@bridge_gpt/mcp-server 0.2.58 → 0.2.60

package/build/conductor/epic-runtime.js

@@ -23,7 +23,7 @@ import { processGateMetMerge } from "./supervisor-merge.js";
 import { observePrCiOnce } from "./pr-ci-producer.js";
 import { runGhCommand } from "./pr-discovery.js";
 import { isPrMergeConflict, parseGhPrMergeabilityFields, } from "./github-mergeability.js";
-import { makeLocalMergeExecutor, resolveLocalMergeMethod } from "./local-merge.js";
+import { makeLocalMergeExecutor, resolveLocalMergeCredential, resolveLocalMergeMethod, } from "./local-merge.js";
 import { getHeadSha, getPrNumber } from "./event-accessors.js";
 import { emitConductorEventIfNew } from "./producer-ledger.js";
 import { rebuildObservedState, extractWorkerLiveness, } from "./epic-state.js";
@@ -54,13 +54,13 @@ const ACTIVE_WORKER_STATUSES = new Set(["dispatched", "running"]);
  * Source + producer tags for the durable `parse.triggered` marker that the
  * parse-after-merge wait emits from the epic-tick process.
  */
-const PARSE_WAIT_EVENT_SOURCE = "conductor-supervisor";
+const PARSE_WAIT_EVENT_SOURCE = "epic-implementer-supervisor";
 const PARSE_WAIT_EVENT_PRODUCER = "epic-parse-wait";
 /**
  * BAPI-494: source + producer tags for the durable `merge.conflict` marker the
  * done-gate pass emits when a `ready_for_review` ticket's PR is un-mergeable.
  */
-const MERGE_CONFLICT_EVENT_SOURCE = "conductor-supervisor";
+const MERGE_CONFLICT_EVENT_SOURCE = "epic-implementer-supervisor";
 const MERGE_CONFLICT_EVENT_PRODUCER = "epic-mergeability";
 function defaultLeaseOwner() {
     return `epic-tick-${process.pid}`;
@@ -403,7 +403,7 @@ export async function runConductorDoneGatePass(ticketStatuses, deps) {
         }
         // Stamp the ticket's run_id and (when available) worker_id onto the emitted
         // gate.met via a per-ticket env override (observePrCiOnce reads
-        // BAPI_CONDUCTOR_RUN_ID/_WORKER_ID from env, env taking precedence). run_id
+        // BAPI_EPIC_IMPLEMENTER_RUN_ID/_WORKER_ID from env, env taking precedence). run_id
         // correlates the fold to the ticket. worker_id is attribution ONLY: BAPI-525
         // Change A removed the worker_id requirement from merge-identity extraction, so
         // a missing worker_id no longer blocks the merge — the backstop stamps real
@@ -456,8 +456,8 @@ export async function runConductorDoneGatePass(ticketStatuses, deps) {
         }
         const perTicketEnv = {
             ...deps.env,
-            ...(runId ? { BAPI_CONDUCTOR_RUN_ID: runId } : {}),
-            ...(workerId ? { BAPI_CONDUCTOR_WORKER_ID: workerId } : {}),
+            ...(runId ? { BAPI_EPIC_IMPLEMENTER_RUN_ID: runId } : {}),
+            ...(workerId ? { BAPI_EPIC_IMPLEMENTER_WORKER_ID: workerId } : {}),
         };
         try {
             const observeResult = await deps.observePrCi({
@@ -550,7 +550,7 @@ export async function runEpicTick(options, deps = {}) {
     // dispatch state. Without this guard, `correlateRunId` writes a `run_spawned` row
     // under the REAL dispatch_key, and the next real tick's `claimDispatchKey` returns
     // `already-spawned`, silently skipping the real worker spawn.
-    const isDryRun = env.BAPI_CONDUCTOR_DISPATCH_DRY_RUN === "1";
+    const isDryRun = env.BAPI_EPIC_IMPLEMENTER_DISPATCH_DRY_RUN === "1";
     const startMs = nowFn();
     // ---------------------------------------------------------------------------
     // Step 0: Resolve Bridge API access (offline / fail-closed guard)
@@ -1320,7 +1320,16 @@ export async function runEpicTick(options, deps = {}) {
                                 merge: makeLocalMergeExecutor({
                                     method: resolveLocalMergeMethod(localCfg.method),
                                     approvalRequired: localCfg.approval_required === true,
-                                }, { env: process.env }),
+                                }, 
+                                // BAPI-1136: `env` now supplies only the allowlisted
+                                // operational base; the identity is the explicitly configured
+                                // local credential, and an unconfigured one fails closed with
+                                // `local_merge_credential_missing` rather than borrowing the
+                                // ambient `gh` login this path used to rely on.
+                                {
+                                    env: process.env,
+                                    credential: resolveLocalMergeCredential(process.env, "local"),
+                                }),
                                 // BAPI-525 Change A: durable attribution for a worker_id-less gate.met.
                                 resolveWorkerIdForGateEvent,
                             });
@@ -1736,12 +1745,12 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         // The dispatch kind comes from the plan node's automation (start-tickets or
         // review-tickets); default to start-tickets when unspecified.
         const kind = automationMap.get(tk) ?? "start-tickets";
-        // Operator dry-run: when BAPI_CONDUCTOR_DISPATCH_DRY_RUN=1, dispatch resolves
+        // Operator dry-run: when BAPI_EPIC_IMPLEMENTER_DISPATCH_DRY_RUN=1, dispatch resolves
         // the spawn command + model routing but opens NO terminal, creates NO worktree,
         // and opens NO PR (start-tickets/review-tickets dryRun). The full loop dispatch
         // path (ready-set → claim key → dispatch → correlate run_id) still exercises;
         // dry-run rows carry no runId, so a synthetic one is substituted for correlation.
-        const dispatchDryRun = process.env.BAPI_CONDUCTOR_DISPATCH_DRY_RUN === "1";
+        const dispatchDryRun = process.env.BAPI_EPIC_IMPLEMENTER_DISPATCH_DRY_RUN === "1";
         // BAPI-507 (N-2): thread the ticket's declared file scope into the
         // IMPLEMENTATION dispatch identity only. A `review-tickets` node does not open
         // an implementation PR, so it gets no file-scope env (Step 8.5).
@@ -1850,11 +1859,11 @@ export async function buildProductionEpicRuntimeDeps(epicKey) {
         if (cachedPlanVersion === 0) {
             throw new Error(`dispatchReviewSeam called before fetchPlan for epic ${ek} ticket ${tk}; cachedPlanVersion is 0`);
         }
-        const dispatchDryRun = process.env.BAPI_CONDUCTOR_DISPATCH_DRY_RUN === "1";
+        const dispatchDryRun = process.env.BAPI_EPIC_IMPLEMENTER_DISPATCH_DRY_RUN === "1";
         // Deliberately omit `dispatch_key` from the identity: the reconcile pass owns
         // the idempotent :review key claim (recordEpicDispatch with reviewRole) and the
         // run_spawned correlation. orchestrateReviewTickets still mints the run_id and
-        // injects BAPI_CONDUCTOR_RUN_ID into the review agent's environment, which is
+        // injects BAPI_EPIC_IMPLEMENTER_RUN_ID into the review agent's environment, which is
         // exactly the correlation channel the Python review orchestrator reads to stamp
         // the spec_review.* verdict event with this review run's id (Phase 2).
         const identity = {

package/build/conductor/errors.js

@@ -81,7 +81,7 @@ export class ConductorEpicTickV1FrozenError extends Error {
  *
  * Worker-facing ledger operations (`check_messages`, `wait_for_done_gate` event
  * emission) MUST execute through `conductor-bin.js` under the captured conductor
- * Node (`CONDUCTOR_NODE_PATH`) so the worker Node never loads the `better-sqlite3`
+ * Node (`EPIC_IMPLEMENTER_NODE_PATH`) so the worker Node never loads the `better-sqlite3`
  * native binary. When that runtime is missing or invalid, this error makes the
  * failure LOUD and structured rather than silently falling back to the worker
  * Node. The carried `reason`/`envVar` are the ONLY diagnostic surface — both are
@@ -240,8 +240,8 @@ export function toConductorErrorEnvelope(error) {
             message: "Conductor persistence is unavailable (the optional better-sqlite3 native module is not loaded). Conductor coordination features are disabled; core tools are unaffected.",
         };
     }
-    // Worker-ledger subprocess runtime failure (BAPI-527): CONDUCTOR_NODE_PATH /
-    // BAPI_CONDUCTOR_CLI_FILE is missing or invalid so the worker cannot reach the
+    // Worker-ledger subprocess runtime failure (BAPI-527): EPIC_IMPLEMENTER_NODE_PATH /
+    // BAPI_EPIC_IMPLEMENTER_CLI_FILE is missing or invalid so the worker cannot reach the
     // local ledger through the captured conductor Node. Surfaced as a retryable-
     // shaped 503 with a fixed, secret-free message plus a small non-secret details
     // bag (env_var + stable reason). NOTHING path/secret-bearing is echoed. This is

package/build/conductor/file-scope-guard.js

@@ -2,7 +2,7 @@
  * BAPI-507 (N-2): warn-only worker file-scope guard.
  *
  * Compares a branch's changed files against the planner-declared touched-file
- * set (delivered to the worker via `BAPI_CONDUCTOR_DECLARED_TOUCHED_FILES_JSON`)
+ * set (delivered to the worker via `BAPI_EPIC_IMPLEMENTER_DECLARED_TOUCHED_FILES_JSON`)
  * and warns when the diff strays outside that set. It is strictly warn-only /
  * fail-open: it NEVER blocks PR creation, mutates the branch, or exits non-zero.
  * A worker that implements a sibling's files (the N-2 over-reach observed in the
@@ -21,9 +21,9 @@
  */
 import { spawnSync } from "node:child_process";
 /** Env var carrying the compact JSON array of declared repo-relative paths. */
-export const DECLARED_TOUCHED_FILES_ENV = "BAPI_CONDUCTOR_DECLARED_TOUCHED_FILES_JSON";
+export const DECLARED_TOUCHED_FILES_ENV = "BAPI_EPIC_IMPLEMENTER_DECLARED_TOUCHED_FILES_JSON";
 /** Env var carrying the dispatched ticket key (used only to label warnings). */
-export const FILE_SCOPE_GUARD_TICKET_KEY_ENV = "BAPI_CONDUCTOR_TICKET_KEY";
+export const FILE_SCOPE_GUARD_TICKET_KEY_ENV = "BAPI_EPIC_IMPLEMENTER_TICKET_KEY";
 /** Base ref the branch diff is computed against. */
 export const FILE_SCOPE_GUARD_BASE_REF = "origin/main";
 /**
@@ -73,7 +73,7 @@ export function normalizeDeclaredTouchedFiles(list) {
     return Array.from(out).sort();
 }
 /**
- * Parse `BAPI_CONDUCTOR_DECLARED_TOUCHED_FILES_JSON` into a normalized
+ * Parse `BAPI_EPIC_IMPLEMENTER_DECLARED_TOUCHED_FILES_JSON` into a normalized
  * declaration. Returns an "unspecified" result on a missing, blank, invalid-JSON,
  * non-array, or empty (after normalization) value — the guard no-ops in every
  * such case.

package/build/conductor/git-ci-types.js

@@ -155,7 +155,7 @@ export function stableJsonHash(value) {
  * The two literals are exported as named constants so no consumer spells them
  * inline — a typo in one consumer would otherwise silently disagree with the
  * parser about which disposition is configured. The Python mirror lives in
- * `api/library/epic_conductor/epic_implementer_readiness.py` and must carry the same
+ * `api/library/epic_implementer/epic_implementer_readiness.py` and must carry the same
  * closed set.
  */
 export const VERDICTLESS_DISPOSITION_PARK = "park";

package/build/conductor/git-inspection.js

@@ -72,7 +72,7 @@ export function sanitizeGitRemoteUrl(url) {
 /**
  * Resolve the local worktree context: worktree root, git common dir, current
  * branch, HEAD SHA, sanitized origin remote, and repo identity. Repo name prefers
- * `BAPI_CONDUCTOR_REPO_NAME`, then `BAPI_REPO_NAME`, then the git root basename.
+ * `BAPI_EPIC_IMPLEMENTER_REPO_NAME`, then `BAPI_REPO_NAME`, then the git root basename.
  * Never throws — missing git simply yields a degraded context.
  */
 export function getGitWorktreeContext(options = {}) {
@@ -86,7 +86,7 @@ export function getGitWorktreeContext(options = {}) {
     const branch = branchRaw === null || branchRaw === "HEAD" ? null : branchRaw;
     const headSha = normalizeSha(firstLine(runGitCommand(["rev-parse", "HEAD"], { cwd })) ?? "");
     const remoteOrigin = sanitizeGitRemoteUrl(firstLine(runGitCommand(["config", "--get", "remote.origin.url"], { cwd })) ?? "");
-    const repo = normalizeRepoName(env.BAPI_CONDUCTOR_REPO_NAME) ??
+    const repo = normalizeRepoName(env.BAPI_EPIC_IMPLEMENTER_REPO_NAME) ??
         normalizeRepoName(env.BAPI_REPO_NAME) ??
         normalizeRepoName(basename(worktreePath)) ??
         "unknown";

package/build/conductor/install-doctor.js

@@ -36,7 +36,7 @@ import { buildConductorDoctorReport, formatConductorDoctorReport, } from "./doct
 import { inspectBridgeApiProfileToken, } from "../mcp-host-config.js";
 import { collectExecutorServiceDiagnostics, formatExecutorServiceDiagnosticsReport, } from "../doctor.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, } from "../install-doctor.js";
-import { bringUpSafetySections, conductorHookTargetsSection, conductorLedgerLoadabilitySection, conductorProfileTokenSection, CONDUCTOR_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
+import { bringUpSafetySections, conductorHookTargetsSection, conductorLedgerLoadabilitySection, gitHubActionsMergeObservabilitySections, conductorProfileTokenSection, EPIC_IMPLEMENTER_PROFILE_TOKEN, detectConductorContext, executorObservationSection, executorProvisioningSection, executorServiceStateSection, githubActionsSection, mergeExecutionSections, githubCredentialsSection, inspectWorkflowPresence, reconcilerSection, supervisorSection, workflowSection, } from "./readiness-sections.js";
 import { ConductorBridgeApiError, fetchConductorReadiness, } from "./bridge-api-client.js";
 /**
  * Run one optional collector, containing any throw.
@@ -86,8 +86,8 @@ export async function runConductorInstallDoctor(deps) {
     const legacyConductor = conductorSettled.value ?? null;
     if (conductorSettled.failed) {
         sections.push({
-            id: "conductor-ledger",
-            label: "Conductor ledger doctor",
+            id: "epic-implementer-ledger",
+            label: "Epic Implementer ledger doctor",
             status: "degraded",
             detail: "the local epic-implementer doctor could not be built",
             remediation: "run `epic-implementer doctor` directly to see why the local ledger report failed.",
@@ -157,6 +157,13 @@ export async function runConductorInstallDoctor(deps) {
         sections.push(...supervisorSection(readiness));
         sections.push(githubCredentialsSection(readiness));
         sections.push(githubActionsSection(readiness));
+        // BAPI-1135 — the shared "Merge execution eligibility" section, immediately
+        // after the App permission row it is most often confused with, so the two
+        // write facts are read side by side. Built by `readiness-sections.ts` rather
+        // than formatted here, so this installer and the advisory gate render one
+        // classification; the installer's `settle`-based degraded isolation is
+        // unchanged, and no row here is `fatal`.
+        sections.push(...mergeExecutionSections(readiness));
     }
     const workflow = await inspectWorkflowPresence(deps.readWorkflowFile, deps.classifyWorkflowDrift);
     sections.push(workflowSection(workflow.presence, deps.reviewPolicySource, workflow.driftDetail));
@@ -219,7 +226,7 @@ export async function runConductorInstallDoctor(deps) {
         }));
     let profileToken = null;
     try {
-        profileToken = await inspectProfile(deps.projectRoot ?? process.cwd(), CONDUCTOR_PROFILE_TOKEN);
+        profileToken = await inspectProfile(deps.projectRoot ?? process.cwd(), EPIC_IMPLEMENTER_PROFILE_TOKEN);
     }
     catch {
         // The shared inspector never throws for the ordinary absent/malformed
@@ -230,6 +237,13 @@ export async function runConductorInstallDoctor(deps) {
     sections.push(conductorProfileTokenSection(profileToken, conductorContext));
     sections.push(conductorHookTargetsSection(legacyConductor, conductorContext));
     sections.push(conductorLedgerLoadabilitySection(legacyConductor));
+    // BAPI-1135 — this HOST's ability to observe the merge capability, beside the
+    // other locally-derived doctor rows. Distinct from the server-fact
+    // "Merge execution eligibility" section pushed above: that one says whether
+    // the repository can merge, these two say whether this machine can look.
+    // `settle`-based degraded isolation is unchanged — a doctor that failed to
+    // collect yields two explicit unknown rows, never an omitted section.
+    sections.push(...gitHubActionsMergeObservabilitySections(legacyConductor));
     return {
         legacyConductor,
         legacyExecutorPreflight,
@@ -285,7 +299,7 @@ export function formatConductorInstallDoctorReport(report) {
         embed("Bridge install status", () => formatInstallStatusReport(report.legacyInstallChecks));
     }
     if (report.legacyConductor) {
-        embed("Conductor ledger doctor", () => formatConductorDoctorReport(report.legacyConductor));
+        embed("Epic Implementer ledger doctor", () => formatConductorDoctorReport(report.legacyConductor));
     }
     if (report.legacyExecutorPreflight) {
         const p = report.legacyExecutorPreflight;
@@ -335,6 +349,14 @@ export function conductorInstallDoctorHasFatal(report) {
 // remediation constants, or the installer reporting APIs from
 // `conductor/install-doctor.js` keeps resolving exactly as before.
 // ---------------------------------------------------------------------------
-export { BRING_UP_SECTION_LABELS, bringUpSafetySections, databaseMigrationCurrentSection, singleTransitionAuthoritySection, workerPresentSection, CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, CONDUCTOR_PROFILE_TOKEN, CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION, CONDUCTOR_PROFILE_TOKEN_REMEDIATION, CONDUCTOR_HOOK_TARGET_REMEDIATION, CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION, EXECUTOR_INSTALL_SERVICE_REMEDIATION, EXECUTOR_SERVICE_START_REMEDIATION, } from "./readiness-sections.js";
+export { BRING_UP_SECTION_LABELS, bringUpSafetySections, 
+// BAPI-1135 — re-exported on the compatibility surface like every other
+// section builder, so an existing importer of this module sees the new
+// section without learning a second import path.
+mergeExecutionSections, databaseMigrationCurrentSection, singleTransitionAuthoritySection, workerPresentSection, CONDUCTOR_OPERATOR_RUNBOOK_POINTER, EXECUTOR_PROVISIONING_GUIDANCE, EPIC_IMPLEMENTER_PROFILE_TOKEN, CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION, CONDUCTOR_PROFILE_TOKEN_REMEDIATION, CONDUCTOR_HOOK_TARGET_REMEDIATION, CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION, EXECUTOR_INSTALL_SERVICE_REMEDIATION, EXECUTOR_SERVICE_START_REMEDIATION, 
+// BAPI-1135 — both new section builders join the compatibility surface like
+// every other one, so an existing importer of this module does not learn a
+// second import path for them.
+gitHubActionsMergeObservabilitySections, } from "./readiness-sections.js";
 // BAPI-1153 — the bring-up remediations the three sections above render.
 export { BRING_UP_RUNBOOK, BRING_UP_UNREPORTED_REMEDIATION, DATABASE_MIGRATION_BEHIND_REMEDIATION, DATABASE_MIGRATION_UNREADABLE_REMEDIATION, SECOND_RECONCILER_REMEDIATION, WORKER_HEARTBEAT_UNREADABLE_REMEDIATION, WORKER_NOT_PRESENT_REMEDIATION, } from "./bring-up-facts.js";