@bridge_gpt/mcp-server 0.2.65 → 0.2.66

package/README.md

@@ -252,9 +252,13 @@ workflows. Bridge-spawned Codex workers then select it automatically, including
 the fresh implementation session after review. Pass `--codex-profile=off` to
 decline; the installer leaves any existing profile content intact. On package
 upgrade, the next Bridge-spawned worker refreshes an older, unmodified managed
-profile before launch. If a profile
-already contains user-authored or conflicting content, the installer leaves it
-untouched and reports that workers cannot use it. Run `doctor --agent codex` to
+profile before launch. The profile preapproves review-decision capture, the
+fixed reviewed-document publisher, and the implementation phase-result record,
+so those required Bridge writes do not enter Codex Auto-review. The general
+`attachment` tool stays on automatic review because it also supports deletion
+and replacement. If a profile already contains user-authored or conflicting
+content, the installer leaves it untouched and reports that workers cannot use
+it. Run `doctor --agent codex` to
 inspect the current status. To use the profile in a Codex session you open
 yourself, run `codex --profile bridge`. Bridge `--auto` controls recipe gates;
 Codex MCP tool approvals are a separate setting. The profile does not change
@@ -369,7 +373,7 @@ later boot.
   "mcpServers": {
     "bridge": {
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.65", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.66", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -391,7 +395,7 @@ later boot.
     "bridge": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.65", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.66", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -413,7 +417,7 @@ later boot.
     "bridge": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.65", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.66", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -436,7 +440,7 @@ Windsurf only supports global MCP configuration.
   "mcpServers": {
     "bridge": {
       "command": "npx",
-      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.65", "serve"],
+      "args": ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.66", "serve"],
       "env": {
         "BAPI_BASE_URL": "https://bridgegpt-api.com",
         "BAPI_REPO_NAME": "your-repo",
@@ -455,7 +459,7 @@ Windsurf only supports global MCP configuration.
 ```toml
 [mcp_servers.bridge]
 command = "npx"
-args = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.65", "serve"]
+args = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.66", "serve"]
 
 [mcp_servers.bridge.env]
 BAPI_BASE_URL = "https://bridgegpt-api.com"
@@ -893,7 +897,7 @@ Because tier 2 outranks tier 3, a stale `SFCC_HOSTNAME` left in the environment
 "env": { "BRIDGE_MCP_PROFILE": "sfcc" }
 ```
 
-`sfcc` gives the eight read tools plus `sfcc_log_query`. For the nine destructive write tools as well, use `"sfcc,sfcc-write"`; `full` expands to every group and is therefore write-capable. Without any of these, only the diagnostic tools are registered.
+`sfcc` gives the two diagnostics, the eight read tools, and `sfcc_log_query`. For the nine destructive write tools as well, use `"sfcc,sfcc-write"`; `full` expands to every group and is therefore write-capable. Without any of these, no SFCC tool is registered — not even the diagnostics.
 
 **4. Verify and grant OCAPI access.** With `sfcc` selected in step 3 (both diagnostics live in that profile), ask your agent to run `sfcc_setup_status` (expect all checks ✓), then `check_permissions`. If it reports HTTP 401/403, it prints the exact OCAPI Settings JSON to paste in Business Manager (**Administration → Site Development → Open Commerce API Settings → Data API** tab); save it there and re-run. Restart the MCP client after any credential or env change — a running session does not pick them up.
 
@@ -1163,7 +1167,15 @@ requests a lane, or starts or signals an executor. With `--json` (valid only wit
 `readiness`, `live_run`, `plan`, `summary`, `decision`, and `refusal`. The
 readiness `reason_id` and `remedy` are the strings the real refusal prints. The
 webhook URL, credentials, and policy contents are never included. The preview does
-not probe ports, so a local plane that is not listening reads as unknown readiness.
+probes only a selected loopback plane after a network readiness failure and an
+available plan. A refused port plus passing local preflight yields a conditional
+`create` with optional `cold_start` (`plane_endpoint`, `will_start_plane: true`,
+`live_run_checked: false`), `live_run: null`, and partial offline setup validation.
+The real launch attempts guarded startup, then rechecks run existence and server
+validation; the preview does not guarantee creation. Remote targets, non-refused
+port probes, and ordinary production previews keep their existing refusal or
+create behavior. `target.source` is optional and appears only for selected
+profiles (`profile` or `profile-env`).
 
 **The composed bring-up is two-phase (BAPI-1102).** With `--plan-file` on a
 repository whose readiness is missing only the runtime facts, one invocation runs,
@@ -1456,7 +1468,7 @@ If a custom pipeline has the same key as a built-in pipeline, the custom version
 | `BAPI_BASE_URL` (`executor` subcommand) | **Yes** | _(none)_ | The `executor` deliberately has **no** production fallback — it refuses to start rather than guess a target |
 | `BAPI_REPO_NAME` | Yes | _(none)_ | Jira project/repository identifier configured in Bridge API |
 | `BAPI_API_KEY` | No | _(none)_ | A Bridge credential **is** required; this environment variable is only the first place the server looks for it. When it is unset the server resolves the credential from the user-scoped store (`~/.config/bridge/credentials.json`, target `bapi:<repo>`), which is why generated MCP registrations are secret-free |
-| `BAPI_PROJECT_ROOT` | No | _(see fallback order)_ | Absolute path to project root. Anchors `BAPI_DOCS_DIR` and `BAPI_PIPELINES_DIR` resolution. Resolved once, in order: `BAPI_PROJECT_ROOT` → the connected client's MCP `roots/list` → `CLAUDE_PROJECT_DIR` → `process.cwd()`. Several paths *write* it into a generated registration (`--init`, host-config provisioning, the worktree `mcp-invoke` shim) — that is provenance, not a runtime default |
+| `BAPI_PROJECT_ROOT` | No | _(see fallback order)_ | Absolute path to project root. Anchors `BAPI_DOCS_DIR` and `BAPI_PIPELINES_DIR` resolution. Resolved once, in order: `BAPI_PROJECT_ROOT` → the connected client's MCP `roots/list` → `CLAUDE_PROJECT_DIR` → `process.cwd()`. The explicit value is validated: it is used only when it exists, is a folder, and contains `.git` (a folder, or a worktree's `.git` file) or `.bridge/config`. Otherwise it is ignored and the next source is used, so a path committed from another machine is harmless. The later sources are not validated. The server logs the chosen root and its source to stderr once (for example `Bridge MCP: project root /home/b/app (from roots/list); BAPI_PROJECT_ROOT /Users/a/app ignored: does not exist`), and `doctor` reports whether each configured value is valid. The check proves the path looks like a project, not that it is *this* project. Several paths *write* it into a generated registration (`--init`, `install`, `upgrade`, host-config provisioning, the worktree `mcp-invoke` shim) — that is provenance, not a runtime default; a git-tracked config keeps its existing value. What each host passes at start: see the per-host table in `docs/claude/cli-install-architecture.md` (§5a) |
 | `SFCC_HOSTNAME` | No | _(none)_ | SFCC sandbox hostname. Part of the environment credential tier — `SFCC_HOSTNAME`, `SFCC_CLIENT_ID`, and `SFCC_CLIENT_SECRET` must **all three** be set for that tier to apply, and a complete tier takes precedence over `dw.json` |
 | `SFCC_CLIENT_ID` | No | _(none)_ | Account Manager API client id. See `SFCC_HOSTNAME` — all three are needed together. Also required on its own when a tool is called with an explicit dotted `instance` |
 | `SFCC_CLIENT_SECRET` | No | _(none)_ | Account Manager API client secret. See `SFCC_HOSTNAME` — all three are needed together. Never sent to Bridge; it goes only to the Account Manager token endpoint |
@@ -1730,7 +1742,7 @@ The full surface, for when you need the complete enumeration. Day-to-day, use [U
 
 ### MCP tools
 
-The authoritative tool catalog covers **77 tools** (enumerated below). What's actually registered in a session depends on `BRIDGE_MCP_PROFILE`: the default `core` profile loads a trimmed subset, and the conductor/pipeline-authoring/SFCC tools are added only under their respective profiles (see [Environment Variables](#environment-variables)). Async AI tools follow a request/get pattern: call the `request_*` tool to kick off generation, then the matching `get_*` tool to retrieve the result (or pass `wait_for_result: true` to poll automatically).
+The authoritative tool catalog covers **78 tools** (enumerated below). What's actually registered in a session depends on `BRIDGE_MCP_PROFILE`: the default `core` profile loads a trimmed subset, and the conductor/pipeline-authoring/SFCC tools are added only under their respective profiles (see [Environment Variables](#environment-variables)). Async AI tools follow a request/get pattern: call the `request_*` tool to kick off generation, then the matching `get_*` tool to retrieve the result (or pass `wait_for_result: true` to poll automatically).
 
 - **Connectivity & identity** — `ping` (its JSON also carries `docs_dir`, `role`, and `customer_type`)
 - **Team & access** — `invite_member` (admin-only; mints a scoped access key for a teammate on an already-configured project — the plaintext key is shown exactly once)
@@ -1743,7 +1755,7 @@ The authoritative tool catalog covers **77 tools** (enumerated below). What's ac
 - **Jira status** — `update_jira_status` (pass `status: "auto"` to resolve the configured post-PR status server-side)
 - **Repository & CI** — `parse_repository` (`action`: `start`, `status`), `regenerate_directory_map`, `create_pull_request`, `merge_pull_request`, `resolve_ci_checks`, `poll_ci_checks`, `wait_for_ci_checks` (the last two are hidden until `ci_check_config` resolves, and share one visibility gate)
 - **Pipelines & automation** — `get_pipeline_recipe` (returns a fully resolved recipe the agent executes step-by-step)
-- **Config** — `get_project_standards`, `config_field` (operations: `get`, `update`, `list`)
+- **Config** — `get_project_standards`, `config_field` (operations: `get`, `update`, `list`), `model_thresholds` (actions: `get`, `set`, `clear`; the only way to set personal thresholds)
 
 ### Bundled pipelines
 

package/build/agent-launchers/claude-executor-adapter.js

@@ -1,4 +1,3 @@
-import { isModelTier, isValidModelAlias, resolveModelAlias } from "../agent-registry.js";
 import { evaluateClaudeMcpShadowingPolicy, inspectClaudeUserConfigForMcpShadowing, resolveClaudeUserConfigPath, } from "../claude-user-config-doctor.js";
 import { runDenyEnforcementPreflight } from "../conductor/deny-enforcement-preflight.js";
 import { buildExecutorBaseWorkerEnv } from "../executor/env.js";
@@ -7,7 +6,7 @@ import { provisionExecutorDenyLayer } from "../executor/permissions.js";
 import { WORKER_GUARD_ROOT_FLAG } from "../executor/worker-guard-hook.js";
 import { SUPPORTED_EXECUTOR_PLATFORMS, evaluateExecutorPlatform } from "../executor/platform.js";
 import { normalizeMcpServerNames } from "../executor/observation.js";
-import { COMPLETION_EVIDENCE_TRANSPORT, supported } from "./executor-adapter.js";
+import { COMPLETION_EVIDENCE_TRANSPORT, resolveExecutorModelAlias, supported, } from "./executor-adapter.js";
 import { SUPPORTED_COMPLETION_RUNTIME, boundedIdentifier, } from "../executor/completion-contract.js";
 import { MCP_SERVER_NAME } from "../mcp-identity.js";
 /** Stable identity of this reference implementation. */
@@ -159,21 +158,12 @@ export function classifyClaudeAuthFailure(stdoutExcerpt) {
  * when it passes both registry alias validation AND the spec's static allowlist;
  * anything else falls through to tier resolution, and an unusable result is null
  * (meaning "omit `--model`") rather than an unvalidated passthrough.
+ *
+ * BAPI-1343: the rule now lives in the agent-neutral
+ * {@link resolveExecutorModelAlias}; this export delegates with no behavior change.
  */
 export function resolveClaudeModelAlias(spec, payload) {
-    const p = payload && typeof payload === "object" ? payload : {};
-    const directRaw = p.model_alias;
-    if (typeof directRaw === "string" && directRaw.trim().length > 0) {
-        const direct = directRaw.trim();
-        const allowed = !spec.staticModelAliasAllowlist || spec.staticModelAliasAllowlist.includes(direct);
-        if (isValidModelAlias(direct) && allowed) {
-            return direct;
-        }
-        // An invalid/disallowed direct alias falls through to the tier path — never
-        // returned as-is.
-    }
-    const tier = isModelTier(p.model_tier) ? p.model_tier : null;
-    return resolveModelAlias(spec, tier, null);
+    return resolveExecutorModelAlias(spec, payload);
 }
 // ---------------------------------------------------------------------------
 // Spawn shape
@@ -411,9 +401,10 @@ function shellQuoteHookPath(value) {
  * where the executor's env deny-list can guarantee an ambient value never
  * substitutes for the job's own.
  */
-export function buildWorkerGuardHookCommand(binPath, execPath, worktreePath) {
+export function buildWorkerGuardHookCommand(binPath, execPath, worktreePath, correctionIntentVersion) {
     return (`${shellQuoteHookPath(execPath)} ${shellQuoteHookPath(binPath)} ` +
-        `${WORKER_GUARD_ROOT_FLAG} ${shellQuoteHookPath(worktreePath)}`);
+        `${WORKER_GUARD_ROOT_FLAG} ${shellQuoteHookPath(worktreePath)}` +
+        (correctionIntentVersion === 1 ? " --correction-intent-version 1" : ""));
 }
 // ---------------------------------------------------------------------------
 // The adapter factory
@@ -450,6 +441,9 @@ export function createClaudeExecutorAdapter(spec, deps = {}) {
             if (input.workerBranch !== undefined) {
                 envOptions.workerBranch = input.workerBranch;
             }
+            if (input.correctionIntentVersion !== undefined) {
+                envOptions.correctionIntentVersion = input.correctionIntentVersion;
+            }
             if (input.declaredTouchedFiles !== undefined) {
                 envOptions.declaredTouchedFiles = input.declaredTouchedFiles;
             }
@@ -522,7 +516,7 @@ export function createClaudeExecutorAdapter(spec, deps = {}) {
             }
             const options = {
                 baseBranch: input.baseBranch,
-                workerGuardHookCommand: buildWorkerGuardHookCommand(input.workerGuardHookBinPath, deps.execPath ?? process.execPath, input.worktreePath),
+                workerGuardHookCommand: buildWorkerGuardHookCommand(input.workerGuardHookBinPath, deps.execPath ?? process.execPath, input.worktreePath, input.correctionIntentVersion),
             };
             if (input.workerBranch !== undefined) {
                 options.workerBranch = input.workerBranch;

package/build/agent-launchers/executor-adapter.js

@@ -1,3 +1,4 @@
+import { isModelTier, isValidModelAlias, resolveModelAlias } from "../agent-registry.js";
 /** Construct a supported capability. */
 export function supported(value) {
     return { supported: true, value };
@@ -8,6 +9,32 @@ export function unsupported(reason, strategyId) {
         ? { supported: false, reason }
         : { supported: false, reason, strategyId };
 }
+/**
+ * Agent-neutral payload -> model alias rule shared by every executor adapter
+ * (BAPI-1343).
+ *
+ * A direct `model_alias` is accepted only when it passes registry alias
+ * validation AND the spec's static allowlist. Otherwise a stamped `model_tier`
+ * maps through {@link resolveModelAlias} with no repository override. Anything
+ * unusable returns null, meaning "omit the model flag". There is deliberately no
+ * job-type branch: the server decides whether to stamp a tier, and every stamped
+ * payload takes the same path.
+ */
+export function resolveExecutorModelAlias(spec, payload) {
+    const p = payload && typeof payload === "object" ? payload : {};
+    const directRaw = p.model_alias;
+    if (typeof directRaw === "string" && directRaw.trim().length > 0) {
+        const direct = directRaw.trim();
+        const allowed = !spec.staticModelAliasAllowlist || spec.staticModelAliasAllowlist.includes(direct);
+        if (isValidModelAlias(direct) && allowed) {
+            return direct;
+        }
+        // An invalid/disallowed direct alias falls through to the tier path — never
+        // returned as-is.
+    }
+    const tier = isModelTier(p.model_tier) ? p.model_tier : null;
+    return resolveModelAlias(spec, tier, null);
+}
 // ---------------------------------------------------------------------------
 // Completion evidence (job-specific, non-required) — BAPI-1301 (D4a)
 // ---------------------------------------------------------------------------

package/build/bridge-config.js

@@ -11,6 +11,7 @@
  * touching the filesystem or invoking real `git`.
  */
 import path from "path";
+import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
 /**
  * True if a string contains any ASCII control character (0x00-0x1f or 0x7f).
  * Keeps identifiers path-safe and free of anything that could smuggle into a
@@ -307,6 +308,109 @@ export function parseBridgeConfigToml(text) {
     return { ok: true, manifest: { repoName, mcp: cleaned } };
 }
 // ---------------------------------------------------------------------------
+// Teammate notice, representability, and lossless repo_name rewrite (BAPI-1318)
+// ---------------------------------------------------------------------------
+/**
+ * The teammate notice carried in the header of every scaffolded `.bridge/config`,
+ * and inserted by a consented repair when an older file lacks it. A teammate who
+ * clones a committed project gets this file but no MCP config (`.mcp.json` is
+ * gitignored), so this is the one place that tells them to run install.
+ *
+ * ONE source for both writers ({@link rewriteBridgeConfigRepoName} and
+ * `buildBridgeConfigManifest` in `init.ts`), and the exact-text detector for "this
+ * file already carries the notice", so the two can never drift.
+ */
+export const BRIDGE_CONFIG_TEAMMATE_NOTICE_LINES = [
+    "# Teammates: this file does not connect your editor. Run",
+    `# "npx -y ${MCP_PACKAGE_NAME} install" once in this folder.`,
+];
+/**
+ * Whether `name` can be written as `repo_name = "<name>"` and read back unchanged
+ * by {@link parseBridgeConfigToml}. `validateRepoName()` is deliberately left as
+ * it is (it gates every install name input); this is the stricter,
+ * manifest-only check the scaffold, post-rename, and repair writers all apply.
+ * The quoted-string subset has no escapes, so an embedded `"` or `\` is refused,
+ * and surrounding whitespace is refused because the parser would trim it away.
+ */
+export function validateBridgeConfigRepoNameRepresentability(name) {
+    const validated = validateRepoName(name);
+    if (!validated.ok)
+        return validated;
+    if (validated.value !== name) {
+        return { ok: false, error: "repo_name must not have leading or trailing whitespace" };
+    }
+    if (validated.value.includes('"')) {
+        return { ok: false, error: "repo_name cannot contain a double quote in .bridge/config" };
+    }
+    if (validated.value.includes("\\")) {
+        return { ok: false, error: "repo_name cannot contain a backslash in .bridge/config" };
+    }
+    return validated;
+}
+/**
+ * Rewrite ONLY the quoted value of the single top-level `repo_name` line, and add
+ * the teammate notice at the top when its exact lines are absent. Every other
+ * byte — comments, blank lines, each `[[mcp]]` block, the `repo_name` line's own
+ * indentation and spacing around `=`, and the line endings — is preserved.
+ *
+ * Pure. The input is parsed first (a malformed file is refused, never rewritten)
+ * and the output is parsed again: it must carry the new name and the same ordered
+ * `mcp` list, or the rewrite is refused. Refusal messages never echo file content.
+ */
+export function rewriteBridgeConfigRepoName(text, newName) {
+    const representable = validateBridgeConfigRepoNameRepresentability(newName);
+    if (!representable.ok) {
+        return { ok: false, kind: "unrepresentable-name", error: representable.error };
+    }
+    const before = parseBridgeConfigToml(text);
+    if (!before.ok) {
+        return { ok: false, kind: "parse-error", error: before.error };
+    }
+    const eol = text.includes("\r\n") ? "\r\n" : "\n";
+    const lines = text.split("\n");
+    // Locate the one top-level repo_name line: the parse above proved there is
+    // exactly one, and that it sits before the first [[mcp]] header.
+    let repoLine = -1;
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        if (trimmed === "[[mcp]]")
+            break;
+        if (trimmed.startsWith("#") || trimmed.length === 0)
+            continue;
+        const eq = trimmed.indexOf("=");
+        if (eq !== -1 && trimmed.slice(0, eq).trim() === "repo_name") {
+            repoLine = i;
+            break;
+        }
+    }
+    if (repoLine === -1) {
+        return { ok: false, kind: "verification-failed", error: "Could not locate the repo_name line" };
+    }
+    const original = lines[repoLine];
+    const open = original.indexOf('"', original.indexOf("=") + 1);
+    const close = original.lastIndexOf('"');
+    if (open === -1 || close <= open) {
+        return { ok: false, kind: "verification-failed", error: "Could not locate the repo_name value" };
+    }
+    lines[repoLine] = `${original.slice(0, open + 1)}${representable.value}${original.slice(close)}`;
+    let next = lines.join("\n");
+    const noticePresent = BRIDGE_CONFIG_TEAMMATE_NOTICE_LINES.every((line) => text.split("\n").some((existing) => existing.replace(/\r$/, "") === line));
+    if (!noticePresent) {
+        next = BRIDGE_CONFIG_TEAMMATE_NOTICE_LINES.map((line) => `${line}${eol}`).join("") + next;
+    }
+    const after = parseBridgeConfigToml(next);
+    if (!after.ok ||
+        after.manifest.repoName !== representable.value ||
+        JSON.stringify(after.manifest.mcp) !== JSON.stringify(before.manifest.mcp)) {
+        return {
+            ok: false,
+            kind: "verification-failed",
+            error: "The rewritten .bridge/config did not parse back to the same manifest",
+        };
+    }
+    return { ok: true, text: next, changed: next !== text, noticeAdded: !noticePresent };
+}
+// ---------------------------------------------------------------------------
 // Reading + identity resolution
 // ---------------------------------------------------------------------------
 /** Absolute path to a project root's committed manifest. */

package/build/codex-bridge-profile.js

@@ -18,6 +18,15 @@ export const BRIDGE_WORKFLOW_TOOLS = [
     "update_jira_status", "config_field", "resolve_ci_checks", "poll_ci_checks",
     "wait_for_ci_checks",
 ];
+// These bounded workflow writes are required to complete review and implementation.
+// `auto` can route their repository-derived payloads to Auto-review, which can
+// reject the Jira publish or phase ledger write despite the opted-in profile.
+// Keep the general `attachment` tool on `auto`: it also supports delete/replace.
+const PREAPPROVED_WORKFLOW_TOOLS = new Set([
+    "capture_review_decisions",
+    "publish_reviewed_attachment",
+    "record_phase_result",
+]);
 export function codexProfilePaths(home) {
     return {
         profile: path.join(home, PROFILE_FILE),
@@ -31,7 +40,7 @@ export function renderBridgeCodexProfile(key) {
         `# Applies only when selected with codex --profile ${BRIDGE_CODEX_PROFILE}.`,
         ...BRIDGE_WORKFLOW_TOOLS.flatMap((tool) => [
             `[mcp_servers.${key}.tools.${tool}]`,
-            'approval_mode = "auto"',
+            `approval_mode = "${PREAPPROVED_WORKFLOW_TOOLS.has(tool) ? "approve" : "auto"}"`,
             "",
         ]),
     ].join("\n") + "\n";