@bridge_gpt/mcp-server 0.2.62 → 0.2.66

package/build/executor/prompt-spec.js

@@ -17,7 +17,7 @@
  * placeholder name). This module NEVER logs prompt text, ticket specs, git logs,
  * or reasons.
  */
-import { ExecutorNamedError } from "./job-errors.js";
+import { CiFixContext, ExecutorNamedError } from "./job-errors.js";
 /** Stable named-error kind used for every prompt-spec contract failure. */
 const PROMPT_CONTRACT_ERROR = "ContractError.Prompt";
 /** The prompt-spec version this renderer understands. */
@@ -55,7 +55,357 @@ const SUPPORTED_PLACEHOLDERS = new Set([
     "REVISE_REASONS",
     "RELATED_CONTEXT",
     "SPEC_CITATION_FRESHNESS_WARNING",
+    // BAPI-1296 — resolved ONLY from a validated `ci_fix` dispatch context
+    // (`readCiFixDispatchContext`), never from configured required checks.
+    "FAILING_CHECKS",
+    "MISSING_CHECKS",
+    "LOG_EXCERPTS",
 ]);
+// ---------------------------------------------------------------------------
+// BAPI-1296 — the focused `ci_fix` dispatch contract (executor half).
+//
+// The reconciler writes `payload.ci_resolved_inputs` from the per-head CI
+// observation (`_ci_fix_resolved_inputs_from_observation` in
+// `api/library/epic_implementer/reconciler.py`). These bounds MIRROR the
+// server's, and an over-bound essential value is REFUSED, never truncated: a
+// check silently dropped here would be a check the worker is never told about.
+// Only excerpt diagnostic TEXT may be cut, and visibly.
+// ---------------------------------------------------------------------------
+/** Most distinct actionable (failing ∪ missing) checks. */
+export const CI_FIX_MAX_ACTIONABLE_CHECKS = 32;
+/** Longest check name, in UTF-8 bytes. */
+export const CI_FIX_MAX_CHECK_NAME_BYTES = 200;
+/** Most log excerpts carried into the prompt. */
+export const CI_FIX_MAX_LOG_EXCERPTS = 8;
+/** Longest single excerpt text, in UTF-8 bytes (cut visibly beyond it). */
+export const CI_FIX_MAX_LOG_EXCERPT_BYTES = 512;
+/** Total excerpt text across all excerpts, in UTF-8 bytes. */
+export const CI_FIX_MAX_LOG_EXCERPTS_TOTAL_BYTES = 4_096;
+/** Longest excerpt `source` label, in UTF-8 bytes. */
+const CI_FIX_MAX_EXCERPT_SOURCE_BYTES = 200;
+/**
+ * Ceiling on the ticket spec a ci_fix prompt carries. The server bounds the spec
+ * to 64,000 characters plus a truncation marker; anything past this is not a
+ * spec the server produced.
+ */
+export const CI_FIX_TICKET_SPEC_MAX_CHARS = 70_000;
+/** The exact placeholder set a focused ci_fix prompt spec must declare. */
+const CI_FIX_PLACEHOLDERS = [
+    "TICKET_SPEC",
+    "WORK_BRANCH",
+    "FAILING_CHECKS",
+    "MISSING_CHECKS",
+    "LOG_EXCERPTS",
+];
+const CI_FIX_EXCERPT_TRUNCATION_MARKER = " …[excerpt truncated]";
+const CI_FIX_HEAD_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+/** Build the named, bounded refusal for a focused ci_fix job. */
+export function ciFixContextError(job, reason) {
+    return new ExecutorNamedError(CiFixContext, `ci_fix job ${job.id} refused before worker effects (reason=${reason})`);
+}
+function utf8Bytes(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+function hasControlCharacter(value) {
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+function sanitizeCiText(value, maxBytes = 512) {
+    const redacted = value
+        .replace(/gh[pousr]_[A-Za-z0-9]{20,}/giu, "[REDACTED]")
+        .replace(/bearer\s+[^\s,;]+/giu, "Bearer [REDACTED]")
+        .replace(/authorization:\s*[^\s,;]+/giu, "Authorization: [REDACTED]")
+        .replace(/https?:\/\/[^\s/@<>]+:[^\s/@<>]+@[^\s<>]+/giu, "[REDACTED URL]")
+        .replace(/https?:\/\/[^\s<>]+\?[^\s<>]+/giu, "[REDACTED URL]");
+    return sliceUtf8(redacted, maxBytes).replace(/[\x00-\x08\x0B-\x1F\x7F]/gu, " ");
+}
+function safeCiSourceRef(raw, repository) {
+    if (typeof raw !== "string" || raw.length > 1024)
+        return null;
+    try {
+        const url = new URL(raw);
+        if (url.protocol !== "https:" || url.hostname !== "github.com" ||
+            url.username || url.password || url.search || url.hash ||
+            !url.pathname.toLowerCase().startsWith(`/${repository.toLowerCase()}/`))
+            return null;
+        return url.toString();
+    }
+    catch {
+        return null;
+    }
+}
+function readCiEvidence(raw, headSha, failing) {
+    if (raw === null || raw === undefined)
+        return { status: "unavailable", reason: "legacy_no_snapshot" };
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return { status: "unavailable", reason: "malformed_snapshot" };
+    }
+    const item = raw;
+    let serializedLength;
+    try {
+        serializedLength = JSON.stringify(item).length;
+    }
+    catch {
+        return { status: "unavailable", reason: "malformed_snapshot" };
+    }
+    if (item.version !== 1 || item.head_sha !== headSha ||
+        typeof item.repository !== "string" || !item.repository ||
+        typeof item.target_branch !== "string" || !item.target_branch ||
+        typeof item.policy_source !== "string" ||
+        typeof item.policy_fingerprint !== "string" ||
+        !Array.isArray(item.required_failures) || item.required_failures.length === 0 ||
+        item.required_failures.length > 20 || serializedLength > 24_000) {
+        return { status: "unavailable", reason: "malformed_snapshot" };
+    }
+    const required = [];
+    for (const candidate of item.required_failures) {
+        if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+            return { status: "unavailable", reason: "malformed_snapshot" };
+        }
+        const record = candidate;
+        if (typeof record.name !== "string" || !failing.has(record.name)) {
+            return { status: "unavailable", reason: "malformed_snapshot" };
+        }
+        required.push({
+            name: record.name,
+            sourceKind: typeof record.source_kind === "string" ? sanitizeCiText(record.source_kind, 32) : "unknown",
+            conclusion: typeof record.conclusion === "string" ? sanitizeCiText(record.conclusion, 32) : "unknown",
+            runId: typeof record.run_id === "number" && Number.isSafeInteger(record.run_id) && record.run_id > 0 ? record.run_id : null,
+            summary: typeof record.summary === "string" ? sanitizeCiText(record.summary) : "",
+            sourceRef: safeCiSourceRef(record.source_ref, item.repository),
+        });
+    }
+    if (required.length !== failing.size ||
+        new Set(required.map(record => record.name)).size !== failing.size) {
+        return { status: "unavailable", reason: "malformed_snapshot" };
+    }
+    const related = Array.isArray(item.related_failures) ? item.related_failures.slice(0, 8)
+        .filter((record) => !!record && typeof record === "object" && !Array.isArray(record))
+        .map((record) => typeof record.name === "string" ? sanitizeCiText(record.name, 200) : "(unnamed)") : [];
+    return {
+        status: "available",
+        policySource: sanitizeCiText(item.policy_source, 32),
+        policyFingerprint: sanitizeCiText(item.policy_fingerprint, 64),
+        repository: sanitizeCiText(item.repository, 200),
+        targetBranch: sanitizeCiText(item.target_branch, 200),
+        headSha,
+        observedAt: typeof item.observed_at === "string" ? sanitizeCiText(item.observed_at, 64) : "unavailable",
+        freshness: typeof item.freshness === "string" ? sanitizeCiText(item.freshness, 64) : "unavailable",
+        coverage: typeof item.coverage === "string" ? sanitizeCiText(item.coverage, 64) : "unknown",
+        availability: typeof item.availability === "string" ? sanitizeCiText(item.availability, 64) : "unavailable",
+        required,
+        related,
+    };
+}
+/** Validate + de-duplicate one check-name list; `null` when a name is unusable. */
+function readCheckNames(raw) {
+    if (raw === undefined || raw === null)
+        return [];
+    if (!Array.isArray(raw))
+        return null;
+    const names = [];
+    const seen = new Set();
+    for (const item of raw) {
+        if (typeof item !== "string")
+            return null;
+        const name = item.trim();
+        if (name.length === 0 ||
+            utf8Bytes(name) > CI_FIX_MAX_CHECK_NAME_BYTES ||
+            hasControlCharacter(name)) {
+            return null;
+        }
+        if (!seen.has(name)) {
+            seen.add(name);
+            names.push(name);
+        }
+    }
+    return names;
+}
+function sliceUtf8(value, maxBytes) {
+    if (utf8Bytes(value) <= maxBytes)
+        return value;
+    // Decoding a cut multi-byte sequence yields U+FFFD; drop it so the kept
+    // prefix is clean text.
+    return Buffer.from(value, "utf8").subarray(0, maxBytes).toString("utf8").replace(/\uFFFD+$/u, "");
+}
+function readLogExcerpts(raw, headSha, dispatched) {
+    // An ABSENT record is not a reason to refuse targeted work: excerpts are
+    // optional evidence. It renders as plainly unavailable.
+    if (raw === undefined || raw === null) {
+        return { status: "unavailable", reason: "not_supplied" };
+    }
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const record = raw;
+    if (record.status === "unavailable") {
+        const reason = typeof record.reason === "string" &&
+            /^[a-z0-9_]{1,64}$/.test(record.reason)
+            ? record.reason
+            : "unspecified";
+        return { status: "unavailable", reason };
+    }
+    if (record.status !== "supplied" || !Array.isArray(record.excerpts))
+        return null;
+    if (record.excerpts.length === 0 || record.excerpts.length > CI_FIX_MAX_LOG_EXCERPTS) {
+        return null;
+    }
+    const excerpts = [];
+    let totalBytes = 0;
+    for (const entry of record.excerpts) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return null;
+        const e = entry;
+        // Provenance is ESSENTIAL: an excerpt that cannot name a dispatched check, a
+        // source, and the dispatch head is not verified evidence for this attempt.
+        if (typeof e.check !== "string" ||
+            !dispatched.has(e.check.trim()) ||
+            typeof e.source !== "string" ||
+            e.source.trim().length === 0 ||
+            utf8Bytes(e.source.trim()) > CI_FIX_MAX_EXCERPT_SOURCE_BYTES ||
+            hasControlCharacter(e.source.trim()) ||
+            typeof e.head_sha !== "string" ||
+            e.head_sha.trim().toLowerCase() !== headSha ||
+            typeof e.text !== "string") {
+            return null;
+        }
+        let text = e.text;
+        if (utf8Bytes(text) > CI_FIX_MAX_LOG_EXCERPT_BYTES) {
+            text =
+                sliceUtf8(text, CI_FIX_MAX_LOG_EXCERPT_BYTES - utf8Bytes(CI_FIX_EXCERPT_TRUNCATION_MARKER)) +
+                    CI_FIX_EXCERPT_TRUNCATION_MARKER;
+        }
+        const remaining = CI_FIX_MAX_LOG_EXCERPTS_TOTAL_BYTES - totalBytes;
+        if (remaining <= utf8Bytes(CI_FIX_EXCERPT_TRUNCATION_MARKER))
+            break;
+        if (utf8Bytes(text) > remaining) {
+            text =
+                sliceUtf8(text, remaining - utf8Bytes(CI_FIX_EXCERPT_TRUNCATION_MARKER)) +
+                    CI_FIX_EXCERPT_TRUNCATION_MARKER;
+        }
+        totalBytes += utf8Bytes(text);
+        excerpts.push({ check: e.check.trim(), source: e.source.trim(), text });
+    }
+    return { status: "supplied", excerpts };
+}
+/**
+ * Validate a claimed `ci_fix` job's focused contract WITHOUT touching a worktree.
+ *
+ * Checks, in order: no explicit `payload.prompt` (a legacy full-recipe prompt
+ * must not silently replace the focused route); a valid `ci_fix` prompt spec
+ * declaring exactly the five focused placeholders; a non-blank, bounded ticket
+ * spec; and a head-bound `ci_resolved_inputs` whose repository and expected
+ * branch agree with the claimed job. Throws `ContractError.CiFixContext` with a
+ * fixed reason token on the first failure — never a fallback prompt.
+ */
+export function readCiFixDispatchContext(job) {
+    const payload = job.payload && typeof job.payload === "object"
+        ? job.payload
+        : {};
+    if (typeof payload.prompt === "string" && payload.prompt.trim().length > 0) {
+        throw ciFixContextError(job, "explicit_prompt_unsupported");
+    }
+    let spec;
+    try {
+        spec = readPromptSpecPayload(payload.prompt_spec, "ci_fix");
+    }
+    catch {
+        throw ciFixContextError(job, "prompt_spec_invalid");
+    }
+    if (spec.placeholders.length !== CI_FIX_PLACEHOLDERS.length ||
+        !CI_FIX_PLACEHOLDERS.every((name) => spec.placeholders.includes(name))) {
+        throw ciFixContextError(job, "prompt_spec_invalid");
+    }
+    if (!isNonBlankString(payload.ticket_spec)) {
+        throw ciFixContextError(job, "ticket_spec_missing");
+    }
+    if (payload.ticket_spec.length > CI_FIX_TICKET_SPEC_MAX_CHARS) {
+        throw ciFixContextError(job, "ticket_spec_oversized");
+    }
+    const inputs = payload.ci_resolved_inputs;
+    if (!inputs || typeof inputs !== "object" || Array.isArray(inputs)) {
+        throw ciFixContextError(job, "dispatched_checks_missing");
+    }
+    const raw = inputs;
+    const failing = readCheckNames(raw.failing_checks);
+    const missing = readCheckNames(raw.missing_checks);
+    if (failing === null || missing === null) {
+        throw ciFixContextError(job, "check_name_invalid");
+    }
+    const required = [];
+    const seen = new Set();
+    for (const name of [...failing, ...missing]) {
+        if (!seen.has(name)) {
+            seen.add(name);
+            required.push(name);
+        }
+    }
+    if (required.length === 0) {
+        throw ciFixContextError(job, "dispatched_checks_missing");
+    }
+    if (required.length > CI_FIX_MAX_ACTIONABLE_CHECKS) {
+        throw ciFixContextError(job, "too_many_checks");
+    }
+    const headSha = typeof raw.head_sha === "string" ? raw.head_sha.trim().toLowerCase() : "";
+    const repoName = typeof raw.repo_name === "string" ? raw.repo_name.trim() : "";
+    const expectedBranch = typeof raw.expected_branch === "string" ? raw.expected_branch.trim() : "";
+    if (!CI_FIX_HEAD_SHA_RE.test(headSha) || !repoName || !expectedBranch) {
+        // A pre-BAPI-1296 payload carries the check lists without a head binding:
+        // it cannot be proven to describe the checkout this executor will prepare.
+        throw ciFixContextError(job, "identity_missing");
+    }
+    const jobExpectedBranch = typeof job.expected_branch === "string" ? job.expected_branch.trim() : "";
+    if (repoName !== job.repo_name || (jobExpectedBranch && jobExpectedBranch !== expectedBranch)) {
+        throw ciFixContextError(job, "identity_mismatch");
+    }
+    const logExcerpts = readLogExcerpts(raw.log_excerpts, headSha, seen);
+    if (logExcerpts === null) {
+        throw ciFixContextError(job, "log_excerpts_invalid");
+    }
+    return {
+        headSha,
+        repoName,
+        expectedBranch,
+        failingChecks: failing,
+        missingChecks: missing,
+        requiredClaimChecks: required,
+        logExcerpts,
+        evidence: readCiEvidence(raw.evidence_snapshot, headSha, new Set(failing)),
+    };
+}
+function formatCheckList(names, none) {
+    return names.length > 0 ? names.map((name) => `- ${sanitizeCiText(name, 200)}`).join("\n") : none;
+}
+function formatLogExcerpts(context) {
+    const evidence = context.evidence;
+    const header = evidence.status === "unavailable"
+        ? `CI snapshot UNAVAILABLE (${evidence.reason}).` : [
+        `Policy: ${evidence.policySource} (${evidence.policyFingerprint})`,
+        `Target: ${evidence.repository} ${evidence.targetBranch} @ ${evidence.headSha}`,
+        `Observed: ${evidence.observedAt}; freshness: ${evidence.freshness}`,
+        `Coverage: ${evidence.coverage}; detail: ${evidence.availability}`,
+        "Selected required failures:",
+        ...evidence.required.map((item) => `- ${sanitizeCiText(item.name, 200)} [${item.sourceKind}; run ${item.runId ?? "unavailable"}; ${item.conclusion}]${item.sourceRef ? ` ${item.sourceRef}` : ""}`),
+        "Related failures — contribution not established:",
+        ...evidence.related.map((name) => `- ${name}`),
+    ].join("\n");
+    const excerpts = context.logExcerpts;
+    if (excerpts.status === "unavailable") {
+        return header + "\n## UNTRUSTED PROVIDER DIAGNOSTICS BEGIN ##\n" + ("UNAVAILABLE — no log excerpt was supplied with this job " +
+            `(reason: ${excerpts.reason}). No log content is provided below or ` +
+            "anywhere else in this prompt. Diagnose from the check names, the code, " +
+            "and local reproduction; do not assume what any log said.") + "\n## UNTRUSTED PROVIDER DIAGNOSTICS END ##";
+    }
+    const summaries = evidence.status === "available"
+        ? evidence.required.filter((item) => item.summary).map((item) => `${sanitizeCiText(item.name, 200)} selected summary: ${item.summary}`)
+        : [];
+    return header + "\n## UNTRUSTED PROVIDER DIAGNOSTICS BEGIN ##\n" +
+        [...summaries, ...excerpts.excerpts.map((e) => `--- check: ${sanitizeCiText(e.check, 200)} (source: ${sanitizeCiText(e.source, 200)}) ---\n${sanitizeCiText(e.text)}`)].join("\n\n") +
+        "\n## UNTRUSTED PROVIDER DIAGNOSTICS END ##";
+}
 /**
  * Explicit "no stale-citation advisory" value (BAPI-722) — never an empty string.
  *
@@ -229,6 +579,21 @@ export async function buildPromptSpecPlaceholderValues(job, spec, context) {
                     : RELATED_CONTEXT_NONE;
                 break;
             }
+            case "FAILING_CHECKS":
+            case "MISSING_CHECKS":
+            case "LOG_EXCERPTS": {
+                // BAPI-1296: only a validated ci_fix dispatch context resolves these.
+                // Any other job type declaring them is a contract failure, and the
+                // repository's required-check configuration is never a source.
+                if (job.job_type !== "ci_fix") {
+                    throw promptContractError(`prompt_spec for job ${job.id} declares ci_fix-only placeholder '${name}'`);
+                }
+                const ci = readCiFixDispatchContext(job);
+                values.FAILING_CHECKS = formatCheckList(ci.failingChecks, "(none — no check was observed failing on the dispatched head)");
+                values.MISSING_CHECKS = formatCheckList(ci.missingChecks, "(none — every required check reported on the dispatched head)");
+                values.LOG_EXCERPTS = formatLogExcerpts(ci);
+                break;
+            }
             case "SPEC_CITATION_FRESHNESS_WARNING": {
                 // OPTIONAL by contract (BAPI-722): an absent field is the normal case and
                 // resolves to the explicit "none" text, NEVER a thrown contract error and

package/build/executor/provider-checks.js

@@ -0,0 +1,69 @@
+/**
+ * Read-only provider-check helpers shared by the executor's post-push waits
+ * (BAPI-1152, extracted in BAPI-1311).
+ *
+ * `reconcile_overlap` waited on provider CI after its guarded push; BAPI-1311's
+ * focused `rebase` waits on the same evidence after its worker's push. Both need
+ * one poller and one pair of predicates, so they live here rather than being
+ * copied. Everything in this module is READ-ONLY: it polls the Bridge API's
+ * existing `/poll-ci-checks` read and classifies the response. It resets no
+ * worktree, pushes nothing, and decides no gate — the server's completion
+ * verifier stays the authority for both lanes (R14 rule 3).
+ */
+import { pollCiChecksForCommit, resolveConductorBridgeApiAccess, } from "../conductor/bridge-api-client.js";
+import { allRequiredChecksGreen } from "../conductor/local-merge.js";
+export { allRequiredChecksGreen };
+/** Thrown by a provider-check poller that has no Bridge API access at all. */
+export class ProviderChecksUnobservable extends Error {
+}
+/**
+ * A provider-check poller that resolves Bridge API access once, on first use —
+ * the same read-only CI poll the `merge` job waits on. Without access it throws
+ * {@link ProviderChecksUnobservable}, so a caller can end its wait immediately
+ * rather than sleeping out the job budget on evidence it can never read.
+ */
+export function lazyProviderCheckPoller(accessDeps) {
+    let access;
+    return async (sha) => {
+        if (access === undefined) {
+            const resolved = await resolveConductorBridgeApiAccess(accessDeps);
+            access = resolved.ok ? resolved.access : null;
+        }
+        if (access === null)
+            throw new ProviderChecksUnobservable("bridge api access unavailable");
+        return pollCiChecksForCommit(access, sha);
+    };
+}
+/** Conclusions that PROVE a check failed, as opposed to not having finished. */
+export const FAILED_CHECK_CONCLUSIONS = new Set([
+    "failure",
+    "cancelled",
+    "timed_out",
+    "action_required",
+    "startup_failure",
+    "stale",
+]);
+/**
+ * True when any REQUIRED check reports a conclusion in
+ * {@link FAILED_CHECK_CONCLUSIONS}. A running, queued, or missing check is not a
+ * failure. Envelope-tolerant: `pollCiChecksForCommit` returns
+ * `{available, reason, action, detail}` with the checks under `detail`.
+ */
+export function anyRequiredCheckFailed(pollResponse, required) {
+    if (pollResponse === null || typeof pollResponse !== "object")
+        return false;
+    let obj = pollResponse;
+    const detail = obj.detail;
+    if (detail && typeof detail === "object" && Array.isArray(detail.checks)) {
+        obj = detail;
+    }
+    const checks = Array.isArray(obj.checks) ? obj.checks : [];
+    const wanted = new Set(required);
+    return checks.some((c) => {
+        if (!c || typeof c !== "object")
+            return false;
+        const name = typeof c.name === "string" ? c.name : "";
+        const conclusion = typeof c.conclusion === "string" ? c.conclusion.toLowerCase() : "";
+        return wanted.has(name) && FAILED_CHECK_CONCLUSIONS.has(conclusion);
+    });
+}