * routes `sticky is None` to `PENDING` (waivable) and EVERY `"unknown"` to
- * `UNKNOWN` (never waivable), and `conductor_merge_service` admits only `PENDING`.
+ * `UNKNOWN` (never waivable), and `epic_implementer_merge_service` admits only `PENDING`.
  * No new server field is needed to do this — `sticky_verdict` already carries the
  * distinction on the wire, and `normalizeReviewSnapshot` already preserves it.
  *