@bridge_gpt/mcp-server 0.2.65 → 0.2.67

package/build/worktree-core.js

@@ -96,6 +96,8 @@ function pickWorktreePathField(parsed) {
     }
     return undefined;
 }
+/** A full 40-character hex object name. */
+const FULL_SHA_PATTERN = /^[0-9a-f]{40}$/i;
 /**
  * The remediation sentence for a branch left over by a prior FAILED run.
  * Unchanged since the guard was introduced.
@@ -111,18 +113,115 @@ function staleLeftoverRemedy(branch, baseRef) {
  *
  * Names the `pr_not_attached` gate observation so the executor refusal and the
  * reconciler's own state are one searchable vocabulary, points at attachment, and
- * states plainly that the two remedies above destroy completed work. It must not
+ * states plainly that the two remedies above destroy pushed work. It must not
  * contain the words "delete" or "rebase" at all: an operator scanning a wall of
  * job output for the next command is exactly who lost work last time.
  */
 function unattachedSuccessRemedy(branch) {
-    return (`it carries the commits of a SUCCEEDED implement whose pull request was never attached ` +
+    return (`it carries the pushed commits of an implement whose pull request was never attached ` +
         `(implement gate observation: pr_not_attached). Refusing to reuse the worktree — but this ` +
-        `branch is finished work, not a leftover. Open or attach a pull request from '${branch}' and ` +
-        `let the reconciler bind it. Do NOT remove or re-write the branch: either would destroy a ` +
-        `completed implementation.`);
+        `branch is pushed work, not a leftover; whether its required work is finished or its checks ` +
+        `passed is not established by this observation. Open or attach a pull request from ` +
+        `'${branch}' and let the reconciler bind it. Do NOT remove or re-write the branch: either ` +
+        `would destroy pushed work.`);
 }
-export async function isExistingBranchSafeToReuse(deps, branch, baseStartPoint, classification = "unknown") {
+/**
+ * BAPI-1367: the remedy for a branch that holds pushed work from an EARLIER
+ * attempt of this same job. Leads with the work state, uses the short head only
+ * as supporting evidence, and points at inspection and recovery. It must not
+ * contain the words "delete" or "rebase": an operator scanning job output for the
+ * next command is exactly who would lose this work.
+ */
+function priorAttemptRemedy(branch, priorHeadSha) {
+    const evidence = priorHeadSha ? ` (recorded head ${priorHeadSha.slice(0, 12)})` : "";
+    return (`it holds pushed work from this job's prior attempt${evidence}. ` +
+        `Refusing to reuse the worktree automatically because its lineage could not be fully proven; ` +
+        `this branch is prior work, not a leftover. Inspect '${branch}' and recover from it; ` +
+        `do not discard it.`);
+}
+/** Exit status 1 is Git's definite "not an ancestor"; anything else is not proof. */
+async function isAncestor(deps, ancestor, descendant) {
+    const result = await deps.runCommand("git", ["merge-base", "--is-ancestor", ancestor, descendant], { cwd: deps.cwd });
+    if (commandSucceeded(result))
+        return "yes";
+    return result.exitCode === 1 ? "no" : "unknown";
+}
+async function resolveCommit(deps, ref) {
+    const result = await deps.runCommand("git", ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], { cwd: deps.cwd });
+    if (!commandSucceeded(result))
+        return null;
+    const sha = result.stdout.trim();
+    return FULL_SHA_PATTERN.test(sha) ? sha : null;
+}
+/**
+ * BAPI-1367: prove that `branch` may be resumed from `policy.priorHeadSha`.
+ *
+ * Selects exactly ONE tip: the local branch when it exists (and only it — a valid
+ * `origin/<branch>` never substitutes for a failing local branch), else
+ * `origin/<branch>`. That tip must equal or descend from the prior head, and the
+ * prior head must NOT already be an ancestor of the resolved base. Every inability
+ * to prove any of this refuses. Only read-only Git is run here.
+ */
+export async function provePriorHeadLineage(deps, branch, policy, only) {
+    const refuse = (reason, containsPriorHead = false) => ({
+        ok: false,
+        reason,
+        containsPriorHead,
+    });
+    if (typeof policy.priorHeadSha !== "string" || !FULL_SHA_PATTERN.test(policy.priorHeadSha)) {
+        return refuse("no usable prior-attempt head was supplied");
+    }
+    const prior = await resolveCommit(deps, policy.priorHeadSha);
+    if (prior === null) {
+        return refuse(`the prior-attempt head ${policy.priorHeadSha.slice(0, 12)} is not present in this checkout`);
+    }
+    // `only: "origin_branch"` judges the pushed ref alone, for a caller that must
+    // recreate a worktree from it even though a local branch also exists.
+    const local = only === "origin_branch" ? false : await branchExists(deps, branch);
+    const selected = await resolveCommit(deps, local ? `refs/heads/${branch}` : `refs/remotes/origin/${branch}`);
+    if (selected === null) {
+        return refuse(`${local ? "its local tip" : `origin/${branch}`} could not be resolved`);
+    }
+    const lineage = await isAncestor(deps, prior, selected);
+    if (lineage !== "yes") {
+        return refuse(`its tip does not contain the prior-attempt head ${prior.slice(0, 12)}`);
+    }
+    const inBase = await isAncestor(deps, prior, policy.baseRef);
+    if (inBase === "yes") {
+        return refuse(`the prior-attempt head ${prior.slice(0, 12)} is already part of the base, so it is not unmerged work from this job`, true);
+    }
+    if (inBase === "unknown") {
+        return refuse(`whether the prior-attempt head ${prior.slice(0, 12)} is part of the base could not be established`, true);
+    }
+    return { ok: true, source: local ? "local_branch" : "origin_branch" };
+}
+export async function isExistingBranchSafeToReuse(deps, branch, baseStartPoint, classification = "unknown", allowedPriorHead) {
+    // BAPI-1367: with a caller-authorized prior head, the ONLY way to reuse a
+    // branch that carries commits beyond base is explicit lineage proof. A refusal
+    // here is final: the legacy base-ancestry shortcut can never turn it into a
+    // base alignment. A refused branch whose history holds the recorded head gets
+    // the calm own-prior remedy; one without that history keeps the ordinary
+    // stale-branch text when the legacy guard also refuses it.
+    if (allowedPriorHead !== undefined) {
+        const proof = await provePriorHeadLineage(deps, branch, allowedPriorHead);
+        if (proof.ok)
+            return { safe: true, resume: proof.source };
+        if (proof.containsPriorHead) {
+            return {
+                safe: false,
+                reason: `existing branch '${branch}' ${priorAttemptRemedy(branch, allowedPriorHead.priorHeadSha)} ` +
+                    `(${proof.reason})`,
+            };
+        }
+        // Only a LOCAL branch has a legacy verdict to keep; an origin-only branch is
+        // judged by the proof alone.
+        if (await branchExists(deps, branch)) {
+            const legacy = await isExistingBranchSafeToReuse(deps, branch, baseStartPoint, classification);
+            if (!legacy.safe)
+                return legacy;
+        }
+        return { safe: false, reason: `existing branch '${branch}' cannot be resumed: ${proof.reason}` };
+    }
     let baseRef = baseStartPoint;
     const originRef = `origin/${baseStartPoint}`;
     const originExists = await deps.runCommand("git", ["rev-parse", "--verify", "--quiet", originRef], { cwd: deps.cwd });
@@ -137,7 +236,9 @@ export async function isExistingBranchSafeToReuse(deps, branch, baseStartPoint,
     // unchanged). Only the diagnosis and the remedy differ.
     const remedy = classification === "succeeded_pr_not_attached"
         ? unattachedSuccessRemedy(branch)
-        : staleLeftoverRemedy(branch, baseRef);
+        : classification === "prior_attempt_of_this_job"
+            ? priorAttemptRemedy(branch)
+            : staleLeftoverRemedy(branch, baseRef);
     return {
         safe: false,
         reason: `existing branch '${branch}' is not an ancestor of ${baseRef}; ${remedy}`,
@@ -272,11 +373,28 @@ export async function createWorktreeForTicket(deps, key, branchOverrides, worktr
     const branch = resolveBranchForTicket(key, branchOverrides);
     try {
         const exists = await branchExists(deps, branch);
+        // BAPI-1367: a caller-authorized prior head decides reuse by lineage proof
+        // alone, before ANY branch mutation (no switch, reset, clean, or alignment).
+        // It applies whether or not a local branch exists: with none, the proof reads
+        // `origin/<branch>` and the worktree is cut from exactly that ref.
+        let priorResume;
+        if (behavior.allowedPriorHead !== undefined) {
+            const safety = await isExistingBranchSafeToReuse(deps, branch, baseStartPoint, "prior_attempt_of_this_job", behavior.allowedPriorHead);
+            if (!safety.safe || safety.resume === undefined) {
+                return {
+                    key,
+                    branch,
+                    status: "create-failed",
+                    error: `stale worktree guard: ${safety.reason ?? "prior-attempt lineage could not be proven"}`,
+                };
+            }
+            priorResume = safety.resume;
+        }
         // F7 (conductor dispatch): refuse a stale pre-existing branch rather than
         // silently building the worker on leftover code. BAPI-527: the ancestry
         // check compares against the SAME effective base start point (branch name or
         // fetched SHA) that a NEW branch would be cut from below.
-        if (exists && guardStaleWorktree) {
+        if (exists && guardStaleWorktree && priorResume === undefined) {
             const safety = await isExistingBranchSafeToReuse(deps, branch, baseStartPoint, behavior.staleBranchClassification ?? "unknown");
             if (!safety.safe) {
                 return {
@@ -287,7 +405,10 @@ export async function createWorktreeForTicket(deps, key, branchOverrides, worktr
                 };
             }
         }
-        const args = buildWtSwitchArgs(branch, exists, baseStartPoint);
+        // BAPI-1367: an origin-only resume is cut from exactly the ref whose lineage
+        // was just proven, never from whatever start point the caller supplied.
+        const startPoint = priorResume === "origin_branch" ? `origin/${branch}` : baseStartPoint;
+        const args = buildWtSwitchArgs(branch, exists, startPoint);
         const result = await deps.runCommand(worktrunkBinary, args, { cwd: deps.cwd });
         if (!commandSucceeded(result)) {
             const reason = (result.stderr || result.stdout || "").trim();
@@ -299,6 +420,12 @@ export async function createWorktreeForTicket(deps, key, branchOverrides, worktr
             };
         }
         const worktreePath = extractWorktreePath(result.stdout, deps.cwd, deps.platform);
+        // BAPI-1367: a lineage-approved resume stops here. Retained commits and
+        // uncommitted files ARE the work, so none of the destructive steps below
+        // (reset, clean, base verification) may run.
+        if (priorResume !== undefined) {
+            return { key, branch, status: "created", path: worktreePath, priorHeadResume: priorResume };
+        }
         // BAPI-528: freshen a REUSED existing branch onto the pushed ref. A new
         // branch was already cut from `baseStartPoint` (recovery sets that to
         // `origin/<branch>`), so this only applies when the local branch pre-existed.