@bridge_gpt/mcp-server 0.2.65 → 0.2.67

package/build/bridge-config.js

@@ -11,6 +11,7 @@
  * touching the filesystem or invoking real `git`.
  */
 import path from "path";
+import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
 /**
  * True if a string contains any ASCII control character (0x00-0x1f or 0x7f).
  * Keeps identifiers path-safe and free of anything that could smuggle into a
@@ -307,6 +308,109 @@ export function parseBridgeConfigToml(text) {
     return { ok: true, manifest: { repoName, mcp: cleaned } };
 }
 // ---------------------------------------------------------------------------
+// Teammate notice, representability, and lossless repo_name rewrite (BAPI-1318)
+// ---------------------------------------------------------------------------
+/**
+ * The teammate notice carried in the header of every scaffolded `.bridge/config`,
+ * and inserted by a consented repair when an older file lacks it. A teammate who
+ * clones a committed project gets this file but no MCP config (`.mcp.json` is
+ * gitignored), so this is the one place that tells them to run install.
+ *
+ * ONE source for both writers ({@link rewriteBridgeConfigRepoName} and
+ * `buildBridgeConfigManifest` in `init.ts`), and the exact-text detector for "this
+ * file already carries the notice", so the two can never drift.
+ */
+export const BRIDGE_CONFIG_TEAMMATE_NOTICE_LINES = [
+    "# Teammates: this file does not connect your editor. Run",
+    `# "npx -y ${MCP_PACKAGE_NAME} install" once in this folder.`,
+];
+/**
+ * Whether `name` can be written as `repo_name = "<name>"` and read back unchanged
+ * by {@link parseBridgeConfigToml}. `validateRepoName()` is deliberately left as
+ * it is (it gates every install name input); this is the stricter,
+ * manifest-only check the scaffold, post-rename, and repair writers all apply.
+ * The quoted-string subset has no escapes, so an embedded `"` or `\` is refused,
+ * and surrounding whitespace is refused because the parser would trim it away.
+ */
+export function validateBridgeConfigRepoNameRepresentability(name) {
+    const validated = validateRepoName(name);
+    if (!validated.ok)
+        return validated;
+    if (validated.value !== name) {
+        return { ok: false, error: "repo_name must not have leading or trailing whitespace" };
+    }
+    if (validated.value.includes('"')) {
+        return { ok: false, error: "repo_name cannot contain a double quote in .bridge/config" };
+    }
+    if (validated.value.includes("\\")) {
+        return { ok: false, error: "repo_name cannot contain a backslash in .bridge/config" };
+    }
+    return validated;
+}
+/**
+ * Rewrite ONLY the quoted value of the single top-level `repo_name` line, and add
+ * the teammate notice at the top when its exact lines are absent. Every other
+ * byte — comments, blank lines, each `[[mcp]]` block, the `repo_name` line's own
+ * indentation and spacing around `=`, and the line endings — is preserved.
+ *
+ * Pure. The input is parsed first (a malformed file is refused, never rewritten)
+ * and the output is parsed again: it must carry the new name and the same ordered
+ * `mcp` list, or the rewrite is refused. Refusal messages never echo file content.
+ */
+export function rewriteBridgeConfigRepoName(text, newName) {
+    const representable = validateBridgeConfigRepoNameRepresentability(newName);
+    if (!representable.ok) {
+        return { ok: false, kind: "unrepresentable-name", error: representable.error };
+    }
+    const before = parseBridgeConfigToml(text);
+    if (!before.ok) {
+        return { ok: false, kind: "parse-error", error: before.error };
+    }
+    const eol = text.includes("\r\n") ? "\r\n" : "\n";
+    const lines = text.split("\n");
+    // Locate the one top-level repo_name line: the parse above proved there is
+    // exactly one, and that it sits before the first [[mcp]] header.
+    let repoLine = -1;
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        if (trimmed === "[[mcp]]")
+            break;
+        if (trimmed.startsWith("#") || trimmed.length === 0)
+            continue;
+        const eq = trimmed.indexOf("=");
+        if (eq !== -1 && trimmed.slice(0, eq).trim() === "repo_name") {
+            repoLine = i;
+            break;
+        }
+    }
+    if (repoLine === -1) {
+        return { ok: false, kind: "verification-failed", error: "Could not locate the repo_name line" };
+    }
+    const original = lines[repoLine];
+    const open = original.indexOf('"', original.indexOf("=") + 1);
+    const close = original.lastIndexOf('"');
+    if (open === -1 || close <= open) {
+        return { ok: false, kind: "verification-failed", error: "Could not locate the repo_name value" };
+    }
+    lines[repoLine] = `${original.slice(0, open + 1)}${representable.value}${original.slice(close)}`;
+    let next = lines.join("\n");
+    const noticePresent = BRIDGE_CONFIG_TEAMMATE_NOTICE_LINES.every((line) => text.split("\n").some((existing) => existing.replace(/\r$/, "") === line));
+    if (!noticePresent) {
+        next = BRIDGE_CONFIG_TEAMMATE_NOTICE_LINES.map((line) => `${line}${eol}`).join("") + next;
+    }
+    const after = parseBridgeConfigToml(next);
+    if (!after.ok ||
+        after.manifest.repoName !== representable.value ||
+        JSON.stringify(after.manifest.mcp) !== JSON.stringify(before.manifest.mcp)) {
+        return {
+            ok: false,
+            kind: "verification-failed",
+            error: "The rewritten .bridge/config did not parse back to the same manifest",
+        };
+    }
+    return { ok: true, text: next, changed: next !== text, noticeAdded: !noticePresent };
+}
+// ---------------------------------------------------------------------------
 // Reading + identity resolution
 // ---------------------------------------------------------------------------
 /** Absolute path to a project root's committed manifest. */

package/build/codex-bridge-profile.js

@@ -18,6 +18,15 @@ export const BRIDGE_WORKFLOW_TOOLS = [
     "update_jira_status", "config_field", "resolve_ci_checks", "poll_ci_checks",
     "wait_for_ci_checks",
 ];
+// These bounded workflow writes are required to complete review and implementation.
+// `auto` can route their repository-derived payloads to Auto-review, which can
+// reject the Jira publish or phase ledger write despite the opted-in profile.
+// Keep the general `attachment` tool on `auto`: it also supports delete/replace.
+const PREAPPROVED_WORKFLOW_TOOLS = new Set([
+    "capture_review_decisions",
+    "publish_reviewed_attachment",
+    "record_phase_result",
+]);
 export function codexProfilePaths(home) {
     return {
         profile: path.join(home, PROFILE_FILE),
@@ -31,7 +40,7 @@ export function renderBridgeCodexProfile(key) {
         `# Applies only when selected with codex --profile ${BRIDGE_CODEX_PROFILE}.`,
         ...BRIDGE_WORKFLOW_TOOLS.flatMap((tool) => [
             `[mcp_servers.${key}.tools.${tool}]`,
-            'approval_mode = "auto"',
+            `approval_mode = "${PREAPPROVED_WORKFLOW_TOOLS.has(tool) ? "approve" : "auto"}"`,
             "",
         ]),
     ].join("\n") + "\n";