@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/bitbucket-workspace-remote.js

@@ -0,0 +1,136 @@
+/**
+ * Infer the Bitbucket workspace slug from this project's `origin` remote (BAPI-1401).
+ *
+ * `connect-bitbucket` sends the workspace it reads here to Bridge as a *claim*: it only
+ * decides which workspace's Forge settings page lists the connection request. It is not
+ * an identity and authorizes nothing — the approval itself happens on the Atlassian side
+ * and binds only within the workspace Bridge derives from the signed Forge invocation.
+ *
+ * Only bitbucket.org repository remotes are recognized, in three shapes:
+ *
+ *   https://[user@]bitbucket.org/<workspace>/<repo>[.git]
+ *   git@bitbucket.org:<workspace>/<repo>[.git]
+ *   ssh://git@bitbucket.org[:port]/<workspace>/<repo>[.git]
+ *
+ * Anything else (another host, a lookalike host, a path without both segments, a
+ * malformed URL, blank output, a failed command) yields no workspace, and the caller
+ * keeps the legacy code flow. The remote URL and any process error are never printed:
+ * a remote can embed a credential (`https://user:token@…`).
+ *
+ * Git runs through an injected argument-array seam (never a shell), so this is
+ * unit-testable without a real repository.
+ */
+import { execFile } from "child_process";
+const BITBUCKET_HOST = "bitbucket.org";
+/** Mirrors the server's workspace-slug allowlist (`normalize_bitbucket_slug`). */
+const WORKSPACE_SLUG_RE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+const WORKSPACE_SLUG_MAX_LENGTH = 255;
+/** Bounded so a hung git (a credential prompt, a slow filesystem) cannot stall the CLI. */
+const GIT_TIMEOUT_MS = 5_000;
+/** The default runner: `execFile` with an argument array, no shell, short timeout. */
+export const defaultGitRemoteRunner = (args, cwd) => new Promise((resolve) => {
+    try {
+        execFile("git", args, { cwd, shell: false, timeout: GIT_TIMEOUT_MS, windowsHide: true }, (error, stdout) => {
+            if (error) {
+                resolve(null);
+                return;
+            }
+            resolve(typeof stdout === "string" ? stdout : String(stdout));
+        });
+    }
+    catch {
+        resolve(null);
+    }
+});
+function workspaceFromPath(pathPart) {
+    const segments = pathPart.replace(/^\/+/, "").split("/");
+    // A repository remote has exactly <workspace>/<repo>, optionally with a trailing slash.
+    const meaningful = segments.filter((segment, index) => segment !== "" || index < segments.length - 1);
+    if (meaningful.length !== 2)
+        return null;
+    const [workspace, repo] = meaningful;
+    if (!workspace || !repo || repo === ".git")
+        return null;
+    if (workspace.length > WORKSPACE_SLUG_MAX_LENGTH || !WORKSPACE_SLUG_RE.test(workspace)) {
+        return null;
+    }
+    return workspace;
+}
+/**
+ * Parse a remote URL into its Bitbucket workspace slug, or null when it is not a
+ * recognizable bitbucket.org repository remote. Pure; never throws.
+ */
+export function parseBitbucketWorkspaceFromRemote(remote) {
+    if (typeof remote !== "string")
+        return null;
+    const value = remote.trim();
+    if (!value || /\s/.test(value) || /[\u0000-\u001F\u007F]/.test(value))
+        return null;
+    // scp-like SSH: git@bitbucket.org:<workspace>/<repo>.git
+    const scp = /^([A-Za-z0-9._-]+)@([^:/]+):(.+)$/.exec(value);
+    if (scp && !value.includes("://")) {
+        if (scp[2].toLowerCase() !== BITBUCKET_HOST)
+            return null;
+        return workspaceFromPath(scp[3]);
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (!["https:", "ssh:", "git+ssh:"].includes(parsed.protocol))
+        return null;
+    if (parsed.hostname.toLowerCase() !== BITBUCKET_HOST)
+        return null;
+    if (parsed.search || parsed.hash)
+        return null;
+    let pathname;
+    try {
+        pathname = decodeURIComponent(parsed.pathname);
+    }
+    catch {
+        return null;
+    }
+    return workspaceFromPath(pathname);
+}
+/**
+ * Read `git remote get-url origin` in `cwd` and return its Bitbucket workspace slug, or
+ * null. Never throws and never prints.
+ */
+export async function inferBitbucketWorkspaceFromGitRemote(cwd, runGit = defaultGitRemoteRunner) {
+    let stdout;
+    try {
+        stdout = await runGit(["remote", "get-url", "origin"], cwd);
+    }
+    catch {
+        return null;
+    }
+    if (typeof stdout !== "string")
+        return null;
+    const firstLine = stdout.split(/\r?\n/)[0] ?? "";
+    return parseBitbucketWorkspaceFromRemote(firstLine);
+}
+/**
+ * Resolve the Bitbucket workspace for a connect run: an explicit `--workspace` value
+ * first (already validated by the caller's argument parser), otherwise the `origin`
+ * remote of `cwd`. An inferred slug has already passed the same allowlist as the flag
+ * (see {@link parseBitbucketWorkspaceFromRemote}) and is shown to the user, so a wrong
+ * remote is visible. Returns undefined when nothing usable is found — the connect flow
+ * then uses code mode. Never prints the remote URL.
+ *
+ * Lives here, not in `connect-bitbucket.ts`, so `install-bridge.ts` can share it
+ * without importing the connect flow module.
+ */
+export async function resolveBitbucketWorkspace(explicit, cwd, runGit, log) {
+    if (explicit)
+        return explicit;
+    if (!runGit)
+        return undefined;
+    const inferred = await inferBitbucketWorkspaceFromGitRemote(cwd, runGit);
+    if (!inferred)
+        return undefined;
+    log(`Using Bitbucket workspace ${inferred}`);
+    return inferred;
+}

package/build/bootstrap-project-identity.js

@@ -0,0 +1,24 @@
+/** Bootstrap labels are display data, never credential selectors. */
+const whitespace = " \u00a0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000";
+const controls = /[\u0000-\u001f\u007f-\u009f\u2028\u2029\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
+export function validateBootstrapDisplayName(value) {
+    if (typeof value !== "string" || controls.test(value))
+        throw new Error("Invalid project label.");
+    const label = value.replace(new RegExp(`^[${whitespace}]+|[${whitespace}]+$`, "gu"), "");
+    if (Array.from(label).length < 1 || Array.from(label).length > 255)
+        throw new Error("Invalid project label.");
+    return label;
+}
+export function validateBootstrapRepoName(value) {
+    if (typeof value !== "string" || value.length < 1 || value.length > 100 || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value))
+        throw new Error("Invalid project identity.");
+    return value;
+}
+export function validateBootstrapServerIdentity(value) {
+    if (!value || typeof value !== "object")
+        throw new Error("Invalid project identity response.");
+    const identity = value;
+    if (identity.identity_mode !== "server_assigned")
+        throw new Error("Unsupported project identity response.");
+    return { repo_name: validateBootstrapRepoName(identity.repo_name), repo_display_name: validateBootstrapDisplayName(identity.repo_display_name), identity_mode: "server_assigned" };
+}

package/build/bounded-wait.js

@@ -24,8 +24,8 @@
  * keeps the reason vocabulary below closed: the primitive can only report states
  * it can itself observe.
  *
- * NO RAW UPSTREAM DATA ESCAPES. A result carries a closed-vocabulary reason and
- * nothing else. Exception text, response bodies, headers, URLs, and credentials
+ * NO RAW UPSTREAM DATA ESCAPES. A result carries a closed-vocabulary reason plus
+ * whatever already-sanitized detail the caller's probe attached. Exception text, response bodies, headers, URLs, and credentials
  * are never read into a result — a caller that needs upstream detail must obtain
  * it inside its own probe and sanitize it there, the same bar
  * `formatRecoverablePollGiveUp` sets for the existing poller.
@@ -48,7 +48,39 @@ const TERMINAL_REASON_SENTENCES = {
     lost_after_retries: "The server restarted during the run and gave up after its automatic retries.",
     handler_failed: "The run failed on the server.",
     expired: "The run expired on the server before it finished.",
+    insufficient_ticket_detail: "The ticket description is too short for the server to work from.",
+    completed_without_artifact: "The run finished on the server without producing a document.",
 };
+/** Plain sentences for the probe-named terminal reasons (BAPI-1382). */
+const WAIT_REASON_SENTENCES = {
+    NO_REVIEW_REQUESTED: "No review request is known for this ticket, and none is running on the server.",
+    NO_REVIEW_RUNNING: "A review was submitted, but the server has no review running and no document for it.",
+};
+/** The plain sentence for a probe-named wait reason, or `null` for the others. */
+export function formatWaitReasonSentence(reason) {
+    return WAIT_REASON_SENTENCES[reason] ?? null;
+}
+function isWholeNonNegative(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+/**
+ * The insufficient-detail sentence. It names whichever measurements the server
+ * sent — "26 of 200 characters" with both, the minimum alone when the length
+ * was not stored (the spawn-mode and review-run paths) — and otherwise falls
+ * back to the generic sentence, so a missing field is never printed as
+ * `undefined`. The server's `retry_hint` carries the next step.
+ */
+function insufficientDetailSentence(detail) {
+    const measured = detail?.measuredLength;
+    const threshold = detail?.threshold;
+    if (isWholeNonNegative(measured) && isWholeNonNegative(threshold)) {
+        return `The ticket description is too short (${measured} of ${threshold} characters).`;
+    }
+    if (isWholeNonNegative(threshold)) {
+        return `The ticket description is shorter than the ${threshold}-character minimum.`;
+    }
+    return TERMINAL_REASON_SENTENCES.insufficient_ticket_detail;
+}
 /**
  * Build the plain recovery message for a terminal outcome, or `null` when the
  * server sent neither a reason nor a retry hint (the caller then keeps its
@@ -60,6 +92,14 @@ export function formatTerminalRecoveryMessage(detail) {
     if (!reason && !retryHint)
         return null;
     const parts = [];
+    if (reason === "insufficient_ticket_detail") {
+        parts.push(insufficientDetailSentence(detail));
+        // The server's hint for this reason is a full sentence naming the fix and
+        // the tool call, so it is printed as-is rather than after "Retry with:".
+        parts.push(retryHint ||
+            "Lengthen the ticket description (use update_ticket_description), then submit a new request.");
+        return parts.join(" ");
+    }
     if (reason) {
         parts.push(TERMINAL_REASON_SENTENCES[reason] ?? `The server reported: ${reason}.`);
     }
@@ -123,12 +163,21 @@ export async function boundedWait(options) {
         signal?.addEventListener("abort", finish, { once: true });
     });
     let consecutiveFailures = 0;
+    // BAPI-1356: latched, never reset. Set only where the server actually
+    // answered; a throw, a probe timeout, or a transient streak leaves it alone.
+    let observed = false;
+    const pending = (reason) => ({
+        state: "pending",
+        reason,
+        observed,
+        windowMs: effectiveBudgetMs,
+    });
     try {
         while (true) {
             if (signal?.aborted)
                 return { state: "error", reason: "ABORTED" };
             if (remaining() <= 0) {
-                return { state: "pending", reason: "WAIT_WINDOW_ELAPSED" };
+                return pending("WAIT_WINDOW_ELAPSED");
             }
             // One controller per probe, aborted by EITHER the per-probe timeout or the
             // caller's signal. The probe therefore never outlives its own budget, and a
@@ -164,15 +213,22 @@ export async function boundedWait(options) {
             if (threw || timedOut || outcome === null) {
                 consecutiveFailures += 1;
                 if (consecutiveFailures >= MAX_CONSECUTIVE_POLL_FAILURES) {
-                    return { state: "pending", reason: "UPSTREAM_TRANSIENT" };
+                    return pending("UPSTREAM_TRANSIENT");
                 }
             }
             else if (outcome.kind === "terminal") {
-                // Recovery detail is additive: it is attached only when the probe
-                // captured some, so a legacy terminal result keeps its exact shape.
-                return outcome.recovery
-                    ? { state: "error", reason: "UPSTREAM_TERMINAL", recovery: outcome.recovery }
-                    : { state: "error", reason: "UPSTREAM_TERMINAL" };
+                // Recovery detail and upstream evidence are additive: each is attached
+                // only when the probe captured some, so a legacy terminal result keeps
+                // its exact shape.
+                const terminal = {
+                    state: "error",
+                    reason: outcome.reason ?? "UPSTREAM_TERMINAL",
+                };
+                if (outcome.recovery)
+                    terminal.recovery = outcome.recovery;
+                if (outcome.upstream)
+                    terminal.upstream = outcome.upstream;
+                return terminal;
             }
             else if (outcome.kind === "malformed") {
                 return { state: "error", reason: "INVALID_RESPONSE" };
@@ -181,6 +237,7 @@ export async function boundedWait(options) {
                 // The server answered. Reset the streak BEFORE evaluating readiness — an
                 // answer of "not yet" is still proof the transport is healthy.
                 consecutiveFailures = 0;
+                observed = true;
                 if (outcome.ready === true) {
                     const value = outcome.value;
                     if (isReady === undefined || isReady(value)) {
@@ -189,7 +246,7 @@ export async function boundedWait(options) {
                 }
             }
             if (remaining() <= 0) {
-                return { state: "pending", reason: "WAIT_WINDOW_ELAPSED" };
+                return pending("WAIT_WINDOW_ELAPSED");
             }
             // The existing poller's curve plus bounded jitter, clamped to whatever is
             // actually left so a backoff can never overrun the deadline it is inside.