@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/executor/worker-finalization.js

@@ -60,6 +60,15 @@
  * reports its head, publication is `unknown`
  * (`WorkerFinalizationPublicationUnverified`), never `ok`.
  *
+ * BAPI-1357: "absent" and "could not be checked" are different facts. Only the
+ * origin lookup's authoritative "no matching ref" (`git ls-remote --exit-code`
+ * exit code 2), or having no expected branch at all, is reported as
+ * `WorkerFinalizationMissingRemoteBranchAndPr`; a thrown command, an expired
+ * call bound, any other exit, or unusable output leaves publication unknown and is
+ * `WorkerFinalizationOriginUnverifiable`, which the server treats as transient.
+ * Both keep the `clean_exit` classification the process earned. No-expected-branch
+ * and absent-on-origin are still one cause, and may be refined later.
+ *
  * This check is deliberately fail-CLOSED, unlike the BAPI-586 base check it now
  * shares a lookup with. "The PR could not be verified" and "there is no PR" are
  * the same thing from the contract's point of view: neither is evidence that the
@@ -67,7 +76,7 @@
  * this ticket removes. The reconciler stays the decision-maker — the executor
  * only reports the observation (R14 rule 3).
  */
-import { ReconcileOverlapPushUnfinalized, secretFreeErrorMessage, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationPrBaseMismatch, WorkerFinalizationPrNotAttached, WorkerFinalizationPublicationUnverified, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
+import { ReconcileOverlapPushUnfinalized, WorkerFinalizationMissingRemoteBranchAndPr, WorkerFinalizationOriginUnverifiable, WorkerFinalizationPrBaseMismatch, WorkerFinalizationPrNotAttached, WorkerFinalizationPublicationUnverified, WorkerFinalizationSavedButUnfinalized, } from "./job-errors.js";
 import { isImplementationStyleJobType } from "./job-types.js";
 /** A full, lower-case 40-hex commit SHA. */
 const FULL_SHA_RE = /^[0-9a-f]{40}$/;
@@ -129,40 +138,56 @@ function parseLsRemoteHeadSha(stdout, expectedRef) {
     }
     return null;
 }
+/** `git ls-remote --exit-code` exits with this status when no ref matched. */
+const LS_REMOTE_NO_MATCHING_REF_EXIT_CODE = 2;
 /**
- * Resolve the origin branch's authoritative current tip SHA (normalized), or
- * `null` if the ref is absent. Uses `git ls-remote` against the exact normalized
- * ref — never a local `origin/<branch>` remote-tracking ref, which can be stale
- * on a recovery worktree. A non-zero exit is treated as "branch not found"
- * without copying raw stderr into diagnostics.
+ * Resolve the origin branch's authoritative current tip. Uses `git ls-remote`
+ * against the exact normalized ref — never a local `origin/<branch>`
+ * remote-tracking ref, which can be stale on a recovery worktree.
+ *
+ * Only exit code 2 (`--exit-code`'s "no matching ref") is `absent`. A thrown
+ * command, an expired call bound, every other non-zero exit, and an exit-zero
+ * response with no usable SHA for the exact ref are all `unverifiable`: none of
+ * them is evidence the branch is missing. Neither stderr nor a thrown error's
+ * message is read or copied anywhere.
  */
 export async function resolveOriginBranchSha(runCommand, worktreePath, branch, bound) {
     const normalizedRef = normalizeBranchRef(branch);
     if (callExpired(bound))
-        return null;
-    const result = await runCommand("git", ["ls-remote", "--exit-code", "--heads", "origin", normalizedRef], callOptions(worktreePath, bound));
+        return { state: "unverifiable" };
+    let result;
+    try {
+        result = await runCommand("git", ["ls-remote", "--exit-code", "--heads", "origin", normalizedRef], callOptions(worktreePath, bound));
+    }
+    catch {
+        return { state: "unverifiable" };
+    }
+    if (result.exitCode === LS_REMOTE_NO_MATCHING_REF_EXIT_CODE)
+        return { state: "absent" };
     if (result.exitCode !== 0)
-        return null;
-    return parseLsRemoteHeadSha(result.stdout, normalizedRef);
+        return { state: "unverifiable" };
+    const sha = parseLsRemoteHeadSha(result.stdout, normalizedRef);
+    return sha === null ? { state: "unverifiable" } : { state: "found", sha };
 }
 /**
  * Repeatedly resolve the authoritative origin tip until it either satisfies
  * finalization or the bounded retry budget is exhausted. Stops early (no further
  * lookups) when the origin tip matches the worker HEAD, or when the branch exists
  * and the worker HEAD is unavailable (degraded telemetry, existence-only). Retries
- * when the tip is `null` (branch not yet visible) or, with a known HEAD, does not
- * yet match. Returns the LAST authoritative observation — the caller decides
- * loud-failure from that final value, so true negatives are preserved.
+ * an observed absence, a found tip that does not yet match a known HEAD, and an
+ * unverifiable read (a later read may succeed). Returns the LAST observation with
+ * its state intact — an unverifiable read is never turned into an absence here,
+ * so the caller decides loud-failure from what was actually established.
  */
 async function resolveOriginBranchShaForFinalization(runCommand, worktreePath, branch, trimmedHeadSha, attempts, retryDelayMs, sleep, bound) {
     const total = Math.max(1, attempts);
-    let remoteSha = null;
+    let lookup = { state: "unverifiable" };
     for (let attempt = 0; attempt < total; attempt++) {
-        remoteSha = await resolveOriginBranchSha(runCommand, worktreePath, branch, bound?.());
-        if (remoteSha !== null) {
+        lookup = await resolveOriginBranchSha(runCommand, worktreePath, branch, bound?.());
+        if (lookup.state === "found") {
             // Existence-only success when HEAD is unknown; exact-match success otherwise.
-            if (!trimmedHeadSha || remoteSha === trimmedHeadSha) {
-                return { sha: remoteSha, attemptsUsed: attempt + 1 };
+            if (!trimmedHeadSha || lookup.sha === trimmedHeadSha) {
+                return { lookup, attemptsUsed: attempt + 1 };
             }
         }
         if (attempt < total - 1)
@@ -170,7 +195,7 @@ async function resolveOriginBranchShaForFinalization(runCommand, worktreePath, b
     }
     // `attemptsUsed` is reported even on failure so the caller can tell a
     // first-try answer from one that needed the settling window (BAPI-862).
-    return { sha: remoteSha, attemptsUsed: total };
+    return { lookup, attemptsUsed: total };
 }
 /** The bounded, public projection finalization asks the provider for. */
 const PR_VIEW_JSON_FIELDS = "number,url,baseRefName,body,headRefOid";
@@ -385,12 +410,19 @@ function publicationUnverifiedFailure(job, branch, workerHeadSha, detail) {
     };
 }
 /**
- * `detail` describes a state with NO evidence any work reached origin (branch
- * unresolved, branch absent from origin, or the origin lookup itself failed).
+ * `detail` describes a state with NO evidence any work reached origin, and is
+ * used for exactly two cases: no expected branch to verify, or a branch the
+ * origin lookup OBSERVED absent (exit code 2). An origin lookup that merely
+ * failed is {@link originUnverifiableFailure}, never this. Those two cases stay
+ * one cause for now and may be refined later.
  * `hasPrUrl` only changes the wording — a PR existing is never treated as
  * evidence of a push, so the message must not claim "no PR URL" when one was
  * actually present (that would be false and would mislead the operator reading
  * it toward the wrong recovery step).
+ *
+ * The classification is `clean_exit` because the worker process did exit
+ * cleanly; the finalization failure rides in the error kind, not in a rewritten
+ * exit (the same rule the other finalization failures follow).
  */
 function missingBranchAndPrFailure(job, detail, hasPrUrl) {
     const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
@@ -398,7 +430,23 @@ function missingBranchAndPrFailure(job, detail, hasPrUrl) {
     return {
         error_kind: WorkerFinalizationMissingRemoteBranchAndPr,
         error_message: `${label} exited cleanly but ${prefix} ${detail}`,
-        classification: "crashed",
+        classification: "clean_exit",
+    };
+}
+/**
+ * BAPI-1357: the origin lookup could not be trusted, so the branch was neither
+ * seen nor observed missing. The wording is fixed and bounded: it names only the
+ * ticket, job and branch (public identifiers), never a command, stderr, a thrown
+ * error's text, a host, or a credential, and it does not claim the branch is
+ * absent. The server treats this kind as transient.
+ */
+function originUnverifiableFailure(job, branch) {
+    const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
+    return {
+        error_kind: WorkerFinalizationOriginUnverifiable,
+        error_message: `${label} exited cleanly, but whether branch '${branch}' reached origin could not be ` +
+            `verified. The branch was not observed to be missing; publication is unknown for this attempt.`,
+        classification: "clean_exit",
     };
 }
 /**
@@ -411,14 +459,14 @@ function missingBranchAndPrFailure(job, detail, hasPrUrl) {
  * existing convention); the full 40-character origin SHA is carried in the
  * structured `last_commit_sha` field so nothing has to re-derive it from prose.
  */
-function savedButUnfinalizedFailure(job, branch, originSha, workerHeadSha) {
+function savedButUnfinalizedFailure(job, branch, originSha, workerHeadSha, publicationAttempted = false) {
     const label = job.ticket_key ? `${job.ticket_key} (job ${job.id})` : `job ${job.id}`;
     return {
         error_kind: WorkerFinalizationSavedButUnfinalized,
         error_message: `${label} exited cleanly, but origin branch '${branch}' is at ${originSha.slice(0, 12)}, ` +
-            `which does not match this worker's HEAD ${workerHeadSha.slice(0, 12)} — the worker's latest ` +
-            `commit was not pushed. Work already on origin at this SHA is recoverable: resume/finalize ` +
-            `from '${branch}' instead of re-running from scratch.`,
+            `which does not match this worker's HEAD ${workerHeadSha.slice(0, 12)}. The newer commit ` +
+            `is retained only in the local worktree and was not pushed. Automatic publication ` +
+            `${publicationAttempted ? "was refused" : "was unavailable or not attempted"}; preserve the worktree for recovery.`,
         classification: "crashed",
         last_commit_sha: originSha,
     };
@@ -525,19 +573,50 @@ export async function validateWorkerFinalization(input) {
     try {
         origin = await resolveOriginBranchShaForFinalization(runCommand, worktreePath, trimmedBranch, trimmedHeadSha, attempts, retryDelayMs, sleep, bound);
     }
-    catch (err) {
-        return {
-            ok: false,
-            failure: missingBranchAndPrFailure(job, `branch '${trimmedBranch}' could not be verified on origin: ${secretFreeErrorMessage(err)}`, hasPrUrl),
-        };
+    catch {
+        // BAPI-1357: nothing thrown here says anything about the branch, and its text
+        // is never rendered — the fixed unverifiable outcome is the whole report.
+        return { ok: false, failure: originUnverifiableFailure(job, trimmedBranch) };
     }
-    const remoteSha = origin.sha;
-    if (remoteSha === null) {
+    // BAPI-1357: only an authoritative "no matching ref" is an absence. A lookup
+    // that could not be trusted stays unknown and never funds the deterministic
+    // missing-branch failure.
+    if (origin.lookup.state === "unverifiable") {
+        return { ok: false, failure: originUnverifiableFailure(job, trimmedBranch) };
+    }
+    if (origin.lookup.state === "absent") {
         return {
             ok: false,
             failure: missingBranchAndPrFailure(job, `branch '${trimmedBranch}' is not on origin`, hasPrUrl),
         };
     }
+    let publicationAttempted = false;
+    if (trimmedHeadSha && origin.lookup.sha !== trimmedHeadSha && job.job_type !== "reconcile_overlap" && input.publishRetainedHead) {
+        publicationAttempted = true;
+        let pushed;
+        try {
+            pushed = await input.publishRetainedHead();
+        }
+        catch {
+            pushed = { status: "refused", reason: "remote_rejected" };
+        }
+        // The original lease is never replaced after an intermediate worker push.
+        // A timeout/rejected lease may have landed elsewhere; only the ordinary
+        // authoritative origin and PR contracts can accept that state, without
+        // manufacturing a wrapper publication fact.
+        if (pushed.status === "published" || pushed.reason === "lease_rejected" || pushed.reason === "timeout") {
+            origin = await resolveOriginBranchShaForFinalization(runCommand, worktreePath, trimmedBranch, trimmedHeadSha, 1, retryDelayMs, sleep, bound);
+            if (origin.lookup.state !== "found")
+                return { ok: false, failure: originUnverifiableFailure(job, trimmedBranch) };
+            pr = await resolvePrForFinalization(runCommand, worktreePath, trimmedBranch, bound());
+            const refreshedBase = evaluatePrBase(job, pr, expectedBase);
+            if (refreshedBase)
+                return { ok: false, failure: refreshedBase };
+        }
+    }
+    if (origin.lookup.state !== "found")
+        return { ok: false, failure: originUnverifiableFailure(job, trimmedBranch) };
+    const remoteSha = origin.lookup.sha;
     // BAPI-762: an authoritative origin tip that does not match the worker's HEAD
     // is positive evidence of RECOVERABLE work — distinct from the sub-cases above,
     // which have no evidence any work reached origin at all. This is the only
@@ -549,7 +628,7 @@ export async function validateWorkerFinalization(input) {
             ok: false,
             failure: job.job_type === "reconcile_overlap"
                 ? reconcilePushUnfinalizedFailure(job, trimmedBranch, remoteSha, trimmedHeadSha)
-                : savedButUnfinalizedFailure(job, trimmedBranch, remoteSha, trimmedHeadSha),
+                : savedButUnfinalizedFailure(job, trimmedBranch, remoteSha, trimmedHeadSha, publicationAttempted),
         };
     }
     // BAPI-862: the work is provably ON ORIGIN. That was the whole of the success