@bridge_gpt/mcp-server 0.2.60 → 0.2.65

package/build/install-bridge.js

@@ -325,7 +325,11 @@ export const INSTALL_BRIDGE_AGENT_PROMPT = "Run /install-bridge now, with no arg
     "do' line. The server decides eligibility (repository state AND whether this caller can run the " +
     "command), so do NOT apply a role rule or a learned-state rule of your own. Do NOT run the " +
     "returned command yourself — only recommend it; running it is the human's next explicit " +
-    "invocation. For supporting context around a recommended command, use the manifest's own " +
+    "invocation. When you recommend a command and `next_step.command_context` is a non-empty " +
+    "string, print it verbatim on its own line directly under the command — it is the server's " +
+    "explanation of what the command gives the human and how long it takes; do not reword, shorten, " +
+    "or extend it, and render nothing in its place when it is empty or missing. " +
+    "For other supporting context around a recommended command, use the manifest's own " +
     "next_step.post_install_indexing and next_step.post_install_scheduler text rather than inventing " +
     "an explanation for it. " +
     "Never request, echo, or transport any credential — only ever direct the human to that " +
@@ -1943,21 +1947,34 @@ export async function resolveSignupEmail(options, deps) {
     if (typeof fromEnv === "string" && fromEnv.trim().length > 0) {
         return { ok: true, value: fromEnv.trim() };
     }
+    const entered = await promptForBoundedEmail(deps, "Email for Bridge workspace setup (required): ");
+    if (entered === undefined)
+        return { ok: false, error: "No email entered." };
+    return { ok: true, value: entered };
+}
+/**
+ * The bounded interactive email prompt shared by self-serve signup
+ * ({@link resolveSignupEmail}) and invite redemption (BAPI-1263). Two reads at
+ * most: the first answer, then ONE re-prompt after a single hint line. EOF
+ * resolves as an empty value (promptLineViaReadline resolves "" on close), which
+ * fails the shape check like any other blank answer, so it costs one re-prompt and
+ * then fails cleanly rather than hanging. Returns the trimmed (case-preserved)
+ * address, or `undefined` after two invalid answers. The answer is never echoed.
+ * The caller guarantees `deps.promptLine` exists.
+ */
+async function promptForBoundedEmail(deps, promptText) {
     const promptLine = deps.promptLine;
-    // BAPI-1171: bounded to two reads total — the first answer, then ONE re-prompt
-    // after a single hint line. EOF resolves as an empty value (promptLineViaReadline
-    // resolves "" on close), which fails the shape check like any other blank
-    // answer, so it costs one re-prompt and then fails cleanly rather than hanging.
+    if (!promptLine)
+        return undefined;
     for (let attempt = 0; attempt < 2; attempt += 1) {
-        const raw = await promptLine("Email for Bridge workspace setup (required): ");
+        const raw = await promptLine(promptText);
         const entered = String(raw ?? "").trim();
-        if (INSTALL_BRIDGE_SIGNUP_EMAIL_SHAPE.test(entered)) {
-            return { ok: true, value: entered };
-        }
+        if (INSTALL_BRIDGE_SIGNUP_EMAIL_SHAPE.test(entered))
+            return entered;
         if (attempt === 0)
             deps.log(INSTALL_BRIDGE_SIGNUP_EMAIL_HINT);
     }
-    return { ok: false, error: "No email entered." };
+    return undefined;
 }
 /**
  * Select the onboarding branch as pure logic (deterministic, no I/O, no prompt):
@@ -3428,15 +3445,21 @@ export function buildBootstrapExchangeUrl(baseUrl) {
  * POST the bootstrap-invite exchange. The token and `key_secret` travel ONLY in
  * the JSON request body (never a query string, never a header, never a log line).
  * Bounded by the same 10s timeout as the connectivity ping.
+ *
+ * BAPI-1263: an optional nonempty `email` is appended as a fourth body field, used
+ * only on the retry after an `email-required` refusal. Omitted or empty, the body is
+ * the legacy three-field one, byte for byte.
  */
-export async function exchangeBootstrapInvite(deps, baseUrl, token, repoName, keySecret) {
+export async function exchangeBootstrapInvite(deps, baseUrl, token, repoName, keySecret, email) {
     const url = buildBootstrapExchangeUrl(baseUrl);
     let resp;
     try {
         resp = await deps.fetch(url, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ token, repo_name: repoName, key_secret: keySecret }),
+            body: JSON.stringify(email
+                ? { token, repo_name: repoName, key_secret: keySecret, email }
+                : { token, repo_name: repoName, key_secret: keySecret }),
             signal: AbortSignal.timeout(10_000),
         });
     }
@@ -3490,12 +3513,42 @@ export async function exchangeBootstrapInvite(deps, baseUrl, token, repoName, ke
     if (resp.status === 401) {
         return { ok: false, kind: "invalid-invite", message: `The Bridge API rejected the bootstrap invite (HTTP ${resp.status}).` };
     }
+    if (resp.status === 426) {
+        // Only the exact `email_required` refusal is recognized; any other, absent, or
+        // unreadable 426 body stays on the generic failure path below. The message is
+        // installer-owned — nothing from the response is propagated.
+        let recognized = false;
+        try {
+            const body = (await resp.json());
+            recognized = body?.detail?.error === "email_required";
+        }
+        catch {
+            recognized = false;
+        }
+        if (recognized) {
+            return {
+                ok: false,
+                kind: "email-required",
+                message: "The Bridge API requires an email address to redeem this invite.",
+            };
+        }
+    }
     return {
         ok: false,
         kind: "failed",
         message: `The bootstrap exchange failed (HTTP ${resp.status}). Verify BAPI_BASE_URL and try again.`,
     };
 }
+/** The invite-email prompt (BAPI-1263), shown once after an `email_required` refusal. */
+const INVITE_EMAIL_PROMPT = "Email for this Bridge invite (required): ";
+/** BAPI-1263: fixed, secret-free failures for the invite email recovery. */
+export const INVITE_EMAIL_REQUIRED_NON_INTERACTIVE_MESSAGE = "Error: this invite needs an email address, and there is no interactive terminal to ask for it. " +
+    `The bootstrap invite has NOT been used. Re-run \`npx -y ${MCP_PACKAGE_NAME} install\` in an ` +
+    "interactive terminal.";
+export const INVITE_EMAIL_INVALID_ANSWERS_MESSAGE = "Error: no valid email address was entered. The bootstrap invite has NOT been used. Re-run " +
+    "install and enter an address like you@example.com.";
+export const INVITE_EMAIL_REPEATED_REFUSAL_MESSAGE = "Error: the Bridge API still requires an email address after one was entered. The bootstrap " +
+    "invite has NOT been used. Re-run install, or contact support if this repeats.";
 // ---------------------------------------------------------------------------
 // Self-serve mint (BAPI-618): email -> invite token
 // ---------------------------------------------------------------------------
@@ -6014,12 +6067,35 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
             // self-serve record — once more with a freshly minted token (R4-3).
             let exchange;
             let selfServeRefreshed = false;
+            // BAPI-1263: the email typed after an `email_required` refusal. Run-local only —
+            // never persisted, logged, or written to the pending record — and carried on
+            // every later ordinary-invite exchange, including after a 409 rename.
+            let inviteEmail;
             for (;;) {
-                exchange = await exchangeBootstrapInvite(deps, baseUrl, inviteToken, repoName, keySecret);
+                exchange = await exchangeBootstrapInvite(deps, baseUrl, inviteToken, repoName, keySecret, inviteEmail);
                 // 409 repo_name_taken: the server ROLLED BACK, so the invite is NOT consumed and
                 // the SAME token can be retried under a new name — with the SAME pending secret,
-                // re-pointed to that name.
-                while (!exchange.ok && exchange.kind === "repo-name-taken") {
+                // re-pointed to that name. The same loop handles an ordinary invite's 426
+                // `email_required` (BAPI-1263), so a 409 on the email-bearing retry re-enters
+                // the rename branch without an extra exchange request.
+                while (!exchange.ok &&
+                    (exchange.kind === "repo-name-taken" ||
+                        (exchange.kind === "email-required" && !selfServeSignupMode))) {
+                    if (exchange.kind === "email-required") {
+                        if (inviteEmail !== undefined) {
+                            return fatal(INVITE_EMAIL_REPEATED_REFUSAL_MESSAGE);
+                        }
+                        if (!deps.isTTY || !deps.promptLine) {
+                            return fatal(INVITE_EMAIL_REQUIRED_NON_INTERACTIVE_MESSAGE);
+                        }
+                        const typedEmail = await promptForBoundedEmail(deps, INVITE_EMAIL_PROMPT);
+                        if (typedEmail === undefined) {
+                            return fatal(INVITE_EMAIL_INVALID_ANSWERS_MESSAGE);
+                        }
+                        inviteEmail = typedEmail;
+                        exchange = await exchangeBootstrapInvite(deps, baseUrl, inviteToken, repoName, keySecret, inviteEmail);
+                        continue;
+                    }
                     if (!deps.isTTY || !deps.promptLine) {
                         errorLog(`Error: ${exchange.message} Re-run with a different --repo (the bootstrap invite has NOT ` +
                             "been used).");
@@ -6046,7 +6122,7 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                     }
                     repoName = nextRepo;
                     // Same token, same key_secret — never regenerated inside the rename loop.
-                    exchange = await exchangeBootstrapInvite(deps, baseUrl, inviteToken, repoName, keySecret);
+                    exchange = await exchangeBootstrapInvite(deps, baseUrl, inviteToken, repoName, keySecret, inviteEmail);
                 }
                 if (exchange.ok)
                     break;

package/build/merge-pull-request.js

@@ -83,7 +83,7 @@ import { resolveLocalMergeMethod, runApprovedLocalMerge, resolveLocalMergeCreden
  * The exact remediation for a `dry_run`. Fixed text, because a caller that has to
  * infer WHICH setting to flip from a reason code guesses wrong.
  */
-const DRY_RUN_HINT = "set auto_merge_enabled=true on the project default via PUT /jira/epic-runs/supervisor-config/defaults/";
+const DRY_RUN_HINT = "auto_merge_enabled is off on the project default; turning it on grants merge authority, so the supervisor-config PUT refuses it (BAPI-1288) — an operator must enable it through the account-settings runbook";
 /**
  * Guidance for a post-dispatch transport failure. The action key makes the request
  * idempotent, so repeating it verbatim is safe and is the ONLY safe move: the merge

package/build/merge-workflow-config.js

@@ -131,3 +131,57 @@ export const MERGE_COMMAND_FETCH_RESPONSE_FIELDS = [
     "execution",
     "lease_expires_at",
 ];
+/**
+ * The integration-action actor contract the rendered workflow's
+ * `integration` job consumes (BAPI-1259).
+ *
+ * A DEDICATED contract, deliberately not an extension of the merge-command
+ * fetch above: an integration action is never a child merge, and a workflow
+ * that could interpret one as the other would be one refactor away from
+ * merging an integration pull request. The routes are mounted under
+ * {@link INTEGRATION_ACTION_PATH_PREFIX} in `api/routes/__init__.py`.
+ *
+ * The dispatch inputs only wake and correlate: `action_key` carries the
+ * server-minted action id (`integ:{repo}:{hex}`) and `lease_owner` carries the
+ * server-minted per-claim token. Everything the job acts on — the operation,
+ * the exact epic branch, the expected heads — comes from the fetch response.
+ */
+export const INTEGRATION_ACTION_PATH_PREFIX = "/epic-integration-actions";
+/** Re-read the approved work under the dispatched lease. */
+export const INTEGRATION_ACTION_FETCH_PATH = INTEGRATION_ACTION_PATH_PREFIX + "/fetch";
+/** Report bounded facts. Returns an acknowledgement only. */
+export const INTEGRATION_ACTION_REPORT_PATH = INTEGRATION_ACTION_PATH_PREFIX + "/report";
+/** The one protocol version the rendered job speaks (exact equality server-side). */
+export const INTEGRATION_ACTION_PROTOCOL_VERSION = 1;
+/** The dispatch `operation` value that selects the integration job. */
+export const INTEGRATION_ACTION_WORKFLOW_OPERATION = "integration_action";
+/** The dispatch `operation` default that selects the child-merge job. */
+export const CHILD_MERGE_WORKFLOW_OPERATION = "child_merge";
+/**
+ * The operations the WORKFLOW may perform. `correct` is absent on purpose: a
+ * correction needs a worker, which only a local or durable executor runs, so the
+ * server never issues one to the workflow and the job refuses one if it arrives.
+ */
+export const INTEGRATION_WORKFLOW_OPERATIONS = ["sync_base", "mark_ready"];
+/** The request fields of the fetch, in the contract's own spelling. */
+export const INTEGRATION_ACTION_FETCH_REQUEST_FIELDS = [
+    "protocol_version",
+    "repo_name",
+    "action_id",
+    "claim_token",
+];
+/** The response fields the rendered job reads from the fetch. */
+export const INTEGRATION_ACTION_FETCH_RESPONSE_FIELDS = [
+    "protocol_version",
+    "action_id",
+    "operation",
+    "actor",
+    "repo_name",
+    "provider_repository",
+    "epic_key",
+    "epic_branch",
+    "base_branch",
+    "expected_epic_head_sha",
+    "expected_base_sha",
+    "pr_number",
+];

package/build/merge-workflow-drift.js

@@ -33,11 +33,42 @@ export function canonicalMergeWorkflowSha() {
  * Every Bridge-published historical rendering of the merge workflow, by Git blob
  * SHA, with the contract version it declared.
  *
- * Empty at contract version 1: there is no earlier published version to upgrade
- * FROM. A future contract version adds its predecessor's SHA here, and only
- * then can {@link classifyMergeWorkflowContent} return `managed_version_older`.
+ * A future contract version adds its predecessor's SHA here, and only then can
+ * {@link classifyMergeWorkflowContent} return `managed_version_older`.
+ *
+ * ## Why a version-1 entry exists without a version bump (BAPI-1257)
+ *
+ * The first entry is a rendering that was published AS version 1 and then
+ * corrected WITHIN version 1. Its fork-origin guard read
+ * `jq -r '.isCrossRepository // true'`, and jq's `//` yields its right-hand side
+ * when the left is null OR FALSE — so a same-repository pull request, which
+ * every epic child is, read as `true` and the merge was refused as fork-origin.
+ * That rendering could never merge anything.
+ *
+ * The marker version is deliberately NOT bumped: the wire contract, the dispatch
+ * inputs and the command-fetch protocol are all unchanged, and
+ * `MERGE_WORKFLOW_EXPECTED_VERSION` is the server's deploy-ordering check, not a
+ * byte checksum. But without this entry a repository holding that rendering
+ * classifies as `modified_or_unrecognized`, and the installer's preflight hard
+ * refuses to touch a workflow Bridge does not recognise — leaving no automated
+ * path off a copy that cannot merge. Registering the superseded SHA restores it:
+ * the copy classifies `managed_version_older` and the installer opens its
+ * ordinary upgrade pull request.
+ *
+ * The SHA is the Git blob SHA of the complete superseded rendering, which is
+ * what {@link canonicalMergeWorkflowSha} computes for the current one.
+ *
+ * ## The version-1 entry added by BAPI-1259
+ *
+ * `0d44c814…` is the last version-1 rendering (the one BAPI-1257 corrected).
+ * Contract version 2 adds the `operation` input and the integration job, so a
+ * repository holding that rendering is an ordinary managed older version and
+ * the installer opens its upgrade pull request.
  */
-export const MANAGED_MERGE_WORKFLOW_HISTORY = new Map();
+export const MANAGED_MERGE_WORKFLOW_HISTORY = new Map([
+    ["3d4956c9447223c37075069352cdd9aae2d561dc", 1],
+    ["0d44c81436005beb3c314de1b98eaf972ef3b4db", 1],
+]);
 /**
  * Classify an installed copy against the canonical bytes.
  *