@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/conductor/bring-up-facts.js

@@ -1,5 +1,5 @@
 /** The pinned operator runbook every remedy below points into. */
-export const BRING_UP_RUNBOOK = "docs/claude/epic-implementer-v2-operator-runbook.md";
+export const BRING_UP_RUNBOOK = "docs/epic-implementer/operator-runbook.md";
 /**
  * The client-derived refusal vocabulary, IN REFUSAL ORDER.
  *

package/build/conductor/command-drift-production.js

@@ -0,0 +1,92 @@
+/**
+ * Production boundaries for the pure command-drift probe (BAPI-1392).
+ *
+ * `command-drift.ts` is dependency-injected and imports no `fs` or
+ * `child_process`; this module is where those effects live. Two boundaries:
+ *
+ *  - the Git boundary, a list-argument `git` runner (never a shell) that can pass
+ *    the packaged UTF-8 bytes on stdin for `git hash-object --stdin`; and
+ *  - the profile boundary, which resolves repo-scoped Bridge access through the
+ *    shared credential resolver and reads the confirmed gate profile through the
+ *    existing `fetchConductorGateProfile` — no second profile reader.
+ *
+ * Everything here is read-only. Raw Git output, error text and credentials are
+ * never surfaced: a failure is a thrown marker the probe maps to a closed reason.
+ */
+import { spawnSync } from "node:child_process";
+import { COMMANDS } from "../commands.generated.js";
+import { probeCommandDrift, } from "./command-drift.js";
+/** Bounded timeout for one Git subprocess. */
+const GIT_TIMEOUT_MS = 5_000;
+const BLOB_ID = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+export function createGitRunner(cwd) {
+    return (args, input) => {
+        const result = spawnSync("git", args, {
+            cwd,
+            input,
+            encoding: "utf-8",
+            timeout: GIT_TIMEOUT_MS,
+            stdio: [input === undefined ? "ignore" : "pipe", "pipe", "ignore"],
+        });
+        if (result.error)
+            return { status: null, stdout: "" };
+        return { status: result.status, stdout: typeof result.stdout === "string" ? result.stdout : "" };
+    };
+}
+/** The Git boundary. Throws when Git is unavailable; "no tracked copy" is a value. */
+export function createCommandDriftGit(run) {
+    let headState;
+    const ensureRepository = () => {
+        if (headState)
+            return headState;
+        const inside = run(["rev-parse", "--git-dir"]);
+        if (inside.status !== 0)
+            throw new Error("git-unavailable");
+        // A repository with no commit yet has no HEAD, so nothing is tracked at HEAD.
+        headState = run(["rev-parse", "--verify", "--quiet", "HEAD"]).status === 0 ? "commit" : "no-commit";
+        return headState;
+    };
+    return {
+        async trackedBlob(path) {
+            if (ensureRepository() === "no-commit")
+                return { tracked: false };
+            const result = run(["rev-parse", "--verify", "--quiet", `HEAD:${path}`]);
+            if (result.status === null)
+                throw new Error("git-unavailable");
+            const id = result.stdout.trim();
+            return result.status === 0 && BLOB_ID.test(id) ? { tracked: true, blobId: id } : { tracked: false };
+        },
+        async hashObject(content) {
+            ensureRepository();
+            const result = run(["hash-object", "--stdin"], content);
+            const id = result.stdout.trim();
+            if (result.status !== 0 || !BLOB_ID.test(id))
+                throw new Error("git-unavailable");
+            return id;
+        },
+    };
+}
+/**
+ * Build the production drift inspector: resolve Bridge access, read the confirmed
+ * profile's `customized_commands` (an unconfirmed repository has none), and probe
+ * Git. Never throws; an unresolved credential or failed read is a `warn`.
+ */
+export function createCommandDriftInspector(options) {
+    return () => probeCommandDrift({
+        catalog: COMMANDS,
+        git: createCommandDriftGit(options.runGit ?? createGitRunner(options.cwd)),
+        fetchCustomizedCommands: async () => {
+            // Lazy: keeps the credential/HTTP graph out of the static imports, as the
+            // doctor's other credentialed inspections do.
+            const client = await import("./bridge-api-client.js");
+            const resolved = await client.resolveConductorBridgeApiAccess({
+                env: options.env,
+                cwd: options.cwd,
+            });
+            if (!resolved.ok)
+                throw new Error("profile-unavailable");
+            const read = await client.fetchConductorGateProfile(resolved.access, ((url, init) => (options.fetch ?? fetch)(url, init)));
+            return read.profile?.customized_commands ?? [];
+        },
+    });
+}

package/build/conductor/command-drift.js

@@ -0,0 +1,89 @@
+/** Stable row id shared by `doctor` and `readiness`. */
+export const COMMAND_DRIFT_ROW_ID = "command-drift";
+export const COMMAND_DRIFT_ROW_LABEL = "Committed command drift";
+/** Group-level remedy for divergent, non-customized commands. */
+export const COMMAND_DRIFT_DIVERGENT_REMEDIATION = "run `/upgrade-bridge` and commit the refreshed commands, or mark the command customized in the gate profile";
+/** Remedy when the check itself could not be completed. */
+export const COMMAND_DRIFT_UNASSESSABLE_REMEDIATION = "restore Bridge profile access and Git access for this repository, then rerun `epic-implementer doctor`";
+const SAFE_COMMAND_FILE = /^([a-z][a-z0-9-]*)\.md$/;
+/** The repository-relative path of a packaged command's tracked copy. */
+export function commandDriftTrackedPath(name) {
+    return `.claude/commands/${name}.md`;
+}
+/** Run the probe. Never throws and never returns a `fail`. */
+export async function probeCommandDrift(deps) {
+    let customized;
+    try {
+        customized = new Set(await deps.fetchCustomizedCommands());
+    }
+    catch {
+        return { status: "warn", kind: "unassessable", reason: "profile-unavailable" };
+    }
+    const names = [];
+    for (const key of Object.keys(deps.catalog)) {
+        const match = SAFE_COMMAND_FILE.exec(key);
+        if (match)
+            names.push(match[1]);
+    }
+    names.sort();
+    const divergent = [];
+    const customizedDivergent = [];
+    try {
+        for (const name of names) {
+            const tracked = await deps.git.trackedBlob(commandDriftTrackedPath(name));
+            if (!tracked.tracked)
+                continue;
+            const packaged = await deps.git.hashObject(deps.catalog[`${name}.md`]);
+            if (packaged === tracked.blobId)
+                continue;
+            (customized.has(name) ? customizedDivergent : divergent).push(name);
+        }
+    }
+    catch {
+        return { status: "warn", kind: "unassessable", reason: "git-unavailable" };
+    }
+    if (divergent.length === 0)
+        return { status: "pass", customizedDivergent };
+    return { status: "warn", kind: "divergent", divergent, customizedDivergent };
+}
+function commandList(names) {
+    return names.map((n) => `/${n}`).join(", ");
+}
+/**
+ * The ONE projection of a probe result into a report row, shared by `doctor` and
+ * `readiness` so wording, ordering and remediation are decided once. The status
+ * vocabulary is the readiness one, and only `pass` or `warn` is ever produced.
+ */
+export function projectCommandDriftRow(result) {
+    const base = { id: COMMAND_DRIFT_ROW_ID, label: COMMAND_DRIFT_ROW_LABEL };
+    if (result.status === "pass") {
+        return {
+            ...base,
+            status: "pass",
+            detail: "committed Bridge commands match the packaged copies" +
+                (result.customizedDivergent.length > 0
+                    ? `; customized, not a warning: ${commandList(result.customizedDivergent)}`
+                    : ""),
+        };
+    }
+    if (result.kind === "divergent") {
+        return {
+            ...base,
+            status: "warn",
+            detail: `divergent / likely stale: ${commandList(result.divergent)}` +
+                (result.customizedDivergent.length > 0
+                    ? `; customized, not a warning: ${commandList(result.customizedDivergent)}`
+                    : ""),
+            remediation: COMMAND_DRIFT_DIVERGENT_REMEDIATION,
+        };
+    }
+    const reason = result.reason === "profile-unavailable"
+        ? "the gate profile could not be read"
+        : "Git could not be inspected";
+    return {
+        ...base,
+        status: "warn",
+        detail: `Could not check command drift: ${reason}`,
+        remediation: COMMAND_DRIFT_UNASSESSABLE_REMEDIATION,
+    };
+}

package/build/conductor/doctor.js

@@ -15,6 +15,7 @@ import { detectClaudeLogin, formatClaudeLoginAdvisory } from "../claude-login.js
 import { inspectConductorGitHooks } from "./git-hooks.js";
 import { MERGE_WORKFLOW_IDENTIFIER } from "./merge-execution-contract.js";
 import { resolveMcpShimInvocationForRuntime, resolvePackageRootFromModuleUrl, } from "../mcp-server-invocation.js";
+import { projectCommandDriftRow } from "./command-drift.js";
 import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 import { resolveProfiles } from "../mcp-profile.js";
 import { createReadinessCheck, createReadinessCheckSafely, } from "../readiness-check.js";
@@ -694,6 +695,9 @@ export async function buildConductorDoctorReport(deps = {}) {
         homedir: deps.claudeLoginDeps?.homedir ?? os.homedir,
         readFile: deps.claudeLoginDeps?.readFile ?? ((p) => readFileAsync(p, "utf-8")),
     });
+    const command_drift = deps.inspectCommandDrift
+        ? await inspectCommandDriftSafe(deps.inspectCommandDrift)
+        : undefined;
     return {
         ledger,
         git_hooks: inspectHooks(deps.hooksDeps),
@@ -704,8 +708,18 @@ export async function buildConductorDoctorReport(deps = {}) {
         deny_enforcement,
         claude_login,
         repair_credentials: await inspectRepairVerbCredentials(deps.env ?? process.env, deps.resolveRepairAccess),
+        ...(command_drift ? { command_drift } : {}),
     };
 }
+/** Run the drift inspector, containing any throw as an unassessable `warn`. */
+async function inspectCommandDriftSafe(inspect) {
+    try {
+        return await inspect();
+    }
+    catch {
+        return { status: "warn", kind: "unassessable", reason: "git-unavailable" };
+    }
+}
 /**
  * Run the GitHub Actions merge inspector, containing any throw as degraded data.
  *
@@ -822,9 +836,9 @@ export function formatConductorDoctorReport(report) {
             lines.push(`  - ${w}`);
     }
     lines.push("");
-    lines.push("Epic Conductor v2 reconciles epics server-side — nothing to schedule");
-    lines.push("locally. To execute claimed jobs on this machine, run:");
-    lines.push(`  npx -y ${MCP_PACKAGE_NAME} executor --repo <name>`);
+    lines.push("The Epic Implementer reconciles epics server-side — nothing to schedule");
+    lines.push("locally. To execute a run's claimed jobs on this machine, run:");
+    lines.push(`  npx -y ${MCP_PACKAGE_NAME} executor --repo <name> --epic-run-id <run-id>`);
     lines.push("");
     lines.push("MCP Profile (optional, local)");
     lines.push("─────────────────────────────");
@@ -940,6 +954,17 @@ export function formatConductorDoctorReport(report) {
     }
     lines.push("");
     lines.push(formatClaudeLoginAdvisory(claude_login));
+    // BAPI-1392 — the same projected row `readiness` shows, last in both reports.
+    // Warn-only: it never changes this command's exit code.
+    if (report.command_drift) {
+        const row = projectCommandDriftRow(report.command_drift);
+        lines.push("");
+        lines.push("Committed command drift (advisory)");
+        lines.push("──────────────────────────────────");
+        lines.push(`${row.id}:         ${row.status === "pass" ? "[OK]" : "[WARNING]"} ${row.detail ?? ""}`);
+        if (row.remediation)
+            lines.push(`  → ${row.remediation}`);
+    }
     return lines.join("\n");
 }
 // ---------------------------------------------------------------------------
@@ -1136,33 +1161,51 @@ export function mapConductorDoctorReportToReadinessChecks(report) {
         record(outcome);
     record(denyEnforcementOutcome(report));
     record(claudeLoginOutcome(report));
-    return CONDUCTOR_READINESS_DESCRIPTORS.map(({ id, label }) => {
-        const outcome = collected.get(id);
-        if (!outcome) {
-            // Unknown, and unknown is never healthy: a prerequisite whose owning
-            // inspection did not report is a failure with a restoring remediation.
-            return createReadinessCheck({
+    // BAPI-1392 — appended AFTER the fixed descriptor set and only when the drift
+    // inspection ran. It is deliberately not a descriptor: an uncollected
+    // descriptor reports as a `fail`, and this row is warn-only by contract.
+    const driftChecks = report?.command_drift
+        ? (() => {
+            const row = projectCommandDriftRow(report.command_drift);
+            return [
+                createReadinessCheckSafely({
+                    id: `conductor.${row.id}`,
+                    source: "conductor",
+                    label: row.label,
+                    status: row.status,
+                    ...(row.detail ? { detail: row.detail } : {}),
+                    ...(row.remediation ? { remediation: row.remediation } : {}),
+                }),
+            ];
+        })()
+        : [];
+    return [...CONDUCTOR_READINESS_DESCRIPTORS.map(({ id, label }) => {
+            const outcome = collected.get(id);
+            if (!outcome) {
+                // Unknown, and unknown is never healthy: a prerequisite whose owning
+                // inspection did not report is a failure with a restoring remediation.
+                return createReadinessCheck({
+                    id: `conductor.${id}`,
+                    source: "conductor",
+                    label,
+                    status: "fail",
+                    detail: CONDUCTOR_UNCOLLECTED_DETAIL,
+                    remediation: CONDUCTOR_UNCOLLECTED_REMEDIATION,
+                });
+            }
+            return createReadinessCheckSafely({
                 id: `conductor.${id}`,
                 source: "conductor",
-                label,
-                status: "fail",
-                detail: CONDUCTOR_UNCOLLECTED_DETAIL,
-                remediation: CONDUCTOR_UNCOLLECTED_REMEDIATION,
+                label: outcome.label || label,
+                status: outcome.status,
+                ...(outcome.detail ? { detail: outcome.detail } : {}),
+                // Same fallback as the plane adapter: a real failure must never be
+                // downgraded into a generic "unreadable check" for want of a fix line.
+                ...(outcome.status === "fail"
+                    ? { remediation: outcome.remediation ?? CONDUCTOR_UNCOLLECTED_REMEDIATION }
+                    : outcome.status !== "pass" && outcome.remediation
+                        ? { remediation: outcome.remediation }
+                        : {}),
             });
-        }
-        return createReadinessCheckSafely({
-            id: `conductor.${id}`,
-            source: "conductor",
-            label: outcome.label || label,
-            status: outcome.status,
-            ...(outcome.detail ? { detail: outcome.detail } : {}),
-            // Same fallback as the plane adapter: a real failure must never be
-            // downgraded into a generic "unreadable check" for want of a fix line.
-            ...(outcome.status === "fail"
-                ? { remediation: outcome.remediation ?? CONDUCTOR_UNCOLLECTED_REMEDIATION }
-                : outcome.status !== "pass" && outcome.remediation
-                    ? { remediation: outcome.remediation }
-                    : {}),
-        });
-    });
+        }), ...driftChecks];
 }