@bridge_gpt/mcp-server 0.2.59 → 0.2.60

package/build/executor/job-runner.js

@@ -19,6 +19,7 @@ import os from "node:os";
 import { runHeartbeatLoop } from "./heartbeat.js";
 import { isExecutorNamedError, toExecutorFailure, secretFreeErrorMessage, MissingVerdictArtifact, PreSpawnVerification, RequiredMcpRegistration, McpSurfaceMismatch, WorkerStartupFatal, WORKER_STARTUP_FATAL_MESSAGE, formatMcpSurfaceMismatch, ClaudeNotAuthenticated, CLAUDE_NOT_AUTHENTICATED_MESSAGE, ExecutorAdapterUnavailable, ExecutorNamedError, WorktreeBusy, StaleArtifactCleanupFailed, WORKTREE_BUSY_MESSAGE, WorkerEnvFilePresent, WORKER_ENV_FILE_PRESENT_MESSAGE, } from "./job-errors.js";
 import { buildConductorMergeAccessForExecutorJob, buildDefaultMergeLocalDeps, runExecutorMergeJob, MERGE_RETRYABLE, MERGE_FAILED, } from "./merge-job.js";
+import { createProductionCiRerunDeps, runCiRerunJob, } from "./ci-rerun-job.js";
 import { createObservationState } from "./observation.js";
 import { getWorktreeMcpRegistrationTargets, normalizeWorktreePathForRegistration, provisionMcpRegistrationForWorktree, } from "../mcp-provisioning.js";
 import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter-registry.js";
@@ -615,6 +616,16 @@ control) {
     if (job.job_type === "smoke") {
         return runSmokeJob(job, httpClient, options, deps, ownership, observation, control);
     }
+    // BAPI-1160: `ci_rerun` is a deterministic executor action, dispatched here
+    // beside `merge`/`smoke` and BEFORE the generic spawn path. It ensures no
+    // worktree and spawns no worker, and it must NEVER fall back to one: spawning
+    // an LLM worker to "fix" a failure the server already proved to be
+    // infrastructure is exactly the behavior this job type replaces. `job-types.ts`
+    // keeps it out of both `SPAWN_JOB_TYPES` and `RECOVERY_JOB_TYPES`, so reaching
+    // the spawn path below is structurally impossible rather than merely unlikely.
+    if (job.job_type === "ci_rerun") {
+        return runCiRerunExecutorJob(job, httpClient, options, deps, ownership, observation, seams, control);
+    }
     // BAPI-1152: `reconcile_overlap` takes its OWN branch, after `merge`/`smoke`
     // and before the generic spawn path. It needs a prepared, locked worktree like
     // a spawn job, but its body is the reconcile module's state machine: the
@@ -652,6 +663,121 @@ control) {
     });
     return { status: "failed", reason: "unsupported_job_type" };
 }
+/**
+ * Run a deterministic `ci_rerun` job (BAPI-1160).
+ *
+ * Supervised through the SAME ownership, heartbeat, dead-man, and timeout
+ * protocol as {@link runMergeJob} — via {@link createFlowProcess} — so a
+ * deterministic job is not a second, weaker lifecycle. The body itself spawns no
+ * subprocess of its own beyond the bounded `gh` invocations inside
+ * `ci-rerun-job.ts`, and there is NO fallback to a worker on failure.
+ *
+ * The completion carries only the job's fact envelope. It names no gate,
+ * requests no transition, and asserts no verdict: the reconciler re-observes the
+ * head independently and remains the sole transition authority (R14 rule 3).
+ */
+async function runCiRerunExecutorJob(job, httpClient, options, deps, ownership, observation, seams, control) {
+    // Resolve + enforce payload.timeout_seconds BEFORE any provider work, exactly
+    // as the merge branch does.
+    const timeout = resolveJobTimeoutSeconds(job, options.defaultJobTimeoutSeconds);
+    if (!timeout.ok) {
+        await httpClient.fail(job, {
+            error_kind: "ContractError.Timeout",
+            error_message: timeout.error,
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "timeout_contract" };
+    }
+    const runCiRerun = seams.runCiRerun ??
+        ((payload) => runCiRerunJob(payload, createProductionCiRerunDeps()));
+    const flow = createFlowProcess(() => runCiRerun(job.payload), (result) => result.ok);
+    const procResult = await superviseProcess({
+        job,
+        httpClient,
+        options,
+        deps,
+        ownership,
+        observation,
+        proc: flow.proc,
+        timeoutSeconds: timeout.timeoutSeconds,
+        collectTelemetry: async () => ({}),
+        control,
+    });
+    if (ownership.abandoned) {
+        return { status: "abandoned", reason: ownership.abandonReason };
+    }
+    if (procResult.classification === "timeout") {
+        const terminal = await sendTerminalMutationWithAuthReport({
+            kind: "fail",
+            send: () => httpClient.fail(job, {
+                error_kind: "CiRerunFailed",
+                error_message: "ci_rerun exceeded its job timeout",
+                classification: "timeout",
+                telemetry: observation.snapshot(),
+            }),
+            deps,
+            options,
+            ownership,
+            log: deps.log,
+        }, job, control);
+        return terminalToRunResult(terminal, "failed");
+    }
+    const outcome = flow.getOutcome();
+    if (outcome === undefined) {
+        const terminal = await sendTerminalMutationWithAuthReport({
+            kind: "fail",
+            send: () => httpClient.fail(job, {
+                error_kind: "CiRerunFailed",
+                error_message: "ci_rerun completed without an outcome",
+                classification: "crashed",
+                telemetry: observation.snapshot(),
+            }),
+            deps,
+            options,
+            ownership,
+            log: deps.log,
+        }, job, control);
+        return terminalToRunResult(terminal, "failed");
+    }
+    if (outcome.ok) {
+        const completion = {
+            job_type: "ci_rerun",
+            exit_code: 0,
+            classification: "clean_exit",
+            // The FACT ENVELOPE, verbatim. No gate, no transition, no verdict — the
+            // backend model is `extra="forbid"`, so anything else fails validation
+            // rather than being silently ignored.
+            result: outcome.result,
+            telemetry: observation.snapshot(),
+        };
+        const terminal = await sendTerminalMutationWithAuthReport({
+            kind: "complete",
+            send: () => httpClient.complete(job, completion),
+            deps,
+            options,
+            ownership,
+            log: deps.log,
+        }, job, control);
+        return terminalToRunResult(terminal, "completed");
+    }
+    // A refused or failed re-run. The reserved infrastructure attempt stays
+    // CONSUMED — see `ci-rerun-job.ts` — and the reason is a closed token, never
+    // provider text.
+    const terminal = await sendTerminalMutationWithAuthReport({
+        kind: "fail",
+        send: () => httpClient.fail(job, {
+            error_kind: outcome.failure.errorKind,
+            error_message: outcome.failure.reason,
+            classification: "crashed",
+            telemetry: observation.snapshot(),
+        }),
+        deps,
+        options,
+        ownership,
+        log: deps.log,
+    }, job, control);
+    return terminalToRunResult(terminal, "failed");
+}
 /**
  * Adapt a `runMerge(...)` promise into an {@link OwnedChildProcess} so the merge
  * flow is supervised by the SAME heartbeat/deadman/timeout path as spawn/smoke

package/build/executor/job-types.js

@@ -26,6 +26,15 @@
  * resolution, but it does NOT re-enter `/implement-ticket`: it always carries an
  * explicit server-rendered `payload.prompt`, which wins over the synthesis in
  * `worker-command.ts`, and `job-runner.ts` dispatches it to its own body.
+ *
+ * BAPI-1160: `ci_rerun` is DELIBERATELY ABSENT from this set and from
+ * `SPAWN_JOB_TYPES` below. It is a deterministic actuator — one bounded
+ * `gh run rerun --failed` and a bounded poll — with no worktree, no branch to
+ * reuse, no prompt, and no worker. It has a dedicated dispatch branch in
+ * `job-runner.ts` beside `merge` and `smoke`, ahead of the generic spawn path,
+ * and it must NEVER fall back to a worker subprocess: spawning an LLM worker to
+ * "fix" a failure the server already PROVED to be infrastructure is the exact
+ * behavior this job type exists to replace.
  */
 export const RECOVERY_JOB_TYPES = new Set([
     "remediate",
@@ -37,8 +46,9 @@ export const RECOVERY_JOB_TYPES = new Set([
  * Real headless-spawn job types (worktree + worker LLM): the first-pass
  * `implement`, the `resume` continuation (own pre-spawn protocol), the
  * `spec_review` verdict job, and the recovery jobs. `merge` (deterministic,
- * no worktree/worker) and `smoke` (no-op acceptance) are intentionally EXCLUDED —
- * they have dedicated dispatch branches BEFORE the generic spawn path.
+ * no worktree/worker), `smoke` (no-op acceptance), and BAPI-1160's `ci_rerun`
+ * (deterministic, no worktree/worker) are intentionally EXCLUDED — they have
+ * dedicated dispatch branches BEFORE the generic spawn path.
  *
  * BAPI-1152: `reconcile_overlap` is here because it needs a prepared, locked
  * worktree and MAY spawn a worker — but only CONDITIONALLY. A clean merge whose

package/build/executor/merge-job.js

@@ -21,7 +21,7 @@
  *    {@link MERGE_FAILED} `error_kind` (via {@link classifyMergeFailureErrorKind})
  *    so the companion re-fire lane can route retry-vs-rebase without string parsing.
  */
-import { makeLocalMergeExecutor, resolveLocalMergeMethod, } from "../conductor/local-merge.js";
+import { makeLocalMergeExecutor, resolveLocalMergeCredential, resolveLocalMergeMethod, } from "../conductor/local-merge.js";
 import { resolveConductorBridgeApiAccess, } from "../conductor/bridge-api-client.js";
 import { createProductionEpicIntegrationGhRunner, ensureEpicIntegrationPullRequest, formatEpicIntegrationPullRequestOutcome, EPIC_BRANCH_PREFIX, } from "../epic-integration-pr.js";
 import { secretFreeErrorMessage } from "./job-errors.js";
@@ -353,5 +353,14 @@ export async function runExecutorMergeJob(job, seams) {
  * unchanged (no App token is ever placed here).
  */
 export function buildDefaultMergeLocalDeps(deps, signal) {
-    return { env: deps.env, signal };
+    // BAPI-1136: the executor's merge job runs on the operator's own machine, which
+    // is typed `local`, so it reads the local configuration key and no other. The
+    // environment is still passed for the allowlisted operational base (PATH, HOME,
+    // certificates); it no longer supplies the identity, and an ambient GH_TOKEN in
+    // it is dropped rather than inherited.
+    return {
+        env: deps.env,
+        credential: resolveLocalMergeCredential(deps.env, "local"),
+        signal,
+    };
 }

package/build/executor/service-lifecycle.js

@@ -36,6 +36,24 @@
  * The command forms address user-domain (per-user) services directly:
  * `launchctl` against `gui/<uid>/<label>` on darwin, and `systemctl --user`
  * on linux.
+ *
+ * FOUR INDEPENDENT FACTS (BAPI-1137). A durable host is described by four
+ * separate observations, and no one of them implies another:
+ *
+ *  1. **Unit-content compliance** — what the generated/on-disk unit DECLARES
+ *     (`service-unit.ts`). A perfect unit file can be sitting unloaded.
+ *  2. **Service-manager state** — what the manager is running RIGHT NOW
+ *     ({@link inspectExecutorServiceState}). The manager may still be running a
+ *     previously loaded definition rather than the current bytes on disk.
+ *  3. **Session persistence** — whether the host keeps running it once nobody is
+ *     logged in ({@link inspectExecutorServiceDurability}). An `active` service
+ *     with lingering off is active exactly until the operator logs out.
+ *  4. **Server-observed readiness** — whether BRIDGE has seen an executor claim.
+ *     Only this one can produce `executor_ready`, and rule 4 above is why:
+ *     nothing local, however green, is evidence for it.
+ *
+ * They are reported separately everywhere, and collapsing any pair of them would
+ * reintroduce exactly the dishonest-green this module is built to refuse.
  */
 import { posixShellQuote } from "../platform-escaping.js";
 /**
@@ -62,6 +80,10 @@ function renderCommand(command) {
 /**
  * Build the platform-specific start sequence.
  *
+ * UNCHANGED by BAPI-1137: start remains separately consented, one-shot, and
+ * non-retrying. The durability inspection added lower in this file is read-only
+ * and has no path to this function or to {@link startExecutorService}.
+ *
  * darwin: `launchctl bootstrap gui/<uid> <plist-path>`
  * linux:  `systemctl --user daemon-reload`, then
  *         `systemctl --user enable --now <unit-name>`
@@ -267,3 +289,117 @@ export async function inspectExecutorServiceState(target, run) {
         return { state: "inactive", probe };
     return { state: "unknown", probe };
 }
+/**
+ * The Linux remediation, verbatim and in one place so the lifecycle module, the
+ * installer, and doctor cannot print three subtly different commands.
+ */
+export const EXECUTOR_LINGER_REMEDIATION = "run `loginctl enable-linger $USER` yourself to keep this user's services running " +
+    "without an active login session (Bridge never runs it for you)";
+/**
+ * The macOS prerequisite. A LaunchAgent bootstrapped into `gui/<uid>` lives in a
+ * user-login domain, which `launchctl(1)` documents as created when the user logs
+ * in at the GUI — so it needs that login to exist, and after a reboot it needs
+ * the user to log in again (automatic login, or a human at the keyboard).
+ */
+export const EXECUTOR_MACOS_SESSION_REMEDIATION = "keep this user logged in at the GUI — a launchd LaunchAgent runs in the gui/<uid> " +
+    "login domain, so after a reboot the user must log in again (e.g. enable automatic " +
+    "login) for the executor to come back";
+/**
+ * Build the strictly read-only durability prerequisite probe for a target.
+ *
+ * linux:  `loginctl show-user <uid> --property=Linger` — a QUERY. `show-user`
+ * reads properties; it cannot enable or disable anything, which is what makes it
+ * safe to run unprompted where `enable-linger` would not be.
+ * darwin: `launchctl print gui/<uid>` — the login domain itself, not a service
+ * inside it. A zero exit means the GUI login domain exists for this uid.
+ *
+ * PURE: consults no runner, no environment, and no filesystem, so an
+ * incompletely described target is refused before anything could be executed.
+ */
+export function buildExecutorServiceDurabilityProbe(target) {
+    if (typeof target.uid !== "number" || !Number.isInteger(target.uid) || target.uid < 0) {
+        return null;
+    }
+    if (target.platform === "linux") {
+        return {
+            stage: "loginctl show-user --property=Linger",
+            executable: "loginctl",
+            args: ["show-user", String(target.uid), "--property=Linger"],
+        };
+    }
+    if (target.platform === "darwin") {
+        return {
+            stage: "launchctl print gui",
+            executable: "launchctl",
+            args: ["print", `gui/${target.uid}`],
+        };
+    }
+    return null;
+}
+/**
+ * Inspect the local session/linger durability prerequisite. STRICTLY read-only:
+ * it issues exactly one query and never enables lingering, starts a service,
+ * reloads a manager, or writes anything.
+ *
+ * Everything the runner returns beyond a recognized state token is DISCARDED —
+ * stdout past the token, stderr entirely, and any thrown value — because a
+ * service manager's output can name paths, units, and environment values that
+ * have no place in operator-facing text.
+ */
+export async function inspectExecutorServiceDurability(target, run) {
+    if (target.platform !== "darwin" && target.platform !== "linux") {
+        return { prerequisite: "not-applicable", probe: null, remediation: null };
+    }
+    const probe = buildExecutorServiceDurabilityProbe(target);
+    if (!probe)
+        return { prerequisite: "unverifiable", probe: null, remediation: null };
+    let exitCode;
+    let stdout;
+    try {
+        const result = await run(probe.executable, probe.args);
+        exitCode = typeof result?.exitCode === "number" ? result.exitCode : 1;
+        stdout = typeof result?.stdout === "string" ? result.stdout : "";
+    }
+    catch {
+        return { prerequisite: "unverifiable", probe, remediation: null };
+    }
+    if (target.platform === "darwin") {
+        // The login domain either exists for this uid or it does not; launchctl
+        // exposes no third answer here, and a non-zero exit is reported as an
+        // unavailable session rather than dressed up as a confirmed absence of
+        // durability the probe did not establish.
+        //
+        // A ZERO exit is NOT `configured`. It says the gui/<uid> domain exists at
+        // this instant — which it does whenever an operator runs `install conductor`
+        // or `doctor` from their own logged-in session — and a LaunchAgent in that
+        // domain is tied to the login, not to the machine being powered on. Calling
+        // it `configured` would let a renderer that means "survives logout" assert
+        // the opposite of what launchd guarantees, so darwin gets its own state and
+        // carries the session prerequisite as the thing to keep true.
+        if (exitCode === 0) {
+            return {
+                prerequisite: "session-bound",
+                probe,
+                remediation: EXECUTOR_MACOS_SESSION_REMEDIATION,
+            };
+        }
+        return {
+            prerequisite: "not-configured",
+            probe,
+            remediation: EXECUTOR_MACOS_SESSION_REMEDIATION,
+        };
+    }
+    if (exitCode !== 0)
+        return { prerequisite: "unverifiable", probe, remediation: null };
+    // `loginctl show-user --property=Linger` prints exactly `Linger=yes|no`. Only
+    // those two tokens are mapped; anything else is unverifiable rather than a
+    // guess derived from a format this module does not recognize.
+    const match = stdout.match(/^\s*Linger=(\S+)\s*$/m);
+    const value = match?.[1]?.toLowerCase();
+    if (value === "yes")
+        return { prerequisite: "configured", probe, remediation: null };
+    if (value === "no") {
+        return { prerequisite: "not-configured", probe, remediation: EXECUTOR_LINGER_REMEDIATION };
+    }
+    return { prerequisite: "unverifiable", probe, remediation: null };
+}