@bridge_gpt/mcp-server 0.2.65 → 0.2.66

package/build/executor/worker-guard-hook.js

@@ -879,19 +879,45 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
  */
 export function evaluateWorkerGuardPayload(payload, ctx) {
     const root = asRecord(payload);
+    if (ctx.correctionContextInvalid)
+        return { kind: "deny", category: "workflow-entry", family: "workflow" };
     if (root === undefined)
-        return { kind: "malformed" };
+        return ctx.correctionEnforced
+            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
+            : { kind: "malformed" };
     const toolName = root.tool_name ?? root.toolName;
     if (typeof toolName !== "string")
-        return { kind: "malformed" };
+        return ctx.correctionEnforced
+            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
+            : { kind: "malformed" };
+    const input = asRecord(root.tool_input ?? root.toolInput);
+    if (ctx.correctionEnforced) {
+        if (input === undefined)
+            return { kind: "deny", category: "workflow-entry", family: "workflow" };
+        const args = Object.values(input).filter((v) => typeof v === "string").join(" ");
+        const fullEntry = /(?:^|\s|\/)\/?(?:bridge-)?(?:implement-ticket|plan-ticket|idea-to-pr|review-and-implement)(?:\s|$|\.)/i;
+        const recipePath = /(?:commands\/src|\.claude\/commands|\.cursor\/commands|pipelines)\/(?:implement-ticket|plan-ticket)(?:\.md|\.json)?/i;
+        const plannerTool = /(?:request_plan_generation|get_pipeline_recipe|plan_ticket|implement_ticket)/i;
+        if (recipePath.test(args) || fullEntry.test(args) ||
+            (plannerTool.test(toolName) && toolName !== "Bash")) {
+            return { kind: "deny", category: "workflow-entry", family: "workflow" };
+        }
+        if (/^(?:Task|Agent|Skill|SlashCommand|mcp__)/i.test(toolName) &&
+            (fullEntry.test(args) || plannerTool.test(args))) {
+            return { kind: "deny", category: "workflow-entry", family: "workflow" };
+        }
+    }
     if (toolName !== "Bash")
         return { kind: "allow" };
-    const input = asRecord(root.tool_input ?? root.toolInput);
     if (input === undefined)
-        return { kind: "malformed" };
+        return ctx.correctionEnforced
+            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
+            : { kind: "malformed" };
     const command = input.command;
     if (typeof command !== "string")
-        return { kind: "malformed" };
+        return ctx.correctionEnforced
+            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
+            : { kind: "malformed" };
     const rawCwd = root.cwd ?? input.cwd;
     const payloadCwd = typeof rawCwd === "string" ? rawCwd : undefined;
     for (const segment of tokenizeShellCommand(command)) {
@@ -908,18 +934,21 @@ export function evaluateWorkerGuardPayload(payload, ctx) {
  * exception: the binary's job is to emit one bounded line and get out of the way.
  */
 export function evaluateWorkerGuardInput(raw, ctx) {
+    const unreadable = () => ctx.correctionEnforced || ctx.correctionContextInvalid
+        ? { kind: "deny", category: "workflow-entry", family: "workflow" }
+        : { kind: "malformed" };
     if (typeof raw !== "string")
-        return { kind: "malformed" };
+        return unreadable();
     if (raw.length > WORKER_GUARD_MAX_PAYLOAD_BYTES)
-        return { kind: "malformed" };
+        return unreadable();
     if (raw.trim().length === 0)
-        return { kind: "malformed" };
+        return unreadable();
     let parsed;
     try {
         parsed = JSON.parse(raw);
     }
     catch {
-        return { kind: "malformed" };
+        return unreadable();
     }
     try {
         return evaluateWorkerGuardPayload(parsed, ctx);
@@ -927,7 +956,7 @@ export function evaluateWorkerGuardInput(raw, ctx) {
     catch {
         // Defensive: an unexpected evaluator failure is a HOOK problem, not a worker
         // problem, so it takes the fail-open path rather than blocking the tool loop.
-        return { kind: "malformed" };
+        return unreadable();
     }
 }
 /** The flag through which provisioning templates the trusted worktree root. */
@@ -968,5 +997,12 @@ export function resolveWorkerGuardContext(env, cwd, argv = []) {
     const branch = env.BAPI_WORKER_BRANCH;
     if (typeof branch === "string" && branch.trim().length > 0)
         ctx.workerBranch = branch.trim();
+    const flagIndex = argv.indexOf("--correction-intent-version");
+    const flagValue = flagIndex >= 0 ? argv[flagIndex + 1] : undefined;
+    const envValue = env.BAPI_CORRECTION_INTENT_VERSION;
+    ctx.correctionEnforced = flagValue === "1" || envValue === "1";
+    ctx.correctionContextInvalid = flagIndex >= 0 && flagValue !== "1" ||
+        (envValue !== undefined && envValue !== "1") ||
+        (flagIndex >= 0 && envValue !== undefined && envValue !== flagValue);
     return ctx;
 }

package/build/executor/worker-log.js

@@ -1,21 +1,70 @@
 /**
- * Per-job worker log tee primitives (BAPI-535, TDD §8, G5).
+ * Per-attempt worker log tee primitives (BAPI-535, TDD §8, G5; BAPI-1330).
+ *
+ * Every worker's output is teed to a log file that belongs to exactly ONE claimed
+ * attempt: `<worktree>/.conductor/worker-job<id>-attempt<n>-<claim>.log`, where
+ * `<claim>` is an opaque identifier minted fresh for each claim. The file is
+ * created EXCLUSIVELY before the first write, so a retry, a reclaim, or a reused
+ * worktree can never truncate, rotate, or append into an earlier attempt's
+ * transcript — and a reference to one attempt can never resolve to another's
+ * contents.
+ *
+ * BAPI-1330 retired the fixed `.conductor/worker.log` path. Its BAPI-1021
+ * rotation (rename the old file to a timestamped archive, truncate a new one)
+ * left the job-log registry pointing at a MUTABLE path that the next attempt
+ * reused, and a timestamp is not collision protection. There is no active alias
+ * any more: readers go through the registry, which names the stable file.
  *
- * Every worker's output is teed to the fixed path `<worktree>/.conductor/worker.log`
- * in human-readable form so `tail -f` reproduces the v1 tab experience on demand.
  * The tee is PURELY a recorder: it never owns, signals, or kills the worker
- * process — closing/finalizing the log affects the file only. All filesystem
- * access is behind injected boundaries so this is unit-testable with no real I/O.
+ * process, and a logging failure never changes a worker's disposition — it only
+ * marks this attempt's transcript unavailable. All filesystem access is behind
+ * injected boundaries so this is unit-testable with no real I/O.
  */
+import { randomBytes as nodeRandomBytes } from "node:crypto";
 import { pathApiForExecutorPlatform } from "./worktree-inspection.js";
 /** The fixed `.conductor` worker-log directory (relative to the worktree). */
 export const CONDUCTOR_WORKER_LOG_DIR = ".conductor";
-/** The fixed worker-log filename. */
+/**
+ * The RETIRED fixed worker-log filename (BAPI-1330). Nothing writes it any more;
+ * it is kept only so readers can recognize a legacy registry record that names
+ * it and report that record as unavailable instead of following a mutable alias.
+ */
 export const CONDUCTOR_WORKER_LOG_FILE = "worker.log";
-/** Resolve `<worktree>/.conductor/worker.log` with platform-correct separators. */
-export function buildWorkerLogPath(worktreePath, platform = process.platform) {
+/** An opaque per-claim identifier: 32 lower-case hex characters. */
+export const WORKER_LOG_CLAIM_ID_RE = /^[0-9a-f]{32}$/;
+/**
+ * The stable attempt-log filename shape. Groups: job id, attempt, claim id.
+ * Readers validate a registry record against this before returning a pointer.
+ */
+export const WORKER_LOG_ATTEMPT_FILE_RE = /^worker-job([1-9][0-9]*)-attempt([0-9]+)-([0-9a-f]{32})\.log$/;
+/** Mint a fresh opaque claim identifier (16 random bytes, hex). */
+export function createWorkerLogClaimId(randomBytes = nodeRandomBytes) {
+    return randomBytes(16).toString("hex");
+}
+/** True for a well-formed attempt identity. */
+export function isValidWorkerLogAttemptIdentity(identity) {
+    return (Number.isInteger(identity.jobId) &&
+        identity.jobId > 0 &&
+        Number.isInteger(identity.attempt) &&
+        identity.attempt >= 0 &&
+        typeof identity.claimId === "string" &&
+        WORKER_LOG_CLAIM_ID_RE.test(identity.claimId));
+}
+/**
+ * The stable filename for one attempt. Throws on a malformed identity: every
+ * component is validated so nothing can escape `.conductor` or collide with
+ * another attempt's name.
+ */
+export function workerLogAttemptFileName(identity) {
+    if (!isValidWorkerLogAttemptIdentity(identity)) {
+        throw new Error("invalid worker log attempt identity");
+    }
+    return `worker-job${identity.jobId}-attempt${identity.attempt}-${identity.claimId}.log`;
+}
+/** Resolve `<worktree>/.conductor/<attempt file>` with platform-correct separators. */
+export function buildWorkerLogPath(worktreePath, identity, platform = process.platform) {
     const pathApi = pathApiForExecutorPlatform(platform);
-    return pathApi.join(worktreePath, CONDUCTOR_WORKER_LOG_DIR, CONDUCTOR_WORKER_LOG_FILE);
+    return pathApi.join(worktreePath, CONDUCTOR_WORKER_LOG_DIR, workerLogAttemptFileName(identity));
 }
 /**
  * Render one stdout/stderr chunk as human-readable log text. The worker's stream
@@ -26,81 +75,97 @@ export function buildWorkerLogPath(worktreePath, platform = process.platform) {
 export function renderWorkerLogChunk(chunk, _stream = "stdout") {
     return chunk;
 }
-/**
- * True for a Node-`fs`-shaped "does not exist" rejection (`code: "ENOENT"`).
- * The normal, expected outcome of probing a first-ever attempt's log path —
- * never itself a reason to warn.
- */
-function isMissingFileError(err) {
-    return typeof err === "object" && err !== null && err.code === "ENOENT";
+function errorCode(err) {
+    return typeof err === "object" && err !== null ? err.code : undefined;
 }
 /**
- * The bounded, secret-free archive-preservation warning (BAPI-1021, AC-6).
- * Carries ONLY the stable category and the current/archive path identifiers —
- * never the caught exception's message or stack. Emitted at most once per tee
- * creation, whether the existence probe or the rename itself failed.
+ * The bounded, secret-free transcript-unavailable warning (BAPI-1330). Carries
+ * only the job id, attempt number and a closed reason — never a path, an
+ * exception message, or transcript content.
  */
-export function formatWorkerLogArchivePreservationWarning(currentLogPath, archivePath) {
-    return archivePath
-        ? `worker log archive: could not preserve the prior attempt's log ` +
-            `(${currentLogPath} -> ${archivePath}); the new attempt continues.`
-        : `worker log archive: could not confirm whether a prior attempt's log exists ` +
-            `at ${currentLogPath}; the new attempt continues.`;
+export function formatWorkerLogUnavailableWarning(identity, reason) {
+    return (`worker log unavailable for job ${identity.jobId} attempt ${identity.attempt} (${reason}); ` +
+        "the attempt continues without a recorded transcript.");
 }
-/**
- * Create the `.conductor` directory, initialize an empty `worker.log`, and return
- * a tee handle. When an `appendFile` boundary is supplied, chunks are appended
- * incrementally; otherwise a buffered fallback re-writes the accumulated content
- * via `writeFile` so all consumed chunks are preserved in order.
- *
- * BAPI-1021 (AC-6): before writing the new empty log, archives any PRIOR
- * attempt's log under a timestamped filename in the same directory — so a
- * retried job in the same worktree does not silently overwrite what the
- * previous attempt wrote. Best-effort throughout: a missing prior log is the
- * normal first-attempt case (no warning); a probe or rename failure degrades
- * to exactly one bounded warning and tee creation still proceeds.
- */
-export async function createWorkerLogTee(worktreePath, deps) {
-    const platform = deps.platform ?? process.platform;
-    const pathApi = pathApiForExecutorPlatform(platform);
-    const dir = pathApi.join(worktreePath, CONDUCTOR_WORKER_LOG_DIR);
-    const logPath = pathApi.join(dir, CONDUCTOR_WORKER_LOG_FILE);
-    await deps.mkdir(dir, { recursive: true });
-    if (deps.stat && deps.rename) {
+/** Create the attempt file exclusively. Resolves with a reason when it could not. */
+async function allocateAttemptLog(logPath, deps) {
+    try {
+        if (deps.writeFileExclusive) {
+            await deps.writeFileExclusive(logPath, "");
+            return null;
+        }
+        if (!deps.stat)
+            return "allocation_failed";
         try {
             await deps.stat(logPath);
         }
         catch (err) {
-            if (!isMissingFileError(err)) {
-                deps.errorLog?.(formatWorkerLogArchivePreservationWarning(logPath));
-            }
-            // Missing (or unconfirmable) is the normal first-attempt case either
-            // way: fall through to the truncating write below without a rename.
+            if (errorCode(err) !== "ENOENT")
+                return "allocation_failed";
             await deps.writeFile(logPath, "");
-            return createTeeHandle(logPath, deps);
-        }
-        // The current log exists: archive it before truncating.
-        const clock = deps.now ?? Date.now;
-        const timestamp = new Date(clock()).toISOString().replace(/:/g, "-");
-        const archivePath = pathApi.join(dir, `worker.${timestamp}.log`);
-        try {
-            await deps.rename(logPath, archivePath);
-        }
-        catch {
-            deps.errorLog?.(formatWorkerLogArchivePreservationWarning(logPath, archivePath));
+            return null;
         }
+        return "allocation_collision";
+    }
+    catch (err) {
+        return errorCode(err) === "EEXIST" ? "allocation_collision" : "allocation_failed";
     }
-    await deps.writeFile(logPath, "");
-    return createTeeHandle(logPath, deps);
 }
-/** Shared tee-handle construction, used by every `createWorkerLogTee` return path. */
-function createTeeHandle(logPath, deps) {
+/**
+ * Allocate this attempt's log file and return a tee for it.
+ *
+ * The file is created EXCLUSIVELY before any append. An existing file is refused,
+ * never truncated or archived: a collision means some other claim already owns
+ * that name, and its transcript must survive. Allocation failure does NOT throw —
+ * the tee comes back `available: false` (appends become no-ops), one bounded
+ * diagnostic is emitted, and the worker runs exactly as it would have.
+ */
+export async function createWorkerLogTee(worktreePath, deps, identity) {
+    const platform = deps.platform ?? process.platform;
+    const pathApi = pathApiForExecutorPlatform(platform);
+    const dir = pathApi.join(worktreePath, CONDUCTOR_WORKER_LOG_DIR);
+    const logPath = buildWorkerLogPath(worktreePath, identity, platform);
+    let reason;
+    try {
+        await deps.mkdir(dir, { recursive: true });
+        reason = await allocateAttemptLog(logPath, deps);
+    }
+    catch {
+        reason = "allocation_failed";
+    }
+    const handle = createTeeHandle(logPath, identity, deps);
+    if (reason !== null)
+        handle.markUnavailable(reason);
+    return handle;
+}
+/** Shared tee-handle construction. */
+function createTeeHandle(logPath, identity, deps) {
     let buffer = "";
     let closed = false;
+    let unavailableReason;
+    const markUnavailable = (reason) => {
+        if (unavailableReason !== undefined)
+            return;
+        unavailableReason = reason;
+        try {
+            deps.errorLog?.(formatWorkerLogUnavailableWarning(identity, reason));
+        }
+        catch {
+            /* the diagnostic is best-effort too */
+        }
+    };
     return {
         logPath,
+        identity,
+        get available() {
+            return unavailableReason === undefined;
+        },
+        get unavailableReason() {
+            return unavailableReason;
+        },
+        markUnavailable,
         async append(chunk) {
-            if (closed)
+            if (closed || unavailableReason !== undefined)
                 return;
             try {
                 if (deps.appendFile) {
@@ -112,7 +177,9 @@ function createTeeHandle(logPath, deps) {
                 }
             }
             catch {
-                /* the log tee is a visibility nicety — a write failure never fails a job */
+                // A write failure never fails a job; it makes this attempt's transcript
+                // incomplete, which readers must be told rather than left to guess.
+                markUnavailable("append_failed");
             }
         },
         async close() {
@@ -146,7 +213,7 @@ export const MAX_SESSION_SCAN_CHARS = 2_000_000;
  * The DISTINCT `session_id` values present in a worker log (BAPI-793).
  *
  * The incident signature this exists to catch is two Claude sessions writing
- * into one worktree's single `.conductor/worker.log`. Every stream-json record a
+ * into one attempt's worker log. Every stream-json record a
  * worker emits carries its `session_id`, so one healthy job produces MANY
  * records and exactly ONE distinct id — which is why this counts DISTINCT ids
  * rather than occurrences. A count-based check would flag every normal job.
@@ -210,7 +277,7 @@ export function distinctWorkerLogSessionIds(logText) {
  */
 export function formatWorkerLogSessionInvariantWarning(sessionCount) {
     return (`worker log session invariant violated: ${sessionCount} distinct Claude sessions wrote to this ` +
-        "job's .conductor/worker.log, so more than one worker was active in this worktree. The " +
+        "attempt's .conductor worker log, so more than one worker was active in this worktree. The " +
         "worktree lock should have refused the second one — treat this as evidence it was bypassed " +
         "(a pre-existing stale lock, a worktree entered outside the executor, or a manual claude run).");
 }

package/build/executor/worktree-gc.js

@@ -10,6 +10,7 @@
  * never abort the whole sweep. All I/O is injected for offline unit testing.
  */
 import { listGitWorktrees, pathApiForExecutorPlatform, } from "./worktree-inspection.js";
+import { WORKER_LOG_ATTEMPT_FILE_RE } from "./worker-log.js";
 /** Idle cutoff: a worktree must be idle strictly longer than 24h to be eligible. */
 export const EXECUTOR_WORKTREE_GC_IDLE_MS = 24 * 60 * 60 * 1000;
 function conductorMarkerPaths(worktreePath, platform) {
@@ -17,30 +18,53 @@ function conductorMarkerPaths(worktreePath, platform) {
     const dir = pathApi.join(worktreePath, ".conductor");
     return {
         dir,
-        workerLog: pathApi.join(dir, "worker.log"),
         resultJson: pathApi.join(dir, "result.json"),
     };
 }
+/**
+ * The per-attempt worker logs in `.conductor` (BAPI-1330). Only names matching
+ * the stable attempt-log shape count; the retired fixed `worker.log` is never
+ * probed. A listing failure yields none — the other markers still apply.
+ */
+async function attemptLogPaths(dir, deps) {
+    if (!deps.listDir)
+        return [];
+    let names;
+    try {
+        names = await deps.listDir(dir);
+    }
+    catch {
+        return [];
+    }
+    const pathApi = pathApiForExecutorPlatform(deps.platform ?? process.platform);
+    return names.filter((name) => WORKER_LOG_ATTEMPT_FILE_RE.test(name)).map((name) => pathApi.join(dir, name));
+}
 /**
  * Conservatively identify an executor/conductor-managed worktree by the presence
- * of a `.conductor` directory, `.conductor/worker.log`, or `.conductor/result.json`.
+ * of a `.conductor` directory or `.conductor/result.json`.
  */
 export async function isExecutorManagedWorktree(worktreePath, deps) {
     const markers = conductorMarkerPaths(worktreePath, deps.platform ?? process.platform);
-    for (const marker of [markers.workerLog, markers.resultJson, markers.dir]) {
+    for (const marker of [markers.resultJson, markers.dir]) {
         if ((await deps.statMtimeMs(marker)) !== null)
             return true;
     }
     return false;
 }
 /**
- * Compute last activity as the NEWEST mtime among `.conductor/worker.log`,
- * `.conductor/result.json`, and the worktree directory itself. Returns `null`
+ * Compute last activity as the NEWEST mtime among the per-attempt worker logs
+ * in `.conductor` (the newest attempt log wins), `.conductor/result.json`, the
+ * `.conductor` directory, and the worktree directory itself. Returns `null`
  * when none can be stat'd (activity cannot be proven → the caller retains).
  */
 export async function getWorktreeLastActivityMs(worktreePath, deps) {
     const markers = conductorMarkerPaths(worktreePath, deps.platform ?? process.platform);
-    const candidates = [markers.workerLog, markers.resultJson, worktreePath];
+    const candidates = [
+        ...(await attemptLogPaths(markers.dir, deps)),
+        markers.resultJson,
+        markers.dir,
+        worktreePath,
+    ];
     let newest = null;
     for (const candidate of candidates) {
         const mtime = await deps.statMtimeMs(candidate);