@bridge_gpt/mcp-server 0.2.59 → 0.2.60

package/build/conductor/readiness-sections.js

@@ -36,7 +36,9 @@
 import { MANAGED_HOOK_NAMES } from "./git-hooks.js";
 import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 import { CLAUDE_REVIEW_WORKFLOW_DRIFT_REMEDIATION, summarizeClaudeReviewWorkflowDrift, } from "../claude-review-workflow-drift.js";
-import { describeNativeLedgerAvailability } from "./doctor.js";
+import { describeNativeLedgerAvailability, GH_ACTIONS_MERGE_AUTH_REMEDIATION, GH_ACTIONS_MERGE_SKIPPED_DETAIL, GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION, } from "./doctor.js";
+import { classifyMergeExecutionEligibility, MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION, } from "./merge-execution-eligibility.js";
+import { MERGE_WORKFLOW_EXPECTED_VERSION, MERGE_WORKFLOW_PATH, } from "./merge-execution-contract.js";
 import { classifyDatabaseMigration, classifySingleTransitionAuthority, classifyWorkerPresent, } from "./bring-up-facts.js";
 /** Operator runbook pointer surfaced beside the executor gap. */
 export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-implementer-v2-operator-runbook.md";
@@ -71,7 +73,7 @@ export const CONDUCTOR_HOOK_TARGET_REMEDIATION = "re-run `install conductor` and
 export const CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION = "`better-sqlite3` is an optionalDependency npm silently skips on a build failure — " +
     "reinstall it for this Node runtime to restore local conductor observability.";
 /** Remediation surfaced whenever no healthy generated service unit is detected. */
-export const EXECUTOR_INSTALL_SERVICE_REMEDIATION = "generate a persistent unit with `install conductor --executor-id <id>` or " +
+export const EXECUTOR_INSTALL_SERVICE_REMEDIATION = "generate a persistent unit with `install conductor --executor-id <id> --repo-wide` or " +
     "`executor install-service` (or run the executor by hand) — " +
     `see ${CONDUCTOR_OPERATOR_RUNBOOK_POINTER}.`;
 /** Remediation for a unit that exists but whose service is not running. */
@@ -216,6 +218,94 @@ export function githubActionsSection(readiness) {
         remediation: "grant the GitHub App `actions: write`; the conductor's workflow rerun lane fails open on 403 without it.",
     };
 }
+/**
+ * The "Merge execution eligibility" section (BAPI-1135).
+ *
+ * A DEDICATED section rather than extra rows on the GitHub App block, because it
+ * is a different safety diagnostic about a different principal: the App block
+ * describes the installation's dispatch permission, this one describes whether
+ * the repository's merge workflow can actually merge.
+ *
+ * Rows are rendered in DEPENDENCY order — probe/readability, presence, enabled
+ * state, exact version, App `actions: write`, workflow-token write authority,
+ * branch-policy admission — so a reader meets the fact that decided the verdict
+ * before the facts that were never reached.
+ *
+ * Three rendering rules this section holds to:
+ *
+ * * an absent older-server block and a failed probe are explicit UNKNOWN rows,
+ *   never an omitted section and never a pass. "Not reported" is not "healthy";
+ *   omitting the section would make an unknown look like a clean bill of health.
+ * * confirmed policy denial stays verbally distinct from unreadability. The
+ *   status word (`degraded` for unknown, `fatal`-adjacent `degraded` with
+ *   different copy for confirmed) is carried in TEXT, not by colour alone, and
+ *   the detail line opens with `could not verify:` or `not eligible:`.
+ * * command strings, workflow paths, versions, and reason codes are rendered as
+ *   backticked monospace through the established section conventions, and are
+ *   allowed to wrap rather than being truncated — a truncated remedy command is
+ *   not a remedy.
+ */
+export function mergeExecutionSections(readiness) {
+    const verdict = classifyMergeExecutionEligibility(readiness);
+    const m = readiness.merge_execution;
+    if (m === null || m === undefined) {
+        // One row, not seven. Fabricating six more unknown rows from a block that
+        // was never reported would imply the server answered six questions.
+        return [
+            {
+                id: "merge-execution-eligibility",
+                label: "Merge execution eligibility",
+                status: "degraded",
+                detail: `could not verify: ${verdict.detail}`,
+                remediation: verdict.remediation ?? MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION,
+            },
+        ];
+    }
+    const decisive = {
+        id: "merge-execution-eligibility",
+        label: "Merge execution eligibility",
+        status: verdict.status === "eligible" ? "ok" : "degraded",
+        detail: verdict.status === "eligible"
+            ? `eligible: ${verdict.detail}`
+            : verdict.status === "could_not_verify"
+                ? `could not verify: ${verdict.detail}`
+                : `not eligible: ${verdict.detail} (\`${verdict.reason}\`)`,
+        ...(verdict.remediation ? { remediation: verdict.remediation } : {}),
+    };
+    // The supporting facts, in dependency order. Each is a plain readable row — no
+    // remediation of its own, because the decisive row above already names the one
+    // action, and repeating it seven times would bury it.
+    const fact = (id, label, ok, detail) => ({
+        id,
+        label,
+        status: ok ? "ok" : "degraded",
+        detail,
+    });
+    return [
+        decisive,
+        fact("merge-execution-branch-policy-readable", "Branch policy readable", m.branch_protection_probe_succeeded, m.branch_protection_probe_succeeded
+            ? `read on the ${m.branch_scope.replace("_", " ")}`
+            : "could not verify: the branch policy could not be read"),
+        fact("merge-execution-workflow-present", "Merge workflow present", m.merge_workflow_probe_succeeded && m.merge_workflow_present, !m.merge_workflow_probe_succeeded
+            ? "could not verify: the workflow metadata could not be read"
+            : m.merge_workflow_present
+                ? `\`${MERGE_WORKFLOW_PATH}\` present`
+                : `not eligible: \`${MERGE_WORKFLOW_PATH}\` is absent`),
+        fact("merge-execution-workflow-enabled", "Merge workflow enabled", m.merge_workflow_enabled, m.merge_workflow_enabled ? "enabled" : "not eligible: disabled or unknown"),
+        fact("merge-execution-workflow-version", "Merge workflow version", m.merge_workflow_version === MERGE_WORKFLOW_EXPECTED_VERSION, `\`${m.merge_workflow_version ?? "unset"}\` (expected \`${MERGE_WORKFLOW_EXPECTED_VERSION}\`)`),
+        fact("merge-execution-app-actions-write", "GitHub App `actions: write`", readiness.github.actions_write, readiness.github.actions_probe_succeeded
+            ? `actions: \`${readiness.github.actions_permission_level}\``
+            : "could not verify: the App permission could not be checked"),
+        fact("merge-execution-workflow-token-write", "Workflow token write authority", m.merge_workflow_token_write_authority, m.merge_workflow_token_write_authority
+            ? "the merge workflow's own token holds write authority"
+            : "not eligible: the merge workflow's own token does not hold write authority"),
+        fact("merge-execution-actor-admitted", "Branch policy admits the workflow actor", m.branch_protection_actions_bot_admitted, m.branch_protection_probe_succeeded
+            ? m.branch_protection_actions_bot_admitted
+                ? "admitted"
+                : "not eligible: the workflow actor is excluded"
+            : "could not verify: the branch policy could not be read"),
+    ];
+}
 export function reconcilerSection(readiness) {
     const r = readiness.reconciler;
     if (!r.liveness_readable) {
@@ -630,6 +720,73 @@ export function conductorHookTargetsSection(legacyConductor, conductorContext) {
  * sanitized failure kind, because the common cause is npm silently skipping an
  * optionalDependency build and that is undiagnosable without the ABI.
  */
+/**
+ * Project the doctor's read-only `github_actions` merge OBSERVABILITY inspection
+ * into this layer's sections (BAPI-1135).
+ *
+ * Projected here rather than formatted inside installation code, for the same
+ * reason every other doctor fact is: the install-time doctor and the advisory
+ * readiness gate must render one classification, and a second formatter in the
+ * installer is how the two come to describe the same probe differently.
+ *
+ * Two sections, never one. `gh` authentication and endpoint reachability are
+ * independently actionable, and a collapsed row would hide which of the two the
+ * operator has to fix.
+ *
+ * These describe THIS HOST's ability to observe — never whether the capability
+ * is sufficient. {@link mergeExecutionSections} owns that, from the server's own
+ * report. The wording keeps them apart deliberately: `not observable` and `could
+ * not verify` here, versus `not eligible` there.
+ */
+export function gitHubActionsMergeObservabilitySections(legacyConductor) {
+    const authBase = {
+        id: "gh-actions-merge-auth",
+        label: "GitHub Actions merge: local observation prerequisites",
+    };
+    const observeBase = {
+        id: "gh-actions-merge-observable",
+        label: "GitHub Actions merge: capability observability",
+    };
+    const inspection = legacyConductor?.github_actions_merge;
+    if (inspection === undefined || inspection === null) {
+        // The doctor was not collected, or predates this inspection. Both rows say
+        // so rather than being omitted — an absent row reads as "fine".
+        const detail = "could not verify — the epic-implementer doctor reported no observation";
+        return [
+            { ...authBase, status: "degraded", detail },
+            { ...observeBase, status: "degraded", detail },
+        ];
+    }
+    return [
+        inspection.gh_authed
+            ? { ...authBase, status: "ok", detail: "eligible to observe — `gh` is authenticated" }
+            : {
+                ...authBase,
+                status: "degraded",
+                detail: "not observable — no authenticated `gh` identity on this host",
+                remediation: GH_ACTIONS_MERGE_AUTH_REMEDIATION,
+            },
+        !inspection.gh_authed
+            ? {
+                ...observeBase,
+                status: "degraded",
+                detail: GH_ACTIONS_MERGE_SKIPPED_DETAIL,
+                remediation: GH_ACTIONS_MERGE_AUTH_REMEDIATION,
+            }
+            : inspection.capability_observable
+                ? {
+                    ...observeBase,
+                    status: "ok",
+                    detail: "eligible to observe — the workflow metadata endpoint answered",
+                }
+                : {
+                    ...observeBase,
+                    status: "degraded",
+                    detail: "could not verify — the workflow metadata endpoint could not be read",
+                    remediation: GH_ACTIONS_MERGE_UNOBSERVABLE_REMEDIATION,
+                },
+    ];
+}
 export function conductorLedgerLoadabilitySection(legacyConductor) {
     const base = {
         id: "epic-implementer-ledger-loadability",

package/build/conductor/readiness.js

@@ -47,19 +47,28 @@
  * a local collector, and the Bridge API owner for a server-side collector that
  * keeps timing out or answering unreadably.
  *
- * ## Deferred retirement: local `gh` (AC-7)
- *
- * **Detection** is `conductor.gh-cli` and `conductor.gh-auth`, carried as two
- * separate checks because installing `gh` and authenticating it are two
- * different operator actions. **Containment** is the existing local-merge
- * execution path, which refuses and emits `merge.failed`/`merge.skipped` rather
- * than merging without auth — a missing `gh` degrades a run, it does not corrupt
- * one. **Escalation** targets the invoking operator first; there is no automated
- * fallback, because the GitHub App token is `contents: read` and structurally
- * cannot merge (see `mcp_server/src/executor/merge-job.ts`). **Retirement** is
- * owned by epic A2, after the App is elevated to `contents: write`. Until A2
- * ships this check is load-bearing and no code here may remove, hide, or
- * downgrade it.
+ * ## RETIRED deferral: local `gh` auth (AC-7, retired by BAPI-1136)
+ *
+ * This deferral named its retirement owner as epic A2, and A2 has now landed.
+ * It is recorded here rather than deleted, because the point of naming an owner
+ * is being able to check afterwards that the owner actually did the work.
+ *
+ * **What it used to be.** Detection was `conductor.gh-cli` and
+ * `conductor.gh-auth`: the merge ran under this host's own `gh` session, because
+ * the GitHub App token is `contents: read` and structurally cannot merge (see
+ * `mcp_server/src/executor/merge-job.ts`). Until A2 shipped, that ambient-session
+ * check was load-bearing.
+ *
+ * **What replaced it.** BAPI-1136 de-personalized the merge: it now authenticates
+ * with one explicitly configured, customer-held credential
+ * (`BAPI_LOCAL_MERGE_TOKEN` or `BAPI_MACHINE_MERGE_TOKEN`) and never with the
+ * ambient session. So the second check was RE-POINTED, not removed —
+ * `conductor.gh-cli` still asks whether `gh` exists, and
+ * `conductor.merge-credential` asks whether a credential is configured. Removing
+ * it would have been a silent downgrade; leaving it would have been worse, since
+ * it reported green on exactly the hosts about to fail closed. **Containment** and
+ * **escalation** are unchanged: the merge refuses with a named reason rather than
+ * merging without a credential, and the invoking operator is the first target.
  *
  * ## Deferred retirement: native SQLite ledger (AC-7)
  *
@@ -89,6 +98,7 @@ import { mapPlanePreflightToReadinessChecks, } from "../plane/preflight.js";
 import { runConductorInstallDoctor, } from "./install-doctor.js";
 import { BRING_UP_SECTION_LABELS } from "./readiness-sections.js";
 import { classifyBringUpFacts } from "./bring-up-facts.js";
+import { classifyMergeExecutionEligibility, MERGE_EXECUTION_INELIGIBLE_REMEDIATION, MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION, } from "./merge-execution-eligibility.js";
 import { createReadinessCheck, createReadinessCheckSafely, summarizeReadinessChecks, validateReadinessChecks, } from "../readiness-check.js";
 /** This report's own schema version. See the module docstring. */
 export const CONDUCTOR_READINESS_GATE_SCHEMA_VERSION = 1;
@@ -110,6 +120,13 @@ export const SERVER_READINESS_DESCRIPTORS = [
     { id: "review-policy", label: "Review policy" },
     { id: "github-credentials", label: "GitHub App credentials" },
     { id: "github-actions-permission", label: "GitHub App actions permission" },
+    // BAPI-1135 — merge-execution eligibility, BESIDE the App permission row and
+    // never replacing it: that row is the installation's dispatch/rerun
+    // permission, these two are the merge workflow and the branch policy that
+    // governs it. Two rows rather than one, because a workflow that is absent and
+    // a branch policy that excludes the actor are separately actionable.
+    { id: "merge-execution-workflow", label: "Merge workflow eligibility" },
+    { id: "merge-execution-branch-policy", label: "Merge branch policy" },
     // BAPI-1153 — the "Bring-up safety" group: deployment-wide facts that decide
     // whether a plane can drive a run at all, ahead of the repository-scoped
     // reconciler/executor rows. Labels come from the shared section layer.
@@ -163,7 +180,7 @@ const SERVER_REMEDIATIONS = {
     reconcilerUnreadable: "retry once the Bridge API is reachable; reconciler liveness is unknown here, not confirmed stale.",
     reconcilerStale: "start the reconciler for this repository (the `epic-implementer epic-tick` schedule) so ticks resume.",
     executorUnreadable: "retry once the Bridge API is reachable; no executor readiness claim is ever made from local state.",
-    executorNeverSeen: "provision and start an executor (`install conductor --executor-id <id>` or `executor install-service`); readiness comes only from a live server observation.",
+    executorNeverSeen: "provision and start an executor (`install conductor --executor-id <id> --repo-wide` or `executor install-service`); readiness comes only from a live server observation.",
     executorStale: "restart the executor service; it was observed once and has gone quiet past the server's staleness threshold.",
     reviewWorkflowUnknown: "re-run; the default branch's review workflow could not be evaluated, which is not the same as it being absent.",
     reviewWorkflowIncomplete: "install the claude-review workflow template on the default branch so it emits both the run id and the reviewed SHA the verdict protocol reads.",
@@ -175,6 +192,11 @@ const SERVER_REMEDIATIONS = {
     unattendedConsent: "set `unattended_epic_implementer_allowed` for this repository (docs/claude/account-settings-operator-runbook.md), or run setup with --attended.",
     unattendedNotifyDefault: "supply a --policy-file declaring notify.webhook_url, or run setup with --attended; an unattended run must have a working escalation channel, and notify.local_sink is not one.",
     repositoryWorkflowReadiness: "run `install-bridge conductor` so the review and conductor-CI workflows are confirmed on the default branch, or run setup with --attended.",
+    // BAPI-1135. Both are IMPORTED from the shared classifier rather than written
+    // out here, so the remedy command has exactly one spelling across the refusal,
+    // the readiness row, and the doctor — see `merge-execution-contract.ts`.
+    mergeExecutionUnverifiable: MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION,
+    mergeExecutionIneligible: MERGE_EXECUTION_INELIGIBLE_REMEDIATION,
 };
 /**
  * Project the validated server readiness response into `server.*` checks.
@@ -279,6 +301,7 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
             remediation: SERVER_REMEDIATIONS.githubCredentials,
         });
     outcomes.push(githubActionsOutcome(readiness));
+    outcomes.push(...mergeExecutionOutcomes(readiness));
     outcomes.push(...bringUpOutcomes(readiness));
     outcomes.push(reconcilerOutcome(readiness));
     outcomes.push(executorOutcome(readiness));
@@ -460,6 +483,64 @@ function githubActionsOutcome(readiness) {
         remediation: SERVER_REMEDIATIONS.actionsMissing,
     };
 }
+/**
+ * The two BAPI-1135 merge-execution rows.
+ *
+ * Both are backed SOLELY by {@link classifyMergeExecutionEligibility}, so this
+ * gate, the install doctor's section, the `drive-epic` requirement, and the
+ * `setup-epic` refusal cannot disagree about the status or the first blocker.
+ * Nothing here re-reads the server block or re-derives a fact.
+ *
+ * A `could_not_verify` verdict produces a RETRY-oriented row on both, and never
+ * claims the capability is absent. A confirmed insufficiency produces a
+ * `not eligible` row carrying the exact shared remedy command. The two are
+ * deliberately different statuses — `fail` for confirmed, `warn` for unknown —
+ * so the visible status label distinguishes them without relying on colour.
+ *
+ * Which of the two rows carries the blocker is decided by the reason: a branch
+ * policy that could not be read or an actor that is not admitted belongs to the
+ * branch-policy row; everything else belongs to the workflow row. The other row
+ * then reports that it was not reached, rather than showing a misleading pass.
+ */
+function mergeExecutionOutcomes(readiness) {
+    const verdict = classifyMergeExecutionEligibility(readiness);
+    const branchScoped = verdict.reason === "branch_policy_unreadable" || verdict.reason === "actor_not_admitted";
+    if (verdict.status === "eligible") {
+        return [
+            {
+                id: "merge-execution-workflow",
+                status: "pass",
+                detail: verdict.detail,
+            },
+            {
+                id: "merge-execution-branch-policy",
+                status: "pass",
+                detail: "the branch policy admits the workflow actor",
+            },
+        ];
+    }
+    const status = verdict.status === "could_not_verify" ? "warn" : "fail";
+    const remediation = verdict.status === "could_not_verify"
+        ? SERVER_REMEDIATIONS.mergeExecutionUnverifiable
+        : SERVER_REMEDIATIONS.mergeExecutionIneligible;
+    const blocked = {
+        id: branchScoped ? "merge-execution-branch-policy" : "merge-execution-workflow",
+        status,
+        detail: verdict.status === "could_not_verify"
+            ? `could not verify: ${verdict.detail}`
+            : `not eligible: ${verdict.detail}`,
+        remediation,
+    };
+    // The row that did not decide reports exactly that. Showing it as a pass would
+    // claim evidence the classifier stopped short of gathering.
+    const notReached = {
+        id: branchScoped ? "merge-execution-workflow" : "merge-execution-branch-policy",
+        status: "warn",
+        detail: "could not verify: not evaluated — an earlier merge-eligibility fact decided first",
+        remediation,
+    };
+    return branchScoped ? [notReached, blocked] : [blocked, notReached];
+}
 /** Reconciler liveness, preserving the server's own `stale` conclusion. */
 function reconcilerOutcome(readiness) {
     const r = readiness.reconciler;

package/build/conductor/recovery-operations.js

@@ -20,7 +20,7 @@
 import { randomUUID } from "crypto";
 import { adoptCurrentHeadAndUnparkTicket, completeMergeChild, ConductorBridgeApiError, dispatchRemediation, fetchEpicRunState, mergeChild, patchPolicy, resumeRun, safeDiagnosticMessage, scopeCatchUp, scopeReparse, stopEpicRun, unparkEpicTicket, updateEpicRunStatus, } from "./bridge-api-client.js";
 import { DEFAULT_GATE_NAME } from "./git-ci-types.js";
-import { resolveLocalMergeMethod, runApprovedLocalMerge } from "./local-merge.js";
+import { resolveLocalMergeCredential, resolveLocalMergeMethod, runApprovedLocalMerge, } from "./local-merge.js";
 /**
  * Bounded total attempts for a ticket-recovery CAS retry loop. Each attempt
  * begins with a fresh, authoritative state read — so this bounds full
@@ -312,7 +312,13 @@ export async function mergeChildRepair(access, options, deps = {}) {
             // which is discarded — never the server's action key, which the server
             // recomposes itself at completion.
             action_key: `merge-child:${options.epicRunId}:${options.prNumber}`,
-        }, { method: resolveLocalMergeMethod(local.merge_method) }, { env: deps.env ?? process.env });
+        }, { method: resolveLocalMergeMethod(local.merge_method) }, 
+        // BAPI-1136: an explicitly configured local credential, never the ambient
+        // login. `env` remains the source of the allowlisted operational base only.
+        {
+            env: deps.env ?? process.env,
+            credential: resolveLocalMergeCredential(deps.env ?? process.env, "local"),
+        });
         succeeded = localResult.status === "succeeded";
         alreadyMerged = succeeded && localResult.reason === "already_merged";
         failureReason = boundedLocalMergeReason(localResult.reason);

package/build/connect-bitbucket-api.js

@@ -138,7 +138,12 @@ export async function mintBitbucketConnection(deps, repoName) {
     if (!body || !state || !installUrl || typeof ttlSeconds !== "number") {
         return { ok: false, kind: "malformed" };
     }
-    return { ok: true, value: { state, installUrl, ttlSeconds } };
+    // Optional and permissive ON PURPOSE, and only here: absent, null, empty, or any
+    // non-string collapses to null through the same nullable helper the candidate parser
+    // uses. Required-field strictness above is untouched — an optional field must not
+    // become a new way for a server change to fail a mint.
+    const redeemUrlTemplate = asNullableString(body.redeem_url_template);
+    return { ok: true, value: { state, installUrl, ttlSeconds, redeemUrlTemplate } };
 }
 /** Strictly parse candidates. A candidate missing a usable identity fails the whole list. */
 function parseCandidates(value) {