@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/executor/worker-guard-hook.js

@@ -62,13 +62,54 @@ export const WORKER_GUARD_MALFORMED_LINE = `${WORKER_GUARD_REASON_PREFIX}: paylo
  * branch, or an exception could reach this string — the bound is structural rather
  * than a rule a caller is asked to remember.
  */
-export function renderWorkerGuardReason(category, family) {
+export function renderWorkerGuardReason(category, family, form) {
     if (category === "git-ambiguous") {
         return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
             "This shell form cannot be safely resolved: substitution, redirection, or " +
             "stdin-fed arguments hide what git will run. Use literal arguments instead; " +
             "for a commit message, write it to a file and run git commit -F <file>.");
     }
+    if (form === "shell_form") {
+        const pattern = category === "git-push"
+            ? "If the destination is your own branch and no force is used, run git push origin HEAD:<your work branch> alone."
+            : category === "git-reset-hard"
+                ? "If resetting your own branch, run git reset --hard origin/<your work branch> alone."
+                : category === "filesystem-clean"
+                    ? "If all pathspecs are inside your worktree, run git clean with literal worktree-contained pathspecs alone."
+                    : category === "filesystem-remove"
+                        ? "If all paths are inside your worktree, run rm with literal worktree-contained paths alone."
+                        : "If arguments are read-only, run literal read-only arguments alone, without redirects or $VAR.";
+        return `${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "Shell form cannot be checked: redirects, pipes, substitution, or stdin-fed arguments. " + pattern;
+    }
+    const restriction = {
+        "git-push": "Push only to your own branch, without force. Use HEAD:<your work branch> as the destination.",
+        "git-reset-hard": "Hard reset only against your own branch ref.",
+        "filesystem-clean": "Clean only literal paths inside your worktree.",
+        "filesystem-remove": "Remove only literal paths inside your worktree.",
+        "database-destructive": "Destructive SQL is prohibited. Use read-only database arguments.",
+        "network-mutating": "Mutating requests are prohibited. Use read-only network arguments.",
+    };
+    if (restriction[category])
+        return `${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ${restriction[category]}`;
+    if (category === "workflow-entry" ||
+        category === "workflow-launch-skill" ||
+        category === "workflow-launch-shell" ||
+        category === "workflow-planner-tool") {
+        return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "A correction worker must not start a full workflow. Reading or editing files " +
+            "that mention a workflow is allowed; make the focused correction directly.");
+    }
+    if (category === "correction-context-invalid") {
+        return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "The correction context for this worker is not valid, so no tool call can be " +
+            "checked. Stop and report the launch problem.");
+    }
+    if (category === "correction-payload-invalid") {
+        return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "The tool call could not be read as a tool name with a tool input, so it cannot " +
+            "be checked. Retry with a well-formed call.");
+    }
     return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
         "This command family is restricted to the worker's own branch, worktree, and " +
         "read-only network access. Use a different approach and continue.");
@@ -192,6 +233,92 @@ export function tokenizeShellCommand(command) {
     endCommand();
     return commands;
 }
+function diagnosticProjections(command) {
+    if (command.length > WORKER_GUARD_MAX_PAYLOAD_BYTES)
+        return [];
+    const result = [];
+    let start = 0;
+    let masked = "";
+    let quote = "";
+    let uncertain = false;
+    const finish = (end) => {
+        const original = tokenizeShellCommand(command.slice(start, end));
+        const projected = tokenizeShellCommand(masked);
+        const value = !uncertain && projected.length === 1
+            ? { argv: projected[0].argv, complete: !projected[0].unsafe } : undefined;
+        result.push(...original.map((_, i) => i === 0 ? value : undefined));
+        masked = "";
+        uncertain = false;
+        start = end + 1;
+    };
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (ch === "\\" && quote !== "'") {
+            masked += command.slice(i, i + 2);
+            i += 1;
+            continue;
+        }
+        if (quote) {
+            masked += ch;
+            if (ch === quote)
+                quote = "";
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            masked += ch;
+            continue;
+        }
+        if (ch === ">" || ch === "<") {
+            // A numeric fd is syntax only at a token boundary, not in a word.
+            masked = masked.replace(/(^|\s)\d+$/, "$1");
+            let j = i + 1;
+            if (command[j] === ch)
+                j += 1;
+            if (command[j] === "&")
+                j += 1;
+            while (/[ \t]/.test(command[j] ?? "") && j < command.length)
+                j += 1;
+            const operandStart = j;
+            let operandQuote = "";
+            while (j < command.length) {
+                const c = command[j];
+                if (c === "\\" && operandQuote !== "'") {
+                    j += 2;
+                    continue;
+                }
+                if (operandQuote) {
+                    if (c === operandQuote)
+                        operandQuote = "";
+                    j += 1;
+                    continue;
+                }
+                if (c === "'" || c === '"') {
+                    operandQuote = c;
+                    j += 1;
+                    continue;
+                }
+                if (/[\s;|&<>]/.test(c))
+                    break;
+                j += 1;
+            }
+            if (j === operandStart || operandQuote || command.slice(i, j).startsWith("<<"))
+                uncertain = true;
+            masked += " ";
+            i = j - 1;
+            continue;
+        }
+        if (SEPARATORS.has(ch) || ch === "\n") {
+            finish(i);
+            continue;
+        }
+        masked += ch;
+    }
+    if (quote)
+        uncertain = true;
+    finish(command.length);
+    return result;
+}
 // ---------------------------------------------------------------------------
 // Payload shape
 // ---------------------------------------------------------------------------
@@ -643,18 +770,59 @@ function unsafeGitCategory(argv) {
         return "filesystem-clean";
     return "git-ambiguous";
 }
-/** The category a governed family denies with when its segment is unmodelable. */
-function unsafeSegmentDecision(family, argv) {
-    switch (family) {
-        case "git":
-            return { kind: "deny", category: unsafeGitCategory(argv), family: "git" };
-        case "rm":
-            return { kind: "deny", category: "filesystem-remove", family: "rm" };
-        case "database":
-            return { kind: "deny", category: "database-destructive", family: "psql" };
-        case "network":
-            return { kind: "deny", category: "network-mutating", family: "curl" };
+/** Diagnostic-only force policy; literal enforcement remains unchanged. */
+function diagnosticPushForce(args) {
+    return args.some(t => t === "--force" || t === "-f" ||
+        t === "--force-with-lease" || t.startsWith("--force-with-lease=") || t.startsWith("+"));
+}
+function diagnosticViolation(family, diagnostic, ctx, cwd) {
+    const full = unwrapTransparentPrefixes(diagnostic.argv);
+    // A literal prefix may prove a violation even when later arguments are unknown.
+    // It is used only to establish a denial, never to assert a complete safe argv.
+    const unknown = diagnostic.complete ? -1 : full.findIndex(t => /[$`]/.test(t));
+    const argv = unknown < 0 ? full : full.slice(0, unknown);
+    if (family === "database")
+        return evaluateDatabase(argv).kind === "deny";
+    if (family === "network")
+        return evaluateNetwork(argv).kind === "deny";
+    // Never evaluate unknown/omitted targets as a complete safe command. Visible
+    // force/SQL/network restrictions can still be established independently.
+    const git = parseGitInvocation(argv, cwd);
+    if (family === "git" && git.subcommand === "push" && diagnosticPushForce(git.args))
+        return true;
+    if (!diagnostic.complete) {
+        if (family === "rm")
+            return argv.slice(1).some(t => !t.startsWith("-")) && evaluateRemove(argv, ctx, cwd).kind === "deny";
+        if (git.subcommand === "push")
+            return git.args.filter(t => !t.startsWith("-")).length >= 2 && evaluateGitPush(git.args, ctx).kind === "deny";
+        if (git.subcommand === "reset")
+            return git.args.some(t => !t.startsWith("-")) && evaluateGitReset(git.args, ctx).kind === "deny";
+        if (git.subcommand === "clean")
+            return evaluateGitClean(git.args, ctx, git.cwd).kind === "deny";
+        return false;
     }
+    if (family === "rm")
+        return evaluateRemove(argv, ctx, cwd).kind === "deny";
+    if (git.unsafe)
+        return true;
+    if (git.subcommand === "push")
+        return evaluateGitPush(git.args, ctx).kind === "deny";
+    if (git.subcommand === "reset")
+        return evaluateGitReset(git.args, ctx).kind === "deny";
+    if (git.subcommand === "clean")
+        return evaluateGitClean(git.args, ctx, git.cwd).kind === "deny";
+    return false;
+}
+/** Select metadata only, preserving the existing category and family. */
+function unsafeSegmentDecision(family, argv, ctx, cwd, diagnostic) {
+    const category = family === "git" ? unsafeGitCategory(argv)
+        : family === "rm" ? "filesystem-remove"
+            : family === "database" ? "database-destructive" : "network-mutating";
+    const name = family === "database" ? "psql" : family === "network" ? "curl" : family;
+    const decision = { kind: "deny", category, family: name };
+    return diagnostic && category !== "git-ambiguous" &&
+        !diagnosticViolation(family, diagnostic, ctx, cwd)
+        ? { ...decision, form: "shell_form" } : decision;
 }
 /**
  * Transparent prefixes that run another command without changing what it does.
@@ -780,8 +948,54 @@ function stripStdinPrefixOptions(argv) {
     }
     return argv.slice(i);
 }
+/** The workflow names a correction worker must never launch. */
+const WORKFLOW_NAMES = "implement-ticket|plan-ticket|idea-to-pr|review-and-implement";
+/**
+ * A slash-form workflow launch: the slash starts the text or follows whitespace, and
+ * the name ends at whitespace or the end. A file path such as
+ * `docs/claude/idea-to-pr.md` has neither, so it never matches.
+ */
+const WORKFLOW_SLASH_LAUNCH = new RegExp(`(?:^|\\s)/(?:bridge-)?(?:${WORKFLOW_NAMES})(?=\\s|$)`, "i");
+/** A bare skill or command name, with optional leading slash and `plugin:` prefix. */
+const WORKFLOW_NAME_EXACT = new RegExp(`^/?(?:[A-Za-z0-9_-]+:)?(?:bridge-)?(?:${WORKFLOW_NAMES})$`, "i");
+/** The token after `npx` that names the Claude CLI package. */
+const CLAUDE_PACKAGE_TOKEN = /^(?:@anthropic-ai\/)?claude(?:-code)?(?:@\S+)?$/;
+/** The argv after the Claude CLI name, or `undefined` when this is not a Claude launch. */
+function claudeLaunchArgs(argv) {
+    const base = path.basename(argv[0] ?? "");
+    if (base === "claude")
+        return argv.slice(1);
+    if (base === "npx") {
+        const index = argv.findIndex((token, i) => i > 0 && CLAUDE_PACKAGE_TOKEN.test(token));
+        return index === -1 ? undefined : argv.slice(index + 1);
+    }
+    return undefined;
+}
+/**
+ * Is this a correction-mode Claude print run that launches a workflow (or that cannot
+ * be read well enough to rule one out)?
+ *
+ * Runs on tokenized, de-quoted argv, so a quoted prompt is one plain token. The whole
+ * argv is scanned for the print flag and for a workflow slash launch, because the
+ * prompt may sit anywhere among the options. A print run in a segment the tokenizer
+ * marked unsafe denies without trying to resolve the substitution.
+ */
+function isClaudeWorkflowPrintLaunch(segment) {
+    const args = claudeLaunchArgs(segment.argv);
+    if (args === undefined)
+        return false;
+    const printing = args.some((token) => token === "-p" || token === "--print" || token.startsWith("--print="));
+    if (!printing)
+        return false;
+    if (segment.unsafe)
+        return true;
+    return args.some((token) => {
+        const value = token.startsWith("--print=") ? token.slice("--print=".length) : token;
+        return WORKFLOW_SLASH_LAUNCH.test(value);
+    });
+}
 /** Evaluate one already-tokenized simple command. */
-function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = false) {
+function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = false, diagnostic) {
     const argv = unwrapTransparentPrefixes(segment.argv);
     const executable = argv[0];
     if (executable === undefined)
@@ -794,8 +1008,9 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
         const cIndex = argv.findIndex((t) => t === "-c");
         const inner = cIndex === -1 ? undefined : argv[cIndex + 1];
         if (inner !== undefined) {
-            for (const nested of tokenizeShellCommand(inner)) {
-                const decision = evaluateSimpleCommand(nested, ctx, payloadCwd, depth + 1, stdinFed);
+            const projections = diagnostic?.complete ? diagnosticProjections(inner) : [];
+            for (const [i, nested] of tokenizeShellCommand(inner).entries()) {
+                const decision = evaluateSimpleCommand(nested, ctx, payloadCwd, depth + 1, stdinFed, projections[i]);
                 if (decision.kind === "deny")
                     return decision;
             }
@@ -804,8 +1019,10 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
     }
     // `eval <words>` — join and re-tokenize, exactly as the shell would.
     if (EVAL_BUILTINS.has(path.basename(executable)) && depth < 4) {
-        for (const nested of tokenizeShellCommand(argv.slice(1).join(" "))) {
-            const decision = evaluateSimpleCommand(nested, ctx, payloadCwd, depth + 1, stdinFed);
+        const inner = argv.slice(1).join(" ");
+        const projections = diagnostic?.complete ? diagnosticProjections(inner) : [];
+        for (const [i, nested] of tokenizeShellCommand(inner).entries()) {
+            const decision = evaluateSimpleCommand(nested, ctx, payloadCwd, depth + 1, stdinFed, projections[i]);
             if (decision.kind === "deny")
                 return decision;
         }
@@ -825,9 +1042,12 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
         // `stdinFed` from here down: once arguments come from stdin, no containment or
         // destination question about them can be answered, so reaching a governed
         // family at any depth below denies.
-        return evaluateSimpleCommand({ argv: rest, unsafe: segment.unsafe }, ctx, payloadCwd, depth + 1, true);
+        return evaluateSimpleCommand({ argv: rest, unsafe: segment.unsafe }, ctx, payloadCwd, depth + 1, true, diagnostic ? { argv: stripStdinPrefixOptions(unwrapTransparentPrefixes(diagnostic.argv)), complete: false } : undefined);
     }
     segment = { argv, unsafe: segment.unsafe };
+    if (ctx.correctionEnforced && isClaudeWorkflowPrintLaunch(segment)) {
+        return { kind: "deny", category: "workflow-launch-shell", family: "workflow" };
+    }
     const family = classify(executable);
     if (family === null)
         return { kind: "allow" };
@@ -835,11 +1055,11 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
     // under `stdinFed` can never be proven safe regardless of how its visible argv
     // looks — the fail-CLOSED rule, applied after every wrapper has been resolved.
     if (stdinFed)
-        return unsafeSegmentDecision(family, segment.argv);
+        return unsafeSegmentDecision(family, segment.argv, ctx, resolveEffectiveCwd(ctx, payloadCwd), diagnostic);
     // A governed family inside a segment carrying substitution or redirection can
     // never be proven safe — deny, per the fail-CLOSED half of the contract.
     if (segment.unsafe)
-        return unsafeSegmentDecision(family, segment.argv);
+        return unsafeSegmentDecision(family, segment.argv, ctx, resolveEffectiveCwd(ctx, payloadCwd), diagnostic);
     const cwd = resolveEffectiveCwd(ctx, payloadCwd);
     if (family === "rm")
         return evaluateRemove(segment.argv, ctx, cwd);
@@ -850,21 +1070,70 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
     const git = parseGitInvocation(segment.argv, cwd);
     if (git.subcommand === "push") {
         return git.unsafe
-            ? { kind: "deny", category: "git-push", family: "git" }
+            ? unsafeSegmentDecision("git", segment.argv, ctx, cwd, diagnostic)
             : evaluateGitPush(git.args, ctx);
     }
     if (git.subcommand === "reset") {
         return git.unsafe
-            ? { kind: "deny", category: "git-reset-hard", family: "git" }
+            ? unsafeSegmentDecision("git", segment.argv, ctx, cwd, diagnostic)
             : evaluateGitReset(git.args, ctx);
     }
     if (git.subcommand === "clean") {
         return git.unsafe
-            ? { kind: "deny", category: "filesystem-clean", family: "git" }
+            ? unsafeSegmentDecision("git", segment.argv, ctx, cwd, diagnostic)
             : evaluateGitClean(git.args, ctx, git.cwd);
     }
     return { kind: "allow" };
 }
+function workflowDeny(category) {
+    return { kind: "deny", category, family: "workflow" };
+}
+/**
+ * Tools that read or change files. Their path and pattern fields name files, and a
+ * file named after a workflow is not a workflow launch, so they are never matched.
+ */
+const FILE_TOOLS = new Set(["Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Grep", "Glob"]);
+/** The fields of each invocation tool that can carry a workflow launch. */
+const INVOCATION_FIELDS = {
+    Skill: ["skill", "args"],
+    Task: ["prompt", "description"],
+    Agent: ["prompt", "description"],
+    SlashCommand: ["command"],
+};
+/** An `mcp__` tool whose name is a planner or recipe entry point. */
+const PLANNER_TOOL_NAME = /(?:request_plan_generation|get_pipeline_recipe|plan_ticket|implement_ticket)/i;
+/**
+ * Correction-mode dispatch by tool role. Returns a decision for a file tool, an
+ * invocation tool, a planner tool, or an unknown role, and `undefined` for `Bash`,
+ * which the caller evaluates as a shell command.
+ */
+function evaluateCorrectionToolRole(toolName, input) {
+    if (FILE_TOOLS.has(toolName))
+        return { kind: "allow" };
+    if (toolName === "Bash")
+        return undefined;
+    const fields = INVOCATION_FIELDS[toolName];
+    if (fields !== undefined) {
+        for (const field of fields) {
+            const value = input[field];
+            if (value === undefined)
+                continue;
+            if (typeof value !== "string")
+                return workflowDeny("workflow-launch-skill");
+            const nameField = toolName === "Skill" ? field === "skill" : toolName === "SlashCommand";
+            if (WORKFLOW_SLASH_LAUNCH.test(value) || (nameField && WORKFLOW_NAME_EXACT.test(value.trim().split(/\s+/)[0] ?? ""))) {
+                return workflowDeny("workflow-launch-skill");
+            }
+        }
+        return { kind: "allow" };
+    }
+    if (/^mcp__/i.test(toolName) && PLANNER_TOOL_NAME.test(toolName)) {
+        return workflowDeny("workflow-planner-tool");
+    }
+    // Any other role: only an explicit workflow launch in a string argument denies.
+    const args = Object.values(input).filter((v) => typeof v === "string").join(" ");
+    return WORKFLOW_SLASH_LAUNCH.test(args) ? workflowDeny("workflow-entry") : undefined;
+}
 /**
  * Evaluate a parsed PreToolUse payload.
  *
@@ -878,50 +1147,37 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
  * governed here.
  */
 export function evaluateWorkerGuardPayload(payload, ctx) {
-    const root = asRecord(payload);
     if (ctx.correctionContextInvalid)
-        return { kind: "deny", category: "workflow-entry", family: "workflow" };
-    if (root === undefined)
-        return ctx.correctionEnforced
-            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
-            : { kind: "malformed" };
+        return workflowDeny("correction-context-invalid");
+    const root = asRecord(payload);
+    if (root === undefined) {
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    }
     const toolName = root.tool_name ?? root.toolName;
-    if (typeof toolName !== "string")
-        return ctx.correctionEnforced
-            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
-            : { kind: "malformed" };
+    if (typeof toolName !== "string") {
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    }
     const input = asRecord(root.tool_input ?? root.toolInput);
     if (ctx.correctionEnforced) {
         if (input === undefined)
-            return { kind: "deny", category: "workflow-entry", family: "workflow" };
-        const args = Object.values(input).filter((v) => typeof v === "string").join(" ");
-        const fullEntry = /(?:^|\s|\/)\/?(?:bridge-)?(?:implement-ticket|plan-ticket|idea-to-pr|review-and-implement)(?:\s|$|\.)/i;
-        const recipePath = /(?:commands\/src|\.claude\/commands|\.cursor\/commands|pipelines)\/(?:implement-ticket|plan-ticket)(?:\.md|\.json)?/i;
-        const plannerTool = /(?:request_plan_generation|get_pipeline_recipe|plan_ticket|implement_ticket)/i;
-        if (recipePath.test(args) || fullEntry.test(args) ||
-            (plannerTool.test(toolName) && toolName !== "Bash")) {
-            return { kind: "deny", category: "workflow-entry", family: "workflow" };
-        }
-        if (/^(?:Task|Agent|Skill|SlashCommand|mcp__)/i.test(toolName) &&
-            (fullEntry.test(args) || plannerTool.test(args))) {
-            return { kind: "deny", category: "workflow-entry", family: "workflow" };
-        }
+            return workflowDeny("correction-payload-invalid");
+        const decision = evaluateCorrectionToolRole(toolName, input);
+        if (decision !== undefined)
+            return decision;
     }
     if (toolName !== "Bash")
         return { kind: "allow" };
     if (input === undefined)
-        return ctx.correctionEnforced
-            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
-            : { kind: "malformed" };
+        return { kind: "malformed" };
     const command = input.command;
-    if (typeof command !== "string")
-        return ctx.correctionEnforced
-            ? { kind: "deny", category: "workflow-entry", family: "workflow" }
-            : { kind: "malformed" };
+    if (typeof command !== "string") {
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    }
     const rawCwd = root.cwd ?? input.cwd;
     const payloadCwd = typeof rawCwd === "string" ? rawCwd : undefined;
-    for (const segment of tokenizeShellCommand(command)) {
-        const decision = evaluateSimpleCommand(segment, ctx, payloadCwd);
+    const projections = diagnosticProjections(command);
+    for (const [i, segment] of tokenizeShellCommand(command).entries()) {
+        const decision = evaluateSimpleCommand(segment, ctx, payloadCwd, 0, false, projections[i]);
         if (decision.kind === "deny")
             return decision;
     }
@@ -934,9 +1190,11 @@ export function evaluateWorkerGuardPayload(payload, ctx) {
  * exception: the binary's job is to emit one bounded line and get out of the way.
  */
 export function evaluateWorkerGuardInput(raw, ctx) {
-    const unreadable = () => ctx.correctionEnforced || ctx.correctionContextInvalid
-        ? { kind: "deny", category: "workflow-entry", family: "workflow" }
-        : { kind: "malformed" };
+    const unreadable = () => {
+        if (ctx.correctionContextInvalid)
+            return workflowDeny("correction-context-invalid");
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    };
     if (typeof raw !== "string")
         return unreadable();
     if (raw.length > WORKER_GUARD_MAX_PAYLOAD_BYTES)

package/build/executor/worker-log.js

@@ -83,8 +83,8 @@ function errorCode(err) {
  * only the job id, attempt number and a closed reason — never a path, an
  * exception message, or transcript content.
  */
-export function formatWorkerLogUnavailableWarning(identity, reason) {
-    return (`worker log unavailable for job ${identity.jobId} attempt ${identity.attempt} (${reason}); ` +
+export function formatWorkerLogUnavailableWarning(identity, reason, timestamp) {
+    return (`${timestamp ? timestamp + " " : ""}worker log unavailable for job ${identity.jobId} attempt ${identity.attempt} (${reason}); ` +
         "the attempt continues without a recorded transcript.");
 }
 /** Create the attempt file exclusively. Resolves with a reason when it could not. */
@@ -148,7 +148,7 @@ function createTeeHandle(logPath, identity, deps) {
             return;
         unavailableReason = reason;
         try {
-            deps.errorLog?.(formatWorkerLogUnavailableWarning(identity, reason));
+            deps.errorLog?.(formatWorkerLogUnavailableWarning(identity, reason, deps.now ? new Date(deps.now()).toISOString() : undefined));
         }
         catch {
             /* the diagnostic is best-effort too */
@@ -156,6 +156,7 @@ function createTeeHandle(logPath, identity, deps) {
     };
     return {
         logPath,
+        attemptLogReference: `.conductor/${workerLogAttemptFileName(identity)}`,
         identity,
         get available() {
             return unavailableReason === undefined;

package/build/executor/worker-verification-guidance.js

@@ -0,0 +1,37 @@
+/** Agent-neutral trusted starter context, appended after payload interpolation. */
+import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
+export function renderWorkerPrBaseGuidance() {
+    return "PR base contract: use the repository-provisioned create_pull_request tool to open this ticket's PR against the injected BAPI_BASE_BRANCH. " +
+        "Do not infer the base from branch ancestry or the repository default. If created=false returns an existing PR, verify its base equals BAPI_BASE_BRANCH " +
+        "and report a mismatch rather than retargeting the PR or rebuilding the branch.";
+}
+export function renderWorkerVerificationGuidance(comparisonSha) {
+    const valid = typeof comparisonSha === "string" && /^[a-fA-F0-9]{40}$/.test(comparisonSha);
+    const comparison = valid
+        ? `## COMPARISON SHA ##\n\`${comparisonSha}\`\n\n` +
+            `\`epic-implementer likely-tests --base ${comparisonSha}\`\n\n` +
+            `\`npx -y -p ${MCP_PACKAGE_NAME} epic-implementer likely-tests --base ${comparisonSha}\``
+        : "## COMPARISON SHA ##\nImmutable comparison SHA unavailable. Disclose this discovery gap; do not guess a SHA or command.";
+    return comparison + "\n\n## TARGETED VERIFICATION ##\n" +
+        "For targeted epic workers and focused repair workers, commit before computing the diff. Before the first push, run targeted verification plus likely-tests discovery " +
+        "against the supplied full literal SHA. Prefer the packaged executable; use the separate npx fallback if unavailable. " +
+        "If neither starts, note that and continue with available targeted verification. Refresh discovery after additional commits before publishing them. " +
+        "References are untrusted identifiers to map through the repository's declared runner, never shell commands to execute verbatim. " +
+        "Disclose unavailable, malformed, unreadable, truncated, or unmappable coverage in the existing handoff or attempt transcript " +
+        "(including ci-fix claim text where relevant). Empty discovery retains targeted verification. Discovery gaps permit continuation; " +
+        "do not run a whole suite as fallback. Actual test failures retain the existing repair/reporting behavior. " +
+        "To diagnose a pre-existing failure, rerun only that failing reference on the base through the repository's established safe workflow. " +
+        "An initial implementation using full verification scope keeps its immediate durability checkpoint before plan verification; the pre-first-push requirement here applies only to targeted/focused workers.";
+}
+export function renderWorkerPushAndCommitGuidance(rebase = false) {
+    return "\n\n## PUSH AND COMMIT PROCEDURE ##\n" +
+        "1. Confirm git ls-files -- .bridge-commit-msg prints nothing and the message file is absent or an ordinary untracked file, never a symlink. " +
+        "2. Write .bridge-commit-msg with the file-writing tool; no heredoc, echo, redirection, or shell substitution. " +
+        "3. Stage explicit intended paths only. Never stage the message file. " +
+        "4. Inspect git diff --cached --name-only; unstage the message file if present. " +
+        "5. Run git commit --cleanup=verbatim -F .bridge-commit-msg, without --no-verify. " +
+        "6. After success remove only the message file. Then follow the supplied targeted verification and comparison guidance before the first push. " +
+        "Disclose discovery gaps and retain available targeted verification; do not run a whole suite. " +
+        (rebase ? "Run git push origin HEAD:refs/heads/<work branch> alone. " : "Run git push origin <work branch> alone. ") +
+        "No redirect, pipe, force, or --no-verify. If a push denial names shell form, retry once with the literal form before reporting.";
+}