@bridge_gpt/mcp-server 0.2.62 → 0.2.66

package/build/epic-implementer-bundle-cli.js

@@ -27,7 +27,10 @@ const USAGE = [
     "  validate   Validate identities, the node->ticket mapping, manifest agreement,",
     "             and path containment. Writes nothing.",
     "  finalize   Validate, then finalize epic-plan.dag.json with real keys and",
-    "             per-node touched_files, and write the sibling-ticket manifest.",
+    "             per-node touched_files, write the sibling-ticket manifest, and",
+    "             write epic-plan.meta.json ({\"epic_key\": ...}) beside the DAG so",
+    "             drive-epic can find the plan from the epic key. Each file is a",
+    "             separate atomic write, not one transaction across all three.",
     "",
     "Options:",
     "  --input <file>     JSON document with epic_key, epic_slug, mappings,",
@@ -235,6 +238,15 @@ export async function runEpicImplementerBundleCli(argv, overrides = {}) {
     const manifestWrite = await writeJsonAtomically(validation.value.manifest_path, manifest, deps.fs);
     if (!manifestWrite.ok)
         return emitFailure(manifestWrite.error);
+    // BAPI-1285: the discovery metadata is written LAST, and separately from the
+    // DAG on purpose — the sidecar goes to the server, whose epic-run models
+    // forbid extra fields. A failure here must never read as success, but the
+    // earlier artifacts are already final, so the message says so.
+    const metaWrite = await writeJsonAtomically(validation.value.meta_path, { epic_key: validation.value.epic_key }, deps.fs);
+    if (!metaWrite.ok) {
+        return emitFailure(`Could not write meta_path ${validation.value.meta_path}. The sidecar and manifest may ` +
+            "already be finalized. Re-run finalize, or check write permissions on the docs directory.");
+    }
     const result = {
         ok: true,
         mode: "finalize",
@@ -242,6 +254,7 @@ export async function runEpicImplementerBundleCli(argv, overrides = {}) {
         plan_version: validation.value.plan_version,
         sidecar_path: validation.value.sidecar_path,
         manifest_path: validation.value.manifest_path,
+        meta_path: validation.value.meta_path,
         ticket_keys: validation.value.mappings.map((m) => m.ticket_key),
     };
     if (opts.json)

package/build/epic-launch-diagnostic.js

@@ -0,0 +1,31 @@
+/** Keep operator-controlled components out of trusted epic-launch refusal text. */
+export function diagnosticComponent(value) {
+    // A short identifier here is a schema-field label, not its stored value.
+    if (/^field '[A-Za-z][A-Za-z0-9]{0,39}'$/.test(value))
+        return value;
+    if (value.length > 512 ||
+        /[\x00-\x1f\x7f]/.test(value) ||
+        /(?:sk[-_][A-Za-z0-9]+|api[-_]?key[-_:=][A-Za-z0-9]+|secret|token|password|bearer|authorization)/i.test(value) ||
+        /%[0-9a-f]{2}/i.test(value) && decodedLooksSensitive(value))
+        return "<redacted>";
+    return value;
+}
+function decodedLooksSensitive(value) {
+    try {
+        const decoded = decodeURIComponent(value);
+        return decoded !== value && diagnosticComponent(decoded) === "<redacted>";
+    }
+    catch {
+        return true;
+    }
+}
+/** URL validation alone permits paths and queries that look like credentials. */
+export function safeEpicLaunchTargetUrl(baseUrl) {
+    try {
+        const url = new URL(baseUrl);
+        return !url.username && !url.password && diagnosticComponent(baseUrl) === baseUrl;
+    }
+    catch {
+        return false;
+    }
+}

package/build/epic-launch-profile.js

@@ -26,11 +26,13 @@
  */
 import os from "node:os";
 import path from "node:path";
+import { createHash } from "node:crypto";
 import { chmod, mkdir, open, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import { durablyReplaceCredentialStoreJson, getPrimaryCredentialStorePath, withCredentialStoreLock, } from "./credential-store.js";
 import { validateHttpBaseUrl, describeBaseUrlRejection } from "./base-url.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
 import { isTransientNpxEntryPath } from "./mcp-server-invocation.js";
+import { diagnosticComponent } from "./epic-launch-diagnostic.js";
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
@@ -45,7 +47,7 @@ export const EPIC_LAUNCH_EXECUTION_MODES = ["local", "durable"];
 /** One-time migration guidance for a profile this build cannot read. */
 export function epicLaunchProfileSetupGuidance(name) {
     return (`Re-run guided setup to (re)write it: npx -y ${MCP_PACKAGE_NAME} install conductor ` +
-        `--launch-profile ${EPIC_LAUNCH_PROFILE_NAME_PATTERN.test(name) ? name : "<name>"} --base-url <url> ...`);
+        `--launch-profile ${EPIC_LAUNCH_PROFILE_NAME_PATTERN.test(name) ? diagnosticComponent(name) : "<name>"} --base-url <url> ...`);
 }
 // ---------------------------------------------------------------------------
 // Validation (pure)
@@ -73,7 +75,7 @@ function malformed(name, field, why) {
     return {
         ok: false,
         kind: "profile-malformed",
-        message: `Epic launch profile '${name}' is unusable: ${field} ${why}. ${epicLaunchProfileSetupGuidance(name)}`,
+        message: `Epic launch profile '${diagnosticComponent(name)}' is unusable: ${diagnosticComponent(field)} ${why}. ${epicLaunchProfileSetupGuidance(name)}`,
     };
 }
 function validateRuntime(name, raw) {
@@ -118,7 +120,7 @@ export function validateEpicLaunchProfile(raw, selector = "<unnamed>") {
         return {
             ok: false,
             kind: "profile-unsupported-version",
-            message: `Epic launch profile '${selector}' uses an unsupported schema version; this build reads ` +
+            message: `Epic launch profile '${diagnosticComponent(selector)}' uses an unsupported schema version; this build reads ` +
                 `version ${EPIC_LAUNCH_PROFILE_VERSION} only. ${epicLaunchProfileSetupGuidance(selector)}`,
         };
     }
@@ -204,23 +206,23 @@ async function readStoreDocument(deps) {
         if (code === "ENOENT") {
             return { ok: true, present: false, document: { version: EPIC_LAUNCH_PROFILE_VERSION, profiles: {} } };
         }
-        return { ok: false, kind: "store-unreadable", message: `Unable to read ${storePath}.` };
+        return { ok: false, kind: "store-unreadable", message: `Unable to read ${diagnosticComponent(storePath)}.` };
     }
     let parsed;
     try {
         parsed = JSON.parse(raw);
     }
     catch {
-        return { ok: false, kind: "store-unreadable", message: `${storePath} is not valid JSON.` };
+        return { ok: false, kind: "store-unreadable", message: `${diagnosticComponent(storePath)} is not valid JSON.` };
     }
     if (!isPlainObject(parsed) || !isPlainObject(parsed.profiles)) {
-        return { ok: false, kind: "store-unreadable", message: `${storePath} has no profiles object.` };
+        return { ok: false, kind: "store-unreadable", message: `${diagnosticComponent(storePath)} has no profiles object.` };
     }
     if (parsed.version !== EPIC_LAUNCH_PROFILE_VERSION) {
         return {
             ok: false,
             kind: "profile-unsupported-version",
-            message: `${storePath} uses an unsupported schema version; this build reads version ` +
+            message: `${diagnosticComponent(storePath)} uses an unsupported schema version; this build reads version ` +
                 `${EPIC_LAUNCH_PROFILE_VERSION} only. ${epicLaunchProfileSetupGuidance("<name>")}`,
         };
     }
@@ -249,7 +251,7 @@ export async function readEpicLaunchProfile(name, deps) {
         return {
             ok: false,
             kind: "profile-missing",
-            message: `No epic launch profile named '${name}' exists on this host. ${epicLaunchProfileSetupGuidance(name)}`,
+            message: `No epic launch profile named '${diagnosticComponent(name)}' exists on this host. ${epicLaunchProfileSetupGuidance(name)}`,
         };
     }
     const validated = validateEpicLaunchProfile(store.document.profiles[name], name);
@@ -259,7 +261,7 @@ export async function readEpicLaunchProfile(name, deps) {
         return {
             ok: false,
             kind: "profile-host-mismatch",
-            message: `Epic launch profile '${name}' was approved on a different host. Profiles are host-local; ` +
+            message: `Epic launch profile '${diagnosticComponent(name)}' was approved on a different host. Profiles are host-local; ` +
                 epicLaunchProfileSetupGuidance(name),
         };
     }
@@ -309,6 +311,34 @@ export async function writeEpicLaunchProfile(profile, deps) {
         return { ok: true, path: storePath, action: existing === undefined ? "created" : "updated" };
     }, (error) => ({ ok: false, kind: "store-write-failed", message: error }));
 }
+/** Safe for text and JSON; no policy recipient or webhook value is retained. */
+export function formatEpicLaunchChannelIdentity(identity) {
+    return identity;
+}
+const pinnedPolicyContents = new WeakMap();
+/** Store selected content once, without making it serializable with the selection. */
+export function pinEpicLaunchPolicy(selection, policy) {
+    pinnedPolicyContents.set(selection, policy);
+    return selection;
+}
+export function getPinnedEpicLaunchPolicy(selection) {
+    return pinnedPolicyContents.get(selection);
+}
+export function epicLaunchPolicyDigest(raw) {
+    return createHash("sha256").update(raw).digest("hex");
+}
+/** Finalize the already selected target after the run's existence is known. */
+export function resolveEpicLaunchSelection(args) {
+    return Object.freeze({
+        baseUrl: args.baseUrl,
+        repoName: args.repoName,
+        targetSource: args.targetSource,
+        profileName: args.profile?.name ?? null,
+        topology: args.topology,
+        policy: Object.freeze(args.policy),
+        escalationChannel: args.escalationChannel,
+    });
+}
 /**
  * Normalize every applicable target source and decide ONE target, before any
  * credential is resolved and before any request is made.
@@ -317,8 +347,11 @@ export async function writeEpicLaunchProfile(profile, deps) {
  *    `BAPI_BASE_URL` that names a DIFFERENT endpoint is a conflict — an override
  *    alone never rebinds a profile; guided setup does that.
  *  - Without one, `--base-url` and `BAPI_BASE_URL` must agree when both are set.
- *  - Nothing set is `target-missing`. There is no production default here:
- *    production is supported, but only as a deliberate selection.
+ *  - Nothing set uses the caller's `defaultBaseUrl` (source `"default"`), which
+ *    is validated only on that branch, so it can never change an explicit
+ *    outcome or mask a conflict. `drive-epic` passes production. A caller that
+ *    passes no default — guided setup, which writes a binding and a profile and
+ *    so needs a deliberate target — gets `target-missing`.
  *
  * Messages name the source and the rule only — never a URL, which can carry
  * userinfo.
@@ -335,7 +368,7 @@ export function resolveEpicLaunchTarget(inputs) {
     const flag = normalize(inputs.flagBaseUrl, "--base-url");
     if (!flag.ok)
         return { ok: false, kind: "target-invalid", message: flag.message };
-    const env = normalize(inputs.env.BAPI_BASE_URL, "BAPI_BASE_URL");
+    const env = normalize(inputs.profileSource === "profile-env" ? undefined : inputs.env.BAPI_BASE_URL, "BAPI_BASE_URL");
     if (!env.ok)
         return { ok: false, kind: "target-invalid", message: env.message };
     const profile = inputs.profile;
@@ -344,7 +377,7 @@ export function resolveEpicLaunchTarget(inputs) {
             return {
                 ok: false,
                 kind: "target-conflict",
-                message: `--base-url names a different endpoint than launch profile '${profile.name}'. An override ` +
+                message: `--base-url names a different endpoint than launch profile '${diagnosticComponent(profile.name)}'. An override ` +
                     "does not rebind a profile; re-run guided setup to change its target.",
             };
         }
@@ -352,7 +385,7 @@ export function resolveEpicLaunchTarget(inputs) {
             return {
                 ok: false,
                 kind: "target-conflict",
-                message: `BAPI_BASE_URL names a different endpoint than launch profile '${profile.name}'. Unset it, ` +
+                message: `BAPI_BASE_URL names a different endpoint than launch profile '${diagnosticComponent(profile.name)}'. Unset it, ` +
                     "or re-run guided setup to change the profile's target.",
             };
         }
@@ -361,10 +394,10 @@ export function resolveEpicLaunchTarget(inputs) {
             return {
                 ok: false,
                 kind: "repository-conflict",
-                message: `--repo names a different repository than launch profile '${profile.name}'.`,
+                message: `--repo names a different repository than launch profile '${diagnosticComponent(profile.name)}'.`,
             };
         }
-        return { ok: true, baseUrl: profile.baseUrl, source: "profile", repoName: profile.repoName };
+        return { ok: true, baseUrl: profile.baseUrl, source: inputs.profileSource ?? "profile", repoName: profile.repoName };
     }
     if (flag.value !== null && env.value !== null && flag.value !== env.value) {
         return {
@@ -377,12 +410,18 @@ export function resolveEpicLaunchTarget(inputs) {
         return { ok: true, baseUrl: flag.value, source: "flag" };
     if (env.value !== null)
         return { ok: true, baseUrl: env.value, source: "env" };
+    if (inputs.defaultBaseUrl !== undefined) {
+        const fallback = normalize(inputs.defaultBaseUrl, "default Bridge API target");
+        if (!fallback.ok)
+            return { ok: false, kind: "target-invalid", message: fallback.message };
+        if (fallback.value !== null)
+            return { ok: true, baseUrl: fallback.value, source: "default" };
+    }
     return {
         ok: false,
         kind: "target-missing",
-        message: "No Bridge API target is selected for this epic launch. Pass --launch-profile <name> (created by " +
-            `\`npx -y ${MCP_PACKAGE_NAME} install conductor --launch-profile <name> --base-url <url>\`), or ` +
-            "--base-url <url>. Nothing defaults to production.",
+        message: "No Bridge API target is selected. Pass --base-url <url> or set BAPI_BASE_URL to the server " +
+            "this setup should approve.",
     };
 }
 // ---------------------------------------------------------------------------

package/build/epic-run-status.js

@@ -0,0 +1,5 @@
+export const TERMINAL_EPIC_RUN_STATUSES = ["abandoned", "done"];
+/** True when `status` names a finished run. Unknown strings are NOT terminal. */
+export function isTerminalEpicRunStatus(status) {
+    return TERMINAL_EPIC_RUN_STATUSES.includes(status);
+}

package/build/epic-shared/bridge-client.js

@@ -657,6 +657,36 @@ export async function reclaimIndexScope(access, request, fetchImpl = globalThis.
         },
     };
 }
+const AUTOMATION_QUEUE_VERDICTS = [
+    "ok",
+    "working_backlog",
+    "undrained",
+    "unknown",
+];
+/**
+ * Narrow the optional `automation_queue` block. Anything not shaped like the
+ * BAPI-1299 contract is `null`, so a consumer reports it as unavailable.
+ */
+export function parseAutomationQueueHealth(raw) {
+    if (!isRecord(raw))
+        return null;
+    const status = raw["status"];
+    const verdict = raw["verdict"];
+    if (status !== "readable" && status !== "unreadable")
+        return null;
+    if (typeof verdict !== "string" || !AUTOMATION_QUEUE_VERDICTS.includes(verdict))
+        return null;
+    const count = raw["queued_count"];
+    const age = raw["oldest_queued_age_seconds"];
+    const evidence = raw["has_fresh_drainer_evidence"];
+    return {
+        status,
+        verdict: verdict,
+        queuedCount: typeof count === "number" && Number.isFinite(count) ? count : null,
+        oldestQueuedAgeSeconds: typeof age === "number" && Number.isFinite(age) ? age : null,
+        hasFreshDrainerEvidence: typeof evidence === "boolean" ? evidence : null,
+    };
+}
 /**
  * Epic-run statuses that mean a v2 conductor may still be driving the run.
  *
@@ -681,9 +711,10 @@ const ACTIVE_EPIC_RUN_STATUSES = [
 /**
  * `GET /automation/health?repo_name=` — read-only parse-dispatcher liveness.
  *
- * Root-mounted, NOT under `/jira`. The response is narrowed to two safe fields;
- * signals, stale-ticket samples, queue contents, and every timestamp are
- * deliberately dropped — an advisory line needs a verdict, not a report.
+ * Root-mounted, NOT under `/jira`. The response is narrowed to two safe fields,
+ * plus (BAPI-1299) the automation-queue verdict and its three counts; signals,
+ * stale-ticket samples, queue contents, and every timestamp are deliberately
+ * dropped — an advisory line needs a verdict, not a report.
  *
  * `absent` is claimed ONLY on positive evidence: a `stale` or `never_seen`
  * heartbeat together with a responding process that is not itself sweeping.
@@ -704,6 +735,7 @@ export async function getParseDispatcherHealth(access, fetchImpl = globalThis.fe
             value: { observation: "unavailable", heartbeatState: null, respondingSchedulerRunning: false },
         };
     }
+    const automationQueue = parseAutomationQueueHealth(result.value["automation_queue"]);
     const reconciler = isRecord(result.value["reconciler"]) ? result.value["reconciler"] : null;
     const scheduler = isRecord(result.value["scheduler"]) ? result.value["scheduler"] : null;
     const rawState = reconciler === null ? undefined : reconciler["state"];
@@ -722,7 +754,17 @@ export async function getParseDispatcherHealth(access, fetchImpl = globalThis.fe
     else {
         observation = "unavailable";
     }
-    return { ok: true, value: { observation, heartbeatState, respondingSchedulerRunning } };
+    // BAPI-1299: the queue block is added only when the server sent a
+    // well-formed one, so an older server's result keeps its exact prior shape.
+    return {
+        ok: true,
+        value: {
+            observation,
+            heartbeatState,
+            respondingSchedulerRunning,
+            ...(automationQueue !== null ? { automationQueue } : {}),
+        },
+    };
 }
 /**
  * `GET /jira/epic-runs/runs?repo_name=` — live v2 conductor runs on THIS repo.

package/build/executor/cli.js

@@ -6,6 +6,7 @@
  * the MCP server; all user-facing diagnostics go to stderr; secrets are never
  * printed. Returns numeric exit codes rather than throwing at the top level.
  */
+import { unlink } from "node:fs/promises";
 import os from "node:os";
 import { VERSION } from "../version.generated.js";
 import { resolveWorktrunkBinary } from "../start-tickets-prereqs.js";
@@ -20,6 +21,7 @@ import { createIntegrationActionHttpClient, } from "./integration-job.js";
 import { startExecutorSleepAssertion } from "./platform.js";
 import { runExecutor } from "./runner.js";
 import { runExecutorWatchCli } from "./watch-cli.js";
+import { removeRunExecutorRecordIfOwned } from "../executor-launch.js";
 /** Fixed executor timing/behavior defaults. */
 const DEFAULT_POLL_INTERVAL_MS = 15_000;
 const DEFAULT_HEARTBEAT_INTERVAL_MS = 60_000;
@@ -48,6 +50,9 @@ export function getExecutorUsage() {
         "                                Exactly one of --epic-run-id or --repo-wide is",
         "                                REQUIRED; omitting both is a startup error, not",
         "                                repository-wide claiming (BAPI-1026 / R54).",
+        "  --exit-when-run-terminal      Exit 0 once the ONE --epic-run-id run is done or",
+        "                                abandoned and no job is held (BAPI-1279). Valid",
+        "                                only with exactly one --epic-run-id.",
         "  --base-url <url>              Bridge API endpoint (overrides BAPI_BASE_URL).",
         "  --executor-id <id>            Stable executor id (default: <hostname>-<pid>).",
         "  --max-concurrent <n>          Max concurrent jobs (>= 1, default 1).",
@@ -80,6 +85,7 @@ export function parseExecutorArgs(argv, context) {
     const repos = [];
     const epicRunIds = [];
     let repoWide = false;
+    let exitWhenRunTerminal = false;
     let scrubInheritedGithubCredentials = false;
     let executorId;
     let maxConcurrent = DEFAULT_MAX_CONCURRENT;
@@ -126,6 +132,9 @@ export function parseExecutorArgs(argv, context) {
         else if (arg === "--repo-wide") {
             repoWide = true;
         }
+        else if (arg === "--exit-when-run-terminal") {
+            exitWhenRunTerminal = true;
+        }
         else if (arg === "--scrub-inherited-github-credentials") {
             scrubInheritedGithubCredentials = true;
         }
@@ -208,6 +217,15 @@ export function parseExecutorArgs(argv, context) {
     if (!scope.ok) {
         return { kind: "error", message: scope.message };
     }
+    // BAPI-1279 — "exit when THE run is finished" needs exactly one run to watch.
+    // With several, or with --repo-wide, there is no single run whose end means
+    // this process is done, so the combination is refused before startup.
+    if (exitWhenRunTerminal && epicRunIds.length !== 1) {
+        return {
+            kind: "error",
+            message: "--exit-when-run-terminal requires exactly one --epic-run-id (and no --repo-wide)",
+        };
+    }
     const options = {
         executorId: executorIdFinal,
         repos,
@@ -237,6 +255,8 @@ export function parseExecutorArgs(argv, context) {
         // BAPI-1026 (R54) — same "truly absent, never a falsy placeholder"
         // discipline: `repoWide` is either `true` or the key is missing.
         ...(repoWide ? { repoWide: true } : {}),
+        // BAPI-1279 — same discipline: `true` or absent.
+        ...(exitWhenRunTerminal ? { exitWhenRunTerminal: true } : {}),
         // BAPI-1137: absent unless explicitly requested, so an ordinary executor's
         // options object is byte-for-byte what it was before this slice.
         ...(scrubInheritedGithubCredentials ? { scrubInheritedGithubCredentials: true } : {}),
@@ -401,6 +421,25 @@ export async function runExecutorCli(argv, overrides = {}) {
     const createIntegrationClient = overrides.createIntegrationClient ?? createIntegrationActionHttpClient;
     const runnerSeams = {
         onSignal: overrides.onSignal ?? defaultSignalRegistrar,
+        // BAPI-1279 — on a terminal exit, delete the launcher record drive-epic
+        // wrote for this run, but only if it still names THIS instance (its id, and
+        // this process or the relay that started it). Advisory: a failure here
+        // never changes the exit code.
+        ...(options.exitWhenRunTerminal === true
+            ? {
+                onRunTerminal: async (epicRunId) => {
+                    await removeRunExecutorRecordIfOwned({
+                        repoRoot: deps.cwd,
+                        epicRunId,
+                        executorId: options.executorId,
+                        pids: [context.pid, process.ppid],
+                    }, {
+                        readFile: deps.readFile,
+                        unlink: (filePath) => unlink(filePath),
+                    });
+                },
+            }
+            : {}),
         integrationActions: createIntegrationClient({
             baseUrl,
             apiKey: apiKeyByRepo[options.repoName],