@bridge_gpt/mcp-server 0.2.66 → 0.2.67

package/build/executor/worker-guard-hook.js

@@ -69,6 +69,24 @@ export function renderWorkerGuardReason(category, family) {
             "stdin-fed arguments hide what git will run. Use literal arguments instead; " +
             "for a commit message, write it to a file and run git commit -F <file>.");
     }
+    if (category === "workflow-entry" ||
+        category === "workflow-launch-skill" ||
+        category === "workflow-launch-shell" ||
+        category === "workflow-planner-tool") {
+        return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "A correction worker must not start a full workflow. Reading or editing files " +
+            "that mention a workflow is allowed; make the focused correction directly.");
+    }
+    if (category === "correction-context-invalid") {
+        return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "The correction context for this worker is not valid, so no tool call can be " +
+            "checked. Stop and report the launch problem.");
+    }
+    if (category === "correction-payload-invalid") {
+        return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "The tool call could not be read as a tool name with a tool input, so it cannot " +
+            "be checked. Retry with a well-formed call.");
+    }
     return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
         "This command family is restricted to the worker's own branch, worktree, and " +
         "read-only network access. Use a different approach and continue.");
@@ -780,6 +798,52 @@ function stripStdinPrefixOptions(argv) {
     }
     return argv.slice(i);
 }
+/** The workflow names a correction worker must never launch. */
+const WORKFLOW_NAMES = "implement-ticket|plan-ticket|idea-to-pr|review-and-implement";
+/**
+ * A slash-form workflow launch: the slash starts the text or follows whitespace, and
+ * the name ends at whitespace or the end. A file path such as
+ * `docs/claude/idea-to-pr.md` has neither, so it never matches.
+ */
+const WORKFLOW_SLASH_LAUNCH = new RegExp(`(?:^|\\s)/(?:bridge-)?(?:${WORKFLOW_NAMES})(?=\\s|$)`, "i");
+/** A bare skill or command name, with optional leading slash and `plugin:` prefix. */
+const WORKFLOW_NAME_EXACT = new RegExp(`^/?(?:[A-Za-z0-9_-]+:)?(?:bridge-)?(?:${WORKFLOW_NAMES})$`, "i");
+/** The token after `npx` that names the Claude CLI package. */
+const CLAUDE_PACKAGE_TOKEN = /^(?:@anthropic-ai\/)?claude(?:-code)?(?:@\S+)?$/;
+/** The argv after the Claude CLI name, or `undefined` when this is not a Claude launch. */
+function claudeLaunchArgs(argv) {
+    const base = path.basename(argv[0] ?? "");
+    if (base === "claude")
+        return argv.slice(1);
+    if (base === "npx") {
+        const index = argv.findIndex((token, i) => i > 0 && CLAUDE_PACKAGE_TOKEN.test(token));
+        return index === -1 ? undefined : argv.slice(index + 1);
+    }
+    return undefined;
+}
+/**
+ * Is this a correction-mode Claude print run that launches a workflow (or that cannot
+ * be read well enough to rule one out)?
+ *
+ * Runs on tokenized, de-quoted argv, so a quoted prompt is one plain token. The whole
+ * argv is scanned for the print flag and for a workflow slash launch, because the
+ * prompt may sit anywhere among the options. A print run in a segment the tokenizer
+ * marked unsafe denies without trying to resolve the substitution.
+ */
+function isClaudeWorkflowPrintLaunch(segment) {
+    const args = claudeLaunchArgs(segment.argv);
+    if (args === undefined)
+        return false;
+    const printing = args.some((token) => token === "-p" || token === "--print" || token.startsWith("--print="));
+    if (!printing)
+        return false;
+    if (segment.unsafe)
+        return true;
+    return args.some((token) => {
+        const value = token.startsWith("--print=") ? token.slice("--print=".length) : token;
+        return WORKFLOW_SLASH_LAUNCH.test(value);
+    });
+}
 /** Evaluate one already-tokenized simple command. */
 function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = false) {
     const argv = unwrapTransparentPrefixes(segment.argv);
@@ -828,6 +892,9 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
         return evaluateSimpleCommand({ argv: rest, unsafe: segment.unsafe }, ctx, payloadCwd, depth + 1, true);
     }
     segment = { argv, unsafe: segment.unsafe };
+    if (ctx.correctionEnforced && isClaudeWorkflowPrintLaunch(segment)) {
+        return { kind: "deny", category: "workflow-launch-shell", family: "workflow" };
+    }
     const family = classify(executable);
     if (family === null)
         return { kind: "allow" };
@@ -865,6 +932,55 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
     }
     return { kind: "allow" };
 }
+function workflowDeny(category) {
+    return { kind: "deny", category, family: "workflow" };
+}
+/**
+ * Tools that read or change files. Their path and pattern fields name files, and a
+ * file named after a workflow is not a workflow launch, so they are never matched.
+ */
+const FILE_TOOLS = new Set(["Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Grep", "Glob"]);
+/** The fields of each invocation tool that can carry a workflow launch. */
+const INVOCATION_FIELDS = {
+    Skill: ["skill", "args"],
+    Task: ["prompt", "description"],
+    Agent: ["prompt", "description"],
+    SlashCommand: ["command"],
+};
+/** An `mcp__` tool whose name is a planner or recipe entry point. */
+const PLANNER_TOOL_NAME = /(?:request_plan_generation|get_pipeline_recipe|plan_ticket|implement_ticket)/i;
+/**
+ * Correction-mode dispatch by tool role. Returns a decision for a file tool, an
+ * invocation tool, a planner tool, or an unknown role, and `undefined` for `Bash`,
+ * which the caller evaluates as a shell command.
+ */
+function evaluateCorrectionToolRole(toolName, input) {
+    if (FILE_TOOLS.has(toolName))
+        return { kind: "allow" };
+    if (toolName === "Bash")
+        return undefined;
+    const fields = INVOCATION_FIELDS[toolName];
+    if (fields !== undefined) {
+        for (const field of fields) {
+            const value = input[field];
+            if (value === undefined)
+                continue;
+            if (typeof value !== "string")
+                return workflowDeny("workflow-launch-skill");
+            const nameField = toolName === "Skill" ? field === "skill" : toolName === "SlashCommand";
+            if (WORKFLOW_SLASH_LAUNCH.test(value) || (nameField && WORKFLOW_NAME_EXACT.test(value.trim().split(/\s+/)[0] ?? ""))) {
+                return workflowDeny("workflow-launch-skill");
+            }
+        }
+        return { kind: "allow" };
+    }
+    if (/^mcp__/i.test(toolName) && PLANNER_TOOL_NAME.test(toolName)) {
+        return workflowDeny("workflow-planner-tool");
+    }
+    // Any other role: only an explicit workflow launch in a string argument denies.
+    const args = Object.values(input).filter((v) => typeof v === "string").join(" ");
+    return WORKFLOW_SLASH_LAUNCH.test(args) ? workflowDeny("workflow-entry") : undefined;
+}
 /**
  * Evaluate a parsed PreToolUse payload.
  *
@@ -878,46 +994,32 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
  * governed here.
  */
 export function evaluateWorkerGuardPayload(payload, ctx) {
-    const root = asRecord(payload);
     if (ctx.correctionContextInvalid)
-        return { kind: "deny", category: "workflow-entry", family: "workflow" };
-    if (root === undefined)
-        return ctx.correctionEnforced
-            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
-            : { kind: "malformed" };
+        return workflowDeny("correction-context-invalid");
+    const root = asRecord(payload);
+    if (root === undefined) {
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    }
     const toolName = root.tool_name ?? root.toolName;
-    if (typeof toolName !== "string")
-        return ctx.correctionEnforced
-            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
-            : { kind: "malformed" };
+    if (typeof toolName !== "string") {
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    }
     const input = asRecord(root.tool_input ?? root.toolInput);
     if (ctx.correctionEnforced) {
         if (input === undefined)
-            return { kind: "deny", category: "workflow-entry", family: "workflow" };
-        const args = Object.values(input).filter((v) => typeof v === "string").join(" ");
-        const fullEntry = /(?:^|\s|\/)\/?(?:bridge-)?(?:implement-ticket|plan-ticket|idea-to-pr|review-and-implement)(?:\s|$|\.)/i;
-        const recipePath = /(?:commands\/src|\.claude\/commands|\.cursor\/commands|pipelines)\/(?:implement-ticket|plan-ticket)(?:\.md|\.json)?/i;
-        const plannerTool = /(?:request_plan_generation|get_pipeline_recipe|plan_ticket|implement_ticket)/i;
-        if (recipePath.test(args) || fullEntry.test(args) ||
-            (plannerTool.test(toolName) && toolName !== "Bash")) {
-            return { kind: "deny", category: "workflow-entry", family: "workflow" };
-        }
-        if (/^(?:Task|Agent|Skill|SlashCommand|mcp__)/i.test(toolName) &&
-            (fullEntry.test(args) || plannerTool.test(args))) {
-            return { kind: "deny", category: "workflow-entry", family: "workflow" };
-        }
+            return workflowDeny("correction-payload-invalid");
+        const decision = evaluateCorrectionToolRole(toolName, input);
+        if (decision !== undefined)
+            return decision;
     }
     if (toolName !== "Bash")
         return { kind: "allow" };
     if (input === undefined)
-        return ctx.correctionEnforced
-            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
-            : { kind: "malformed" };
+        return { kind: "malformed" };
     const command = input.command;
-    if (typeof command !== "string")
-        return ctx.correctionEnforced
-            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
-            : { kind: "malformed" };
+    if (typeof command !== "string") {
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    }
     const rawCwd = root.cwd ?? input.cwd;
     const payloadCwd = typeof rawCwd === "string" ? rawCwd : undefined;
     for (const segment of tokenizeShellCommand(command)) {
@@ -934,9 +1036,11 @@ export function evaluateWorkerGuardPayload(payload, ctx) {
  * exception: the binary's job is to emit one bounded line and get out of the way.
  */
 export function evaluateWorkerGuardInput(raw, ctx) {
-    const unreadable = () => ctx.correctionEnforced || ctx.correctionContextInvalid
-        ? { kind: "deny", category: "workflow-entry", family: "workflow" }
-        : { kind: "malformed" };
+    const unreadable = () => {
+        if (ctx.correctionContextInvalid)
+            return workflowDeny("correction-context-invalid");
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    };
     if (typeof raw !== "string")
         return unreadable();
     if (raw.length > WORKER_GUARD_MAX_PAYLOAD_BYTES)

package/build/executor/worktree.js

@@ -10,7 +10,8 @@ import { fetchAndResolveBaseSha, probeClaudeReviewWorkflowDrift, resolveReposito
 // BAPI-941: the shared drift diagnostic formatter (a leaf module — no cycle).
 import { formatClaudeReviewWorkflowDriftDiagnostic } from "../claude-review-workflow-drift.js";
 import { commandSucceeded } from "../start-tickets-prereqs.js";
-import { createWorktreeForTicket } from "../worktree-core.js";
+import { createWorktreeForTicket, provePriorHeadLineage } from "../worktree-core.js";
+import { findWorktreeByBranch, listGitWorktrees } from "./worktree-inspection.js";
 import { provisionCommandsForWorktree } from "../command-provisioning.js";
 /**
  * Resolve the branch for a real spawn job: `expected_branch` wins; else
@@ -252,6 +253,13 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
     // is neither), and it never contributes to the fail-CLOSED base-resolution
     // decision above.
     await emitExecutorWorkflowDriftAdvisory(deps, options.baseBranch);
+    // BAPI-1367: a retry of an `implement` job with a server-minted prior head
+    // resumes its own branch instead of being refused as a stale leftover. The
+    // gate lives HERE, not in the shared primitive, which learns no job types.
+    const priorHeadSha = eligiblePriorHead(job, policy);
+    if (priorHeadSha !== null) {
+        return ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, options, deps);
+    }
     const row = await createWorktreeForTicket(toWorktreeCoreDeps(deps), key, { [key]: branch }, options.worktrunkBinary, baseSha, guardStaleWorktree, {
         alignExistingBranchTo: baseSha,
         verifyHeadMatches: baseSha,
@@ -268,3 +276,76 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
     }
     return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
 }
+/**
+ * BAPI-1367: the prior head a worktree policy may act on, or `null`. Requires an
+ * `implement` job on a real retry and a syntactically valid full SHA; anything
+ * else keeps the ordinary fresh-dispatch behavior.
+ */
+function eligiblePriorHead(job, policy) {
+    if (policy.reuseExistingBranch === true)
+        return null;
+    if (job.job_type !== "implement")
+        return null;
+    if (typeof job.attempt_count !== "number" || job.attempt_count <= 1)
+        return null;
+    const head = policy.priorAttemptHeadSha;
+    return typeof head === "string" && FULL_SHA_PATTERN.test(head) ? head : null;
+}
+/**
+ * BAPI-1367: prepare the worktree for a retry that resumes prior-attempt work.
+ *
+ * Non-destructive by construction: no `alignExistingBranchTo`, no
+ * `verifyHeadMatches: baseSha`, no reset-based freshen, no `git clean -fd`. The
+ * shared primitive proves lineage against the resolved base and refuses before
+ * any mutation otherwise.
+ *
+ * When the worktree is missing it is recreated from the pushed branch, so
+ * `origin/<branch>` is fetched first and its lineage is proven here as well as
+ * (when a local branch exists) the local tip's lineage in the primitive —
+ * recreation may only use a remote source that passes. A conflicting ref refuses
+ * without cleanup. The result says plainly whether prior uncommitted files could
+ * survive.
+ */
+async function ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, options, deps) {
+    const entries = await listGitWorktrees(deps.runCommand, deps.cwd);
+    const retained = findWorktreeByBranch(entries, branch) !== undefined;
+    const coreDeps = toWorktreeCoreDeps(deps);
+    const policy = { priorHeadSha, baseRef: baseSha };
+    if (!retained) {
+        // Recreation reads origin/<branch>; make sure that ref is current and proven.
+        const fetch = await deps.runCommand("git", ["fetch", "origin", branch], { cwd: deps.cwd });
+        if (!commandSucceeded(fetch)) {
+            const reason = (fetch.stderr || fetch.stdout || "").trim();
+            return {
+                ok: false,
+                error: `cannot resume prior-attempt work on '${branch}': git fetch origin ${branch} failed` +
+                    `${reason ? `: ${reason}` : ""}`,
+            };
+        }
+        const remote = await provePriorHeadLineage(coreDeps, branch, policy, "origin_branch");
+        if (!remote.ok) {
+            return {
+                ok: false,
+                error: `stale worktree guard: pushed branch 'origin/${branch}' cannot be resumed: ${remote.reason}`,
+            };
+        }
+    }
+    const row = await createWorktreeForTicket(coreDeps, key, { [key]: branch }, options.worktrunkBinary, baseSha, true, { allowedPriorHead: policy });
+    if (row.status !== "created" || typeof row.path !== "string") {
+        return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
+    }
+    const headSha = await resolveCommitSha(deps, row.path, "HEAD");
+    if (headSha === null) {
+        return { ok: false, error: `failed to resolve HEAD of the resumed worktree for '${branch}'` };
+    }
+    return {
+        ok: true,
+        worktreePath: row.path,
+        branch,
+        expectedHeadSha: headSha,
+        priorWork: {
+            kind: retained ? "retained_worktree" : "recreated_from_pushed_branch",
+            priorHeadSha,
+        },
+    };
+}