@bridge_gpt/mcp-server 0.2.53 → 0.2.55

package/build/start-tickets-conductor.js

@@ -83,9 +83,10 @@ export const DEFAULT_CONDUCTOR_GATE_NAME = "implement-ticket";
  * Exported since BAPI-1020 so the executor resolves the worker-guard bin through
  * the SAME resolver rather than growing a second one. Correct in both build
  * shapes because this module compiles to the build ROOT: the esbuild bundle puts
- * `import.meta.url` at `build/index.js` / `build/conductor-bin.js`, and `tsc` puts
- * it at `build/start-tickets-conductor.js`. A resolver living in a subdirectory
- * module would resolve to `build/<subdir>/<filename>` under `tsc` and be wrong.
+ * `import.meta.url` at `build/index.js` / `build/epic-implementer-bin.js`, and
+ * `tsc` puts it at `build/start-tickets-conductor.js`. A resolver living in a
+ * subdirectory module would resolve to `build/<subdir>/<filename>` under `tsc`
+ * and be wrong.
  */
 export function defaultResolveBinPath(filename) {
     return fileURLToPath(new URL(`./${filename}`, import.meta.url));
@@ -124,12 +125,12 @@ export async function createStartTicketsConductorContext(options, agent, deps) {
         gateName,
         supervisorMode,
         agentName: agent.name,
-        cliFile: resolveBinPath("conductor-bin.js"),
+        cliFile: resolveBinPath("epic-implementer-bin.js"),
         // Capture the conductor process's Node executable so dispatched workers run
-        // conductor-bin.js under THIS runtime (which owns the ledger), never the
-        // worker's own Node (BAPI-527).
+        // epic-implementer-bin.js under THIS runtime (which owns the ledger), never
+        // the worker's own Node (BAPI-527).
         conductorNodePath: deps.execPath ?? process.execPath,
-        hookBinPath: resolveBinPath("conductor-claude-hook-bin.js"),
+        hookBinPath: resolveBinPath("epic-implementer-claude-hook-bin.js"),
     };
     if (options.epic) {
         context.epic = options.epic;

package/build/ticket-key-utils.js

@@ -10,9 +10,10 @@
  *   | `start-tickets.ts`                          | `^[A-Z]+-[0-9]+$`        | no                |
  *
  * A repository configured with `jira_ticket_key = "MY_PROJ"` therefore minted
- * keys the server considered valid and the clients rejected — `/full-automation`
- * silently dropped them. Jira project keys may contain underscores too, so this
- * was never a local-mode-only defect.
+ * keys the server considered valid and the clients rejected — the pre-rename
+ * `/full-automation` command (renamed to `/idea-to-pr` in BAPI-1058) silently
+ * dropped them. Jira project keys may contain underscores too, so this was never
+ * a local-mode-only defect.
  *
  * This module mirrors the public Python contract
  * (`api.library.config.field_validators.TICKET_KEY_PREFIX_PATTERN_SOURCE` plus a

package/build/ticket-review-artifact-gate.js

@@ -0,0 +1,461 @@
+/**
+ * Generation-aware persistence gate for ticket review (BAPI-1121, BAPI-1129).
+ *
+ * WHO CALLS THIS. Both calling conventions, and nothing else:
+ * `wait_for_ticket_review` (the non-blocking submit-then-wait pattern the
+ * review-ticket recipe uses) and `request_ticket_review` with
+ * `wait_for_result: true` (the older blocking convention, routed here by
+ * BAPI-1129). This module is therefore the SOLE IMPLEMENTATION of review
+ * classification and persistence — not the wait, which is merely one of its
+ * two callers. A second copy of the advancement rules in either handler is
+ * the defect this arrangement exists to prevent.
+ *
+ * THE PROBLEM THIS CLOSES. BAPI-1104 made `wait_for_ticket_review` refuse a
+ * `200` whose generation had not advanced past the pre-submission baseline —
+ * but the review-ticket RECIPE still retrieved and saved BOTH legs
+ * unconditionally after a ready wait (`get_clarifying_questions` +
+ * `get_ticket_critique`), regardless of what the wait actually proved. A
+ * fresh clarify beside a stale, un-advanced critique attachment was still
+ * written to the critique's canonical path — the exact stale-attachment
+ * failure the generation baseline was built to catch, reintroduced one layer
+ * up by an unconditional write.
+ *
+ * THE FIX. Persistence authority moves INTO the wait. This module classifies
+ * the observed combined envelope against the submission baseline — using
+ * `parseReviewGeneration` / `generationAdvanced`, never file presence — and
+ * writes ONLY the legs proven to be this submission's own output. A leg that
+ * is delivered but not proven (stale, or carrying no readable identity) is
+ * WITHHELD: never written, and any pre-existing canonical file for it is
+ * removed so a later file-presence read cannot resurrect it. The returned
+ * manifest (`accepted_legs`, `saved_legs`, `withheld_legs`, `absent_legs`,
+ * `freshness_basis`) becomes the authoritative source set for every
+ * downstream consumer (see `evaluate-and-recommend.md` /
+ * `capture-review-decisions.md`).
+ *
+ * ACCEPTED VERSUS SAVED (BAPI-1129). `accepted_legs` is the classification
+ * verdict — which legs are this review's own output — and `saved_legs` is the
+ * durable-write record. They coincide on a persistence-enabled call and
+ * deliberately diverge under `persistenceEnabled: false`, the
+ * classification-only mode `request_ticket_review`'s `save_locally: false`
+ * convention needs: every leg is classified so withheld content is never
+ * handed back as current-review evidence, and no file is written, removed,
+ * reconciled, or recorded. A consumer choosing which document bodies to
+ * present reads `accepted_legs`; one reporting what landed on disk reads
+ * `saved_legs`.
+ *
+ * NO-BASELINE FALLBACK. A resumed session (or an out-of-band submission) has
+ * no baseline to prove freshness against. Terminality alone decides, exactly
+ * as the two `get_*` tools behaved before this ticket — but the manifest
+ * reports `freshness_basis: "terminality_only"` and an empty `advanced_legs`
+ * so nothing here is silently upgraded to a proven claim.
+ */
+import path from "path";
+import { createHash } from "node:crypto";
+import { parseReviewGeneration, generationAdvanced } from "./review-generation.js";
+import { writeCanonicalArtifact, removeCanonicalArtifact } from "./local-artifact-storage.js";
+// Documented leg ordering (BAPI-1121): critique before clarify, matching the
+// pre-existing wait_for_ticket_review response's delivered_legs order so this
+// ticket does not silently reorder an established response field.
+const LEG_NAMES = ["critique", "clarify"];
+function legContent(envelope, leg) {
+    const raw = envelope[leg]?.content;
+    return typeof raw === "string" ? raw : "";
+}
+/**
+ * Whether the resolved submission policy expected `leg`, from
+ * `expectedLegCount`. Every valid resolved policy configures at least one
+ * clarify round (`_validate_bucket_policy` in `review_ticket_policy.py`
+ * rejects a zero-clarify policy), so `expectedLegCount` counting 1 always
+ * means "clarify only" and 2 always means "both" — clarify is therefore
+ * always expected whenever a count was supplied at all, and critique is
+ * expected only when the count is exactly 2.
+ */
+function expectedByPolicy(leg, expectedLegCount) {
+    if (expectedLegCount === undefined)
+        return undefined;
+    return leg === "clarify" ? expectedLegCount >= 1 : expectedLegCount >= 2;
+}
+/** Same order-of-magnitude lifetime as `ReviewGenerationRegistry`'s baseline TTL. */
+const COMPLETED_RESULT_TTL_MS = 2 * 60 * 60 * 1000;
+const MAX_COMPLETED_RESULT_KEYS = 64;
+const COMPLETED_RESULTS = new Map();
+const KEY_SEPARATOR = "\u0000";
+function completedResultKey(repoName, ticketNumber) {
+    return `${repoName.trim().toLowerCase()}${KEY_SEPARATOR}${ticketNumber.trim().toUpperCase()}`;
+}
+function evictExpiredCompletedResults() {
+    const cutoff = Date.now() - COMPLETED_RESULT_TTL_MS;
+    for (const [key, bySignature] of COMPLETED_RESULTS) {
+        for (const [signature, entry] of bySignature) {
+            if (entry.recordedAtMs <= cutoff)
+                bySignature.delete(signature);
+        }
+        if (bySignature.size === 0)
+            COMPLETED_RESULTS.delete(key);
+    }
+}
+/**
+ * A stable signature for one delivered leg: its readable generation when one
+ * exists, or a content digest when it does not. The digest keeps two distinct
+ * footerless documents from colliding onto the same signature (a bare
+ * generation-less key would otherwise treat every unstamped document as
+ * identical).
+ */
+function legSignaturePart(content) {
+    const trimmed = content.trim();
+    if (trimmed.length === 0)
+        return "absent";
+    const generation = parseReviewGeneration(trimmed);
+    if (generation !== null)
+        return `g${generation}`;
+    return `d${createHash("sha256").update(trimmed).digest("hex").slice(0, 16)}`;
+}
+function envelopeSignature(envelope) {
+    return LEG_NAMES.map((leg) => `${leg}:${legSignaturePart(legContent(envelope, leg))}`).join("|");
+}
+function recordCompletedResult(repoName, ticketNumber, signature, manifest) {
+    evictExpiredCompletedResults();
+    const key = completedResultKey(repoName, ticketNumber);
+    let bySignature = COMPLETED_RESULTS.get(key);
+    if (!bySignature) {
+        bySignature = new Map();
+        COMPLETED_RESULTS.set(key, bySignature);
+    }
+    // Delete-then-set so Map iteration order tracks recency, matching the
+    // baseline registry's own eviction technique.
+    bySignature.delete(signature);
+    bySignature.set(signature, { manifest, recordedAtMs: Date.now() });
+    while (COMPLETED_RESULTS.size > MAX_COMPLETED_RESULT_KEYS) {
+        const oldest = COMPLETED_RESULTS.keys().next();
+        if (oldest.done)
+            break;
+        COMPLETED_RESULTS.delete(oldest.value);
+    }
+}
+function getCompletedResult(repoName, ticketNumber, signature) {
+    evictExpiredCompletedResults();
+    return COMPLETED_RESULTS.get(completedResultKey(repoName, ticketNumber))?.get(signature)?.manifest ?? null;
+}
+/**
+ * Invalidate every completed-result entry for this repo/ticket. Called when a
+ * new submission attempt begins (`recordReviewGenerationBaseline`) so a prior
+ * completion can never satisfy a later, not-yet-advanced submission.
+ */
+export function invalidateCompletedReviewResult(repoName, ticketNumber) {
+    COMPLETED_RESULTS.delete(completedResultKey(repoName, ticketNumber));
+}
+// ---------------------------------------------------------------------------
+// Classification + persistence
+// ---------------------------------------------------------------------------
+/**
+ * The single wording authority for every classification outcome (BAPI-1129).
+ *
+ * Both calling conventions render this verbatim — `wait_for_ticket_review` in
+ * its JSON `message` field, blocking `request_ticket_review` appended after
+ * the accepted document bodies. Neither re-derives freshness, withholding,
+ * absence, suppression or zero-advance prose of its own; a second wording
+ * would be a second contract, and the two would drift.
+ *
+ * `acceptedLegs` (not `savedLegs`) drives the proceed/nothing-vouched-for
+ * branch, because a classification-only call accepts legs while saving none.
+ */
+function buildMessage(freshnessBasis, acceptedLegs, savedLegs, withheldLegs, absentLegs, persistenceEnabled) {
+    // Rendered after the outcome sentence on every branch that could otherwise
+    // read as "these files are on disk now".
+    const persistenceNote = persistenceEnabled
+        ? ""
+        : ` PERSISTENCE DISABLED (save_locally: false) — this was a classification-only call: ` +
+            `saved leg(s): none, and no file was written, removed, or reconciled.`;
+    if (freshnessBasis === "terminality_only") {
+        return (`⚠ DEGRADED FRESHNESS — no submission baseline was available, so acceptance is ` +
+            `terminality-only: delivery is proven, generation advancement is NOT. Accepted leg(s): ` +
+            `${acceptedLegs.length > 0 ? acceptedLegs.join(", ") : "none"}. Saved leg(s): ` +
+            `${savedLegs.length > 0 ? savedLegs.join(", ") : "none"}. You may proceed on these ` +
+            `documents, but they may be indistinguishable from a prior attachment; the downstream ` +
+            `identity-footer agreement check remains the protective backstop. If that check ` +
+            `disagrees, STOP and escalate to an operator rather than proceeding. To prove freshness ` +
+            `instead, submit the review with request_ticket_review and wait within the same MCP ` +
+            `session.` + persistenceNote + describeAbsent(absentLegs));
+    }
+    if (acceptedLegs.length === 0) {
+        return (`No current-review leg could be vouched for against the submission baseline yet — every ` +
+            `delivered leg is either at the baseline generation or carries no readable identity. ` +
+            `This is a pending-compatible outcome, not a failure; no file was written or removed. ` +
+            `The submission baseline is retained: call wait_for_ticket_review to keep waiting for ` +
+            `this submission's own output.` +
+            describeWithheld(withheldLegs, false) +
+            describeAbsent(absentLegs));
+    }
+    let message = `The review can proceed. Accepted leg(s): ${acceptedLegs.join(", ")}.`;
+    message += persistenceEnabled
+        ? ` Saved leg(s): ${savedLegs.length > 0 ? savedLegs.join(", ") : "none"}.`
+        : persistenceNote;
+    message += describeWithheld(withheldLegs, persistenceEnabled);
+    message += describeAbsent(absentLegs);
+    return message;
+}
+/**
+ * Name every withheld leg with exactly one closed-vocabulary reason. The
+ * quarantine sentence is stated only when persistence actually ran — a
+ * classification-only call removed nothing and must not claim otherwise.
+ */
+function describeWithheld(withheldLegs, persistenceEnabled) {
+    if (withheldLegs.length === 0)
+        return "";
+    const summary = withheldLegs.map((leg) => `${leg.leg} (${leg.reason})`).join(", ");
+    return (` WARNING — withheld as NOT current-review evidence: ${summary}. These were not saved` +
+        (persistenceEnabled
+            ? `, and any pre-existing local file for them has been removed so it cannot be mistaken ` +
+                `for this submission's output.`
+            : `, and their content is not this review's output; no local file was removed because ` +
+                `persistence was disabled.`));
+}
+/**
+ * Name every absent leg with `not_delivered`, separating a leg the resolved
+ * policy EXPECTED (prominent — something the submission configured never
+ * arrived) from ordinary policy-permitted absence (a one-leg policy simply
+ * did not configure it, which is not a problem at all).
+ */
+function describeAbsent(absentLegs) {
+    if (absentLegs.length === 0)
+        return "";
+    const expected = absentLegs.filter((leg) => leg.expectedByPolicy === true);
+    const permitted = absentLegs.filter((leg) => leg.expectedByPolicy !== true);
+    let text = "";
+    if (expected.length > 0) {
+        text +=
+            ` WARNING — the resolved policy EXPECTED ${expected.map((l) => l.leg).join(", ")} but it ` +
+                `was not delivered (not_delivered) — see absent_legs.`;
+    }
+    if (permitted.length > 0) {
+        text +=
+            ` NOTE: ${permitted.map((l) => l.leg).join(", ")} was not delivered (not_delivered); the ` +
+                `resolved policy did not require it, so this is ordinary policy-permitted absence.`;
+    }
+    return text;
+}
+/**
+ * Classify one delivered leg's advancement against `baseline`.
+ *
+ * `baselineAvailable=false` means terminality alone decides (no proof of
+ * freshness is possible): every delivered leg is accepted, `advanced` stays
+ * false, and `generation` is still reported for operator visibility.
+ */
+function classifyDelivery(content, legBaseline, baselineAvailable) {
+    if (content.trim().length === 0) {
+        return { delivered: false, generation: null, advanced: false, reason: "not_delivered" };
+    }
+    const generation = parseReviewGeneration(content);
+    if (!baselineAvailable) {
+        return { delivered: true, generation, advanced: false };
+    }
+    if (generation === null) {
+        return { delivered: true, generation: null, advanced: false, reason: "identity_unreadable" };
+    }
+    if (generationAdvanced(legBaseline, generation)) {
+        return { delivered: true, generation, advanced: true };
+    }
+    return { delivered: true, generation, advanced: false, reason: "generation_not_advanced" };
+}
+/**
+ * Classify the observed combined envelope against the submission baseline,
+ * persist exactly the accepted legs, remove any stale withheld canonical
+ * file, and record a completed-result entry on full success. Returns a
+ * structured failure — never throws — on any write or removal failure.
+ *
+ * Idempotent: a repeated call with the SAME observed envelope for the same
+ * repo/ticket replays the previously completed result (reconciling canonical
+ * files from the current envelope) rather than degrading to a fresh
+ * terminality-only classification after the live baseline has been cleared.
+ *
+ * BAPI-1129: `ctx.persistenceEnabled === false` makes the whole call
+ * classification-only — the same rules produce the same `accepted_legs`, and
+ * nothing is written, removed, reconciled, or recorded.
+ */
+export async function classifyAndPersistReviewEnvelope(ctx) {
+    const signature = envelopeSignature(ctx.envelope);
+    // Default true: an omitted flag keeps the pre-BAPI-1129 durable-write
+    // behavior, so persistence can only ever be given up deliberately.
+    const persistenceEnabled = ctx.persistenceEnabled !== false;
+    const replayed = getCompletedResult(ctx.repoName, ctx.ticketNumber, signature);
+    if (replayed && !persistenceEnabled) {
+        // Reuse the recorded CLASSIFICATION — it was produced by these same rules
+        // against the same envelope, and is strictly better evidence than a fresh
+        // terminality-only read once the live baseline has been cleared — but
+        // perform none of the replay's reconciliation, and do not mutate the
+        // cached entry. A dry run observes; it never repairs.
+        return {
+            ...replayed,
+            saved_legs: [],
+            legs: replayed.legs.map((leg) => ({ ...leg, saved: false })),
+            withheld_legs: replayed.withheld_legs.map((leg) => ({ ...leg, saved: false })),
+            absent_legs: replayed.absent_legs.map((leg) => ({ ...leg, saved: false })),
+            replay: true,
+            message: `REPLAY (classification only) — reproducing the previously completed classification for ` +
+                `this submission; no write, removal, or reconciliation was performed. ` +
+                buildMessage(replayed.freshness_basis, replayed.accepted_legs, [], replayed.withheld_legs, replayed.absent_legs, false),
+        };
+    }
+    if (replayed) {
+        for (const leg of replayed.saved_legs) {
+            const content = legContent(ctx.envelope, leg);
+            const dir = path.dirname(ctx.canonicalPaths[leg]);
+            const filename = path.basename(ctx.canonicalPaths[leg]);
+            const outcome = await writeCanonicalArtifact(dir, filename, content);
+            if (!outcome.ok) {
+                // BAPI-1121 (Step 7): a reconciliation failure does NOT drop the
+                // completed entry — a subsequent retry must still be able to repair
+                // the canonical state from the same recorded manifest.
+                return {
+                    ok: false,
+                    error: "ARTIFACT_PERSISTENCE_FAILED",
+                    status: 500,
+                    message: `Failed to reconcile ${leg} artifact during replay: ${outcome.message}`,
+                    saved_legs: [],
+                };
+            }
+        }
+        // BAPI-1121 (code review finding): also re-enforce the withheld side of
+        // the manifest. Nothing in this process recreates a withheld leg's
+        // canonical file between two waits, but the manifest-is-authoritative
+        // contract must hold even if something outside this process did — a
+        // replay that only reconciled saved_legs could let a withheld file
+        // resurface and be read by a downstream step that trusts file presence.
+        for (const legStatus of replayed.withheld_legs) {
+            const outcome = await removeCanonicalArtifact(ctx.canonicalPaths[legStatus.leg]);
+            if (!outcome.ok) {
+                return {
+                    ok: false,
+                    error: "ARTIFACT_PERSISTENCE_FAILED",
+                    status: 500,
+                    message: `Failed to re-quarantine withheld ${legStatus.leg} artifact during replay: ${outcome.message}`,
+                    saved_legs: replayed.saved_legs,
+                };
+            }
+        }
+        return {
+            ...replayed,
+            replay: true,
+            message: `REPLAY — reproducing the previously completed result for this submission (no reclassification performed). ${replayed.message}`,
+        };
+    }
+    const baselineAvailable = ctx.baseline !== null;
+    const legs = LEG_NAMES.map((leg) => {
+        const content = legContent(ctx.envelope, leg);
+        const legBaseline = leg === "clarify" ? ctx.baseline?.clarify ?? null : ctx.baseline?.critique ?? null;
+        const classification = classifyDelivery(content, legBaseline, baselineAvailable);
+        return {
+            leg,
+            delivered: classification.delivered,
+            generation: classification.generation,
+            advanced: classification.advanced,
+            saved: false,
+            canonicalPath: ctx.canonicalPaths[leg],
+            expectedByPolicy: expectedByPolicy(leg, ctx.expectedLegCount),
+            reason: classification.reason,
+        };
+    });
+    const freshnessBasis = baselineAvailable ? "generation" : "terminality_only";
+    // The shared ACCEPTANCE rule, and the only place it is expressed: every
+    // delivered leg under terminality-only fallback (no proof is possible, so
+    // terminal delivery alone is accepted — today's pre-BAPI-1121 behavior);
+    // only ADVANCED legs under a generation baseline. BAPI-1129 separated this
+    // from "which legs get written": under `persistenceEnabled: false` the same
+    // legs are accepted and none is written.
+    const acceptedLegs = legs.filter((leg) => (baselineAvailable ? leg.advanced : leg.delivered));
+    const legsToSave = persistenceEnabled ? acceptedLegs : [];
+    // Withheld = delivered but not accepted, ONLY under a generation baseline —
+    // terminality-only has no concept of withholding. Under suppression these
+    // are still classified and reported; they are simply not quarantined.
+    const withheldCandidates = baselineAvailable
+        ? legs.filter((leg) => leg.delivered && !leg.advanced)
+        : [];
+    // Nothing proven yet: do not write, do not remove, do not record
+    // completion. `wait_for_ticket_review` never reaches this branch — its own
+    // bounded-wait readiness gate already required at least one advanced leg
+    // before calling here. Blocking `request_ticket_review` DOES (BAPI-1129):
+    // `pollForResult` treats only 404/202 as pending, so a review that outran
+    // the backend's `_GENERATING_TTL_SECONDS` terminates the poll on a `200`
+    // serving both legs' prior attachments. This is that call's honest
+    // negative — and because it writes nothing, the submission baseline stays
+    // live for a follow-up `wait_for_ticket_review`.
+    if (baselineAvailable && acceptedLegs.length === 0) {
+        const withheldOnly = legs.map((leg) => ({ ...leg, reason: leg.reason ?? "not_delivered" }));
+        return {
+            ok: true,
+            delivered_legs: legs.filter((l) => l.delivered).map((l) => l.leg),
+            advanced_legs: [],
+            accepted_legs: [],
+            saved_legs: [],
+            withheld_legs: withheldOnly.filter((l) => l.delivered),
+            absent_legs: withheldOnly.filter((l) => !l.delivered),
+            freshness_basis: freshnessBasis,
+            generation_baseline_available: baselineAvailable,
+            legs: withheldOnly,
+            message: buildMessage(freshnessBasis, [], [], withheldOnly.filter((l) => l.delivered), withheldOnly.filter((l) => !l.delivered), persistenceEnabled),
+        };
+    }
+    const savedLegNames = [];
+    for (const leg of legsToSave) {
+        const content = legContent(ctx.envelope, leg.leg);
+        const dir = path.dirname(ctx.canonicalPaths[leg.leg]);
+        const filename = path.basename(ctx.canonicalPaths[leg.leg]);
+        const outcome = await writeCanonicalArtifact(dir, filename, content);
+        if (!outcome.ok) {
+            return {
+                ok: false,
+                error: "ARTIFACT_PERSISTENCE_FAILED",
+                status: 500,
+                message: `Failed to save ${leg.leg} artifact: ${outcome.message}. Sibling artifacts already saved were preserved.`,
+                saved_legs: savedLegNames,
+            };
+        }
+        leg.saved = true;
+        savedLegNames.push(leg.leg);
+    }
+    // Stale-file cleanup: remove the exact canonical target for every withheld
+    // leg so a downstream file-presence read can never reintroduce it. Only
+    // performed once at least one leg was genuinely accepted this call — see
+    // the early return above for the zero-advance case — and only when
+    // persistence is enabled: a classification-only call touches no file at
+    // all, in either direction (BAPI-1129).
+    for (const leg of persistenceEnabled ? withheldCandidates : []) {
+        const outcome = await removeCanonicalArtifact(leg.canonicalPath);
+        if (!outcome.ok) {
+            return {
+                ok: false,
+                error: "ARTIFACT_PERSISTENCE_FAILED",
+                status: 500,
+                message: `Failed to remove withheld ${leg.leg} artifact: ${outcome.message}.`,
+                saved_legs: savedLegNames,
+            };
+        }
+    }
+    const deliveredLegs = legs.filter((l) => l.delivered).map((l) => l.leg);
+    const advancedLegs = legs.filter((l) => l.advanced).map((l) => l.leg);
+    const withheldStatuses = legs.filter((l) => withheldCandidates.some((w) => w.leg === l.leg));
+    const absentStatuses = legs.filter((l) => !l.delivered);
+    const manifest = {
+        ok: true,
+        delivered_legs: deliveredLegs,
+        advanced_legs: advancedLegs,
+        accepted_legs: acceptedLegs.map((l) => l.leg),
+        saved_legs: savedLegNames,
+        withheld_legs: withheldStatuses,
+        absent_legs: absentStatuses,
+        freshness_basis: freshnessBasis,
+        generation_baseline_available: baselineAvailable,
+        legs,
+        message: buildMessage(freshnessBasis, acceptedLegs.map((l) => l.leg), savedLegNames, withheldStatuses, absentStatuses, persistenceEnabled),
+    };
+    // Recorded only after a persistence-enabled call actually landed something.
+    // `savedLegNames` is empty for every suppressed call, so a dry run seeds
+    // nothing and a later persistence-enabled wait still does the real
+    // reconciliation. The `persistenceEnabled` conjunct is redundant today and
+    // deliberately explicit: it keeps the invariant true if the saved-leg
+    // accounting ever changes.
+    if (persistenceEnabled && savedLegNames.length > 0) {
+        recordCompletedResult(ctx.repoName, ctx.ticketNumber, signature, manifest);
+    }
+    return manifest;
+}

package/build/upgrade-cli.js

@@ -41,8 +41,6 @@ import { isNewerVersion } from "./update-check.js";
 import { fetchLatestVersion } from "./cli-release.js";
 import { CANONICAL_UPGRADE_COMMAND } from "./upgrade-advice.js";
 import { describeLauncherReason, inspectLauncherConfigs, isApplicableStandardLauncher, isPrerequisiteFailure, LAUNCHER_CONFIG_TARGETS, } from "./launcher-config-inspection.js";
-import { buildGenericAgentShellCommand, detectTerminal, getDefaultSpawnTerminalTabForPlatform, createDefaultStartTicketsDeps, } from "./start-tickets.js";
-import { AGENT_REGISTRY } from "./agent-registry.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
 /** The sentinel this CLI passes to the child it re-execs from `@latest`. */
 const INTERNAL_REEXEC_FLAG = "--internal-reexec";
@@ -90,21 +88,6 @@ function defaultRemoveCompetingLocalInstall(cwd) {
         child.on("error", () => resolve(false));
     });
 }
-async function defaultSpawnReconnect(cwd, command) {
-    try {
-        const terminal = detectTerminal(undefined, process.env);
-        const deps = createDefaultStartTicketsDeps();
-        const spawnTerminalTab = getDefaultSpawnTerminalTabForPlatform(process.platform);
-        const result = await spawnTerminalTab(deps, terminal, command, {
-            key: "reconnect",
-            worktreePath: cwd,
-        });
-        return result.ok;
-    }
-    catch {
-        return false;
-    }
-}
 /** Build the production dependency set. */
 export function createDefaultUpgradeCliDeps(cwd) {
     return {
@@ -115,7 +98,6 @@ export function createDefaultUpgradeCliDeps(cwd) {
         removeCompetingLocalInstall: defaultRemoveCompetingLocalInstall,
         runInit,
         reexecFromLatest: defaultReexec,
-        spawnReconnect: defaultSpawnReconnect,
         stdout: (m) => console.log(m),
         stderr: (m) => console.error(m),
         env: process.env,
@@ -308,7 +290,7 @@ export async function runUpgradeCli(argv, injected) {
             stdout(`- Would print: Already up-to-date.`);
         }
         stdout(`- Would refresh scaffolded artifacts (commands, agents, pipelines).`);
-        stdout(`- Would open a fresh reconnect session.`);
+        stdout(`- Would print a reminder to reload/restart your MCP.`);
         return 0;
     }
     // ---- Phase 4: competing local install — a reconciliation, not a transition ----
@@ -440,13 +422,10 @@ export async function runUpgradeCli(argv, injected) {
     }
     else {
         stdout(`\nUpgrade complete: launcher pins are at ${target.version}.`);
-        stdout("Please reconnect your MCP now.");
-    }
-    // ---- Phase 8: reconnect — convenience only, never changes the verdict ----
-    const spawnCommand = buildGenericAgentShellCommand(AGENT_REGISTRY.claude, "Bridge API MCP server has been upgraded. Please reload/reconnect the MCP server in your environment.", deps.cwd, process.platform);
-    const spawned = await deps.spawnReconnect(deps.cwd, spawnCommand);
-    if (!spawned) {
-        stdout(`\nTo continue, manually run:\n${spawnCommand}\n`);
+        // The running session still holds the OLD MCP connection — MCP config is only
+        // read at session startup, so a launcher repin does not hot-reload it. Tell the
+        // user the concrete action instead of spawning a fresh session for them.
+        stdout("Reload your MCP now (run /mcp) or restart your session to pick up the upgraded server.");
     }
     return 0;
 }

package/build/version.generated.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.53";
-export const BUILD_COMMIT = "99d75063b906";
-export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.53", "serve"];
+export const VERSION = "0.2.55";
+export const BUILD_COMMIT = "b96c1451f24e";
+export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.55", "serve"];