@bridge_gpt/mcp-server 0.2.60 → 0.2.65

package/build/executor/types.js

@@ -42,6 +42,36 @@ export const EXECUTOR_CLASSIFICATION_VALUES = [
     "no_progress",
     "lease_expired",
 ];
+/**
+ * BAPI-1311 — the capability an executor declares when it can run a FOCUSED
+ * merge-stage `rebase`: validate `payload.focused_rebase` before any worker
+ * effect, use the server-rendered prompt verbatim, and supervise the post-push
+ * mergeability/required-check wait under the job's own claim and deadline.
+ * Mirrors `FOCUSED_REBASE_CAPABILITY` in
+ * `src/python/llms/executor_completion_contract.py`. Independent of completion
+ * evidence: `rebase` is not a covered job type.
+ */
+export const FOCUSED_REBASE_CAPABILITY = "focused_rebase.v1";
+/** The focused context version; the same string as the capability on purpose. */
+export const FOCUSED_REBASE_CONTEXT_VERSION = FOCUSED_REBASE_CAPABILITY;
+/**
+ * BAPI-1258 — the terminal provider-capacity protocol contract, mirroring
+ * `src/python/llms/executor_capacity_contract.py`. Closed values: an executor
+ * or server that does not recognize a value refuses it instead of guessing.
+ *
+ * The supported runtime contract is the packaged Claude runtime's stream-json
+ * `rate_limit_event` whose `rate_limit_info.status` is exactly `"rejected"`,
+ * observed during a job whose process then failed. The repository pins no
+ * Claude Code release, so the contract is named for the event shape it relies on.
+ */
+export const TERMINAL_CAPACITY_PROTOCOL_VERSIONS = [1];
+export const TERMINAL_CAPACITY_RUNTIMES = ["claude"];
+export const TERMINAL_CAPACITY_RUNTIME_CONTRACTS = ["claude-stream-json.rate-limit-rejected.v1"];
+export const TERMINAL_CAPACITY_CAUSE_VALUES = [
+    "rate_limit_exhausted",
+    "quota_exhausted",
+    "provider_capacity_unavailable",
+];
 /**
  * Outcome of a heartbeat/complete/fail mutation (T2 status mapping):
  *  - `updated`            2xx `{ ok: true }`
@@ -95,3 +125,28 @@ export const RECONCILER_LIVENESS_VALUES = ["fresh", "stale", "never_seen", "unkn
 export function normalizeHeartbeatResult(response) {
     return typeof response === "string" ? { outcome: response } : response;
 }
+// ---------------------------------------------------------------------------
+// Integration actions (BAPI-1259)
+// ---------------------------------------------------------------------------
+//
+// A SEPARATELY DISCRIMINATED run-level protocol, mirrored from
+// `api/models/epic_integration_action.py`. It is deliberately NOT a member of
+// `EXECUTOR_JOB_TYPE_VALUES` above: an ordinary claim never returns one, and an
+// integration action has no ticket. The executor consumes it through its own
+// client and its own claim loop step.
+/** The one protocol version this executor speaks (exact equality server-side). */
+export const INTEGRATION_ACTION_PROTOCOL_VERSION = 1;
+/** The closed operation vocabulary. There is no merge operation. */
+export const INTEGRATION_ACTION_OPERATIONS = ["sync_base", "correct", "mark_ready"];
+/** The closed fact vocabulary a report may carry. */
+export const INTEGRATION_ACTION_OUTCOMES = [
+    "applied",
+    "already_satisfied",
+    "conflict",
+    "authority_unavailable",
+    "authority_lost",
+    "head_drift",
+    "pr_ambiguous",
+    "indeterminate",
+    "failed",
+];

package/build/executor/worker-command.js

@@ -17,13 +17,21 @@
  * distinct from the argv vocabulary is what stops a future flag rename in one
  * agent's CLI from becoming an operator-visible policy break across all of them.
  */
-import { ExecutorNamedError } from "./job-errors.js";
+import { CiFixContext, ExecutorNamedError } from "./job-errors.js";
 import { isRecoveryJobType } from "./job-types.js";
+/**
+ * BAPI-1296: `ci_fix` is the one recovery job with a FOCUSED prompt route. It
+ * renders its server-authored `payload.prompt_spec` (the dispatched failing and
+ * missing checks) in `job-runner.ts`, and is never given the full recipe.
+ */
+export const CI_FIX_JOB_TYPE = "ci_fix";
 /**
  * Resolve the worker prompt for the explicit-prompt and legacy synthesis paths.
  * Uses an explicit non-empty `payload.prompt` verbatim; otherwise, for
- * `implement` and the recovery jobs, builds the conservative
- * `/implement-ticket <ticket_key> --auto` prompt.
+ * `implement` and the `remediate`/`rebase` recovery jobs, builds the
+ * conservative `/implement-ticket <ticket_key> --auto` prompt. `ci_fix` never
+ * resolves here (BAPI-1296): it is refused if it carries an explicit prompt and
+ * otherwise falls through to its focused prompt-spec route.
  *
  * Structured `payload.prompt_spec` rendering is NOT done here: it needs the
  * prepared worktree/git state, so `job-runner.ts` renders it in the prepared-spawn
@@ -40,19 +48,46 @@ import { isRecoveryJobType } from "./job-types.js";
 /**
  * True for the job types that synthesize `/implement-ticket <KEY> --auto` when no
  * explicit `payload.prompt` is present: the first-pass `implement` plus the
- * recovery jobs (`remediate`/`ci_fix`/`rebase`), which re-enter the SAME
- * correction loop on the ticket's existing branch/PR. Recovery classification is
- * shared with dispatch and worktree reuse via `isRecoveryJobType` (`job-types.ts`)
- * so eligibility cannot drift. Verdict jobs (`spec_review`/`smoke`) are NOT here —
+ * `remediate`/`rebase` recovery jobs, which re-enter the SAME correction loop on
+ * the ticket's existing branch/PR. Recovery classification is shared with
+ * dispatch and worktree reuse via `isRecoveryJobType` (`job-types.ts`) so
+ * eligibility cannot drift. Verdict jobs (`spec_review`/`smoke`) are NOT here —
  * they carry an explicit `payload.prompt` and write a fixed-path artifact (T6/T5b).
+ *
+ * BAPI-1296: `ci_fix` is EXCLUDED even though it stays a recovery job (branch
+ * reuse, worktree lock, and finalization policy are unchanged). Re-entering the
+ * whole recipe to repair a dispatched check repeated planning and implementation
+ * the server had already finished; `ci_fix` now renders its focused prompt spec
+ * or is refused by name, and never falls back to this synthesis.
  */
-function synthesizesImplementPrompt(jobType) {
+export function synthesizesImplementPrompt(jobType) {
+    if (jobType === CI_FIX_JOB_TYPE)
+        return false;
     return jobType === "implement" || isRecoveryJobType(jobType);
 }
 export function resolveExecutorPrompt(job) {
     const payload = job.payload && typeof job.payload === "object"
         ? job.payload
         : {};
+    // BAPI-1296: `ci_fix` is decided FIRST, ahead of both explicit-prompt
+    // precedence and synthesis. An explicit prompt on a ci_fix job — including an
+    // in-flight legacy `/implement-ticket <KEY> --auto` — is refused by name rather
+    // than run, so an old full-recipe prompt cannot silently defeat the focused
+    // route. Otherwise the non-ok result tells `prepareSpawn` to take the focused
+    // prompt-spec route. The message never echoes the prompt text.
+    if (job.job_type === CI_FIX_JOB_TYPE) {
+        if (typeof payload.prompt === "string" && payload.prompt.trim().length > 0) {
+            return {
+                ok: false,
+                errorKind: CiFixContext,
+                error: "ci_fix job refused before worker effects (reason=explicit_prompt_unsupported)",
+            };
+        }
+        return {
+            ok: false,
+            error: "ci_fix renders its focused payload.prompt_spec; no prompt is synthesized",
+        };
+    }
     // An explicit prompt wins and is returned VERBATIM (un-trimmed), but a
     // whitespace-only string is not a usable worker instruction — treat it as
     // absent so a recovery/implement job still falls back to the synthesized
@@ -62,11 +97,12 @@ export function resolveExecutorPrompt(job) {
         return { ok: true, prompt: explicit };
     }
     // `/implement-ticket <KEY> --auto` is the full correction engine, not just a
-    // first-pass implementer: its post-PR loop owns CI-failure correction, review-
-    // change addressing, and merge-conflict resolution (see .claude/commands/
-    // implement-ticket.md "Clean session exit"). So the recovery jobs that operate
-    // on the ticket's existing branch/PR — `remediate`/`ci_fix`/`rebase` — resume
-    // by RE-ENTERING THE COMPLETE RECIPE from step 1, not a distinct resume path.
+    // first-pass implementer: its post-PR loop owns review-change addressing and
+    // merge-conflict resolution (see .claude/commands/implement-ticket.md "Clean
+    // session exit"). So the recovery jobs that operate on the ticket's existing
+    // branch/PR — `remediate`/`rebase` — resume by RE-ENTERING THE COMPLETE RECIPE
+    // from step 1, not a distinct resume path. (`ci_fix` left this path in
+    // BAPI-1296 and returned above: CI failures are repaired by a focused worker.)
     // That re-entry is safe (BAPI-746), backed by re-entry handling already
     // present in three of the recipe's own steps, not a new assumption: plan
     // generation is idempotent because the server reuses a fresh existing plan

package/build/executor/worker-finalization.js

@@ -58,6 +58,16 @@
  */
 import { ReconcileOverlapPushUnfinalized, secretFreeErrorMessage, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationPrBaseMismatch, WorkerFinalizationPrNotAttached, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
 import { isImplementationStyleJobType } from "./job-types.js";
+/** The `runCommand` options for one bounded read; `{ cwd }` alone when unbounded. */
+function callOptions(worktreePath, bound) {
+    return bound && typeof bound.timeoutMs === "number"
+        ? { cwd: worktreePath, timeoutMs: Math.max(1, Math.floor(bound.timeoutMs)) }
+        : { cwd: worktreePath };
+}
+/** True when a bounded call has no time left and must not be issued at all. */
+function callExpired(bound) {
+    return bound !== undefined && typeof bound.timeoutMs === "number" && bound.timeoutMs <= 0;
+}
 /** Bounded settling re-check defaults for the authoritative origin-tip lookup. */
 const DEFAULT_ORIGIN_FINALIZATION_ATTEMPTS = 3;
 const DEFAULT_ORIGIN_FINALIZATION_RETRY_DELAY_MS = 500;
@@ -113,9 +123,11 @@ function parseLsRemoteHeadSha(stdout, expectedRef) {
  * on a recovery worktree. A non-zero exit is treated as "branch not found"
  * without copying raw stderr into diagnostics.
  */
-export async function resolveOriginBranchSha(runCommand, worktreePath, branch) {
+export async function resolveOriginBranchSha(runCommand, worktreePath, branch, bound) {
     const normalizedRef = normalizeBranchRef(branch);
-    const result = await runCommand("git", ["ls-remote", "--exit-code", "--heads", "origin", normalizedRef], { cwd: worktreePath });
+    if (callExpired(bound))
+        return null;
+    const result = await runCommand("git", ["ls-remote", "--exit-code", "--heads", "origin", normalizedRef], callOptions(worktreePath, bound));
     if (result.exitCode !== 0)
         return null;
     return parseLsRemoteHeadSha(result.stdout, normalizedRef);
@@ -129,11 +141,11 @@ export async function resolveOriginBranchSha(runCommand, worktreePath, branch) {
  * yet match. Returns the LAST authoritative observation — the caller decides
  * loud-failure from that final value, so true negatives are preserved.
  */
-async function resolveOriginBranchShaForFinalization(runCommand, worktreePath, branch, trimmedHeadSha, attempts, retryDelayMs, sleep) {
+async function resolveOriginBranchShaForFinalization(runCommand, worktreePath, branch, trimmedHeadSha, attempts, retryDelayMs, sleep, bound) {
     const total = Math.max(1, attempts);
     let remoteSha = null;
     for (let attempt = 0; attempt < total; attempt++) {
-        remoteSha = await resolveOriginBranchSha(runCommand, worktreePath, branch);
+        remoteSha = await resolveOriginBranchSha(runCommand, worktreePath, branch, bound?.());
         if (remoteSha !== null) {
             // Existence-only success when HEAD is unknown; exact-match success otherwise.
             if (!trimmedHeadSha || remoteSha === trimmedHeadSha) {
@@ -170,14 +182,16 @@ const PR_LOOKUP_ABSENT = {
  * collapses to {@link PR_LOOKUP_ABSENT} without copying raw stderr, an
  * authenticated remote, or the command line into anything the caller can render.
  */
-async function resolvePrForFinalization(runCommand, worktreePath, branch) {
+async function resolvePrForFinalization(runCommand, worktreePath, branch, bound) {
     const args = ["pr", "view"];
     if (branch)
         args.push(branch);
     args.push("--json", PR_VIEW_JSON_FIELDS);
+    if (callExpired(bound))
+        return PR_LOOKUP_ABSENT;
     let result;
     try {
-        result = await runCommand("gh", args, { cwd: worktreePath });
+        result = await runCommand("gh", args, callOptions(worktreePath, bound));
     }
     catch {
         return PR_LOOKUP_ABSENT;
@@ -398,6 +412,8 @@ export async function validateWorkerFinalization(input) {
     if (!isImplementationStyleJobType(job.job_type)) {
         return { ok: true };
     }
+    // BAPI-1311: resolved fresh for every call so each read gets only the time left.
+    const bound = () => input.callTimeoutMs ? { timeoutMs: input.callTimeoutMs() } : undefined;
     const hasPrUrl = Boolean(extractPrUrl(result));
     // BAPI-762: `branch`/`headSha` are normalized once here and reused through the
     // rest of the check — including by the diagnostics below — instead of being
@@ -418,7 +434,7 @@ export async function validateWorkerFinalization(input) {
     // unconditional. Their dispositions still differ on purpose (see `PrLookup`),
     // and the ORDER is unchanged: a wrong-base PR is still reported before any
     // origin lookup, exactly as BAPI-586 specified.
-    let pr = await resolvePrForFinalization(runCommand, worktreePath, trimmedBranch);
+    let pr = await resolvePrForFinalization(runCommand, worktreePath, trimmedBranch, bound());
     // BAPI-586: a wrong-base PR (opened against a dependency's feature branch or the
     // repo default instead of the run base) never fires `claude-review.yml` and
     // strands the ticket at `code_review`. When the run base is known, fail loud on
@@ -448,7 +464,7 @@ export async function validateWorkerFinalization(input) {
     const sleep = input.sleep ?? sleepMs;
     let origin;
     try {
-        origin = await resolveOriginBranchShaForFinalization(runCommand, worktreePath, trimmedBranch, trimmedHeadSha, attempts, retryDelayMs, sleep);
+        origin = await resolveOriginBranchShaForFinalization(runCommand, worktreePath, trimmedBranch, trimmedHeadSha, attempts, retryDelayMs, sleep, bound);
     }
     catch (err) {
         return {
@@ -497,7 +513,7 @@ export async function validateWorkerFinalization(input) {
     // base check fail-opened on it, and the PR that has since appeared must not
     // reach success without that check.
     if (origin.attemptsUsed > 1) {
-        pr = await resolvePrForFinalization(runCommand, worktreePath, trimmedBranch);
+        pr = await resolvePrForFinalization(runCommand, worktreePath, trimmedBranch, bound());
         const refreshedBaseVerdict = evaluatePrBase(job, pr, expectedBase);
         if (refreshedBaseVerdict)
             return { ok: false, failure: refreshedBaseVerdict };
@@ -505,7 +521,7 @@ export async function validateWorkerFinalization(input) {
     let contract = evaluatePrContract(pr, trimmedHeadSha);
     for (let attempt = 1; attempt < attempts && !contract.ok && contract.retryable; attempt++) {
         await sleep(retryDelayMs);
-        pr = await resolvePrForFinalization(runCommand, worktreePath, trimmedBranch);
+        pr = await resolvePrForFinalization(runCommand, worktreePath, trimmedBranch, bound());
         contract = evaluatePrContract(pr, trimmedHeadSha);
     }
     if (!contract.ok) {
@@ -514,5 +530,66 @@ export async function validateWorkerFinalization(input) {
             failure: prNotAttachedFailure(job, trimmedBranch, trimmedHeadSha, expectedBase, contract.detail),
         };
     }
-    return { ok: true, prUrl: pr.url ?? undefined, prNumber: pr.prNumber };
+    return {
+        ok: true,
+        prUrl: pr.url ?? undefined,
+        prNumber: pr.prNumber,
+        // BAPI-1311: the verified origin tip — proven equal to the worker's HEAD above
+        // whenever that HEAD was known. Only for a caller that asked for it.
+        ...(input.exposePushedHead === true ? { pushedHeadSha: remoteSha } : {}),
+    };
+}
+// ---------------------------------------------------------------------------
+// BAPI-1311 — the focused rebase wait's pull-request read
+// ---------------------------------------------------------------------------
+/**
+ * The bounded public projection the focused rebase wait asks for. Separate from
+ * {@link PR_VIEW_JSON_FIELDS} on purpose: legacy finalization keeps its exact
+ * field selection, and only the rebase wait pays for state and mergeability.
+ */
+const FOCUSED_PR_VIEW_JSON_FIELDS = "number,state,headRefOid,headRefName,baseRefName,mergeable";
+/**
+ * Read the bound pull request's current state with ONE bounded `gh pr view`.
+ *
+ * Addresses the pull request by NUMBER, never by branch, so a second pull request
+ * opened for the same branch can never be mistaken for the bound one. Parses only
+ * {@link FOCUSED_PR_VIEW_JSON_FIELDS}; raw stdout/stderr never leave this
+ * function. An already-expired bound issues no command at all.
+ */
+export async function readFocusedPullRequest(runCommand, worktreePath, prNumber, bound) {
+    if (!Number.isInteger(prNumber) || prNumber <= 0 || callExpired(bound)) {
+        return { available: false };
+    }
+    let result;
+    try {
+        result = await runCommand("gh", ["pr", "view", String(prNumber), "--json", FOCUSED_PR_VIEW_JSON_FIELDS], callOptions(worktreePath, bound));
+    }
+    catch {
+        return { available: false };
+    }
+    if (result.exitCode !== 0)
+        return { available: false };
+    let parsed;
+    try {
+        parsed = JSON.parse(result.stdout);
+    }
+    catch {
+        return { available: false };
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return { available: false };
+    const obj = parsed;
+    const rawState = nonBlankString(obj.state);
+    const rawHead = nonBlankString(obj.headRefOid);
+    const rawMergeable = nonBlankString(obj.mergeable);
+    const mergeable = rawMergeable === "MERGEABLE" ? "mergeable" : rawMergeable === "CONFLICTING" ? "conflicting" : "unknown";
+    return {
+        available: true,
+        number: typeof obj.number === "number" && Number.isInteger(obj.number) ? obj.number : null,
+        state: rawState === null ? null : rawState.toUpperCase(),
+        headRefOid: rawHead === null ? null : rawHead.toLowerCase(),
+        headRefName: nonBlankString(obj.headRefName),
+        baseRefName: nonBlankString(obj.baseRefName),
+        mergeable,
+    };
 }

package/build/executor/worker-guard-hook.js

@@ -63,6 +63,12 @@ export const WORKER_GUARD_MALFORMED_LINE = `${WORKER_GUARD_REASON_PREFIX}: paylo
  * than a rule a caller is asked to remember.
  */
 export function renderWorkerGuardReason(category, family) {
+    if (category === "git-ambiguous") {
+        return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "This shell form cannot be safely resolved: substitution, redirection, or " +
+            "stdin-fed arguments hide what git will run. Use literal arguments instead; " +
+            "for a commit message, write it to a file and run git commit -F <file>.");
+    }
     return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
         "This command family is restricted to the worker's own branch, worktree, and " +
         "read-only network access. Use a different approach and continue.");
@@ -618,11 +624,30 @@ function classify(executable) {
         return "network";
     return null;
 }
+/**
+ * The category an unmodelable `git` segment denies with.
+ *
+ * CLASSIFICATION ONLY. The caller has already decided to deny; this picks the
+ * truthful reason. A literal `push`, `reset`, or `clean` subcommand keeps its own
+ * category, because the worker does need to know it hit that restriction. Anything
+ * else — a literal `commit`, or a subcommand token built from `$…` or a backtick —
+ * is `git-ambiguous`: no dynamic token is ever guessed to be `push`.
+ */
+function unsafeGitCategory(argv) {
+    const { subcommand } = parseGitInvocation(argv, undefined);
+    if (subcommand === "push")
+        return "git-push";
+    if (subcommand === "reset")
+        return "git-reset-hard";
+    if (subcommand === "clean")
+        return "filesystem-clean";
+    return "git-ambiguous";
+}
 /** The category a governed family denies with when its segment is unmodelable. */
-function unsafeSegmentDecision(family) {
+function unsafeSegmentDecision(family, argv) {
     switch (family) {
         case "git":
-            return { kind: "deny", category: "git-push", family: "git" };
+            return { kind: "deny", category: unsafeGitCategory(argv), family: "git" };
         case "rm":
             return { kind: "deny", category: "filesystem-remove", family: "rm" };
         case "database":
@@ -810,11 +835,11 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
     // under `stdinFed` can never be proven safe regardless of how its visible argv
     // looks — the fail-CLOSED rule, applied after every wrapper has been resolved.
     if (stdinFed)
-        return unsafeSegmentDecision(family);
+        return unsafeSegmentDecision(family, segment.argv);
     // A governed family inside a segment carrying substitution or redirection can
     // never be proven safe — deny, per the fail-CLOSED half of the contract.
     if (segment.unsafe)
-        return unsafeSegmentDecision(family);
+        return unsafeSegmentDecision(family, segment.argv);
     const cwd = resolveEffectiveCwd(ctx, payloadCwd);
     if (family === "rm")
         return evaluateRemove(segment.argv, ctx, cwd);

package/build/executor/worktree.js

@@ -95,6 +95,19 @@ async function finalizeExecutorWorktree(worktreePath, branch, expectedHeadSha, d
     }
     return { ok: true, worktreePath, branch, expectedHeadSha };
 }
+/**
+ * BAPI-1300 — finish a RETAINED continuation worktree the same way a created one
+ * is finished: pin its current HEAD as the pre-spawn expectation and provision
+ * its commands. The worktree itself is not touched: no fetch, no reset, no
+ * recreation — its (already verified and checkpointed) local state is the work.
+ */
+export async function finalizeRetainedExecutorWorktree(worktreePath, branch, deps) {
+    const headSha = await resolveCommitSha(deps, worktreePath, "HEAD");
+    if (headSha === null) {
+        return { ok: false, error: `failed to resolve HEAD of the retained worktree for '${branch}'` };
+    }
+    return finalizeExecutorWorktree(worktreePath, branch, headSha, deps);
+}
 /** A full 40-character hex object name. */
 const FULL_SHA_PATTERN = /^[0-9a-f]{40}$/i;
 /**