@bridge_gpt/mcp-server 0.2.69 → 0.2.70

package/build/executor/likely-tests.js

@@ -5,14 +5,22 @@
  * Optional .conductor/recently-failed-tests.json is
  * {version:1,tests:["most-recent-first reference"],truncated:false}.
  * Child 3 writes recent failures under the worker worktree before each spawn.
- * References are data only, never commands. Priority: recent failures, ordered
- * pins, sorted inferred tracked tests; exact deduplication precedes the limit.
+ * Optional declared touched files (raw JSON, supplied by the caller) admit the
+ * declared files that are tests and exist in the worktree.
+ * References are data only, never commands. Priority: recent failures, sorted
+ * declared tests, ordered pins, sorted inferred tracked tests; exact
+ * deduplication precedes the limit.
  * Missing/malformed/unreadable/truncated sources degrade advisory coverage.
+ * Changed files come from the committed `<base>..HEAD` diff only; workers commit
+ * before discovery. BAPI-1479 confirmed this was not why workers saw no output
+ * (see `runLikelyTestsCommand` for the confirmed cause), so uncommitted changes
+ * stay out of scope.
  */
 import path from "node:path";
 import { constants } from "node:fs";
 import { lstat, open } from "node:fs/promises";
 import { execFile } from "node:child_process";
+import { normalizeDeclaredTouchedFiles } from "../conductor/file-scope-guard.js";
 export const RECENTLY_FAILED_TESTS_PATH = ".conductor/recently-failed-tests.json";
 export const RECENTLY_FAILED_TESTS_MAX_COUNT = 20;
 export const TEST_REFERENCE_MAX_LENGTH = 512;
@@ -213,6 +221,32 @@ export async function resolveLikelyTests(options) {
         if (error.code !== "ENOENT")
             diagnostics.add("data_unavailable");
     }
+    // Declared test files sit right after recent failures and BEFORE any git diff
+    // or scan, so a later early return cannot bypass them.
+    if (options.declaredTouchedFilesJson !== undefined) {
+        let declared;
+        try {
+            const parsed = JSON.parse(options.declaredTouchedFilesJson);
+            if (Array.isArray(parsed))
+                declared = normalizeDeclaredTouchedFiles(parsed);
+        }
+        catch { /* malformed: reported below */ }
+        if (declared === undefined)
+            diagnostics.add("data_unavailable");
+        else {
+            const admitted = [];
+            for (const file of declared.filter(testCandidate)) {
+                try {
+                    await read(root, file, MAX_SCAN_FILE_BYTES);
+                    admitted.push(file);
+                }
+                catch {
+                    diagnostics.add("skipped_entries");
+                }
+            }
+            add(admitted);
+        }
+    }
     let hints;
     try {
         hints = parseHints(JSON.parse(await read(root, ".bridge/verification-hints.json", MAX_OPTIONAL_JSON_BYTES)));

package/build/executor/merge-job.js

@@ -21,11 +21,23 @@
  *    {@link MERGE_FAILED} `error_kind` (via {@link classifyMergeFailureErrorKind})
  *    so the companion re-fire lane can route retry-vs-rebase without string parsing.
  */
-import { makeLocalMergeExecutor, resolveLocalMergeCredential, resolveLocalMergeMethod, } from "../conductor/local-merge.js";
-import { resolveConductorBridgeApiAccess, } from "../conductor/bridge-api-client.js";
+import { classifyLocalGhPreflight, makeLocalMergeExecutor, probeLocalMergeRepositoryAccess, resolveLocalMergeCredential, resolveLocalMergeMethod, } from "../conductor/local-merge.js";
+import { isProviderRepositoryIdentity, resolveConductorBridgeApiAccess, } from "../conductor/bridge-api-client.js";
 import { createProductionEpicIntegrationGhRunner, ensureEpicIntegrationPullRequest, formatEpicIntegrationPullRequestOutcome, EPIC_BRANCH_PREFIX, } from "../epic-integration-pr.js";
+import { resolveMergeCredentialAtAction } from "../conductor/stored-merge-credential.js";
 import { secretFreeErrorMessage } from "./job-errors.js";
 import { resolveExecutorJobBaseBranch } from "./base-branch.js";
+import { GH_REPO_ACCESS_DENIED, failureReasonCode, isFailureReasonCode, } from "./failure-reason-codes.js";
+/** Read the optional `payload.repository` against the provider-repository format. */
+export function resolveMergeJobRepository(job) {
+    const payload = job.payload && typeof job.payload === "object" ? job.payload : {};
+    const value = payload.repository;
+    if (value === undefined || value === null)
+        return { kind: "absent" };
+    if (isProviderRepositoryIdentity(value))
+        return { kind: "valid", repository: value };
+    return { kind: "malformed" };
+}
 function positiveIntOrNull(value) {
     return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
 }
@@ -80,6 +92,7 @@ export function readMergeJobPayloadFields(job, repositoryBaseBranch) {
     const actionKey = asString(payload.action_key) ?? `merge:pr-${prNumber}:${expectedHeadSha}`;
     const ciWaitTimeoutMs = nonNegativeIntOrUndefined(payload.ci_wait_timeout_ms);
     const ciWaitPollIntervalMs = nonNegativeIntOrUndefined(payload.ci_wait_poll_interval_ms);
+    const repository = resolveMergeJobRepository(job);
     return {
         ok: true,
         fields: {
@@ -92,6 +105,7 @@ export function readMergeJobPayloadFields(job, repositoryBaseBranch) {
             ciWaitPollIntervalMs,
             expectedBaseBranch,
             expectedHeadBranch,
+            ...(repository.kind === "valid" ? { repository: repository.repository } : {}),
         },
     };
 }
@@ -166,6 +180,16 @@ export const MERGE_RETRYABLE = "MergeRetryable";
 export const MERGE_CONFLICT = "MergeConflict";
 export const MERGE_FAILED = "MergeFailed";
 export const MERGE_REF_MISMATCH = "MergeRefMismatch";
+/**
+ * BAPI-1453 — a DELIBERATE, terminal refusal: after `gh pr view` failed, the
+ * permission probe PROVED the merge credential cannot access the repository (a
+ * 404, or a 200 without push). Emitted only with the `gh_repo_access_denied`
+ * reason code. Retrying with the same credential reproduces the identical
+ * failure, so — like {@link MERGE_REF_MISMATCH} — it is never retryable, never a
+ * rebase target, and reported as `clean_exit`. The server parks it as
+ * `merge_credential_no_access`.
+ */
+export const MERGE_CREDENTIAL_NO_ACCESS = "MergeCredentialNoAccess";
 /**
  * BAPI-1234 — the server's migration-graph merge guard refused the merge. Two
  * kinds, kept distinct because they call for different human responses:
@@ -187,6 +211,7 @@ const MIGRATION_GRAPH_ERROR_KINDS = new Map([
 /** Error kinds that are deliberate refusals rather than crashes. */
 const DELIBERATE_REFUSAL_ERROR_KINDS = new Set([
     MERGE_REF_MISMATCH,
+    MERGE_CREDENTIAL_NO_ACCESS,
     MERGE_MIGRATION_GRAPH_INVALID,
     MERGE_MIGRATION_GRAPH_UNREADABLE,
 ]);
@@ -222,10 +247,16 @@ const RETRYABLE_MERGE_REASONS = new Set([
  * {@link RETRYABLE_MERGE_REASONS} — it is a terminal safety refusal, not a
  * transient or conflict-shaped failure, and must not be re-firable by any
  * future classification change.
+ *
+ * BAPI-1453: `gh_repo_access_denied` maps to {@link MERGE_CREDENTIAL_NO_ACCESS}
+ * in the same early position and for the same reason. Every other reason keeps
+ * its existing mapping.
  */
 export function classifyMergeFailureErrorKind(response) {
     const hasConflictEvent = response.ledger_events.some((ev) => ev.type === "merge.conflict");
     const reason = asString(response.reason ?? undefined);
+    if (reason === GH_REPO_ACCESS_DENIED)
+        return MERGE_CREDENTIAL_NO_ACCESS;
     if (reason === "ref_mismatch")
         return MERGE_REF_MISMATCH;
     const migrationGraphKind = reason ? MIGRATION_GRAPH_ERROR_KINDS.get(reason) : undefined;
@@ -251,6 +282,11 @@ export function classifyMergeFailureErrorKind(response) {
  * refusal kinds to that set: a `crashed` classification would make the
  * backend's merge re-fire lane retry a merge the server will refuse identically.
  * Every other merge outcome keeps its existing `"crashed"` classification.
+ *
+ * BAPI-1453: also sets `telemetry.failure_reason_code` — the response's reason
+ * when it is in the closed vocabulary, else the fixed
+ * `merge_failure_unclassified`, so an arbitrary response string never reaches
+ * telemetry. The code is display-only; `error_kind` stays the routing signal.
  */
 export function buildMergeJobFailure(response) {
     const reason = asString(response.reason ?? undefined) ?? response.status;
@@ -259,8 +295,21 @@ export function buildMergeJobFailure(response) {
         error_kind: errorKind,
         error_message: secretFreeErrorMessage(new Error(`local merge ${response.status}: ${reason}`)),
         classification: DELIBERATE_REFUSAL_ERROR_KINDS.has(errorKind) ? "clean_exit" : "crashed",
+        telemetry: { failure_reason_code: mergeResponseReasonCode(response) },
     };
 }
+/** The response's reason as a vocabulary code, or the fixed unclassified code. */
+function mergeResponseReasonCode(response) {
+    const reason = asString(response.reason ?? undefined);
+    return isFailureReasonCode(reason) ? reason : MERGE_FAILURE_UNCLASSIFIED;
+}
+/** BAPI-1453 — fixed codes for failures the executor's merge flow builds itself. */
+export const MERGE_FAILURE_UNCLASSIFIED = failureReasonCode("merge_failure_unclassified");
+export const MERGE_PAYLOAD_INVALID = failureReasonCode("merge_payload_invalid");
+export const MERGE_ACCESS_UNAVAILABLE = failureReasonCode("merge_access_unavailable");
+export const MERGE_FLOW_TIMEOUT = failureReasonCode("merge_flow_timeout");
+export const MERGE_FLOW_ERROR = failureReasonCode("merge_flow_error");
+export const MERGE_NO_OUTCOME = failureReasonCode("merge_no_outcome");
 /**
  * Post-merge draft epic-integration-PR retry (BAPI-951). Invoked ONLY after a
  * successful ticket-bound merge whose child PR based on `epic/<EPIC>` — never
@@ -306,6 +355,7 @@ export async function runExecutorMergeJob(job, seams) {
                 error_kind: "ContractError.MergePayload",
                 error_message: resolution.error,
                 classification: "crashed",
+                telemetry: { failure_reason_code: MERGE_PAYLOAD_INVALID },
             },
         };
     }
@@ -333,6 +383,7 @@ export async function runExecutorMergeJob(job, seams) {
                 error_kind: "MergeFailed",
                 error_message: secretFreeErrorMessage(err),
                 classification: "crashed",
+                telemetry: { failure_reason_code: MERGE_FLOW_ERROR },
             },
         };
     }
@@ -343,8 +394,77 @@ export async function runExecutorMergeJob(job, seams) {
         await tryEnsurePostMergeEpicIntegrationPr(seams, fields.expectedBaseBranch);
         return { ok: true, result };
     }
+    if (asString(response.reason ?? undefined) === "gh_pr_view_failed") {
+        response = await reclassifyPrViewFailure(job, response, seams);
+    }
     return { ok: false, failure: buildMergeJobFailure(response) };
 }
+/** Emit one fixed probe diagnostic: the validated job id and a closed category. */
+function logProbeDiagnostic(job, seams, category) {
+    const jobId = positiveIntOrNull(job.id);
+    try {
+        seams.diagnosticLog?.(`[executor] merge job ${jobId ?? "unknown"}: gh_pr_view_failed kept retryable (${category})`);
+    }
+    catch {
+        // A diagnostic sink can never change the merge outcome.
+    }
+}
+/**
+ * BAPI-1453 — after a `gh_pr_view_failed`, run Child 2's permission probe ONCE
+ * against the server-carried repository, with the credential, runner, and abort
+ * signal the merge itself used.
+ *
+ * Only a proven no-access verdict (a 404, or a 200 without push) turns the
+ * failure into `gh_repo_access_denied`. Every other outcome — access confirmed,
+ * probe unavailable (401, 403, 429, 5xx, transport, timeout, malformed), a
+ * thrown probe, a cancelled flow — returns the response UNCHANGED, so the
+ * failure stays a bare, retryable `gh_pr_view_failed`. HTTP statuses are never
+ * re-derived here; the probe's own verdict is the whole answer.
+ *
+ * With no valid `payload.repository` no probe runs at all: there is no
+ * `gh repo view` fallback on this path.
+ */
+async function reclassifyPrViewFailure(job, response, seams) {
+    const repository = resolveMergeJobRepository(job);
+    if (repository.kind !== "valid") {
+        logProbeDiagnostic(job, seams, repository.kind === "absent" ? "repository_absent" : "repository_malformed");
+        return response;
+    }
+    // An aborted flow (overall timeout or ownership loss) owns the outcome; a late
+    // probe must never be started for it.
+    if (seams.localMergeDeps.signal?.aborted) {
+        logProbeDiagnostic(job, seams, "probe_cancelled");
+        return response;
+    }
+    const probe = seams.probeRepositoryAccess ??
+        ((repo) => probeLocalMergeRepositoryAccess(repo, seams.localMergeDeps));
+    let result;
+    try {
+        result = await probe(repository.repository);
+    }
+    catch {
+        // Exception text is never logged: it can carry subprocess detail.
+        logProbeDiagnostic(job, seams, "probe_failed");
+        return response;
+    }
+    if (seams.localMergeDeps.signal?.aborted) {
+        logProbeDiagnostic(job, seams, "probe_cancelled");
+        return response;
+    }
+    const verdict = classifyLocalGhPreflight(result);
+    if (verdict === "no_access") {
+        return { ...response, reason: GH_REPO_ACCESS_DENIED };
+    }
+    if (verdict === "passed")
+        return response;
+    if (verdict === "probe_unavailable") {
+        const detail = result.ok ? undefined : result.probe_unavailable_reason;
+        logProbeDiagnostic(job, seams, detail ?? "probe_response_malformed");
+        return response;
+    }
+    logProbeDiagnostic(job, seams, verdict);
+    return response;
+}
 /**
  * Build the default local-merge deps for production wiring (no real I/O here).
  * An optional {@link AbortSignal} is threaded through so the job-runner's overall
@@ -364,3 +484,26 @@ export function buildDefaultMergeLocalDeps(deps, signal) {
         signal,
     };
 }
+/**
+ * BAPI-1461 — the merge-job deps with the stored-entry fallback, resolved when
+ * the merge job RUNS. The store is read afresh each time, so an executor that
+ * started before the token was stored can still merge.
+ *
+ * `allowStoredEntry` comes from the executor's own mode declaration: it is
+ * `false` for a durable-host service executor (started with
+ * `--scrub-inherited-github-credentials`), which never reads a stored GitHub
+ * credential. The entry key comes from the job's server-carried repository.
+ */
+export async function buildMergeLocalDepsForJob(job, deps, options, signal) {
+    const repository = resolveMergeJobRepository(job);
+    const resolution = await resolveMergeCredentialAtAction(deps.env, "local", {
+        allowStoredEntry: options.allowStoredEntry,
+        providerRepository: repository.kind === "valid" ? repository.repository : null,
+        storeDeps: { env: deps.env, homedir: deps.homedir, readFile: deps.readFile },
+    });
+    return {
+        env: deps.env,
+        credential: resolution.status === "resolved" ? resolution.credential : null,
+        signal,
+    };
+}

package/build/executor/observation.js

@@ -1,10 +1,16 @@
+import { CONSUMER_GUIDE_POINTER } from "../printed-remedy-commands.js";
+import { redactSecrets } from "../secret-redaction.js";
 import { createWorkerDiagnosticsState } from "./worker-diagnostics.js";
+/** BAPI-1453 — at most this many dirty paths are retained as evidence. */
+export const MAX_DIRTY_PATHS = 20;
+/** BAPI-1453 — a retained dirty path is at most this many characters. */
+export const MAX_DIRTY_PATH_CHARS = 256;
 /**
  * Collect load-bearing git telemetry from a worktree. Individual git failures
  * degrade the telemetry (fields omitted) rather than throwing — a degraded
  * signal must never surface as a worker correctness failure.
  */
-export async function collectGitTelemetry(deps, worktreePath, baseBranch) {
+export async function collectGitTelemetry(deps, worktreePath, baseBranch, options = {}) {
     const telemetry = {};
     try {
         const revList = await deps.runCommand("git", [
@@ -39,18 +45,27 @@ export async function collectGitTelemetry(deps, worktreePath, baseBranch) {
         // `.git/index.lock`. This runs on every heartbeat against the LIVE worker's
         // worktree, so without it a worker's own `git add`/`commit` can fail with
         // "index.lock: File exists".
+        // BAPI-1453: `-z` only when paths are wanted. NUL-delimited records are the
+        // only form that survives a filename containing a newline or a quote.
         const status = await deps.runCommand("git", [
             "-C",
             worktreePath,
             "--no-optional-locks",
             "status",
             "--porcelain",
+            ...(options.includeDirtyPaths === true ? ["-z"] : []),
         ]);
         if (status.exitCode === 0) {
-            const dirty = status.stdout.trim().length > 0;
+            // The verdict never depends on path parsing: any output at all is dirty.
+            const dirty = status.stdout.replace(/\0/g, "").trim().length > 0;
             telemetry.dirty = dirty;
             if (dirty) {
                 telemetry.last_activity_at = new Date(deps.now()).toISOString();
+                if (options.includeDirtyPaths === true) {
+                    const evidence = parseDirtyPathEvidence(status.stdout);
+                    telemetry.dirty_paths = evidence.paths;
+                    telemetry.dirty_paths_overflow_count = evidence.overflow;
+                }
             }
         }
     }
@@ -59,6 +74,60 @@ export async function collectGitTelemetry(deps, worktreePath, baseBranch) {
     }
     return telemetry;
 }
+/** True for a path that is absolute, drive/UNC-rooted, or escapes the worktree. */
+function isUnsafeRelativePath(path) {
+    if (path.startsWith("/") || path.startsWith("\\"))
+        return true;
+    if (/^[A-Za-z]:/.test(path))
+        return true;
+    return path.split(/[\\/]/).some((segment) => segment === "..");
+}
+/** Escape every control character so a filename can never forge a log line. */
+function escapeControlCharacters(path) {
+    return path.replace(/[\x00-\x1f\x7f-\x9f]/g, (ch) => `\\x${ch.charCodeAt(0).toString(16).padStart(2, "0")}`);
+}
+/**
+ * Reduce `git status --porcelain -z` output to at most {@link MAX_DIRTY_PATHS}
+ * repository-relative paths plus a count of everything omitted (BAPI-1453).
+ *
+ * Each record is `XY <path>`; a rename or copy (`R` or `C` in either column) is
+ * followed by one more NUL-terminated record holding the source path, which is
+ * consumed and not retained. An entry is omitted — and counted — when it is
+ * malformed, absolute, escapes the worktree, longer than
+ * {@link MAX_DIRTY_PATH_CHARS} once escaped, needs secret redaction, or arrives
+ * after the cap. Never throws; never retains file content.
+ */
+export function parseDirtyPathEvidence(stdout) {
+    const paths = [];
+    let overflow = 0;
+    const records = stdout.split("\0");
+    for (let i = 0; i < records.length; i++) {
+        const record = records[i];
+        if (record.length === 0)
+            continue;
+        const status = record.slice(0, 2);
+        if (/[RC]/.test(status))
+            i += 1; // the source path record of a rename/copy
+        if (record.length < 4 || record[2] !== " ") {
+            overflow += 1;
+            continue;
+        }
+        const path = record.slice(3);
+        if (paths.length >= MAX_DIRTY_PATHS) {
+            overflow += 1;
+            continue;
+        }
+        const escaped = escapeControlCharacters(path);
+        if (isUnsafeRelativePath(path) ||
+            escaped.length > MAX_DIRTY_PATH_CHARS ||
+            redactSecrets(escaped) !== escaped) {
+            overflow += 1;
+            continue;
+        }
+        paths.push(escaped);
+    }
+    return { paths, overflow };
+}
 /** A full 40-character hex object name. */
 const FULL_SHA_PATTERN = /^[0-9a-f]{40}$/i;
 /** Normalize a candidate SHA, or `null` when it is absent/malformed. */
@@ -298,8 +367,8 @@ const RATE_LIMIT_CONSEQUENCE_TEXT = "This warning is advisory only and triggers
     "waiting happens only when the worker then fails with the supported terminal " +
     "rejection and the server advertised capacity recovery for this job; otherwise " +
     "the failure follows ordinary failure handling.";
-/** Fixed runbook reference appended to every rate-limit diagnostic (BAPI-898). */
-const RATE_LIMIT_RUNBOOK_REFERENCE = "See docs/epic-implementer/operator-runbook.md §8.";
+/** Fixed guide reference appended to every rate-limit diagnostic. */
+const RATE_LIMIT_RUNBOOK_REFERENCE = `See ${CONSUMER_GUIDE_POINTER}.`;
 /**
  * Render the operator-facing rate-limit line (BAPI-828, BAPI-898).
  *