@bridge_gpt/mcp-server 0.2.56 → 0.2.58

package/README.md

@@ -242,6 +242,23 @@ npx -y @bridge_gpt/mcp-server doctor
 `doctor` is strictly read-only. It reports what it found — configs, registrations,
 credential availability, prerequisites — and changes nothing.
 
+**Codex approval profile.** When selecting Codex during interactive `install`,
+press Enter to accept the default Yes at the profile prompt, or answer `n`/`no`
+to decline. Pass `--tools=codex --codex-profile=on` in a scripted install. Bridge
+creates `$CODEX_HOME/bridge.config.toml` (default `~/.codex/bridge.config.toml`)
+with approval settings for the tools used by its review and implementation
+workflows. Bridge-spawned Codex workers then select it automatically, including
+the fresh implementation session after review. Pass `--codex-profile=off` to
+decline; the installer leaves any existing profile content intact. On package
+upgrade, the next Bridge-spawned worker refreshes an older, unmodified managed
+profile before launch. If a profile
+already contains user-authored or conflicting content, the installer leaves it
+untouched and reports that workers cannot use it. Run `doctor --agent codex` to
+inspect the current status. To use the profile in a Codex session you open
+yourself, run `codex --profile bridge`. Bridge `--auto` controls recipe gates;
+Codex MCP tool approvals are a separate setting. The profile does not change
+global `sandbox_mode` or `approval_policy`.
+
 </details>
 
 <details>
@@ -351,7 +368,7 @@ later boot.
   "mcpServers": {
     "bridge": {
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.56", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.58", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -373,7 +390,7 @@ later boot.
     "bridge": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.56", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.58", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -395,7 +412,7 @@ later boot.
     "bridge": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.56", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.58", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -418,7 +435,7 @@ Windsurf only supports global MCP configuration.
   "mcpServers": {
     "bridge": {
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.56", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.58", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -437,7 +454,7 @@ Windsurf only supports global MCP configuration.
 ```toml
 [mcp_servers.bridge]
 command = "npx"
-args = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.56", "serve"]
+args = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.58", "serve"]
 
 [mcp_servers.bridge.env]
 BAPI_BASE_URL = "https://bridgegpt-api.com"
@@ -1555,7 +1572,7 @@ The authoritative tool catalog covers **75 tools** (enumerated below). What's ac
 - **Jira tickets** — `get_tickets`, `get_ticket`, `create_ticket`, `update_ticket_description`, `add_comment`, `get_comments`
 - **Attachments** — `attachment` (operations: `upload`, `download`, `list`)
 - **AI generation (request/get)** — `request_plan_generation`/`get_plan`, `create_doc`/`get_doc` (design docs by `doc_type`: tdd/architecture/fsd/prd, where `architecture` is an alias of `tdd`), `request_ticket_review` (writes both `get_clarifying_questions` and `get_ticket_critique`), `request_reimplement_context`/`get_reimplement_context`, `request_council`/`get_council`, `request_deep_research`/`get_deep_research`
-- **Bounded waits** — `wait_for_ticket_review`, `wait_for_ci_checks`. Each call waits at most 240 s and returns `state: "ready" | "pending" | "error"`; `pending` is a normal, resumable result you call again on, never a failure. They exist so an agent can wait without a foreground `sleep` and without binding a long server-side operation to the 900 s MCP client deadline. `wait_for_ci_checks` reports only that checks are **terminal** — deciding pass or fail stays with the caller.
+- **Bounded waits** — `wait_for_ticket_review`, `wait_for_ci_checks`. Each returns `state: "ready" | "pending" | "error"`; review waits default to 20 s and CI waits default to 240 s (both accept up to 240 s explicitly). `pending` is a normal, resumable result you call again on, never a failure. They exist so an agent can wait without a foreground `sleep` and without binding a long server-side operation to the 900 s MCP client deadline. `wait_for_ci_checks` reports only that checks are **terminal** — deciding pass or fail stays with the caller.
 - **Other AI** — `second_opinion`, `generate_image`, `generate_decision_page`, `visual_diff` (deterministic pixel diff of a rendered URL vs a design comp)
 - **Ticket lifecycle** — `track_ticket`, `update_ticket_state`, `get_ticket_state`, `get_ticket_state_tree` (live repo-wide lifecycle + dependency tree; read-only, no mutation parameter)
 - **Jira status** — `update_jira_status` (pass `status: "auto"` to resolve the configured post-PR status server-side)

package/build/codex-bridge-profile.js

@@ -0,0 +1,155 @@
+/** Secret-free, opt-in approval settings for Bridge-spawned Codex workers. */
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { codexBridgeTableNames } from "./mcp-host-config.js";
+import { MCP_SERVER_NAME } from "./mcp-identity.js";
+export { codexHome } from "./codex-home.js";
+export const BRIDGE_CODEX_PROFILE = "bridge";
+const PROFILE_FILE = "bridge.config.toml";
+const STATE_FILE = "bridge.profile-state.json";
+const MARKER = "# Bridge-managed Codex approval profile (BAPI-1214)";
+/** Tools called by review-and-start, review-and-implement, and implement-ticket. */
+export const BRIDGE_WORKFLOW_TOOLS = [
+    "ping", "get_ticket", "get_pipeline_recipe", "request_ticket_review",
+    "wait_for_ticket_review", "fresh_base", "generate_decision_page",
+    "capture_review_decisions", "request_plan_generation", "get_plan",
+    "attachment",
+    "get_phase_context", "record_phase_result", "create_pull_request",
+    "update_jira_status", "config_field", "resolve_ci_checks", "poll_ci_checks",
+    "wait_for_ci_checks",
+];
+export function codexProfilePaths(home) {
+    return {
+        profile: path.join(home, PROFILE_FILE),
+        state: path.join(home, STATE_FILE),
+        config: path.join(home, "config.toml"),
+    };
+}
+export function renderBridgeCodexProfile(key) {
+    return [
+        MARKER,
+        `# Applies only when selected with codex --profile ${BRIDGE_CODEX_PROFILE}.`,
+        ...BRIDGE_WORKFLOW_TOOLS.flatMap((tool) => [
+            `[mcp_servers.${key}.tools.${tool}]`,
+            'approval_mode = "auto"',
+            "",
+        ]),
+    ].join("\n") + "\n";
+}
+function fingerprint(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+async function optionalRead(readFile, filePath) {
+    try {
+        return await readFile(filePath);
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? null : undefined;
+    }
+}
+/** Only a matching managed file and explicit enabled state can activate workers. */
+export async function inspectBridgeCodexProfile(home, readFile) {
+    const paths = codexProfilePaths(home);
+    const [config, profile, state] = await Promise.all([
+        optionalRead(readFile, paths.config),
+        optionalRead(readFile, paths.profile),
+        optionalRead(readFile, paths.state),
+    ]);
+    if (config === undefined || profile === undefined || state === undefined)
+        return { status: "unreadable" };
+    const names = codexBridgeTableNames(config ?? "");
+    if (names.length > 1)
+        return { status: "conflict" };
+    const key = names[0] ?? MCP_SERVER_NAME;
+    if (state === null)
+        return { status: profile === null ? "missing" : "conflict", key };
+    let parsed;
+    try {
+        parsed = JSON.parse(state);
+    }
+    catch {
+        return { status: "conflict", key };
+    }
+    if (!parsed || typeof parsed !== "object" || !("enabled" in parsed) || typeof parsed.enabled !== "boolean") {
+        return { status: "conflict", key };
+    }
+    if (!parsed.enabled)
+        return { status: "declined", key };
+    if (profile === null || !("hash" in parsed) || typeof parsed.hash !== "string")
+        return { status: "conflict", key };
+    if (fingerprint(profile) !== parsed.hash)
+        return { status: "conflict", key };
+    if (profile !== renderBridgeCodexProfile(key)) {
+        return { status: profile.startsWith(MARKER) ? "stale" : "conflict", key };
+    }
+    return { status: "active", key };
+}
+export async function configureBridgeCodexProfile(home, choice, deps) {
+    const paths = codexProfilePaths(home);
+    const current = await inspectBridgeCodexProfile(home, deps.readFile);
+    if (choice === "decline") {
+        const oldState = await optionalRead(deps.readFile, paths.state);
+        if (oldState === undefined)
+            return { status: "unreadable" };
+        let existingHash;
+        if (oldState !== null) {
+            try {
+                const parsed = JSON.parse(oldState);
+                if (!parsed || typeof parsed.enabled !== "boolean")
+                    return { status: "conflict" };
+                if (typeof parsed.hash === "string")
+                    existingHash = parsed.hash;
+            }
+            catch {
+                return { status: "conflict" };
+            }
+        }
+        await deps.mkdir(home, { recursive: true });
+        await deps.writeFile(paths.state, JSON.stringify({ enabled: false, ...(existingHash ? { hash: existingHash } : {}) }) + "\n");
+        return { status: "declined", key: current.key };
+    }
+    if (current.status === "unreadable")
+        return current;
+    const config = await optionalRead(deps.readFile, paths.config);
+    if (config === undefined)
+        return { status: "unreadable" };
+    const names = codexBridgeTableNames(config ?? "");
+    if (names.length > 1)
+        return { status: "conflict" };
+    const key = names[0] ?? MCP_SERVER_NAME;
+    const existing = await optionalRead(deps.readFile, paths.profile);
+    const oldState = await optionalRead(deps.readFile, paths.state);
+    const desired = renderBridgeCodexProfile(key);
+    if (existing === undefined || oldState === undefined)
+        return { status: "unreadable", key };
+    if (oldState !== null) {
+        try {
+            const parsed = JSON.parse(oldState);
+            if (!parsed || typeof parsed.enabled !== "boolean" ||
+                (parsed.enabled && (typeof parsed.hash !== "string" || existing === null || parsed.hash !== fingerprint(existing)))) {
+                return { status: "conflict", key };
+            }
+        }
+        catch {
+            return { status: "conflict", key };
+        }
+    }
+    // Existing user content is never modified or implicitly adopted.
+    if (existing !== null && existing !== desired) {
+        let managed = false;
+        if (oldState !== null && existing.startsWith(MARKER)) {
+            try {
+                const parsed = JSON.parse(oldState);
+                managed = typeof parsed?.enabled === "boolean" && parsed?.hash === fingerprint(existing);
+            }
+            catch { /* malformed state cannot authorize a rewrite */ }
+        }
+        if (!managed)
+            return { status: "conflict", key };
+    }
+    await deps.mkdir(home, { recursive: true });
+    if (existing !== desired)
+        await deps.writeFile(paths.profile, desired);
+    await deps.writeFile(paths.state, JSON.stringify({ enabled: true, hash: fingerprint(desired) }) + "\n");
+    return { status: "active", key };
+}

package/build/codex-home.js

@@ -0,0 +1,7 @@
+import path from "node:path";
+import os from "node:os";
+/** Codex's user config root; only an absolute CODEX_HOME is accepted. */
+export function codexHome(env, homedir = os.homedir()) {
+    const override = env.CODEX_HOME?.trim();
+    return override && path.isAbsolute(override) ? override : path.join(homedir, ".codex");
+}

package/build/codex-launch-scope.js

@@ -1,15 +1,12 @@
 /** Per-process Codex MCP scope, derived from the same manifest and shim as worktree provisioning. */
 import { readBridgeConfig } from "./bridge-config.js";
-import os from "node:os";
 import { codexBridgeTableNames } from "./mcp-host-config.js";
-import { MCP_HOST_TARGETS, resolveHostTargetPath } from "./mcp-host-targets.js";
+import { codexHome } from "./codex-home.js";
+import { codexProfilePaths, configureBridgeCodexProfile, inspectBridgeCodexProfile, BRIDGE_CODEX_PROFILE } from "./codex-bridge-profile.js";
 import { buildMcpServerEntriesForManifest, normalizeWorktreePathForRegistration, } from "./mcp-provisioning.js";
 import { MCP_SERVER_NAME } from "./mcp-identity.js";
-function tomlEntry(entry) {
-    return `{ command = ${JSON.stringify(entry.command)}, args = [${entry.args.map((arg) => JSON.stringify(arg)).join(", ")}] }`;
-}
 /** A missing Bridge target is a launch failure, never a fallback to user-scoped config. */
-export async function resolveCodexLaunchScope(root, deps, codexConfigPath = resolveHostTargetPath(MCP_HOST_TARGETS.codex, { cwd: root, homedir: os.homedir() })) {
+export async function resolveCodexLaunchScope(root, deps, codexConfigPath = codexProfilePaths(codexHome(deps.env ?? process.env, deps.homedir?.())).config) {
     const normalized = normalizeWorktreePathForRegistration(root, deps);
     if (!normalized.ok)
         return { ok: false, error: "Codex MCP scope unavailable: invalid repository path." };
@@ -41,9 +38,28 @@ export async function resolveCodexLaunchScope(root, deps, codexConfigPath = reso
         return { ok: false, error: "Codex MCP scope unavailable: duplicate Bridge registrations in Codex host config." };
     }
     const bridgeKey = registeredNames[0] ?? MCP_SERVER_NAME;
+    const home = codexHome(deps.env ?? process.env, deps.homedir?.());
+    let profile = await inspectBridgeCodexProfile(home, deps.readFile);
+    if (profile.status === "stale") {
+        try {
+            profile = await configureBridgeCodexProfile(home, "enable", deps);
+        }
+        catch {
+            return { ok: false, error: "Codex MCP scope unavailable: could not refresh the managed Bridge approval profile." };
+        }
+        if (profile.status !== "active") {
+            return { ok: false, error: "Codex MCP scope unavailable: managed Bridge approval profile refresh failed." };
+        }
+    }
     const argv = ["-C", normalized.path];
+    if (profile.status === "active" && profile.key === bridgeKey)
+        argv.push("--profile", BRIDGE_CODEX_PROFILE);
     for (const [name, entry] of Object.entries(built.entries)) {
-        argv.push("-c", `mcp_servers.${name === MCP_SERVER_NAME ? bridgeKey : name}=${tomlEntry(entry)}`);
+        const key = name === MCP_SERVER_NAME ? bridgeKey : name;
+        // Field-level overrides retain the profile's mcp_servers.<key>.tools policy.
+        argv.push("-c", `mcp_servers.${key}.command=${JSON.stringify(entry.command)}`);
+        argv.push("-c", `mcp_servers.${key}.args=${JSON.stringify(entry.args)}`);
+        argv.push("-c", `mcp_servers.${key}.enabled=true`);
     }
     return { ok: true, argv };
 }