@bridge_gpt/mcp-server 0.2.58 → 0.2.60

package/build/conductor/bridge-api-client.js

@@ -364,8 +364,15 @@ export function safeDiagnosticMessage(err, fallback) {
     }
     return fallback;
 }
-/** GET auth headers. The API key travels ONLY in a header, never in the URL. */
-function conductorGetHeaders(access) {
+/**
+ * GET auth headers. The API key travels ONLY in a header, never in the URL.
+ *
+ * Exported (BAPI-1133) so a caller outside this module — `setup-epic.ts`'s
+ * {@link ConductorBridgeApiAccess}-based adapter for
+ * `resolveMergeExecutionMode`'s narrow dependency shape — can build the same
+ * headers without a second copy of this one-line mapping.
+ */
+export function conductorGetHeaders(access) {
     return { "X-API-Key": access.apiKey };
 }
 /**
@@ -1331,6 +1338,155 @@ export async function completeMergeChild(access, request, fetchImpl = globalThis
     }, fetchImpl);
     return parseMergeChildRouteResponse(parsed);
 }
+// ---------------------------------------------------------------------------
+// BAPI-1176 — scope-catch-up, patch-policy, resume-run (CLI-only; no MCP tool)
+// ---------------------------------------------------------------------------
+// The same request path as the BAPI-1154 clients above, with STRICT parsers: a
+// response carrying any field outside its documented set is refused, so a server
+// that ever returned a generation, a control record, or a policy value would fail
+// closed here rather than reach operator output. No parser error echoes the body.
+/** The fields every repair response carries. */
+const REPAIR_BASE_KEYS = [
+    "epic_run_id",
+    "before",
+    "after",
+    "committed",
+    "event_recorded",
+];
+/** A bounded, closed-vocabulary token (a catch-up outcome such as `parse_scheduled`). */
+const REPAIR_TOKEN_RE = /^[a-z0-9_.:-]{1,120}$/;
+/** A `patch-policy` digest display token: `policy:` and twelve lowercase hex digits. */
+const POLICY_DIGEST_TOKEN_RE = /^policy:[0-9a-f]{12}$/;
+/** A dotted policy-path NAME. Never a value. */
+const POLICY_PATH_RE = /^[A-Za-z0-9_-]{1,100}(?:\.[A-Za-z0-9_-]{1,100}){0,15}$/;
+/** `resume-run`'s closed run-control state vocabulary. */
+const RESUME_RUN_STATES = ["paused", "quarantined", "none"];
+function requireOnlyRepairKeys(p, extraKeys) {
+    for (const key of Object.keys(p)) {
+        if (!REPAIR_BASE_KEYS.includes(key) && !extraKeys.includes(key)) {
+            throw new ConductorBridgeApiError("server");
+        }
+    }
+}
+function parseStrictNullableString(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== "string") {
+        throw new ConductorBridgeApiError("server");
+    }
+    return value;
+}
+function parseScopeCatchUpResult(parsed) {
+    const p = parseRepairBase(parsed);
+    requireOnlyRepairKeys(p, ["scope_id", "outcome", "parse_scheduled"]);
+    const scopeId = p["scope_id"];
+    const outcome = p["outcome"];
+    const parseScheduled = p["parse_scheduled"];
+    if (typeof scopeId !== "string" ||
+        typeof outcome !== "string" ||
+        !REPAIR_TOKEN_RE.test(outcome) ||
+        typeof parseScheduled !== "boolean") {
+        throw new ConductorBridgeApiError("server");
+    }
+    return {
+        epic_run_id: p["epic_run_id"],
+        scope_id: scopeId,
+        before: parseStrictNullableString(p["before"]),
+        after: parseStrictNullableString(p["after"]),
+        committed: p["committed"],
+        event_recorded: p["event_recorded"],
+        outcome,
+        parse_scheduled: parseScheduled,
+    };
+}
+function parsePatchPolicyResult(parsed) {
+    const p = parseRepairBase(parsed);
+    requireOnlyRepairKeys(p, ["policy_paths"]);
+    const before = p["before"];
+    const after = p["after"];
+    const paths = p["policy_paths"];
+    if (typeof before !== "string" ||
+        !POLICY_DIGEST_TOKEN_RE.test(before) ||
+        typeof after !== "string" ||
+        !POLICY_DIGEST_TOKEN_RE.test(after) ||
+        !Array.isArray(paths) ||
+        !paths.every((path) => typeof path === "string" && POLICY_PATH_RE.test(path))) {
+        throw new ConductorBridgeApiError("server");
+    }
+    return {
+        epic_run_id: p["epic_run_id"],
+        before,
+        after,
+        committed: p["committed"],
+        event_recorded: p["event_recorded"],
+        policy_paths: [...paths],
+    };
+}
+function parseResumeRunResult(parsed) {
+    const p = parseRepairBase(parsed);
+    requireOnlyRepairKeys(p, []);
+    const before = p["before"];
+    const after = p["after"];
+    if (typeof before !== "string" ||
+        !RESUME_RUN_STATES.includes(before) ||
+        typeof after !== "string" ||
+        !RESUME_RUN_STATES.includes(after)) {
+        throw new ConductorBridgeApiError("server");
+    }
+    return {
+        epic_run_id: p["epic_run_id"],
+        before,
+        after,
+        committed: p["committed"],
+        event_recorded: p["event_recorded"],
+    };
+}
+/**
+ * POST `/jira/epic-runs/runs/{epic_run_id}/scope-catch-up` — replay merges the
+ * run's OWN index scope did not observe, through the unchanged guarded advance
+ * gate. Body EXACTLY `{repo_name, scope_id}`: no force flag and no caller-supplied
+ * commit. The server refuses a scope not bound to the run (`404
+ * TICKET_NOT_IN_RUN`) and a blocked advance (`409 SCOPE_CATCH_UP_REFUSED`).
+ */
+export async function scopeCatchUp(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    requireNonEmptyString(request.scopeId);
+    const parsed = await postRepairRequest(access, `${epicRunApiPath(request.epicRunId)}/scope-catch-up`, { scope_id: request.scopeId }, fetchImpl);
+    return parseScopeCatchUpResult(parsed);
+}
+/**
+ * POST `/jira/epic-runs/runs/{epic_run_id}/patch-policy` — body EXACTLY
+ * `{repo_name, merge_patch}`. The SERVER reads the stored policy, applies the RFC
+ * 7396 merge patch, validates the result, and writes it under a snapshot guard.
+ * This is deliberately never `replaceEpicRunPolicy`: the client never reads,
+ * holds, or sends a whole policy, so a server-retained value it cannot see (the
+ * webhook URL) can never be dropped by a read-modify-write.
+ */
+export async function patchPolicy(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    const patch = request.mergePatch;
+    if (!patch ||
+        typeof patch !== "object" ||
+        Array.isArray(patch) ||
+        Object.keys(patch).length === 0) {
+        throw new ConductorBridgeApiError("invalid-input");
+    }
+    const parsed = await postRepairRequest(access, `${epicRunApiPath(request.epicRunId)}/patch-policy`, { merge_patch: patch }, fetchImpl);
+    return parsePatchPolicyResult(parsed);
+}
+/**
+ * POST `/jira/epic-runs/runs/{epic_run_id}/resume-run` — body EXACTLY
+ * `{repo_name, clear_quarantine}`. No generation and no reason: the server
+ * re-reads the control record, re-evaluates activation, and owns the CAS retry.
+ */
+export async function resumeRun(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    if (typeof request.clearQuarantine !== "boolean") {
+        throw new ConductorBridgeApiError("invalid-input");
+    }
+    const parsed = await postRepairRequest(access, `${epicRunApiPath(request.epicRunId)}/resume-run`, { clear_quarantine: request.clearQuarantine }, fetchImpl);
+    return parseResumeRunResult(parsed);
+}
 /**
  * Idempotently seed an epic ticket status row via POST to the per-epic tickets
  * endpoint. The backend uses ON CONFLICT DO NOTHING so repeated seeding across
@@ -1940,6 +2096,8 @@ export const CONDUCTOR_REVIEW_ALIGNMENT_STATUSES = new Set([
 export const READINESS_FRESH_RECONCILER_COUNT_CAP = 2;
 const READINESS_SOURCES = new Set(["epic", "project_default", "none"]);
 const ACTIONS_LEVELS = new Set(["write", "read", "none", "unknown"]);
+/** The one scope the server reports for the merge-execution block (BAPI-1135). */
+const MERGE_EXECUTION_BRANCH_SCOPES = new Set(["default_branch"]);
 function readinessShapeError() {
     // Deliberately carries NO field name, value, or payload excerpt: a malformed
     // body is untrusted input and its contents must not reach output.
@@ -2091,6 +2249,48 @@ export function parseConductorReadinessResponse(body) {
         conductor_ci_workflow: parseConductorCiWorkflow(root),
         unattended: parseUnattended(root),
         bring_up: parseBringUp(root),
+        merge_execution: parseMergeExecution(root),
+    };
+}
+/**
+ * Parse the optional `merge_execution` block (BAPI-1135).
+ *
+ * Same older-server rule as every optional block above: absent (or null) is
+ * `null`, and a PRESENT block is validated strictly — every boolean through
+ * `requireBool`, the scope through the shared enum parser, and the version as
+ * either `null` or a non-negative integer through `requireInt`.
+ *
+ * A malformed PRESENT block or a malformed present FIELD throws, and is never
+ * degraded to `null`. The distinction is load-bearing: `null` means "this server
+ * does not report it", which is a server-version fact, while a block that claims
+ * to carry merge eligibility and cannot be read is untrusted input. Silently
+ * turning the second into the first would let a corrupt body masquerade as an
+ * older deploy, and the two have different remediations.
+ */
+function parseMergeExecution(body) {
+    const raw = body.merge_execution;
+    if (raw === undefined || raw === null)
+        return null;
+    const o = requireObject(raw);
+    const version = o.merge_workflow_version;
+    let parsedVersion;
+    if (version === null || version === undefined) {
+        parsedVersion = null;
+    }
+    else {
+        parsedVersion = requireInt(o, "merge_workflow_version");
+        if (parsedVersion < 0)
+            throw readinessShapeError();
+    }
+    return {
+        branch_scope: requireEnum(o, "branch_scope", MERGE_EXECUTION_BRANCH_SCOPES),
+        branch_protection_probe_succeeded: requireBool(o, "branch_protection_probe_succeeded"),
+        branch_protection_actions_bot_admitted: requireBool(o, "branch_protection_actions_bot_admitted"),
+        merge_workflow_probe_succeeded: requireBool(o, "merge_workflow_probe_succeeded"),
+        merge_workflow_present: requireBool(o, "merge_workflow_present"),
+        merge_workflow_enabled: requireBool(o, "merge_workflow_enabled"),
+        merge_workflow_version: parsedVersion,
+        merge_workflow_token_write_authority: requireBool(o, "merge_workflow_token_write_authority"),
     };
 }
 /**

package/build/conductor/bring-up-facts.js

@@ -1,5 +1,5 @@
 /** The pinned operator runbook every remedy below points into. */
-export const BRING_UP_RUNBOOK = "docs/claude/epic-conductor-v2-operator-runbook.md";
+export const BRING_UP_RUNBOOK = "docs/claude/epic-implementer-v2-operator-runbook.md";
 /**
  * The client-derived refusal vocabulary, IN REFUSAL ORDER.
  *

package/build/conductor/claude-hook.js

@@ -87,10 +87,10 @@ export function mapClaudeHookEventToSemanticType(eventName) {
 }
 /** Conductor identity env required before any worker event may be emitted. */
 const REQUIRED_IDENTITY_ENV = [
-    "BAPI_CONDUCTOR_RUN_ID",
-    "BAPI_CONDUCTOR_WORKER_ID",
-    "BAPI_CONDUCTOR_TICKET_KEY",
-    "BAPI_CONDUCTOR_WORKTREE_PATH",
+    "BAPI_EPIC_IMPLEMENTER_RUN_ID",
+    "BAPI_EPIC_IMPLEMENTER_WORKER_ID",
+    "BAPI_EPIC_IMPLEMENTER_TICKET_KEY",
+    "BAPI_EPIC_IMPLEMENTER_WORKTREE_PATH",
 ];
 function nonEmpty(value) {
     return typeof value === "string" && value.trim().length > 0;
@@ -100,7 +100,7 @@ function nonEmpty(value) {
  * the process environment, or `null` when the event is unmapped or the
  * conductor identity is incomplete.
  *
- * Identity gating: requires `BAPI_CONDUCTOR_ENABLED=1` and all of
+ * Identity gating: requires `BAPI_EPIC_IMPLEMENTER_ENABLED=1` and all of
  * {@link REQUIRED_IDENTITY_ENV}. Any missing value returns `null` WITHOUT
  * emitting — this prevents accidental emissions from unrelated worktrees that
  * happen to have the hook on PATH.
@@ -116,7 +116,7 @@ export function buildClaudeHookConductorEvent(payload, env) {
     if (type === null) {
         return null;
     }
-    if (env.BAPI_CONDUCTOR_ENABLED !== "1") {
+    if (env.BAPI_EPIC_IMPLEMENTER_ENABLED !== "1") {
         return null;
     }
     for (const key of REQUIRED_IDENTITY_ENV) {
@@ -124,14 +124,14 @@ export function buildClaudeHookConductorEvent(payload, env) {
             return null;
         }
     }
-    const ticketKey = env.BAPI_CONDUCTOR_TICKET_KEY.trim();
-    const worktreePath = env.BAPI_CONDUCTOR_WORKTREE_PATH.trim();
+    const ticketKey = env.BAPI_EPIC_IMPLEMENTER_TICKET_KEY.trim();
+    const worktreePath = env.BAPI_EPIC_IMPLEMENTER_WORKTREE_PATH.trim();
     const details = {
         ticket_key: ticketKey,
         worktree_path: worktreePath,
     };
-    if (nonEmpty(env.BAPI_CONDUCTOR_REPO_NAME)) {
-        details.repo = env.BAPI_CONDUCTOR_REPO_NAME.trim();
+    if (nonEmpty(env.BAPI_EPIC_IMPLEMENTER_REPO_NAME)) {
+        details.repo = env.BAPI_EPIC_IMPLEMENTER_REPO_NAME.trim();
     }
     // The native payload lives ONLY under data.raw. Wrap non-object payloads so the
     // raw contract is always an object, never echoing native fields elsewhere.
@@ -142,8 +142,8 @@ export function buildClaudeHookConductorEvent(payload, env) {
         source: "claude-code",
         type,
         subject: ticketKey,
-        run_id: env.BAPI_CONDUCTOR_RUN_ID.trim(),
-        worker_id: env.BAPI_CONDUCTOR_WORKER_ID.trim(),
+        run_id: env.BAPI_EPIC_IMPLEMENTER_RUN_ID.trim(),
+        worker_id: env.BAPI_EPIC_IMPLEMENTER_WORKER_ID.trim(),
         producer: "claude-code-hook",
         observed_via: "claude-code-hook",
         data: {
@@ -176,21 +176,21 @@ export function buildConductorEmitEventArgs(event) {
 }
 /**
  * Resolve how to invoke `epic-implementer emit-event`. Prefers
- * `BAPI_CONDUCTOR_CLI_FILE` (run via the current Node executable so no global
- * install is required), otherwise falls back to `BAPI_CONDUCTOR_BIN` or the
+ * `BAPI_EPIC_IMPLEMENTER_CLI_FILE` (run via the current Node executable so no global
+ * install is required), otherwise falls back to `BAPI_EPIC_IMPLEMENTER_BIN` or the
  * bare `epic-implementer` binary on PATH — never the retained `conductor`
  * name, which is now a fixed migration stub (S4/BAPI-1080). `emitArgs` are
  * appended after the `emit-event` subcommand.
  */
 export function resolveConductorEmitCommand(env, emitArgs) {
-    const cliFile = env.BAPI_CONDUCTOR_CLI_FILE;
+    const cliFile = env.BAPI_EPIC_IMPLEMENTER_CLI_FILE;
     if (nonEmpty(cliFile)) {
         return {
             command: process.execPath,
             args: [cliFile.trim(), "emit-event", ...emitArgs],
         };
     }
-    const bin = nonEmpty(env.BAPI_CONDUCTOR_BIN) ? env.BAPI_CONDUCTOR_BIN.trim() : "epic-implementer";
+    const bin = nonEmpty(env.BAPI_EPIC_IMPLEMENTER_BIN) ? env.BAPI_EPIC_IMPLEMENTER_BIN.trim() : "epic-implementer";
     return { command: bin, args: ["emit-event", ...emitArgs] };
 }
 const defaultConductorSpawn = (command, args, input) => {