@bridge_gpt/mcp-server 0.2.59 → 0.2.62

package/build/drive-epic.js

@@ -55,7 +55,9 @@
  */
 import { readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
-import { ConductorBridgeApiError, resolveConductorBridgeApiAccess, fetchConductorReadiness, fetchEpicRunState, safeDiagnosticMessage, } from "./conductor/bridge-api-client.js";
+import { ConductorBridgeApiError, resolveEpicLaunchBridgeApiAccess, fetchConductorReadiness, fetchEpicRunState, safeDiagnosticMessage, } from "./conductor/bridge-api-client.js";
+import { EPIC_LAUNCH_PROFILE_NAME_PATTERN, renderEpicLaunchCommand, shellQuote, } from "./epic-launch-profile.js";
+import { validateHttpBaseUrl, describeBaseUrlRejection } from "./base-url.js";
 import { BRING_UP_REFUSAL_MESSAGES, BRING_UP_RUNBOOK, firstBringUpRefusal, } from "./conductor/bring-up-facts.js";
 import { runSetupEpicWorkflow, } from "./setup-epic.js";
 import { formatPlaneDiagnostic, launchPlaneControlPlane, requestPlaneScopedLanes, runDefaultPlanePreflight, runPlaneCli, } from "./plane/cli.js";
@@ -161,6 +163,29 @@ export const V2_READINESS_REQUIREMENTS = [
         remedy: "Run `install-bridge conductor` to install them, or pass --attended.",
         satisfied: (r) => r.unattended?.repository_readiness_confirmed === true,
     },
+    // BAPI-1135 — merge-execution eligibility is deliberately NOT a requirement here.
+    //
+    // It was one, and it made `drive-epic` refuse EVERY repository the moment it
+    // shipped. The requirement could only be keyed on repository facts, because
+    // this layer keeps the composed run policy opaque to itself — and no
+    // repository carries the merge workflow until epic child 4 lands it. So both
+    // states resolved the same way: an upgraded server reported
+    // `merge_workflow_present: false` (`not_eligible`), an older one reported no
+    // block at all (`could_not_verify`), and either made `selectConductor` return
+    // `not_ready` and `classifyV2Readiness` return `operator_blocked` — for
+    // `--attended`, `--into-base` and `local`-mode runs alike, with a remedy
+    // naming a flag that does not exist yet.
+    //
+    // That is exactly the failure `selectConductor`'s own docstring warns about,
+    // and it contradicts the compatibility guarantee the rest of this slice keeps:
+    // nothing changes for a run that does not declare `github_actions`.
+    //
+    // Eligibility is still enforced, at the three layers that can actually see the
+    // declared mode: `setup-epic`'s pre-create refusal (which reads the composed
+    // policy), the approval route's server-side gate, and — authoritatively — the
+    // before-merge preflight. Readiness still REPORTS the facts as diagnostic
+    // rows, which inform without blocking. Reinstating a requirement here belongs
+    // with child 4, once a repository can actually satisfy it.
 ];
 /**
  * The readiness facts a `plane up` can actually repair (BAPI-1054).
@@ -310,6 +335,18 @@ export function getDriveEpicUsage() {
         "  --review-policy <src>  PER-RUN review policy source.",
         "  --replace-policy       Authorize replacing a LIVE run's stored policy.",
         "",
+        "Launch target (BAPI-1260) — decided BEFORE any authenticated request:",
+        "  --launch-profile <name>  Select the host-local launch profile guided setup",
+        "                         approved (`install conductor --launch-profile <name>`):",
+        "                         target, repository, mode, runtime, and policy and",
+        "                         credential references. The command setup prints",
+        "                         already selects it and runs in a fresh shell.",
+        "  --base-url <url>       Explicit Bridge API target. With a profile it must",
+        "                         agree with it — an override never rebinds a profile.",
+        "Without either, BAPI_BASE_URL is used; with none of the three, drive-epic",
+        "refuses. Nothing defaults to production — select it deliberately. A stored",
+        "credential is sent only to the endpoint setup approved it for.",
+        "",
         "  -h, --help             Show this help",
     ].join("\n");
 }
@@ -336,6 +373,9 @@ export function parseDriveEpicArgs(argv) {
     let policyFile;
     let reviewPolicy;
     let replacePolicy = false;
+    // BAPI-1260 launch selection.
+    let launchProfile;
+    let baseUrl;
     // BAPI-1009: validated with the SHARED validator setup-epic uses, so a name
     // drive-epic accepts is exactly a name setup-epic accepts. A second rule here
     // would let a name pass the router and fail the delegate.
@@ -371,7 +411,9 @@ export function parseDriveEpicArgs(argv) {
             arg === "--repo" ||
             arg === "--feature-branch" ||
             arg === "--policy-file" ||
-            arg === "--review-policy") {
+            arg === "--review-policy" ||
+            arg === "--launch-profile" ||
+            arg === "--base-url") {
             const value = argv[i + 1];
             if (value === undefined || value.startsWith("-")) {
                 return { status: "error", message: `${arg} requires a value.` };
@@ -384,6 +426,10 @@ export function parseDriveEpicArgs(argv) {
                 policyFile = value;
             else if (arg === "--review-policy")
                 reviewPolicy = value;
+            else if (arg === "--launch-profile")
+                launchProfile = value;
+            else if (arg === "--base-url")
+                baseUrl = value;
             else if (takeFeatureBranch(value) === null) {
                 return {
                     status: "error",
@@ -393,7 +439,7 @@ export function parseDriveEpicArgs(argv) {
             i++;
             continue;
         }
-        const eq = arg.match(/^(--plan-file|--repo|--feature-branch|--policy-file|--review-policy)=(.*)$/);
+        const eq = arg.match(/^(--plan-file|--repo|--feature-branch|--policy-file|--review-policy|--launch-profile|--base-url)=(.*)$/);
         if (eq) {
             const value = eq[2];
             if (eq[1] === "--feature-branch") {
@@ -414,6 +460,10 @@ export function parseDriveEpicArgs(argv) {
                 policyFile = value;
             else if (eq[1] === "--review-policy")
                 reviewPolicy = value;
+            else if (eq[1] === "--launch-profile")
+                launchProfile = value;
+            else if (eq[1] === "--base-url")
+                baseUrl = value;
             else
                 repo = value;
             continue;
@@ -435,6 +485,22 @@ export function parseDriveEpicArgs(argv) {
                 "may be selected — remove whichever one you did not mean.",
         };
     }
+    // BAPI-1260 — the launch selection is validated for SHAPE here, before any
+    // side effect. Whether it agrees with the profile and the environment is
+    // decided by the target resolver, still before any authenticated request.
+    if (launchProfile !== undefined && !EPIC_LAUNCH_PROFILE_NAME_PATTERN.test(launchProfile)) {
+        return {
+            status: "error",
+            message: "--launch-profile must match [a-z0-9][a-z0-9._-]{0,62}.",
+        };
+    }
+    if (baseUrl !== undefined) {
+        const validated = validateHttpBaseUrl(baseUrl);
+        if (!validated.ok) {
+            return { status: "error", message: describeBaseUrlRejection("--base-url", validated.reason) };
+        }
+        baseUrl = validated.baseUrl;
+    }
     if (positionals.length === 0) {
         return { status: "error", message: "Missing required epic key." };
     }
@@ -462,6 +528,8 @@ export function parseDriveEpicArgs(argv) {
         ...(policyFile ? { policyFile } : {}),
         ...(reviewPolicy ? { reviewPolicy } : {}),
         ...(replacePolicy ? { replacePolicy: true } : {}),
+        ...(launchProfile ? { launchProfile } : {}),
+        ...(baseUrl ? { baseUrl } : {}),
     };
     return { status: "ok", options };
 }
@@ -514,7 +582,7 @@ export function selectConductor(readiness) {
  * no quoting to get wrong.
  */
 export function buildSetupEpicArgv(options) {
-    const { epicKey, planFile, repo, featureBranch, intoBase, attended, policyFile, reviewPolicy, replacePolicy, } = options;
+    const { epicKey, planFile, repo, featureBranch, intoBase, attended, policyFile, reviewPolicy, replacePolicy, launchProfile, baseUrl, } = options;
     return [
         "--epic-key",
         epicKey,
@@ -528,6 +596,11 @@ export function buildSetupEpicArgv(options) {
         ...(policyFile ? ["--policy-file", policyFile] : []),
         ...(reviewPolicy ? ["--review-policy", reviewPolicy] : []),
         ...(replacePolicy ? ["--replace-policy"] : []),
+        // BAPI-1260 — the SAME launch selection, so setup-epic resolves the same
+        // target and bound credential drive-epic just did. Appended only when
+        // supplied, so every pre-existing argv stays byte-identical.
+        ...(launchProfile ? ["--launch-profile", launchProfile] : []),
+        ...(baseUrl ? ["--base-url", baseUrl] : []),
     ];
 }
 /**
@@ -538,8 +611,25 @@ export function buildSetupEpicArgv(options) {
  * is only true once {@link runDriveEpicCli} has declined to delegate — so route
  * first, render second.
  */
-export function renderConductorHandoff(selection, epicKey) {
-    const invocation = `npx -y ${MCP_PACKAGE_NAME} drive-epic ${epicKey} --plan-file <path>`;
+export function renderConductorHandoff(selection, epicKey, 
+/**
+ * BAPI-1260 — the selected launch profile and the options this invocation
+ * carried. With a profile, the re-run command selects it and carries every
+ * non-secret flag it needs, shell-quoted, so it runs unchanged in a fresh
+ * shell. The plan file is the one thing that cannot be filled in yet, and it
+ * is the only placeholder left.
+ */
+launch = { profile: null }) {
+    const invocation = launch.profile !== null
+        ? renderEpicLaunchCommand(launch.profile, {
+            epicKey,
+            planFile: "<path>",
+            ...(launch.options?.policyFile ? { policyFile: launch.options.policyFile } : {}),
+            ...(launch.options?.attended ? { attended: true } : {}),
+            ...(launch.options?.intoBase ? { intoBase: true } : {}),
+            ...(launch.options?.featureBranch ? { featureBranch: launch.options.featureBranch } : {}),
+        }).replace(`${shellQuote("<path>")}`, "<path>")
+        : `npx -y ${MCP_PACKAGE_NAME} drive-epic ${epicKey} --plan-file <path>`;
     return {
         conductor: "v2",
         invocation,
@@ -585,6 +675,16 @@ export function assertSingleConductorInvocation(text) {
         throw new Error(`drive-epic emitted more than one conductor invocation (${named.join(", ")}). ` +
             "Exactly one path may ever be presented.");
     }
+    // BAPI-1260 — the entry point itself, too. A rendered handoff now carries a
+    // complete, runnable `drive-epic <KEY> ...` command; two DIFFERENT runnable
+    // commands (say, one per profile or target) would hand the reader a choice of
+    // authority just as surely as naming two conductors. The same command
+    // repeated is still one invocation.
+    const runnable = new Set((text.match(/\bdrive-epic\s+[A-Z][A-Z0-9]*-[0-9]+[^\n]*/g) ?? []).map((line) => line.trim()));
+    if (runnable.size > 1) {
+        throw new Error(`drive-epic emitted ${runnable.size} different runnable launch commands. ` +
+            "Exactly one path may ever be presented.");
+    }
 }
 /**
  * Conservative bound on any single advisory field. Exists so malformed or
@@ -786,14 +886,31 @@ export function resolvePlaneReconcilerInstanceId(manifest, env, hostname) {
 }
 /** Terminal `epic_runs.status` values; every other status is a live run. */
 const TERMINAL_EPIC_RUN_STATUSES = ["abandoned", "done"];
+/** The BAPI-1260 launch selection carried by parsed options. */
+function launchSelectionOf(options) {
+    return {
+        ...(options.launchProfile ? { profileName: options.launchProfile } : {}),
+        ...(options.baseUrl ? { baseUrl: options.baseUrl } : {}),
+    };
+}
 export function createDefaultDriveEpicDeps() {
     return {
-        resolveAccess: async (repo, cwd) => {
-            const result = await resolveConductorBridgeApiAccess({
+        resolveAccess: async (repo, cwd, launch) => {
+            // BAPI-1260: the target-first launch contract. The generic resolver's
+            // production default does not apply to an epic launch.
+            const result = await resolveEpicLaunchBridgeApiAccess(launch ?? {}, {
                 ...(repo ? { repoName: repo } : {}),
                 ...(cwd ? { cwd } : {}),
             });
-            return result.ok ? { ok: true, access: result.access } : { ok: false, error: result.error };
+            return result.ok
+                ? { ok: true, access: result.access, profile: result.profile }
+                : { ok: false, error: result.error };
+        },
+        // Non-secret, and only ever a value the resolver just agreed with the
+        // environment on (a conflicting BAPI_BASE_URL was refused above), so the
+        // processes this command starts see the same target it resolved.
+        adoptLaunchTarget: (baseUrl) => {
+            process.env.BAPI_BASE_URL = baseUrl;
         },
         readReadiness: (access) => fetchConductorReadiness(access, globalThis.fetch),
         runSetupEpic: (argv) => runSetupEpicWorkflow(argv),
@@ -864,12 +981,19 @@ export async function runDriveEpicCli(argv, overrides = {}) {
         return 1;
     }
     const { epicKey, planFile, repo, featureBranch, intoBase } = parsed.options;
+    const launch = launchSelectionOf(parsed.options);
     try {
         // --- Resolve access. A missing credential is UNKNOWN, not not-ready. -----
-        const accessResult = await deps.resolveAccess(repo);
+        // BAPI-1260: the TARGET is decided first — from --launch-profile,
+        // --base-url, and BAPI_BASE_URL — and only then is a credential bound to
+        // that target read. A missing or conflicting target refuses here, before
+        // any authenticated request; nothing defaults to production.
+        const accessResult = await deps.resolveAccess(repo, undefined, launch);
         if (!accessResult.ok) {
             return escalate(deps, epicKey, `conductor readiness could not be read: ${accessResult.error}`);
         }
+        const launchProfile = accessResult.profile ?? null;
+        deps.adoptLaunchTarget?.(accessResult.access.baseUrl);
         // --- Read readiness. Any failure here is UNKNOWN — with ONE exception. ---
         let readiness;
         try {
@@ -884,6 +1008,14 @@ export async function runDriveEpicCli(argv, overrides = {}) {
             // because there unknown is still fatal (R14).
             if (planFile !== undefined && err instanceof ConductorBridgeApiError && err.kind === "network") {
                 const endpoint = planeEndpointForBaseUrl(deps, accessResult.access.baseUrl);
+                // BAPI-1260 — only a SELECTED LOCAL plane is ever started here. A
+                // profile approved for durable execution names an authority this
+                // machine does not own, so a refused port is that authority being
+                // down — never permission to launch a local replacement.
+                if (endpoint !== null && launchProfile !== null && launchProfile.executionMode !== "local") {
+                    return escalate(deps, epicKey, `launch profile '${launchProfile.name}' selects durable execution, and its control plane is ` +
+                        "not answering; no local replacement was started");
+                }
                 if (endpoint !== null) {
                     const probe = await deps.probePlanePort(endpoint.host, endpoint.port);
                     if (probe.kind === "refused") {
@@ -1055,7 +1187,10 @@ export async function runDriveEpicCli(argv, overrides = {}) {
             deps.errorLog(refusal);
             return 1;
         }
-        const handoff = renderConductorHandoff(selection, epicKey);
+        const handoff = renderConductorHandoff(selection, epicKey, {
+            profile: launchProfile,
+            options: parsed.options,
+        });
         const text = handoff.lines.join("\n");
         assertSingleConductorInvocation(text);
         deps.log(text);
@@ -1264,7 +1399,7 @@ async function coldStartPlane(ctx) {
  */
 async function attachToPlane(ctx, manifest, readiness) {
     const { deps, epicKey } = ctx;
-    const rooted = await deps.resolveAccess(ctx.options.repo, manifest.repoRoot);
+    const rooted = await deps.resolveAccess(ctx.options.repo, manifest.repoRoot, launchSelectionOf(ctx.options));
     if (!rooted.ok) {
         return refuse(deps, [
             `${epicKey}: cannot attach to the running plane — Bridge API credentials could not be ` +