@bridge_gpt/mcp-server 0.2.67 → 0.2.69

package/build/plan-execution-ledger.js

@@ -472,38 +472,8 @@ export function validateExecutionLimits(observed, limits = PRE_PR_VERIFICATION_L
 // ---------------------------------------------------------------------------
 // Secret safety
 // ---------------------------------------------------------------------------
-const REDACTED = "[REDACTED]";
-/**
- * Patterns for values that must never reach durable state or a log line.
- *
- * Each rewrites only the secret itself and keeps the surrounding key or scheme, so a
- * redacted record still shows *that* a credential was involved — useful for audit,
- * and materially different from dropping the field.
- */
-const SECRET_PATTERNS = [
-    // Bearer / token schemes in an Authorization header or bare.
-    [/\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{8,}/gi, `$1 ${REDACTED}`],
-    // authorization: <anything>
-    [/\b(authorization)\s*[:=]\s*\S+/gi, `$1: ${REDACTED}`],
-    // Well-known provider key shapes.
-    [/\b(sk|pk|rk)-[A-Za-z0-9_-]{16,}/g, REDACTED],
-    [/\bgh[pousr]_[A-Za-z0-9]{16,}/g, REDACTED],
-    // key/secret/password/token assignments in prose, env, JSON, or CLI form.
-    [
-        /\b([A-Za-z0-9_-]*(?:api[_-]?key|secret|password|passwd|token|credential)[A-Za-z0-9_-]*)\s*[:=]\s*("[^"]*"|'[^']*'|\S+)/gi,
-        `$1=${REDACTED}`,
-    ],
-    // Credentials embedded in a URL.
-    [/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s@]+@/gi, `$1${REDACTED}@`],
-];
-/** Redact secret-bearing substrings while leaving safe technical text intact. */
-export function redactSecrets(value) {
-    let output = value;
-    for (const [pattern, replacement] of SECRET_PATTERNS) {
-        output = output.replace(pattern, replacement);
-    }
-    return output;
-}
+export { redactSecrets } from "./secret-redaction.js";
+import { redactSecrets } from "./secret-redaction.js";
 function redactDeep(value) {
     if (typeof value === "string")
         return redactSecrets(value);

package/build/plane/manifest.js

@@ -536,7 +536,22 @@ export async function writePlaneManifest(manifest, fs) {
     // atomic replacement rather than a copy across a mount boundary.
     const tempPath = `${manifestPath}.${manifest.planeId}.${process.pid}.${manifestWriteCounter}.tmp`;
     await fs.writeFile(tempPath, formatPlaneManifest(manifest));
-    await fs.rename(tempPath, manifestPath);
+    // Windows can briefly refuse replacement while another writer or reader
+    // holds the destination. Retry the atomic rename; never remove the published
+    // manifest or rewrite this writer's private snapshot.
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            await fs.rename(tempPath, manifestPath);
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if (process.platform !== "win32" || !["EPERM", "EACCES"].includes(code ?? "") || attempt >= 4) {
+                throw error;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 25 * (attempt + 1)));
+        }
+    }
 }
 /**
  * Remove the manifest, but only when it still belongs to `planeId`.

package/build/plane/preflight.js

@@ -915,6 +915,35 @@ const PLANE_NOT_APPLICABLE_DETAIL = {
     remote: "not applicable: the target is a remote Bridge API, not a local plane",
     unresolvable: "not applicable: endpoint could not be resolved from target URL",
 };
+/** BAPI-1397 (F4) — the reason id carried by an own-plane pass row. */
+export const PLANE_OWN_PLANE_REASON_ID = "own_plane";
+/**
+ * Fixed own-plane details. Each starts with the stable token `own_plane: ` because
+ * the shared readiness row has no reason field; neither names a port, pid, path,
+ * or run id.
+ */
+const PLANE_OWN_PLANE_DETAIL = {
+    "server-port": `${PLANE_OWN_PLANE_REASON_ID}: the port is served by this repository's plane, which is ` +
+        "bound to the run being attached",
+    "existing-plane": `${PLANE_OWN_PLANE_REASON_ID}: this repository's live plane is bound to the run being attached`,
+};
+/**
+ * Is the live plane this preflight observed the selected run's OWN plane?
+ * (BAPI-1397, F4). Pure, and READINESS-ONLY.
+ *
+ * True only when the existing-plane check's own classification — the same
+ * exact-root, live-member reading `classifyLivePlaneForAttach` makes from the ONE
+ * manifest read — is `attachable` and the manifest's `epicRunId` equals the
+ * selected run id. Nothing here feeds `ok` or a diagnostic, so `plane up` still
+ * refuses a live plane exactly as before; only `readiness --epic-run-id` supplies
+ * a run id.
+ */
+export function planeIsOwnPlaneForRun(result, epicRunId) {
+    if (epicRunId === undefined || epicRunId.trim() === "")
+        return false;
+    const existing = result?.observations?.existingPlane;
+    return existing?.kind === "attachable" && existing.manifest.epicRunId === epicRunId;
+}
 export function mapPlanePreflightToReadinessChecks(result, 
 /**
  * An EXPLICIT statement that the plane checks do not apply to this target. It is
@@ -922,7 +951,14 @@ export function mapPlanePreflightToReadinessChecks(result,
  * input stays the failure it always was, so an unrun probe is never mistaken for
  * an inapplicable one.
  */
-notApplicable) {
+notApplicable, 
+/**
+ * BAPI-1397 (F4) — the run being attached (`readiness --epic-run-id`). When the
+ * observed live plane is that run's own plane, its occupied port and its live
+ * manifest are reported as `pass` rows with the `own_plane` reason instead of two
+ * `fail` rows. Absent or different, every row maps exactly as before.
+ */
+options = {}) {
     if (notApplicable !== undefined) {
         return PLANE_READINESS_DESCRIPTORS.map(({ id, label }) => createReadinessCheck({
             id: `plane.${id}`,
@@ -937,8 +973,25 @@ notApplicable) {
         if (!byId.has(outcome.id))
             byId.set(outcome.id, outcome);
     }
+    const ownPlane = planeIsOwnPlaneForRun(result, options.epicRunId);
     return PLANE_READINESS_DESCRIPTORS.map(({ id, label }) => {
         const outcome = byId.get(id);
+        // The occupied port is only reclassified when the probe actually saw it
+        // occupied; a free port is already a pass and an indeterminate probe keeps
+        // its warning. A pass carries no remediation.
+        if (ownPlane &&
+            outcome &&
+            outcome.status === "fail" &&
+            (id === "existing-plane" ||
+                (id === "server-port" && result?.observations?.serverPort === "connected"))) {
+            return createReadinessCheck({
+                id: `plane.${id}`,
+                source: "plane",
+                label: outcome.label || label,
+                status: "pass",
+                detail: PLANE_OWN_PLANE_DETAIL[id],
+            });
+        }
         if (!outcome) {
             return createReadinessCheck({
                 id: `plane.${id}`,

package/build/printed-remedy-commands.js

@@ -19,10 +19,15 @@ export const PRINTED_REMEDY_DISPATCHED_SUBCOMMANDS = [
     "install-bridge",
     "doctor",
     "connect-github",
+    "executor",
 ];
 /** The guided installer (interactive project setup). */
 export const PRINTED_INSTALL_COMMAND = `${LAUNCHER} install`;
-/** Conductor bootstrap. The parser requires at least one `--required-check`. */
+/**
+ * Conductor bootstrap with an explicit provider check. Since BAPI-1391 a
+ * confirmed gate (provider, local, mixed, or none) replaces the old "at least
+ * one --required-check" rule; a provider check is still the common scripted form.
+ */
 export const PRINTED_CONDUCTOR_INSTALL_COMMAND = `${LAUNCHER} install conductor --required-check <check-name>`;
 /** Conductor bootstrap that also provisions a repository-wide executor service. */
 export const PRINTED_CONDUCTOR_EXECUTOR_INSTALL_COMMAND = `${LAUNCHER} install conductor --required-check <check-name> --executor-id <id> --repo-wide`;
@@ -35,3 +40,13 @@ export const PRINTED_CHECK_NAME_INSTRUCTION = "Replace <check-name> with the exa
     "repeat --required-check for each additional check.";
 /** Explains the `<id>` placeholder of the executor command. */
 export const PRINTED_EXECUTOR_ID_INSTRUCTION = "Replace <id> with a name for the executor service.";
+/**
+ * BAPI-1391 — qualify a confirmed local or mixed gate: enqueue the run-less
+ * qualification job and drain it with a short-lived repository-wide executor.
+ * The remedy for `local_command_unqualified`.
+ */
+export const PRINTED_QUALIFY_GATE_COMMAND = `${LAUNCHER} install-bridge conductor --qualify-gate`;
+/** A persistent repository-wide executor service, which also drains qualification jobs. */
+export const PRINTED_REPO_WIDE_EXECUTOR_COMMAND = `${LAUNCHER} install conductor --executor-id <id> --repo-wide`;
+/** The lifecycle-free executor service-unit generator. */
+export const PRINTED_EXECUTOR_INSTALL_SERVICE_COMMAND = `${LAUNCHER} executor install-service`;