@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/epic-implementer-bundle-cli.js

@@ -6,8 +6,8 @@
  * inside `build/pipelines.generated.js`. `mcp_server/src/` does not exist there,
  * so an instruction that told the agent to "call `validateConductorBundleInputs`"
  * would be referencing a path only this repository has. This subcommand is the
- * reachable surface, mirroring how `store-and-approve-epic-plan.md` invokes
- * `setup-epic` rather than hand-rolling HTTP calls.
+ * reachable surface, the same way `setup-epic` is a command rather than
+ * hand-rolled HTTP calls.
  *
  * It holds no policy of its own: it parses argv, delegates to
  * `conductor-bundle-artifacts.ts`, and prints a JSON envelope. All I/O is behind

package/build/epic-workarounds-path.js

@@ -0,0 +1,39 @@
+/**
+ * The one TypeScript spelling of the Epic Implementer workaround folder (BAPI-1399).
+ *
+ * A worker that defers a MINOR requirement behind a guarded workaround commits a
+ * record at `.bridge/epic-workarounds/<TICKET>.md` on its ticket branch. While
+ * that folder exists on the epic head, the integration pull request stays in
+ * draft: the reconciler's coordinator withholds `mark_ready`
+ * (`api/library/epic_implementer/integration_completion.py`), and the local actor
+ * re-checks the folder before it takes a pull request out of draft
+ * (`executor/integration-job.ts`). Nothing about a workaround is stored in the
+ * database or in run state; the hold is worked out from the folder at the exact
+ * epic head every time.
+ *
+ * Python declares the same value once, beside its directory-listing helper in
+ * `api/library/github/github_webhooks_lib.py`. The static test
+ * `tests/pytest/static/test_epic_workarounds_path_pin.py` fails if any consumer
+ * spells the path differently or drops it.
+ */
+import { TICKET_KEY_PATTERN } from "./ticket-key-utils.js";
+/** The workaround folder, repository-relative, with its trailing slash. */
+export const EPIC_WORKAROUNDS_DIR = ".bridge/epic-workarounds/";
+/** The folder without its trailing slash: the form a contents API path takes. */
+export const EPIC_WORKAROUNDS_DIR_PATH = EPIC_WORKAROUNDS_DIR.slice(0, -1);
+/** A ticket key: the canonical grammar the Epic Implementer accepts everywhere else. */
+const TICKET_KEY_RE = TICKET_KEY_PATTERN;
+/** Upper bound on a ticket key, so a pasted blob is never a path segment. */
+const MAX_TICKET_KEY_CHARS = 64;
+/**
+ * The record path for one ticket, `.bridge/epic-workarounds/<TICKET>.md`, or
+ * `null` when the key is not a valid ticket key. A key is never sanitized into a
+ * path: anything that is not exactly a key is refused.
+ */
+export function epicWorkaroundRecordPath(ticketKey) {
+    if (typeof ticketKey !== "string")
+        return null;
+    if (ticketKey.length > MAX_TICKET_KEY_CHARS || !TICKET_KEY_RE.test(ticketKey))
+        return null;
+    return `${EPIC_WORKAROUNDS_DIR}${ticketKey}.md`;
+}

package/build/executor/cli.js

@@ -22,6 +22,35 @@ import { startExecutorSleepAssertion } from "./platform.js";
 import { runExecutor } from "./runner.js";
 import { runExecutorWatchCli } from "./watch-cli.js";
 import { removeRunExecutorRecordIfOwned } from "../executor-launch.js";
+/** Register an optional parent watch without making the timer a process owner. */
+export function registerExecutorParentWatch(pid, onGone, seams = {
+    setInterval: (callback, ms) => setInterval(callback, ms),
+    clearInterval: (handle) => clearInterval(handle),
+    signalZero: (parentPid) => process.kill(parentPid, 0),
+}) {
+    let disposed = false;
+    let notified = false;
+    const timer = seams.setInterval(() => {
+        if (disposed || notified)
+            return;
+        try {
+            seams.signalZero(pid);
+        }
+        catch (error) {
+            if (error.code === "ESRCH") {
+                notified = true;
+                onGone();
+            }
+        }
+    }, 5_000);
+    timer.unref?.();
+    return () => {
+        if (disposed)
+            return;
+        disposed = true;
+        seams.clearInterval(timer);
+    };
+}
 /** Fixed executor timing/behavior defaults. */
 const DEFAULT_POLL_INTERVAL_MS = 15_000;
 const DEFAULT_HEARTBEAT_INTERVAL_MS = 60_000;
@@ -37,9 +66,10 @@ const DEFAULT_JOB_TIMEOUT_SECONDS = 20 * 60;
 export const DEFAULT_MAX_CONCURRENT = 1;
 export function getExecutorUsage() {
     return [
-        "Usage: mcp-server executor --repo <name> [--repo <name> ...] [options]",
+        "Usage: mcp-server executor --repo <name> [--repo <name> ...]",
+        "                           (--epic-run-id <id> | --repo-wide) [options]",
         "",
-        "Runs the Epic Conductor v2 local executor: poll → claim → spawn → heartbeat.",
+        "Runs the Epic Implementer local executor: poll → claim → spawn → heartbeat.",
         "",
         "Options:",
         "  --repo <name>                 Repo to serve (repeatable).",
@@ -421,6 +451,7 @@ export async function runExecutorCli(argv, overrides = {}) {
     const createIntegrationClient = overrides.createIntegrationClient ?? createIntegrationActionHttpClient;
     const runnerSeams = {
         onSignal: overrides.onSignal ?? defaultSignalRegistrar,
+        watchParent: registerExecutorParentWatch,
         // BAPI-1279 — on a terminal exit, delete the launcher record drive-epic
         // wrote for this run, but only if it still names THIS instance (its id, and
         // this process or the relay that started it). Advisory: a failure here

package/build/executor/completion-contract.js

@@ -53,6 +53,37 @@ export const SUPPORTED_COMPLETION_RUNTIME = {
     platform: "darwin-arm64",
     event_schema: "claude-stream-json.lifecycle.v1",
 };
+/** Oldest Claude CLI version whose lifecycle events were measured. */
+export const MIN_CLI_VERSION = "2.1.282";
+/** The four platform ids `<process.platform>-<process.arch>` the executor can produce. */
+export const SUPPORTED_PLATFORMS = ["darwin-arm64", "darwin-x64", "linux-x64", "linux-arm64"];
+/** Names the lifecycle parser version. A constant, never a probed value. */
+export const EVENT_SCHEMA = "claude-stream-json.lifecycle.v1";
+const CLI_VERSION_RE = /^(0|[1-9][0-9]{0,3})\.(0|[1-9][0-9]{0,3})\.(0|[1-9][0-9]{0,5})(?: \(Claude Code\))?$/;
+/**
+ * Parse `major.minor.patch` with an optional exact ` (Claude Code)` suffix into its
+ * numeric triple. Prereleases, whitespace, non-numeric segments, leading zeros, and
+ * non-strings are `null`. Mirror of `normalize_cli_version` in the Python contract.
+ */
+export function parseCliVersion(value) {
+    if (typeof value !== "string")
+        return null;
+    const match = CLI_VERSION_RE.exec(value);
+    return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
+/** The normalized `major.minor.patch` text, or `null` when the version is not strict. */
+export function normalizeCliVersion(value) {
+    const parsed = parseCliVersion(value);
+    return parsed ? parsed.join(".") : null;
+}
+/** Is version triple `a` at or above `b`? */
+export function cliVersionAtLeast(a, b) {
+    for (let i = 0; i < 3; i += 1) {
+        if (a[i] !== b[i])
+            return a[i] > b[i];
+    }
+    return true;
+}
 export const EVIDENCE_VALUES = ["sufficient", "insufficient"];
 export const INSUFFICIENT_REASON_VALUES = [
     "no_init_event",
@@ -200,6 +231,10 @@ export const COMPLETION_CAUSE_VALUES = [
     "cleanup_unconfirmed",
     "verification_runner_unavailable",
 ];
+export const END_CAUSE_VALUES = [
+    "worker_exit", "completion_window", "job_timeout", "executor_abort",
+    "executor_shutdown", "server_stop", "lease_lost",
+];
 export const MAX_TASKS = 64;
 export const MAX_DENIALS = 32;
 export const MAX_IDENTIFIER_CHARS = 128;
@@ -239,13 +274,23 @@ export function isCoveredJobType(jobType) {
 export function claimRequiresCompletionEvidence(requiredCapabilities) {
     return Array.isArray(requiredCapabilities) && requiredCapabilities.includes(COMPLETION_EVIDENCE_CAPABILITY);
 }
+/**
+ * True for the measured baseline or a newer supported runtime: adapter `claude`, the
+ * lifecycle event schema, a closed platform id, and a strict numeric version at or
+ * above {@link MIN_CLI_VERSION}. Mirror of `runtime_matches_supported` in Python.
+ */
 export function runtimeMatchesSupported(runtime) {
     if (!runtime)
         return false;
+    const version = parseCliVersion(runtime.cli_version);
+    const minimum = parseCliVersion(MIN_CLI_VERSION);
     return (runtime.adapter === SUPPORTED_COMPLETION_RUNTIME.adapter &&
-        runtime.cli_version === SUPPORTED_COMPLETION_RUNTIME.cli_version &&
-        runtime.platform === SUPPORTED_COMPLETION_RUNTIME.platform &&
-        runtime.event_schema === SUPPORTED_COMPLETION_RUNTIME.event_schema);
+        runtime.event_schema === EVENT_SCHEMA &&
+        typeof runtime.platform === "string" &&
+        SUPPORTED_PLATFORMS.includes(runtime.platform) &&
+        version !== null &&
+        minimum !== null &&
+        cliVersionAtLeast(version, minimum));
 }
 export function unresolvedRequiredTasks(envelope) {
     return envelope.tasks.filter((t) => t.required && !TASK_RESOLVING_STATES.has(t.state));
@@ -318,16 +363,25 @@ export function deriveCompletionCause(envelope) {
     if (blocking.length > 0 && envelope.evidence === "sufficient" && blocking.some((d) => d.result_after_denial)) {
         return "permission_stop";
     }
-    if (envelope.cleanup.verdict !== "confirmed" || envelope.cleanup.survivors !== 0)
-        return "cleanup_unconfirmed";
     const unresolved = envelope.tasks.some((t) => t.required && !TASK_RESOLVING_STATES.has(t.state));
-    if (blocking.length > 0 ||
+    const requiredWorkIncomplete = blocking.length > 0 ||
         envelope.evidence !== "sufficient" ||
         envelope.execution !== "complete" ||
         unresolved ||
-        envelope.verification === "incomplete") {
-        return "required_work_incomplete";
+        envelope.verification === "incomplete";
+    // One exception to cleanup precedence: a completed sweep with no survivor and
+    // exactly the single reason `ownership_unverifiable` yields to unfinished
+    // work. Exact array checks, so a mixed list (e.g. with `not_run`) never does.
+    const narrowCleanupUncertainty = envelope.cleanup.verdict === "unconfirmed" &&
+        envelope.cleanup.survivors === 0 &&
+        envelope.cleanup.reasons.length === 1 &&
+        envelope.cleanup.reasons[0] === "ownership_unverifiable";
+    if ((envelope.cleanup.verdict !== "confirmed" || envelope.cleanup.survivors !== 0) &&
+        !(narrowCleanupUncertainty && requiredWorkIncomplete)) {
+        return "cleanup_unconfirmed";
     }
+    if (requiredWorkIncomplete)
+        return "required_work_incomplete";
     if (envelope.verification === "unavailable")
         return "verification_runner_unavailable";
     if (envelope.verification === "failed")
@@ -366,7 +420,9 @@ export function buildNotLaunchedEnvelope(input) {
         binding: { ...input.binding },
         session_id: null,
         evidence: "insufficient",
-        insufficient_reasons: ["worker_not_launched"],
+        insufficient_reasons: input.unsupportedRuntime
+            ? ["worker_not_launched", "unsupported_runtime"]
+            : ["worker_not_launched"],
         execution: "unknown",
         verification: input.verification,
         finalization: "unknown",
@@ -381,7 +437,7 @@ export function buildNotLaunchedEnvelope(input) {
         denials: [],
         missing_capabilities: [],
         results_seen: 0,
-        cause: null,
+        cause: input.unsupportedRuntime ? "unsupported_completion_evidence" : null,
         ...(input.verificationFacts ? { verification_facts: input.verificationFacts } : {}),
     };
 }

package/build/executor/completion-supervision.js

@@ -228,6 +228,10 @@ export function finalizationFacts(outcome) {
         // and neither push nor PR is inferred satisfied.
         case "WorkerFinalizationPublicationUnverified":
             return { verdict: "unknown", pushSatisfied: false, prSatisfied: false };
+        // BAPI-1357: the origin lookup could not be trusted, so the branch was not
+        // observed missing either. Unknown, and neither obligation is inferred met.
+        case "WorkerFinalizationOriginUnverifiable":
+            return { verdict: "unknown", pushSatisfied: false, prSatisfied: false };
         default:
             return { verdict: "unknown", pushSatisfied: false, prSatisfied: false };
     }

package/build/executor/deps.js

@@ -1,3 +1,4 @@
+import { recordProvisionedAssets } from "../generated-assets-inventory.js";
 /**
  * Default (production) executor dependencies (BAPI-534, TDD §7).
  *
@@ -70,6 +71,7 @@ export function createDefaultExecutorDeps() {
                     cwd: options?.cwd,
                     env: options?.env,
                     timeout: options?.timeoutMs,
+                    signal: options?.signal,
                     maxBuffer: MAX_COMMAND_BUFFER,
                     encoding: "utf8",
                     shell: false,
@@ -78,7 +80,7 @@ export function createDefaultExecutorDeps() {
             }
             catch (err) {
                 const e = err;
-                const exitCode = typeof e.code === "number" ? e.code : 1;
+                const exitCode = e.killed || e.code === "ABORT_ERR" ? 124 : typeof e.code === "number" ? e.code : 1;
                 return { stdout: e.stdout ?? "", stderr: e.stderr ?? "", exitCode };
             }
         },
@@ -137,6 +139,7 @@ export function createDefaultExecutorDeps() {
                 },
             };
         },
+        recordPackagedAssets: recordProvisionedAssets,
         readFile: (filePath) => readFile(filePath, "utf-8"),
         writeFile: (filePath, data) => writeFile(filePath, data, "utf-8"),
         appendFile: (filePath, data) => appendFile(filePath, data, "utf-8"),

package/build/executor/env.js

@@ -329,3 +329,22 @@ export function buildExecutorBaseWorkerEnv(parentEnv, options = {}) {
     // per call site.
     return env;
 }
+/**
+ * The environment for a headless agent run that is not a worker job, such as the
+ * executor's deny-enforcement probe (BAPI-1386).
+ *
+ * The probe must see what a worker sees. Spawned from an executor that is itself
+ * running inside a Claude session, it would otherwise inherit that session's
+ * nested-session variables, and the CLI can refuse to start a tool call there. So
+ * this reuses the worker allowlist and worker-injected defaults behind
+ * {@link buildExecutorBaseWorkerEnv} rather than keeping a deny-list of Claude
+ * variable names, which would go stale with every CLI release. No job-specific
+ * option is set: the result carries no branch, base, scope, or correction marker.
+ *
+ * Applied only where the executor builds the deny probe's context. The shared
+ * `runHeadless()` passes its supplied environment through unchanged, so standalone
+ * capability probes are not filtered.
+ */
+export function buildHeadlessAgentEnv(parentEnv) {
+    return buildExecutorBaseWorkerEnv(parentEnv);
+}