@bridge_gpt/mcp-server 0.2.60 → 0.2.62

package/build/conductor/readiness.js

@@ -96,10 +96,11 @@ import { mapConductorDoctorReportToReadinessChecks, } from "./doctor.js";
 import { mapInstallStatusChecksToReadinessChecks, } from "../install-doctor.js";
 import { mapPlanePreflightToReadinessChecks, } from "../plane/preflight.js";
 import { runConductorInstallDoctor, } from "./install-doctor.js";
-import { BRING_UP_SECTION_LABELS } from "./readiness-sections.js";
+import { BRING_UP_SECTION_LABELS, presentRequiredChecks, } from "./readiness-sections.js";
 import { classifyBringUpFacts } from "./bring-up-facts.js";
 import { classifyMergeExecutionEligibility, MERGE_EXECUTION_INELIGIBLE_REMEDIATION, MERGE_EXECUTION_UNVERIFIABLE_REMEDIATION, } from "./merge-execution-eligibility.js";
 import { createReadinessCheck, createReadinessCheckSafely, summarizeReadinessChecks, validateReadinessChecks, } from "../readiness-check.js";
+import { ADMISSION_EVIDENCE_SCHEMA_VERSION, } from "./bridge-api-client.js";
 /** This report's own schema version. See the module docstring. */
 export const CONDUCTOR_READINESS_GATE_SCHEMA_VERSION = 1;
 /** Fixed statement carried in every report, so no consumer can mistake it for a gate. */
@@ -170,7 +171,6 @@ const SERVER_FAILURE_COPY = {
 const SERVER_REMEDIATIONS = {
     supervisorSetup: "run `install conductor` (or `setup-epic`) for this repository to write the project-default supervisor posture.",
     supervisorConfig: "run `install conductor` for this repository to write the project-default supervisor configuration.",
-    requiredChecks: "configure a non-empty required-check list in done_gate_config; an empty list makes the done gate pass unconditionally.",
     mergeApproval: "set the merge-approval requirement explicitly in the supervisor configuration rather than leaving it unset.",
     reviewPolicyMissing: "set the repository review-policy default so the merge path and the code_review gate read the same signal.",
     reviewPolicyDivergent: "align the repository review-policy default with the done gate's review_state condition, or confirm the difference is intended.",
@@ -252,18 +252,20 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
         });
     // Counts and booleans are safe facts and stay in `detail`; they never become
     // checks of their own, because there is nothing separate to remediate.
-    outcomes.push(s.required_checks_empty
-        ? {
-            id: "supervisor-required-checks",
-            status: "warn",
-            detail: "the required-check list is EMPTY — the done gate would pass unconditionally",
-            remediation: SERVER_REMEDIATIONS.requiredChecks,
-        }
-        : {
-            id: "supervisor-required-checks",
-            status: "pass",
-            detail: `${s.required_checks_count} required check(s) configured`,
-        });
+    //
+    // BAPI-1254: a nonempty count is not proof. The shared presentation — the same
+    // one the install-time section renders — passes ONLY a server `verified`
+    // verdict; a confirmed mismatch, could-not-verify, an empty list, and an older
+    // server's silence all fail, with distinct fixed copy.
+    const requiredChecks = presentRequiredChecks(s);
+    outcomes.push({
+        id: "supervisor-required-checks",
+        status: requiredChecks.satisfied ? "pass" : "fail",
+        detail: requiredChecks.detail,
+        ...(requiredChecks.remediation === undefined
+            ? {}
+            : { remediation: requiredChecks.remediation }),
+    });
     // Auto-merge OFF is a posture, not a gap: an operator may deliberately merge
     // by hand. Reported, never remediated.
     outcomes.push({
@@ -309,7 +311,7 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
     outcomes.push(ciWorkflowOutcome(readiness));
     outcomes.push(...unattendedOutcomes(readiness));
     const byId = new Map(outcomes.map((outcome) => [outcome.id, outcome]));
-    return SERVER_READINESS_DESCRIPTORS.map(({ id, label }) => {
+    const described = SERVER_READINESS_DESCRIPTORS.map(({ id, label }) => {
         const outcome = byId.get(id);
         if (!outcome) {
             return createReadinessCheck({
@@ -332,6 +334,97 @@ export function mapServerReadinessToChecks(readiness, failure = "unreachable") {
                 : { remediation: outcome.remediation ?? SERVER_REMEDIATIONS.olderServer }),
         });
     });
+    // BAPI-1260 — appended ONLY when the server reported the block, so every
+    // pre-BAPI-1260 report keeps exactly the descriptor set above.
+    return [...described, ...admissionEvidenceChecks(readiness)];
+}
+/** Human labels for the known BAPI-1260 evidence predicates. */
+const ADMISSION_EVIDENCE_LABELS = {
+    unattended_consent: "Launch evidence: unattended consent",
+    notify_webhook: "Launch evidence: notification destination",
+    repository_readiness: "Launch evidence: repository workflows",
+    required_checks: "Launch evidence: required CI checks",
+    index_provenance: "Launch evidence: canonical index provenance",
+    durable_actor: "Launch evidence: durable actor handshake",
+    migration_head: "Launch evidence: database migration head",
+};
+/** Who acts, in fixed prose. Never a value from the payload. */
+const ADMISSION_OWNER_REMEDIATION = {
+    operator: "the operator re-runs guided setup (`install conductor --launch-profile <name>`) and re-observes.",
+    repository_admin: "a repository administrator resolves it through the account-settings runbook; setup never grants it.",
+    bridge_operations: "escalate to Bridge operations; this is not something an operator command can change.",
+};
+/**
+ * Project the server's typed launch evidence (BAPI-1260) into `server.*`
+ * checks, read-only.
+ *
+ * The CLIENT decides nothing here: `confirmed` renders pass, `not_applicable`
+ * renders skip, and `denied` and `unable_to_verify` both render fail with
+ * DIFFERENT detail — a known denial and an inability to verify call for
+ * different actions, and neither authorizes a launch. The server is the only
+ * admission authority; this row is what it said, not a verdict of our own.
+ */
+export function admissionEvidenceChecks(readiness) {
+    const evidence = readiness.admission_evidence;
+    if (evidence === undefined)
+        return [];
+    if (evidence === null || evidence.schema_version !== ADMISSION_EVIDENCE_SCHEMA_VERSION) {
+        return [
+            createReadinessCheckSafely({
+                id: "server.admission-evidence",
+                source: "server",
+                label: "Launch evidence",
+                status: "fail",
+                detail: evidence === null
+                    ? "the server reported no launch evidence, so no mandatory prerequisite is proven"
+                    : "the server's launch-evidence schema is not one this CLI renders; treat every prerequisite as unverified",
+                remediation: "upgrade the CLI or the Bridge API deploy so both speak the same evidence schema.",
+            }),
+        ];
+    }
+    return evidence.records.map((record) => admissionEvidenceCheck(record));
+}
+function admissionEvidenceCheck(record) {
+    const slug = record.predicate.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
+    const label = ADMISSION_EVIDENCE_LABELS[record.predicate] ?? "Launch evidence";
+    const reason = record.reason ? ` (${record.reason})` : "";
+    const remediation = ADMISSION_OWNER_REMEDIATION[record.next_action_owner ?? "operator"] ?? ADMISSION_OWNER_REMEDIATION.operator;
+    switch (record.verdict) {
+        case "confirmed":
+            return createReadinessCheckSafely({
+                id: `server.admission-${slug}`,
+                source: "server",
+                label,
+                status: "pass",
+                detail: `confirmed by ${record.source}; fresh for ${record.max_age_seconds}s after observation`,
+            });
+        case "not_applicable":
+            return createReadinessCheckSafely({
+                id: `server.admission-${slug}`,
+                source: "server",
+                label,
+                status: "skip",
+                detail: `not applicable${reason}`,
+            });
+        case "denied":
+            return createReadinessCheckSafely({
+                id: `server.admission-${slug}`,
+                source: "server",
+                label,
+                status: "fail",
+                detail: `DENIED by ${record.source}${reason} — dependent activation, dispatch, and privileged operations are held`,
+                remediation,
+            });
+        default:
+            return createReadinessCheckSafely({
+                id: `server.admission-${slug}`,
+                source: "server",
+                label,
+                status: "fail",
+                detail: `could not be verified${reason} — unknown is not safe, so dependent work is held`,
+                remediation,
+            });
+    }
 }
 /**
  * The three BAPI-1153 bring-up safety rows.

package/build/credential-store.js

@@ -1370,6 +1370,12 @@ export async function upsertBapiCredential(repoName, apiKey, deps) {
         const action = hadKey ? "updated" : "created";
         // Preserve sibling secret names; replace ONLY BAPI_API_KEY.
         const nextEntry = { ...(existingEntry ?? {}), BAPI_API_KEY: trimmedKey };
+        // BAPI-1260: an epic-launch binding approves ONE key for one endpoint. A
+        // different key is a different credential, so its approval does not carry
+        // over — guided setup re-binds it explicitly.
+        if (existingEntry && existingEntry.BAPI_API_KEY !== trimmedKey) {
+            delete nextEntry[BAPI_EPIC_LAUNCH_BOUND_BASE_URL_FIELD];
+        }
         const next = { ...base, [target]: nextEntry };
         const dir = path.dirname(primaryPath);
         const suffix = (deps.tempSuffix ?? defaultTempSuffix)();
@@ -1408,3 +1414,153 @@ export async function upsertBapiCredential(repoName, apiKey, deps) {
         return { ok: true, path: primaryPath, target, action, migratedFallback };
     }, (error) => ({ ok: false, path: primaryPath, target, kind: "lock-error", error }));
 }
+// ---------------------------------------------------------------------------
+// Epic-launch credential binding (BAPI-1260)
+// ---------------------------------------------------------------------------
+/**
+ * NON-SECRET sibling field under `bapi:<repo>` naming the one normalized Bridge
+ * API base URL the stored `BAPI_API_KEY` was approved for by guided setup.
+ *
+ * Every pre-existing reader asks for `BAPI_API_KEY` only, so the extra field is
+ * invisible to them — existing credential clients and the public decoding of
+ * the store are unchanged. Only the epic-launch contract below reads it.
+ */
+export const BAPI_EPIC_LAUNCH_BOUND_BASE_URL_FIELD = "BAPI_EPIC_LAUNCH_BOUND_BASE_URL";
+/** Trim and drop trailing slashes — the executor's own base-URL normalization. */
+function normalizeBoundBaseUrl(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const normalized = raw.trim().replace(/\/+$/, "");
+    return normalized.length > 0 ? normalized : null;
+}
+/**
+ * Resolve the `BAPI_API_KEY` for an EPIC LAUNCH against one selected target.
+ *
+ * Unlike {@link resolveBapiCredentials}, the credential is coupled to the
+ * normalized base URL AND the repository, so a repo-only credential is never
+ * silently sent to a different endpoint:
+ *
+ *   - An ambient `BAPI_API_KEY` is used only when the same environment also sets
+ *     `BAPI_BASE_URL` to exactly the target — the pair is its provenance.
+ *     Anything else is `ambient-key-unbound`, and the key is NOT sent.
+ *   - A stored key is used only when its entry carries
+ *     {@link BAPI_EPIC_LAUNCH_BOUND_BASE_URL_FIELD} equal to the target. An
+ *     entry with no binding is `binding-unbound` (a legacy credential, upgraded
+ *     once through guided setup); a different binding is `binding-mismatch`.
+ *
+ * Read-only and migration-free: it never writes the store. Errors name the
+ * logical target and the store path only — never a secret or the entry's
+ * contents.
+ */
+export async function resolveEpicLaunchCredential(repoName, targetBaseUrl, deps) {
+    const target = normalizeBoundBaseUrl(targetBaseUrl);
+    const bundleKey = `bapi:${repoName}`;
+    if (target === null || repoName.trim().length === 0) {
+        return { ok: false, kind: "missing-key", error: "An epic launch needs a target and a repository." };
+    }
+    const envKey = (deps.env.BAPI_API_KEY ?? "").trim();
+    if (envKey.length > 0) {
+        const envBase = normalizeBoundBaseUrl(deps.env.BAPI_BASE_URL);
+        if (envBase !== target) {
+            return {
+                ok: false,
+                kind: "ambient-key-unbound",
+                error: "BAPI_API_KEY is set in this environment, but BAPI_BASE_URL does not name the selected " +
+                    "target, so the key's endpoint cannot be shown. It was not sent. Unset BAPI_API_KEY to use " +
+                    "the credential approved by setup, or set BAPI_BASE_URL to the selected target.",
+            };
+        }
+        return { ok: true, apiKey: envKey, source: "env", binding: "env-paired" };
+    }
+    // Read the stored entry exactly as the shared resolver would, but with the
+    // environment cleared so the ambient branch above stays the only env path.
+    // XDG_CONFIG_HOME is kept: it locates the store, and dropping it would read the
+    // key from a different file than the binding below (and than setup wrote).
+    const stored = await resolveCredentialBundle(bundleKey, ["BAPI_API_KEY"], {
+        ...deps,
+        env: { XDG_CONFIG_HOME: deps.env.XDG_CONFIG_HOME },
+    });
+    if (!stored.ok)
+        return { ok: false, kind: stored.kind, error: stored.error };
+    const bound = await readStoredBinding(bundleKey, deps);
+    const primaryPath = getPrimaryCredentialStorePath(deps);
+    if (bound === null) {
+        return {
+            ok: false,
+            kind: "binding-unbound",
+            error: `The stored credential "${bundleKey}" has not been approved for any Bridge API endpoint ` +
+                `(${primaryPath}). Run guided setup once to bind it: install conductor --launch-profile <name> ` +
+                `--base-url ${target}.`,
+        };
+    }
+    if (bound !== target) {
+        return {
+            ok: false,
+            kind: "binding-mismatch",
+            error: `The stored credential "${bundleKey}" is approved for a different Bridge API endpoint than the ` +
+                "selected target. It was not sent. Re-run guided setup to re-bind it explicitly.",
+        };
+    }
+    return { ok: true, apiKey: stored.values.BAPI_API_KEY, source: "file", binding: "store-bound" };
+}
+/**
+ * Read the non-secret bound base URL for one bundle, or `null` when the store,
+ * the entry, or the field is absent or unreadable. Never throws.
+ */
+export async function readStoredBinding(bundleKey, deps) {
+    try {
+        const resolution = await resolveCredentialStorePath(deps);
+        if (!resolution.found)
+            return null;
+        const parsed = parseCredentialStoreJson(await deps.readFile(resolution.path));
+        if (!parsed.ok)
+            return null;
+        return normalizeBoundBaseUrl(parsed.value[bundleKey]?.[BAPI_EPIC_LAUNCH_BOUND_BASE_URL_FIELD]);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The explicit ONE-TIME upgrade path: approve the stored `bapi:<repo>` key for
+ * one normalized base URL. Called only by guided setup after it has re-verified
+ * access and administrative authorization at that target — never by a launch.
+ *
+ * Writes only the non-secret binding field, under the shared lock, through the
+ * durable replacement; every other entry and sibling field is preserved. A store
+ * with no key for the repository is refused rather than creating one.
+ */
+export async function bindEpicLaunchCredential(repoName, targetBaseUrl, deps) {
+    const target = `bapi:${repoName.trim()}`;
+    const baseUrl = normalizeBoundBaseUrl(targetBaseUrl);
+    if (repoName.trim().length === 0 || baseUrl === null) {
+        return { ok: false, target, kind: "invalid-input", error: "A repository and a target are required." };
+    }
+    const primaryPath = getPrimaryCredentialStorePath(deps);
+    return withCredentialStoreLock(deps, async () => {
+        const primary = await readCredentialStoreJsonIfPresent(primaryPath, deps);
+        if (primary.state === "error") {
+            return { ok: false, target, kind: primary.kind, error: primary.error };
+        }
+        const entry = primary.state === "present" ? primary.value[target] : undefined;
+        if (!entry || typeof entry.BAPI_API_KEY !== "string" || entry.BAPI_API_KEY.trim() === "") {
+            return {
+                ok: false,
+                target,
+                kind: "not-found",
+                error: `No stored BAPI_API_KEY under "${target}" in ${primaryPath} to bind.`,
+            };
+        }
+        const previous = normalizeBoundBaseUrl(entry[BAPI_EPIC_LAUNCH_BOUND_BASE_URL_FIELD]);
+        if (previous === baseUrl)
+            return { ok: true, target, action: "unchanged", path: primaryPath };
+        const next = {
+            ...(primary.state === "present" ? primary.value : {}),
+            [target]: { ...entry, [BAPI_EPIC_LAUNCH_BOUND_BASE_URL_FIELD]: baseUrl },
+        };
+        const written = await durablyReplaceCredentialStoreJson(primaryPath, next, deps);
+        if (!written.ok)
+            return { ok: false, target, kind: written.kind, error: written.error };
+        return { ok: true, target, action: previous === null ? "bound" : "rebound", path: primaryPath };
+    }, (error) => ({ ok: false, target, kind: "lock-error", error }));
+}

package/build/doctor.js

@@ -34,7 +34,8 @@ import { resolveExecutorAgentAdapter } from "./agent-launchers/executor-adapter-
 import { parseDefaultOnEnvFlag } from "./env-flags.js";
 import { createBridgeApiUrls } from "./bridge-api-urls.js";
 import { probeToolSurface } from "./tool-surface-gating.js";
-import { resolveBapiCredentials } from "./credential-store.js";
+import { readStoredBinding, resolveBapiCredentials } from "./credential-store.js";
+import { listEpicLaunchProfiles } from "./epic-launch-profile.js";
 import { resolveConductorBridgeApiAccess } from "./conductor/bridge-api-client.js";
 import { getLiveRepositoryConductors, getParseDispatcherHealth, } from "./epic-shared/bridge-client.js";
 import { resolveRequiredStartTicketsRepoName } from "./start-tickets-repo.js";
@@ -1614,12 +1615,78 @@ export function formatOperationalAdvisoryReport(diagnostic) {
     return lines.join("\n");
 }
 /**
- * CLI entry for the read-only `doctor` subcommand. Returns a process exit code.
- * Help returns 0; parser errors return 1; otherwise it prints the report and
- * returns 0 when every required prerequisite is present, non-zero when any is
- * missing or the platform is unsupported. Never installs, mutates, spawns tabs,
- * or starts the MCP server.
+ * Read-only inventory of this host's epic-launch profiles and whether each
+ * one's credential binding matches its target. It reports; it never binds or
+ * migrates anything.
  */
+export async function collectEpicLaunchProfileDiagnostic(deps) {
+    const listing = await listEpicLaunchProfiles(deps);
+    if (!listing.ok)
+        return { store: "unreadable", message: listing.message };
+    if (!listing.present)
+        return { store: "absent" };
+    const host = deps.hostname();
+    const profiles = [];
+    for (const entry of listing.entries) {
+        if (!entry.validation.ok) {
+            profiles.push({ name: entry.name, usable: false, problem: entry.validation.kind });
+            continue;
+        }
+        const p = entry.validation.profile;
+        const bound = await readStoredBinding(p.credentialRef.target, {
+            env: deps.env,
+            homedir: deps.homedir,
+            platform: process.platform,
+            readFile: deps.readFile,
+            // Presence probe via read: the binding reader treats any failure as unbound.
+            stat: async (filePath) => {
+                await deps.readFile(filePath);
+                return { mode: 0o600 };
+            },
+        });
+        const hostMatches = p.host === host;
+        const credentialBinding = bound === null ? "unbound" : bound === p.baseUrl ? "matches" : "different";
+        profiles.push({
+            name: p.name,
+            usable: hostMatches && credentialBinding === "matches",
+            target: p.baseUrl,
+            repo: p.repoName,
+            mode: p.executionMode,
+            hostMatches,
+            credentialBinding,
+        });
+    }
+    return { store: "present", profiles };
+}
+/** Render the section, or `null` when this host has no profile store. */
+export function formatEpicLaunchProfileDiagnosticReport(diagnostic) {
+    if (diagnostic.store === "absent")
+        return null;
+    const lines = ["", "Epic launch profiles (read-only)", ""];
+    if (diagnostic.store === "unreadable") {
+        lines.push(`  [warn] ${diagnostic.message}`);
+        return lines.join("\n");
+    }
+    if (diagnostic.profiles.length === 0)
+        lines.push("  (none)");
+    for (const p of diagnostic.profiles) {
+        if (p.problem !== undefined) {
+            lines.push(`  [fail] ${p.name}: ${p.problem} — re-run \`install conductor --launch-profile ${p.name}\`.`);
+            continue;
+        }
+        const tag = p.usable ? "[ok]  " : "[fail]";
+        lines.push(`  ${tag} ${p.name}: ${p.target} repo=${p.repo} mode=${p.mode}`);
+        if (p.hostMatches === false)
+            lines.push("         approved on a different host — profiles are host-local.");
+        if (p.credentialBinding === "unbound") {
+            lines.push("         stored credential not yet approved for this target — re-run guided setup to bind it.");
+        }
+        else if (p.credentialBinding === "different") {
+            lines.push("         stored credential is approved for a DIFFERENT target — a launch will refuse to send it.");
+        }
+    }
+    return lines.join("\n");
+}
 export async function runDoctorCli(argv, overrides = {}) {
     const log = overrides.log ?? ((m) => console.log(m));
     const errorLog = overrides.errorLog ?? ((m) => console.error(m));
@@ -1919,6 +1986,27 @@ export async function runDoctorCli(argv, overrides = {}) {
             }));
         }
     }
+    // Advisory epic-launch profile section (BAPI-1260). Read-only: it never binds,
+    // migrates, or rewrites a profile or a credential — setup does that, with
+    // consent. Never affects the exit code.
+    if (overrides.launchProfiles !== false) {
+        try {
+            const injectedFs = deps;
+            const report = formatEpicLaunchProfileDiagnosticReport(await collectEpicLaunchProfileDiagnostic({
+                env: overrides.launchProfiles?.env ?? deps.env,
+                homedir: overrides.launchProfiles?.homedir ?? injectedFs.homedir ?? os.homedir,
+                readFile: overrides.launchProfiles?.readFile ??
+                    injectedFs.readFile ??
+                    ((p) => readFile(p, "utf-8")),
+                hostname: overrides.launchProfiles?.hostname ?? os.hostname,
+            }));
+            if (report !== null)
+                log(report);
+        }
+        catch {
+            /* advisory only: an unexpected failure drops the section, never the doctor */
+        }
+    }
     // Advisory operational-advisories section (BAPI-963). Read by the operator
     // asking "what is already running?" right after the readiness sections above.
     //