@bridge_gpt/mcp-server 0.2.67 → 0.2.68

package/build/doctor.js

@@ -1,3 +1,6 @@
+import { formatGitCompatibilityDiagnostic } from "./start-tickets-prereqs.js";
+import { constants as assetFsConstants } from "node:fs";
+import { collectPackagedAssetDoctor } from "./generated-assets-doctor.js";
 /**
  * doctor — a strictly read-only, detect-and-instruct diagnostics subcommand for
  * the packaged `start-tickets` automation (BAPI-305).
@@ -19,7 +22,7 @@
  * reach a mutating lifecycle verb — `enable-linger`, `bootstrap`, `start` and
  * their kin exist in this file only as remediation TEXT the operator runs.
  */
-import { readdir, readFile, stat } from "fs/promises";
+import { readdir, readFile, stat, lstat, access, realpath } from "fs/promises";
 import { spawn } from "child_process";
 import os from "os";
 import path from "path";
@@ -54,6 +57,7 @@ import { validateBranchName } from "./base-ref.js";
 import { readPlaneManifest } from "./plane/manifest.js";
 import { validateTicketKey } from "./ticket-key-utils.js";
 import { resolveBranchForTicket } from "./worktree-core.js";
+import { BRIDGE_PERMISSIONS_MANIFEST_RELPATH, inspectBridgePermissions, } from "./bridge-permissions.js";
 import { diagnoseStaleWorktreeBranches, formatStaleWorktreeDiagnosticReport, } from "./stale-worktree-doctor.js";
 /**
  * The report/usage title (BAPI-669, U9b). `doctor` diagnoses the whole Bridge
@@ -76,6 +80,7 @@ export function getDoctorUsage() {
         `${DOCTOR_REPORT_TITLE}. It only checks your environment and prints manual`,
         "install instructions — it does not install anything, modify your system, or",
         "start the MCP server.",
+        "Git presence remains a prerequisite; Git-version compatibility is advisory-only.",
         "",
         "Flags:",
         "  --agent claude|cursor-agent|codex  Agent to include in the prerequisite check (default: claude)",
@@ -159,6 +164,13 @@ export function getDoctorUsage() {
         "It reads no install-state file, writes nothing, runs no launchctl/systemctl, and",
         "is advisory: missing, malformed, or credential-less units never change the exit code.",
         "",
+        "It also includes an advisory '/drive-epic-run permission rules' section",
+        "(BAPI-1398): whether the project permissions.allow rules and the optional user",
+        "autoMode entries that install writes are PRESENT, MISSING, or DRIFTED (for",
+        "example after the BAPI_MCP_CLI launcher changed). It reads .claude/settings.local.json,",
+        "~/.claude/settings.json, and .bridge/bridge-permissions.json, writes nothing,",
+        "and never changes the exit code.",
+        "",
         "Conductor ledger / native-module diagnostics (the SQLite ledger's native",
         "binding load status and Node-version skew) live under a separate command:",
         "  epic-implementer doctor",
@@ -363,6 +375,7 @@ export async function collectDoctorResults(deps, agentName) {
     const injected = deps;
     const probeDeps = {
         ...deps,
+        commandAssetMetadata: injected.commandAssetMetadata ?? { lstat, access: p => access(p, assetFsConstants.R_OK) },
         readFile: injected.readFile ?? ((p) => readFile(p, "utf-8")),
         stat: injected.stat ?? ((p) => stat(p)),
         homedir: injected.homedir ?? os.homedir,
@@ -412,6 +425,10 @@ export function formatDoctorPrereqSection(platform, collection) {
         return lines.join("\n");
     }
     for (const result of collection.results) {
+        if (result.gitCompatibility) {
+            lines.push(formatGitCompatibilityDiagnostic(result.gitCompatibility));
+            continue;
+        }
         const status = result.found ? "FOUND  " : "MISSING";
         // Missing-detail stays suppressed for every prerequisite EXCEPT one that has
         // been explicitly audited (BAPI-727, `renderDetailWhenMissing`). The general
@@ -1679,6 +1696,55 @@ export function formatOperationalAdvisoryReport(diagnostic) {
     lines.push("           runs NO command probe, repairs no scheduler, and never changes the exit code.");
     return lines.join("\n");
 }
+/** Collect the permission-rules inspection. Reads only; never writes. */
+export async function collectBridgePermissionsDiagnostic(deps) {
+    return inspectBridgePermissions({ cwd: deps.cwd, homeDir: deps.homeDir, env: deps.env }, { readFile: deps.readFile });
+}
+function formatPermissionScope(label, scope, optionalNote) {
+    switch (scope.state) {
+        case "present":
+            return [`PRESENT   ${label} — all ${scope.count} Bridge entries in ${scope.path}`];
+        case "missing":
+            return [
+                `MISSING   ${label} — ${scope.missing.length} Bridge entr${scope.missing.length === 1 ? "y is" : "ies are"} absent from ${scope.path}`,
+                ...(optionalNote ? [`  ${optionalNote}`] : []),
+            ];
+        case "drifted":
+            return [
+                `DRIFTED   ${label} — ${scope.reason} (${scope.path})`,
+                ...(scope.missing.length > 0 ? [`  ${scope.missing.length} current rule(s) missing.`] : []),
+                ...(scope.stale.length > 0 ? [`  ${scope.stale.length} rule(s) Bridge wrote earlier no longer match.`] : []),
+            ];
+        case "malformed":
+            return [`MALFORMED ${label} — ${scope.path} is not valid JSON settings; doctor did not change it.`];
+    }
+}
+/** Render the permission-rules section (pure formatting, secret-free). */
+export function formatBridgePermissionsDiagnosticReport(inspection) {
+    const lines = ["", "/drive-epic-run permission rules (auto mode)", ""];
+    if (inspection.launcher.ok) {
+        lines.push(`Launcher prefix: ${inspection.launcher.prefix}`);
+        if (inspection.recordedLauncher && inspection.recordedLauncher !== inspection.launcher.prefix) {
+            lines.push(`  Rules were written for a different launcher: ${inspection.recordedLauncher}`);
+        }
+    }
+    if (inspection.project.state === "launcher-refused") {
+        lines.push("REFUSED   project permissions.allow — the launcher override cannot be matched by an exact rule.");
+        if (!inspection.launcher.ok)
+            lines.push(`  ${inspection.launcher.reason}.`);
+    }
+    else {
+        lines.push(...formatPermissionScope("project permissions.allow", inspection.project));
+    }
+    lines.push(...formatPermissionScope("user autoMode entries", inspection.user, "Optional: install adds them only after you say yes."));
+    const healthy = inspection.project.state === "present" && inspection.user.state === "present";
+    if (!healthy) {
+        lines.push(`  To repair: re-run \`npx -y ${MCP_PACKAGE_NAME} install\` in a terminal (it lists every rule it writes).`);
+        lines.push(`  To remove Bridge's entries: \`npx -y ${MCP_PACKAGE_NAME} install --remove-bridge-permissions\`.`);
+    }
+    lines.push(`  Bridge's ownership record: ${BRIDGE_PERMISSIONS_MANIFEST_RELPATH}. Advisory only; never changes the exit code.`);
+    return lines.join("\n");
+}
 /**
  * Read-only inventory of this host's epic-launch profiles and whether each
  * one's credential binding matches its target. It reports; it never binds or
@@ -1886,6 +1952,13 @@ export async function runDoctorCli(argv, overrides = {}) {
     const preference = await readModelRoutingPreference(deps.env.BAPI_REPO_NAME ?? "_doctor_unscoped_", "review_ticket", preferencePath);
     log(`Personal model routing preference: ${preference.warning ?? preference.source}.`);
     log(formatDoctorPrereqSection(deps.platform, collection));
+    if (overrides.packagedAssets !== false) {
+        const injected = overrides.packagedAssets ?? {};
+        log(await collectPackagedAssetDoctor({ cwd: injected.cwd ?? deps.cwd,
+            readFile: injected.readFile ?? deps.readFile ?? (p => readFile(p, "utf-8")),
+            lstat: injected.lstat ?? lstat, access: injected.access ?? (p => access(p, assetFsConstants.R_OK)), realpath: injected.realpath ?? realpath,
+            platform: deps.platform }));
+    }
     // Executor-adapter section (BAPI-781). Advisory with respect to the EXIT CODE
     // — an unusable adapter is reported loudly but does not change doctor's
     // pass/fail, which stays driven by the start-tickets prerequisites this
@@ -1972,6 +2045,24 @@ export async function runDoctorCli(argv, overrides = {}) {
             /* local-launcher diagnostics are advisory; never block the doctor report */
         }
     }
+    // BAPI-1398 /drive-epic-run permission-rules section. Strictly read-only (two
+    // settings files and Bridge's manifest; no command, no network), and advisory:
+    // it never changes the exit code.
+    if (overrides.bridgePermissions !== false) {
+        try {
+            const injected = deps;
+            const permissionDeps = {
+                cwd: overrides.bridgePermissions?.cwd ?? deps.cwd,
+                homeDir: overrides.bridgePermissions?.homeDir ?? (injected.homedir ?? os.homedir)(),
+                env: overrides.bridgePermissions?.env ?? deps.env,
+                readFile: overrides.bridgePermissions?.readFile ?? injected.readFile ?? ((p) => readFile(p, "utf-8")),
+            };
+            log(formatBridgePermissionsDiagnosticReport(await collectBridgePermissionsDiagnostic(permissionDeps)));
+        }
+        catch {
+            /* permission-rule diagnostics are advisory; never block the doctor report */
+        }
+    }
     // Worker containment advisory section (BAPI-1019/A.7). Placed beside the other
     // advisory sections and, uniquely, issuing NO probe of any kind — no command,
     // no file read, no network call. That is what keeps doctor's "an unsupported

package/build/drive-epic.js

@@ -55,13 +55,14 @@
  */
 import { readdir, readFile } from "node:fs/promises";
 import path, { dirname, join } from "node:path";
-import { CONDUCTOR_DEFAULT_BASE_URL, ConductorBridgeApiError, resolveEpicLaunchBridgeApiAccess, fetchConductorReadiness, fetchEpicRunState, safeDiagnosticMessage, } from "./conductor/bridge-api-client.js";
+import { CONDUCTOR_DEFAULT_BASE_URL, ConductorBridgeApiError, resolveEpicLaunchBridgeApiAccess, fetchConductorReadiness, fetchEpicRunState, gateProfileWaivesCiWorkflow, safeDiagnosticMessage, } from "./conductor/bridge-api-client.js";
 import { EPIC_LAUNCH_PROFILE_NAME_PATTERN, epicLaunchPolicyDigest, pinEpicLaunchPolicy, renderEpicLaunchCommand, resolveEpicLaunchSelection, shellQuote, } from "./epic-launch-profile.js";
 import { validateHttpBaseUrl, describeBaseUrlRejection } from "./base-url.js";
 import { BRING_UP_REFUSAL_MESSAGES, BRING_UP_RUNBOOK, firstBringUpRefusal, } from "./conductor/bring-up-facts.js";
 import { repositoryWorkflowRemedy } from "./conductor/repository-workflow-remedy.js";
-import { policyDeclaresNotifyWebhook, effectivePolicyFacts, readSetupEpicPolicyFile, runSetupEpicWorkflow, } from "./setup-epic.js";
+import { policyDeclaresNotifyWebhook, policyNotifyDestinationsConflict, notifyDestinationsConflictMessage, effectivePolicyFacts, readSetupEpicPolicyFile, runSetupEpicWorkflow, } from "./setup-epic.js";
 import { EPIC_KEY_PATTERN } from "./drive-epic-key.js";
+import { flushProcessStdout, writeJsonDocument } from "./conductor/json-output.js";
 import { discoverEpicPlan, } from "./plan-discovery.js";
 import { formatPlaneDiagnostic, launchPlaneControlPlane, requestPlaneScopedLanes, runDefaultPlanePreflight, runPlaneCli, } from "./plane/cli.js";
 import { PLANE_PORT_PROBE_TIMEOUT_MS, describePlanePortOccupant, } from "./plane/preflight.js";
@@ -183,7 +184,14 @@ export const V2_READINESS_REQUIREMENTS = [
         // fixed install-command sentence that stood here could never clear a missing
         // migration-guard job — no install step creates one — so it is gone from this
         // refusal.
-        remedyFor: (r) => repositoryWorkflowRemedy(r),
+        //
+        // BAPI-1390: the server decides which files are required (the review file
+        // only for a `verdict_protocol` run; the CI lane file only for a repository
+        // with no STORED gate profile and no `no_ci_gate`), and `satisfied` reads that
+        // decision as given. The remedy waives the CI file the same way, so a stored
+        // profile is never told to add a file it does not need. Gate-profile WARNINGS
+        // (epic-branch rows) are not requirements and are never read here.
+        remedyFor: (r) => repositoryWorkflowRemedy(gateProfileWaivesCiWorkflow(r) ? { ...r, conductor_ci_workflow: null } : r),
         satisfied: (r) => r.unattended?.repository_readiness_confirmed === true,
     },
     // BAPI-1135 — merge-execution eligibility is deliberately NOT a requirement here.
@@ -1242,6 +1250,7 @@ export function createDefaultDriveEpicDeps() {
         // construction, so nothing has claimed stdout for the protocol transport.
         log: (message) => console.log(message),
         errorLog: (message) => console.error(message),
+        flushStdout: flushProcessStdout,
     };
 }
 /**
@@ -1787,6 +1796,21 @@ async function checkPlaneAdmission(ctx, readiness, manifest) {
  */
 async function coldStartPlane(ctx) {
     const { deps, epicKey } = ctx;
+    // BAPI-1397 (F1): a policy the server would reject for its notify destinations
+    // is refused BEFORE the plane preflight and `plane up`, naming its file. The
+    // same predicate setup-epic applies; a cold start has no live run, so the
+    // selected file is the explicit one or the profile's, as in
+    // `prepareSetupSelection`. An unreadable file is left to that function.
+    const coldPolicyPath = ctx.options.policyFile ?? ctx.profile?.policyRef?.path;
+    if (coldPolicyPath !== undefined) {
+        const read = await readSetupEpicPolicyFile(coldPolicyPath, (filePath) => deps.readPolicyFile(filePath));
+        if (read.ok && policyNotifyDestinationsConflict(read.policy)) {
+            return refuse(deps, [
+                `${epicKey}: REFUSED (policy-notify-conflict) — ` +
+                    notifyDestinationsConflictMessage(coldPolicyPath, ctx.options.policyFile !== undefined ? "explicit" : "profile"),
+            ]);
+        }
+    }
     // The cold start leaves the readiness `catch` before the ordinary advisory
     // read is reached, so it surfaces the BAPI-1022 containment advisory itself —
     // before anything is started, exactly as every other plan-file route does.
@@ -2656,7 +2680,11 @@ async function runDriveEpicPreview(deps, options) {
         });
     }
     ensureRefusalExplained(preview);
-    emitPreview(deps, options, preview);
+    const emitted = await emitPreview(deps, options, preview);
+    // BAPI-1397 (F3): a `--json` document that could not reach stdout whole is a
+    // failed preview, never a silently truncated one.
+    if (!emitted)
+        return 1;
     return preview.decision === "create" || preview.decision === "attach" ? 0 : 1;
 }
 /** The fixed explanation used when a refusal reached the end with none of its own. */
@@ -2986,11 +3014,19 @@ async function previewExecutorFacts(ctx, readiness, planeTarget, live, outcome)
         ? null
         : executorPreconditionRefusal(epicKey, inspected.message, outcome === "No run was created" ? "No run was created." : "No run was changed.");
 }
-/** Print the preview: one JSON line with `--json`, short readable lines otherwise. */
-function emitPreview(deps, options, preview) {
+/**
+ * Print the preview: one JSON line with `--json`, short readable lines otherwise.
+ *
+ * BAPI-1397 (F3): the `--json` document goes through the shared CLI writer, which
+ * waits for a piped stdout to drain before the exit code is returned. Resolves
+ * `false` only when that document could not be written whole.
+ */
+async function emitPreview(deps, options, preview) {
     if (options.json === true) {
-        deps.log(JSON.stringify(preview));
-        return;
+        return writeJsonDocument(JSON.stringify(preview), {
+            log: deps.log,
+            flush: deps.flushStdout ?? (async () => true),
+        });
     }
     const lines = [
         `${preview.epic_key}: launch preview (read-only; nothing was created or started)`,
@@ -3018,4 +3054,5 @@ function emitPreview(deps, options, preview) {
         lines.push(`  Refusal:    ${preview.refusal.reason_id} — ${preview.refusal.remedy}`);
     }
     deps.log(lines.join("\n"));
+    return true;
 }

package/build/epic-coherence-input.test-fixtures.js

@@ -14,7 +14,7 @@ export function memoryRepo(files, options = {}) {
     const contents = new Map();
     for (const [rel, body] of Object.entries(files))
         contents.set(path.join(ROOT, rel), body);
-    const dirs = new Set([path.sep, ROOT]);
+    const dirs = new Set([path.parse(ROOT).root, ROOT]);
     const addDirs = (abs) => {
         let dir = path.dirname(abs);
         while (!dirs.has(dir)) {
@@ -33,8 +33,9 @@ export function memoryRepo(files, options = {}) {
     const repo = { fs: undefined, files: contents, writes: [], reads: [], realpaths: [] };
     const missing = (p) => Object.assign(new Error(`ENOENT: ${p}`), { code: "ENOENT" });
     const resolveLinks = (p) => {
-        const parts = p.split(path.sep).filter(Boolean);
-        let current = path.sep;
+        const root = path.parse(p).root;
+        const parts = p.slice(root.length).split(path.sep).filter(Boolean);
+        let current = root;
         for (const part of parts) {
             current = path.join(current, part);
             const target = symlinks.get(current);