@bridge_gpt/mcp-server 0.2.53 → 0.2.55

package/build/conductor/doctor.js

@@ -1,5 +1,5 @@
 /**
- * Combined, strictly read-only conductor doctor report (BAPI-395, BAPI-418).
+ * Combined, strictly read-only epic-implementer doctor report (BAPI-395, BAPI-418).
  *
  * Extends the existing SQLite ledger health report with local git hook health.
  * Missing hooks and non-worktree directories are reported as a degraded
@@ -63,10 +63,67 @@ export const MCP_REGISTRATION_FORM_REMEDIATION = "build this package so an on-di
 export const NODE_ENGINE_REMEDIATION = "reinstall the package so its package.json is readable; until then the expected Node version is " +
     "unknown and a Node/ABI skew cannot be diagnosed.";
 /** Remediation for a deny-enforcement result the readiness gate could not establish. */
-export const DENY_ENFORCEMENT_SKIP_REMEDIATION = "run `conductor doctor` (without --no-deny-probe) to execute the owning deny-enforcement " +
-    "preflight; `conductor readiness` never spawns that probe itself.";
+export const DENY_ENFORCEMENT_SKIP_REMEDIATION = "run `epic-implementer doctor` (without --no-deny-probe) to execute the owning deny-enforcement " +
+    "preflight; `epic-implementer readiness` never spawns that probe itself.";
 /** Explicit display value for an unset `BRIDGE_MCP_PROFILE`. */
 export const MCP_PROFILE_UNSET = "(unset)";
+/**
+ * The CLI-only verbs that call the Bridge API from a shell-spawned process and
+ * therefore resolve credentials themselves (CLAUDE.md "Shell-Spawned Credential
+ * Resolution"): the four BAPI-872 recovery verbs and the three BAPI-1154 repair
+ * verbs. `.mcp.json` env is invisible to them — only `BAPI_API_KEY` in the parent
+ * env and the user-scoped credential store count.
+ */
+export const CREDENTIALED_RECOVERY_COMMANDS = [
+    "stop-run",
+    "abandon-run",
+    "unpark",
+    "adopt-current-head-and-unpark",
+    "scope-reparse",
+    "dispatch-remediation",
+    "merge-child",
+];
+/** Remediation for recovery/repair verbs that cannot resolve Bridge credentials. */
+export const REPAIR_CREDENTIAL_REMEDIATION = "export BAPI_API_KEY in the shell that runs `conductor`, or store a credential for this " +
+    "repository in ~/.config/bridge/credentials.json (target `bapi:<repo>`) — for example by " +
+    "re-running the Bridge install; `.mcp.json` env is not visible to a shell-spawned command. " +
+    "Diagnostic only: nothing is written for you.";
+/**
+ * Inspect credential resolution for the recovery/repair verbs through the SAME
+ * shared resolver they use (`resolveConductorBridgeApiAccess` →
+ * `resolveBapiCredentials`). Read-only: it resolves, it never stores, migrates,
+ * or repairs anything, and it never calls the Bridge API. Any resolver failure
+ * — including a throw — is reported as unavailable, never as an exception.
+ */
+export async function inspectRepairVerbCredentials(env, resolve) {
+    let outcome;
+    try {
+        let run = resolve;
+        if (!run) {
+            // Lazy: keeps the credential/HTTP graph out of doctor.ts's static imports,
+            // exactly as the recovery verbs themselves load it.
+            const mod = await import("./bridge-api-client.js");
+            run = (d) => mod.resolveConductorBridgeApiAccess(d);
+        }
+        outcome = await run({ env });
+    }
+    catch {
+        outcome = { ok: false, kind: "credentials-unavailable" };
+    }
+    if (outcome.ok) {
+        return { commands: CREDENTIALED_RECOVERY_COMMANDS, available: true, kind: "available", warnings: [] };
+    }
+    const kind = typeof outcome.kind === "string" && outcome.kind ? outcome.kind : "credentials-unavailable";
+    return {
+        commands: CREDENTIALED_RECOVERY_COMMANDS,
+        available: false,
+        kind,
+        warnings: [
+            `Recovery/repair verbs (${CREDENTIALED_RECOVERY_COMMANDS.join(", ")}) cannot resolve Bridge ` +
+                `API credentials (${kind}): ${REPAIR_CREDENTIAL_REMEDIATION}`,
+        ],
+    };
+}
 /**
  * Explicit not-run state for the `deny_enforcement` section when the probe is
  * skipped via `--no-deny-probe`. Enforcement is UNVERIFIED, so the state is
@@ -495,6 +552,7 @@ export async function buildConductorDoctorReport(deps = {}) {
         native_ledger,
         deny_enforcement,
         claude_login,
+        repair_credentials: await inspectRepairVerbCredentials(deps.env ?? process.env, deps.resolveRepairAccess),
     };
 }
 /**
@@ -615,6 +673,19 @@ export function formatConductorDoctorReport(report) {
         for (const w of local_merge.warnings)
             lines.push(`  - ${w}`);
     }
+    if (report.repair_credentials) {
+        const repair = report.repair_credentials;
+        lines.push("");
+        lines.push("Recovery/repair verb credentials (shell-spawned)");
+        lines.push("────────────────────────────────────────────────");
+        lines.push(`credentials resolve:   ${repair.available} ${repair.available ? "[OK]" : `[WARNING] ${repair.kind}`}`);
+        lines.push(`commands:              ${repair.commands.join(", ")}`);
+        if (repair.warnings.length > 0) {
+            lines.push("recovery credential warnings:");
+            for (const w of repair.warnings)
+                lines.push(`  - ${w}`);
+        }
+    }
     lines.push("");
     lines.push("Native ledger module (required for conductor coordination)");
     lines.push("─────────────────────────────────────────────────────────");
@@ -685,18 +756,18 @@ export const CONDUCTOR_READINESS_DESCRIPTORS = [
     { id: "claude-login", label: "Claude login" },
 ];
 /** Remediation for a degraded local event ledger. */
-export const CONDUCTOR_LEDGER_REMEDIATION = "run `conductor doctor` for the ledger detail, then re-create the local ledger directory with " +
+export const CONDUCTOR_LEDGER_REMEDIATION = "run `epic-implementer doctor` for the ledger detail, then re-create the local ledger directory with " +
     "owner-only permissions; the ledger is local observability and never blocks a run.";
 /** Remediation for degraded or missing managed git hooks. */
-export const CONDUCTOR_GIT_HOOKS_REMEDIATION = "run `conductor install-git-hooks` to install the managed post-commit and reference-transaction " +
+export const CONDUCTOR_GIT_HOOKS_REMEDIATION = "run `epic-implementer install-git-hooks` to install the managed post-commit and reference-transaction " +
     "hooks; they are local, opportunistic, and bypassable.";
 /** Remediation for a Claude login this host cannot confirm. */
 export const CONDUCTOR_CLAUDE_LOGIN_REMEDIATION = "run `claude login` on the host that will run conductor workers; Bridge stores no Anthropic " +
     "credential and can only advise here.";
 /** Fixed detail for a prerequisite whose owning inspection was not collected. */
-const CONDUCTOR_UNCOLLECTED_DETAIL = "not collected — the conductor doctor did not report this inspection";
+const CONDUCTOR_UNCOLLECTED_DETAIL = "not collected — the epic-implementer doctor did not report this inspection";
 /** Fixed remediation for a prerequisite whose owning inspection was not collected. */
-const CONDUCTOR_UNCOLLECTED_REMEDIATION = "run `conductor doctor` directly to collect this inspection; its state is unknown, not healthy.";
+const CONDUCTOR_UNCOLLECTED_REMEDIATION = "run `epic-implementer doctor` directly to collect this inspection; its state is unknown, not healthy.";
 /** Ordered outcomes an inspection contributed, or `[]` when it reported none. */
 function outcomesOf(inspection) {
     // Read defensively: an injected sentinel (and the installer's degraded-doctor
@@ -761,7 +832,7 @@ function gitHooksOutcome(report) {
 /**
  * Derive the deny-enforcement outcome.
  *
- * `conductor readiness` NEVER runs the owning probe: `runDenyEnforcementPreflight`
+ * `epic-implementer readiness` NEVER runs the owning probe: `runDenyEnforcementPreflight`
  * spawns real headless agent runs costing minutes, and an advisory report is not
  * a reason to pay that. When the report carries an explicitly skipped result the
  * outcome is `skip` with a remediation naming the command that DOES run it —
@@ -829,7 +900,7 @@ function claudeLoginOutcome(report) {
  * reword, and a gate that read it would change meaning on a copy edit.
  *
  * A null report yields the full descriptor set as failures rather than nothing:
- * "the conductor doctor could not be built" must not read as "there is nothing
+ * "the epic-implementer doctor could not be built" must not read as "there is nothing
  * to report here".
  */
 export function mapConductorDoctorReportToReadinessChecks(report) {