@bridge_gpt/mcp-server 0.2.59 → 0.2.62

package/build/run-unit-tests-launcher.js

@@ -65,6 +65,11 @@ export const MODULE_MOCK_MANIFEST = [
     "build/conductor/store-lifecycle.test.js",
     "build/conductor/store-queries.test.js",
     "build/conductor/tools.test.js",
+    // BAPI-1247: drives offerBitbucketConnection to a chosen structured outcome by
+    // mocking the shared connect flow at install-bridge.ts's import site, which needs
+    // --experimental-test-module-mocks. Kept apart from install-bridge.test.js so that
+    // 346-test file stays in the NORMAL lane.
+    "build/connect-bitbucket-handoff.test.js",
     "build/connect-github-api.test.js",
     "build/connect-github-dispatch.static.test.js",
     "build/connect-github-handoff.test.js",

package/build/setup-epic.js

@@ -78,7 +78,14 @@
 import { readFile as fsReadFile, stat as fsStat } from "node:fs/promises";
 import os from "node:os";
 import { createProductionEpicIntegrationGhRunner, ensureEpicIntegrationPullRequest, formatEpicIntegrationPullRequestOutcome, } from "./epic-integration-pr.js";
-import { approveEpicPlan, createEpicRunWithDisposition, fetchConductorReadiness, fetchEpicRunState, replaceEpicRunPolicy, resolveConductorBridgeApiAccess, storeEpicPlan, validateEpicPlan, ConductorBridgeApiError, } from "./conductor/bridge-api-client.js";
+import { approveEpicPlan, buildConductorJiraUrl, conductorGetHeaders, createEpicRunWithDisposition, decodeCanonicalProvenance, fetchConductorReadiness, fetchEpicRunState, replaceEpicRunPolicy, resolveConductorBridgeApiAccess, resolveEpicLaunchBridgeApiAccess, storeEpicPlan, validateEpicPlan, ConductorBridgeApiError, } from "./conductor/bridge-api-client.js";
+// BAPI-1133 (A2) — the single legacy-to-typed merge-execution-mode mapping and
+// its total legacy resolver live in `merge-pull-request.ts` (no import cycle:
+// that module never imports from `setup-epic.ts`). Reused here rather than
+// reimplemented so the mapping stays single-defined.
+import { mapLegacyMergeExecutionModeToPolicyMode, resolveMergeExecutionMode, } from "./merge-pull-request.js";
+import { MERGE_EXECUTION_INELIGIBLE, MERGE_EXECUTION_MODE_GITHUB_ACTIONS, MERGE_WORKFLOW_REMEDY_COMMAND, } from "./conductor/merge-execution-contract.js";
+import { classifyMergeExecutionEligibility } from "./conductor/merge-execution-eligibility.js";
 import { resolveTrackedPaths } from "./git-reachability.js";
 import { validateBranchName } from "./base-ref.js";
 // Reused from the implement-epic client on purpose: adding a second wrapper under
@@ -90,7 +97,7 @@ import { validateBranchName } from "./base-ref.js";
 // conductor can drift on a field name or an endpoint shape. No MCP tool, no
 // input-schema field, and no description changes.
 import { getConfigFieldBaseBranch, getIndexScopeLifecycle, getParseStatus, } from "./epic-shared/bridge-client.js";
-import { boundScopeLifecycleLabel, createExecFileRunCommand, ensureCommitResolvableLocally, normalizeCommitSha, performExactIndexScopeCut, pollIndexScopeLifecycle, readRemoteBranchHead, runGit, SCOPE_BOOTSTRAP_POLL_INTERVAL_MS, SCOPE_LIFECYCLE_LABELS, } from "./epic-shared/cut-protocol.js";
+import { boundScopeLifecycleLabel, createExecFileRunCommand, ensureCommitResolvableLocally, performExactIndexScopeCut, pollIndexScopeLifecycle, readRemoteBranchHead, runGit, SCOPE_BOOTSTRAP_POLL_INTERVAL_MS, SCOPE_LIFECYCLE_LABELS, } from "./epic-shared/cut-protocol.js";
 import { hashPlan } from "./conductor/plan.js";
 import { BRING_UP_REFUSAL_MESSAGES, firstBringUpRefusal, } from "./conductor/bring-up-facts.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
@@ -128,6 +135,29 @@ export const SETUP_EPIC_UNATTENDED_POSTURE_REFUSED_CODE = "UNATTENDED_POSTURE_RE
  * which is what the observed BAPI-1085 run did.
  */
 export const SETUP_EPIC_AUTO_MERGE_POLICY_KEY = "v2_auto_merge_enabled";
+/**
+ * The `policy_json` key declaring the typed merge-execution mode (BAPI-1133, A2).
+ *
+ * Composed into the unattended default alongside `posture` and
+ * {@link SETUP_EPIC_AUTO_MERGE_POLICY_KEY}, in the SAME fill-if-absent branch,
+ * because the server's `RunPolicy` refuses an unattended auto-merge policy that
+ * omits it (`merge_execution_mode_unconfigured`). `setup-epic` is the only
+ * IMPLICIT writer of this key — any other client may still submit it explicitly
+ * as operator policy, and an explicitly supplied value here is never overwritten.
+ * Declaring `github_actions` or `machine_token` is intent only in this slice:
+ * neither changes merge execution until a later A2 child.
+ */
+export const SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY = "merge_execution_mode";
+/**
+ * BAPI-1259 — the opt-in for automatic integration-PR preparation. Written into
+ * the UNATTENDED epic-branch default only (fill-if-absent), so a run the
+ * operator starts unattended is prepared and handed off without a manual base
+ * merge or a manual un-draft. Attended runs, `--into-base` runs, and runs whose
+ * `--policy-file` already declares the key keep exactly what they had; a run
+ * approved before this key existed is never changed retroactively.
+ */
+export const SETUP_EPIC_INTEGRATION_PREPARATION_POLICY_KEY = "integration_preparation";
+const SETUP_EPIC_INTEGRATION_PREPARATION_DEFAULT = { enabled: true };
 /** Accepted `policy_json.review_policy.source` values (the `ReviewPolicy` surface). */
 export const SETUP_EPIC_REVIEW_POLICY_SOURCES = [
     "verdict_protocol",
@@ -169,12 +199,15 @@ export function getSetupEpicUsage() {
         "repository base branch, matching plain start-tickets semantics.",
         "",
         "Posture (default): a run that selects an epic branch is created UNATTENDED —",
-        "posture: unattended and v2_auto_merge_enabled: true — and the server stamps its",
-        "CI gate at first approval from the repository default, or records an explicit",
-        "no-CI-gate mode when the repository declares none. Child PRs merge into the epic",
-        "branch; the INTEGRATION PR into the repository base branch stays human-gated.",
-        "Pass --attended to opt out. A run that selects no epic branch (--into-base, or a",
-        "single-node plan) is unchanged and composes no posture at all.",
+        "posture: unattended, v2_auto_merge_enabled: true, and merge_execution_mode",
+        "(declared automatically from the repository's configured merge execution; a",
+        "policy declaration only — it does not change merge execution in this release)",
+        "— and the server stamps its CI gate at first approval from the repository",
+        "default, or records an explicit no-CI-gate mode when the repository declares",
+        "none. Child PRs merge into the epic branch; the INTEGRATION PR into the",
+        "repository base branch stays human-gated. Pass --attended to opt out. A run",
+        "that selects no epic branch (--into-base, or a single-node plan) is unchanged",
+        "and composes no posture at all.",
         "",
         "Unattended runs have TWO one-time repository prerequisites, refused by name",
         "before any run is created: repository consent (unattended_epic_implementer_allowed) and",
@@ -226,6 +259,10 @@ export function getSetupEpicUsage() {
         "                         sets no review policy of its own, so a value supplied",
         "                         here always wins.",
         "  --json                 Emit a single JSON result object on stdout",
+        "  --launch-profile <name>  (BAPI-1260) Resolve the target, repository, and bound",
+        "                         credential from this host-local launch profile. Passed",
+        "                         by drive-epic; there is no production default with it.",
+        "  --base-url <url>       (BAPI-1260) Explicit target; must agree with the profile.",
         "  -h, --help             Show this help",
         "",
         "Policy controls:",
@@ -326,6 +363,8 @@ export function parseSetupEpicArgs(argv) {
     let localOnly = false;
     let dryRun = false;
     let json = false;
+    let launchProfile;
+    let baseUrl;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         // `--policy-file=<path>` inline form (BAPI-754).
@@ -427,6 +466,19 @@ export function parseSetupEpicArgs(argv) {
                 i++;
                 break;
             }
+            // BAPI-1260 — the launch selection forwarded by drive-epic.
+            case "--launch-profile":
+            case "--base-url": {
+                const v = takeValue(argv, i, arg);
+                if (v === null || v.trim() === "")
+                    return { status: "error", message: `${arg} requires a value.` };
+                if (arg === "--launch-profile")
+                    launchProfile = v.trim();
+                else
+                    baseUrl = v.trim();
+                i++;
+                break;
+            }
             case "--into-base":
                 intoBase = true;
                 break;
@@ -508,6 +560,9 @@ export function parseSetupEpicArgs(argv) {
             localOnly,
             dryRun,
             json,
+            // BAPI-1260 — only when supplied, so a legacy options object is unchanged.
+            ...(launchProfile ? { launchProfile } : {}),
+            ...(baseUrl ? { baseUrl } : {}),
         },
     };
 }
@@ -1244,6 +1299,66 @@ export function evaluateSetupEpicBringUpPrerequisites(readiness) {
         return null;
     return { reason, message: `${BRING_UP_REFUSAL_MESSAGES[reason]} ${NO_RUN_WAS_CREATED}` };
 }
+/**
+ * Read the composed policy's typed `merge_execution_mode`, if it declares one.
+ *
+ * Strict equality against the mirrored constant, matching the server's own guard
+ * (`preflight._strict_github_actions_mode`). A missing key, a non-string, and
+ * any other mode all answer `false`, so nothing but an explicit declaration
+ * opens the gate.
+ */
+export function policyDeclaresGitHubActionsMerge(policy) {
+    if (policy === undefined || policy === null)
+        return false;
+    return policy.merge_execution_mode === MERGE_EXECUTION_MODE_GITHUB_ACTIONS;
+}
+/**
+ * Evaluate merge-execution eligibility against a readiness report.
+ *
+ * Pure and total. Returns `null` — no refusal — for every policy that does not
+ * declare `github_actions` mode, without reading the report at all.
+ *
+ * Uses {@link classifyMergeExecutionEligibility}, the same classifier readiness
+ * and `drive-epic` read, so all three agree on the status AND on the first
+ * blocker. A client that classified the block itself here would eventually
+ * disagree with the row an operator had just been shown.
+ *
+ * BOTH `not_eligible` and `could_not_verify` return
+ * `merge_execution_ineligible`. One code, because the operator's next action is
+ * the same and splitting it would put the burden of telling "not proven" from
+ * "proven absent" on the person least able to check. The MESSAGE keeps the
+ * capability category explicit, so the distinction survives where it is
+ * actionable.
+ *
+ * The message is built from the shared remedy constant, ends with the exact
+ * standalone sentence `No run was created.`, and carries no GitHub payload, URL,
+ * branch name, workflow source, credential, or exception text.
+ */
+export function evaluateSetupEpicMergeExecutionPrerequisites(readiness, requestedPolicy) {
+    if (!policyDeclaresGitHubActionsMerge(requestedPolicy))
+        return null;
+    if (readiness === null) {
+        return {
+            reason: MERGE_EXECUTION_INELIGIBLE,
+            message: "this run declares merge_execution_mode: github_actions, and the Bridge API " +
+                "conductor readiness report could not be read, so the repository's merge " +
+                "capability could not be confirmed. Retry once the server is reachable, or " +
+                `resolve it with \`${MERGE_WORKFLOW_REMEDY_COMMAND}\`. ${NO_RUN_WAS_CREATED}`,
+        };
+    }
+    const verdict = classifyMergeExecutionEligibility(readiness);
+    if (verdict.status === "eligible")
+        return null;
+    const category = verdict.status === "could_not_verify"
+        ? "could not be confirmed"
+        : "is not sufficient";
+    return {
+        reason: MERGE_EXECUTION_INELIGIBLE,
+        message: "this run declares merge_execution_mode: github_actions, and this repository's " +
+            `merge capability ${category}: ${verdict.detail}. Resolve it with ` +
+            `\`${MERGE_WORKFLOW_REMEDY_COMMAND}\`, then re-run. ${NO_RUN_WAS_CREATED}`,
+    };
+}
 /**
  * Does the policy this invocation will actually send request unattended operation?
  *
@@ -1283,8 +1398,11 @@ export function requestedPolicyIsUnattended(policy, attended) {
  * * **Feature branch, `--attended`** → `base_branch` plus an explicitly
  *   requested `review_policy`, and nothing else. Byte-identical to the
  *   pre-BAPI-1102 composition, which is precisely what the opt-out promises.
- * * **Feature branch, default** → adds `posture: "unattended"` and
- *   `v2_auto_merge_enabled: true`.
+ * * **Feature branch, default** → adds `posture: "unattended"`,
+ *   `v2_auto_merge_enabled: true`, (BAPI-1133, A2) `merge_execution_mode`
+ *   when the caller resolved one — the server refuses an unattended auto-merge
+ *   policy that omits it — and (BAPI-1259) `integration_preparation:
+ *   { enabled: true }`, so the run prepares its own integration PR.
  *
  * Deliberately absent from every shape:
  *
@@ -1306,6 +1424,12 @@ export function composeDefaultSetupEpicPolicy(args) {
         if (!args.attended) {
             policy.posture = SETUP_EPIC_UNATTENDED_POSTURE;
             policy[SETUP_EPIC_AUTO_MERGE_POLICY_KEY] = true;
+            if (args.mergeExecutionMode !== undefined) {
+                policy[SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY] = args.mergeExecutionMode;
+            }
+            policy[SETUP_EPIC_INTEGRATION_PREPARATION_POLICY_KEY] = {
+                ...SETUP_EPIC_INTEGRATION_PREPARATION_DEFAULT,
+            };
         }
     }
     if (args.reviewPolicy !== undefined) {
@@ -1346,6 +1470,14 @@ export function composeDefaultSetupEpicPolicy(args) {
  * * **`v2_auto_merge_enabled` already present** → left exactly as the file set
  *   it, including `false`. Filling the posture does not overwrite an explicit
  *   merge decision.
+ * * **`merge_execution_mode` already present** (BAPI-1133, A2) → left exactly
+ *   as the file set it, valid or not. An explicitly present but invalid mode is
+ *   NOT silently repaired here; it is forwarded unchanged so the server's
+ *   secret-safe typed validation rejects it. Absent, it is filled from the
+ *   caller's already-resolved {@link TypedMergeExecutionMode} in the same
+ *   fill-if-absent branch that stamps `posture` and
+ *   {@link SETUP_EPIC_AUTO_MERGE_POLICY_KEY} — the server refuses an
+ *   unattended auto-merge policy that omits it.
  *
  * Pure: it returns a new object and never mutates the input. It is applied on the
  * CREATE path only. A reused live run reconciles the file against its STORED
@@ -1365,6 +1497,15 @@ export function applySetupEpicUnattendedDefault(policy, args) {
     if (!(SETUP_EPIC_AUTO_MERGE_POLICY_KEY in composed)) {
         composed[SETUP_EPIC_AUTO_MERGE_POLICY_KEY] = true;
     }
+    if (!(SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY in composed) &&
+        args.mergeExecutionMode !== undefined) {
+        composed[SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY] = args.mergeExecutionMode;
+    }
+    if (!(SETUP_EPIC_INTEGRATION_PREPARATION_POLICY_KEY in composed)) {
+        composed[SETUP_EPIC_INTEGRATION_PREPARATION_POLICY_KEY] = {
+            ...SETUP_EPIC_INTEGRATION_PREPARATION_DEFAULT,
+        };
+    }
     return composed;
 }
 /**
@@ -1554,14 +1695,51 @@ export function resolveEffectiveFeatureBranch(featureBranch, requestedPolicy) {
     return trimmed;
 }
 /**
- * Read canonical parse truth and require a `succeeded` parse with a full
- * indexed commit — the commit `origin/<feature>` will be cut at.
+ * BAPI-1252: the operator sentence for each canonical refusal. Every one names
+ * the situation and what to do; none names a SHA, generation, or server error.
+ */
+export function canonicalRefusalMessage(repoName, reason) {
+    switch (reason) {
+        case "canonical_capability_unsupported":
+            return (`The Bridge server for ${repoName} did not report verified canonical index provenance ` +
+                `(it predates this contract, or sent a value this CLI cannot verify). Upgrade the ` +
+                `server; a cut is never authorized from the legacy indexed commit.`);
+        case "canonical_index_unverified":
+            return (`${SETUP_EPIC_PARSE_FIRST_MESSAGE}: the canonical index for ${repoName} has no verified ` +
+                `generation (legacy, interrupted, or still-writing content is never trusted), so there ` +
+                `is no commit to cut the feature branch at.`);
+        case "canonical_source_missing":
+            return (`${SETUP_EPIC_PARSE_FIRST_MESSAGE}: the last canonical parse of ${repoName} observed no ` +
+                `source commit (for example it parsed a supplied directory), so its content cannot be ` +
+                `verified. Re-parse it from its remote.`);
+        case "canonical_manifest_mismatch":
+            return (`The canonical index content for ${repoName} no longer matches its verified manifest ` +
+                `and has been marked unverified. Re-parse the repository before cutting.`);
+        case "canonical_generation_mismatch":
+        case "canonical_index_advanced":
+            return (`The canonical index for ${repoName} advanced while it was being checked. Retry once ` +
+                `the current parse finishes.`);
+        case "canonical_validity_unavailable":
+        default:
+            return (`The canonical validity for ${repoName} could not be read. Retry — this is not ` +
+                `evidence the repository is unindexed.`);
+    }
+}
+/**
+ * Read canonical parse truth and require AFFIRMATIVE verified provenance — the
+ * commit `origin/<feature>` will be cut at (BAPI-1252).
+ *
+ * The cut commit is the server's VERIFIED canonical source SHA, decoded through
+ * `decodeCanonicalProvenance`. Lifecycle fields (`status`, `indexed_commit_sha`)
+ * are display history and are never consulted: a `succeeded` row can describe a
+ * newer-created parse whose content the index does not hold. An absent field
+ * (an older server), an unknown state, a read failure, or an unverified
+ * generation all refuse before any branch or run mutation.
  *
  * Fails CLOSED (ratified R-2). The first line of every refusal is the exact
- * operator instruction; the closing lines state what did NOT happen. An
- * UNREADABLE status is kept distinct from an unsuccessful one — "could not read"
- * is not evidence the repository is unindexed, and telling that operator to
- * re-index would send them to re-parse a repository that may be fine.
+ * operator instruction; the closing line states what did NOT happen. An
+ * UNREADABLE status is kept distinct from an unverified one — "could not read"
+ * is not evidence the repository is unindexed.
  */
 export async function readCanonicalParseTruth(access, fetchImpl) {
     const notCreated = [
@@ -1578,30 +1756,14 @@ export async function readCanonicalParseTruth(access, fetchImpl) {
             ],
         };
     }
-    if (parse.value.status !== "succeeded") {
-        return {
-            ok: false,
-            lines: [
-                `${SETUP_EPIC_PARSE_FIRST_MESSAGE}: the canonical index for ${access.repoName} has no ` +
-                    `successful parse (status: ${String(parse.value.status)}), so there is no commit to ` +
-                    `cut the feature branch at.`,
-                ...notCreated,
-            ],
-        };
-    }
-    const indexed = normalizeCommitSha(parse.value.indexed_commit_sha);
-    if (indexed === null) {
+    const evidence = decodeCanonicalProvenance(parse.value);
+    if (!evidence.verified) {
         return {
             ok: false,
-            lines: [
-                `${SETUP_EPIC_PARSE_FIRST_MESSAGE}: the canonical index for ${access.repoName} published ` +
-                    `no commit for its last successful parse, so there is no commit to cut the feature ` +
-                    `branch at.`,
-                ...notCreated,
-            ],
+            lines: [canonicalRefusalMessage(access.repoName, evidence.reason), ...notCreated],
         };
     }
-    return { ok: true, cutCommitSha: indexed };
+    return { ok: true, cutCommitSha: evidence.sourceCommitSha };
 }
 /** The strict subset of `SetupEpicDeps` the shared cut protocol consumes. */
 function cutProtocolDeps(deps, runCommand) {
@@ -1836,7 +1998,10 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         return 0;
     }
     // --- Resolve access ------------------------------------------------------
-    const accessResult = await resolveConductorBridgeApiAccess({
+    // BAPI-1260: a caller that selected the epic-launch contract (drive-epic
+    // forwards --launch-profile / --base-url) gets the target-first resolver and
+    // the bound credential; the legacy resolver is kept byte-for-byte otherwise.
+    const accessDeps = {
         env: deps.env,
         cwd: deps.cwd,
         homedir: deps.homedir,
@@ -1844,7 +2009,13 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         readFile: deps.readFile,
         stat: deps.stat,
         repoName: opts.repo,
-    });
+    };
+    const accessResult = opts.launchProfile !== undefined || opts.baseUrl !== undefined
+        ? await resolveEpicLaunchBridgeApiAccess({
+            ...(opts.launchProfile ? { profileName: opts.launchProfile } : {}),
+            ...(opts.baseUrl ? { baseUrl: opts.baseUrl } : {}),
+        }, accessDeps)
+        : await resolveConductorBridgeApiAccess(accessDeps);
     if (!accessResult.ok) {
         deps.errorLog(`Cannot reach the Bridge API: ${accessResult.error}`);
         return 1;
@@ -1873,6 +2044,27 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
     // `base_branch` is honored exactly as `--feature-branch` would be. A malformed
     // or unknown policy field is left for the server's strict validation.
     const effectiveFeatureBranch = resolveEffectiveFeatureBranch(featureBranch, requestedPolicy);
+    // --- Typed merge-execution-mode declaration (BAPI-1133, A2) ---------------
+    // Resolved ONCE, here, before either composer runs, so the composer functions
+    // stay pure and synchronous. Gated on the exact predicate both composers'
+    // OWN fill-if-absent branches use — `!attended`, a feature branch selected,
+    // and (for the file path) no `posture` already declared — so this never
+    // performs the new configuration read for `--attended` or `--into-base` runs,
+    // and never for a file that already answered the posture question itself.
+    const unattendedDefaultEligible = !opts.attended &&
+        effectiveFeatureBranch !== undefined &&
+        (requestedPolicy === undefined || !("posture" in requestedPolicy));
+    let declaredMergeExecutionMode;
+    if (unattendedDefaultEligible) {
+        const mergeExecutionModeResolverDeps = {
+            repoName: access.repoName,
+            buildGetUrl: (path, params) => buildConductorJiraUrl(access.baseUrl, path, params),
+            getHeaders: async () => conductorGetHeaders(access),
+            fetchImpl: deps.fetch,
+        };
+        const effectiveLegacyMode = await resolveMergeExecutionMode(mergeExecutionModeResolverDeps);
+        declaredMergeExecutionMode = mapLegacyMergeExecutionModeToPolicyMode(effectiveLegacyMode);
+    }
     // --- The policy the CREATE path will send (BAPI-1102) ---------------------
     // Composed HERE, as soon as both of its inputs exist, so the one object that
     // gets reported, gated, and sent is the same object throughout. It is consumed
@@ -1883,12 +2075,30 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         ? applySetupEpicUnattendedDefault(requestedPolicy, {
             featureBranch: effectiveFeatureBranch,
             attended: opts.attended,
+            mergeExecutionMode: declaredMergeExecutionMode,
         })
         : composeDefaultSetupEpicPolicy({
             featureBranch,
             attended: opts.attended,
             reviewPolicy: opts.reviewPolicy,
+            mergeExecutionMode: declaredMergeExecutionMode,
         });
+    // BAPI-1133 (A2). Reported only when THIS command stamped the key — i.e. it
+    // is present in the composed policy and was absent from whatever the
+    // operator supplied — as low-emphasis policy metadata, mirroring the
+    // existing posture/auto-merge reporting rather than adding a new prompt,
+    // wizard, or runtime status. An explicitly declared mode (CLI-composed
+    // policy already carrying the key) is never reported here as if it were
+    // this command's decision.
+    const mergeExecutionModeStamped = declaredMergeExecutionMode !== undefined &&
+        composedForCreate[SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY] === declaredMergeExecutionMode &&
+        (requestedPolicy === undefined ||
+            !(SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY in requestedPolicy));
+    if (mergeExecutionModeStamped) {
+        say(`Policy:     merge_execution_mode: ${declaredMergeExecutionMode} (declared automatically ` +
+            `for the unattended default; policy metadata only — no dispatch, actuation, eligibility, ` +
+            `containment, or escalation behavior until a later A2 child)`);
+    }
     if (requestedPolicy !== undefined) {
         // The posture is stated for the FILE path too, and read off the composed
         // object rather than re-derived. The `--policy-file` invocation is the one
@@ -2430,6 +2640,21 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
                 deps.errorLog(`setup-epic REFUSED (${bringUpRefusal.reason}): ${bringUpRefusal.message}`);
                 return 1;
             }
+            // BAPI-1135 — merge-execution eligibility, AFTER the universal bring-up
+            // blockers (an unreadable readiness report and a behind database make this
+            // question moot) and BEFORE the unattended prerequisites and every
+            // approval check below. That position is what keeps readiness, this gate,
+            // and the approval refusal naming the SAME first blocker.
+            //
+            // Outside the `requestedPolicyIsUnattended` branch on purpose: an
+            // `--attended` run that declares `github_actions` mode is gated too. The
+            // evaluator itself returns null for every policy that does not declare the
+            // mode, so no other run's behavior changes.
+            const mergeExecutionRefusal = evaluateSetupEpicMergeExecutionPrerequisites(readiness, composedForCreate);
+            if (mergeExecutionRefusal !== null) {
+                deps.errorLog(`setup-epic REFUSED (${mergeExecutionRefusal.reason}): ${mergeExecutionRefusal.message}`);
+                return 1;
+            }
             if (requestedPolicyIsUnattended(composedForCreate, opts.attended)) {
                 // The COMPOSED policy, not the flags: a --policy-file declaring
                 // notify.webhook_url satisfies the escalation-channel prerequisite, and

package/build/version.generated.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.59";
-export const BUILD_COMMIT = "6caab78d0b75";
-export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.59", "serve"];
+export const VERSION = "0.2.62";
+export const BUILD_COMMIT = "9351fac413bf";
+export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.62", "serve"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.59",
+  "version": "0.2.62",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -26,7 +26,7 @@
   "//test": "The `test` script delegates to the bounded launcher (scripts/run-unit-tests.js → src/run-unit-tests-launcher.ts, BAPI-683), which discovers build/*.test.js at runtime and spawns them in size-bounded batches so the argv never exceeds Windows' ~8191-char command-line limit. Two determinism rules from the pre-launcher script are preserved INSIDE the launcher: (1) multi-file batches run WITHOUT --test-force-exit, because that flag makes node:test exit before aggregating per-subprocess summaries and the tally becomes nondeterministic (failures still surface and still set exit 1, but the count cannot be trusted as a completeness signal); (2) build/secret-safety.test.js leaks a handle that holds the event loop ~60s after its tests finish (they run in ~147ms), so the launcher quarantines it into its own single-file --test-force-exit invocation (FORCE_EXIT_QUARANTINE in src/run-unit-tests-launcher.ts) where the tally stays exact. Do NOT add --test-force-exit to batched invocations, and do NOT remove the quarantine, until the underlying handle leak is fixed.",
   "//version": "BAPI-930: fired by `npm version <level>` AFTER npm rewrites package.json's version field, so the bumped version and the repinned README land in the SAME commit. A bump performed by hand-editing package.json instead of running `npm version` bypasses this hook entirely and must repin manually via `node scripts/sync-readme-host-examples.js` — the `--check` wired into `build` below is the backstop that catches that case.",
   "scripts": {
-    "build": "node scripts/bundle-version.js && node scripts/sync-readme-host-examples.js --check && node scripts/validate-packaged-command-references.js && node scripts/bundle-readme.js && node scripts/bundle-pipelines.js && node scripts/bundle-commands.js && node scripts/bundle-agents.js && node scripts/bundle-docs.js && node scripts/bundle-agent-guidance.js && tsc && node scripts/sync-agent-mirrors.js && node scripts/bundle-esbuild.js",
+    "build": "node scripts/bundle-version.js && node scripts/sync-readme-host-examples.js --check && node scripts/validate-packaged-command-references.js && node scripts/bundle-readme.js && node scripts/bundle-pipelines.js && node scripts/bundle-commands.js && node scripts/bundle-agents.js && node scripts/bundle-docs.js && node scripts/bundle-agent-guidance.js && tsc && node scripts/sync-readme-merge-workflow.js --check && node scripts/sync-agent-mirrors.js && node scripts/bundle-esbuild.js",
     "version": "node scripts/sync-readme-host-examples.js --write && git add -- README.md package.json package-lock.json && git commit -m \"chore(mcp-server): release $npm_package_version\" && git tag \"mcp-server/v$npm_package_version\"",
     "check:version-generated": "node scripts/bundle-version.js && node scripts/check-version-generated.js",
     "assert:release-identity": "node scripts/assert-release-identity.js",
@@ -51,7 +51,7 @@
     "playwright": "^1.51.1"
   },
   "devDependencies": {
-    "@types/better-sqlite3": "^7.6.12",
+    "@types/better-sqlite3": "^9.6.0",
     "@types/node": "^26.0.1",
     "@types/pngjs": "^6.0.5",
     "esbuild": "^0.28.1",