@bridge_gpt/mcp-server 0.2.16 → 0.2.19

package/build/conductor/bridge-api-client.js

@@ -74,16 +74,174 @@ export function buildConductorJiraUrl(baseUrl, apiPath, params = {}) {
     }
     return url.toString();
 }
-/** Sanitized HTTP error for conductor Bridge API calls — never leaks secrets. */
+const CONDUCTOR_BRIDGE_API_ERROR_KINDS = [
+    "invalid-input",
+    "network",
+    "timeout",
+    "unauthorized",
+    "server",
+    "http",
+];
+/** Max length of the sanitized body preview embedded in error diagnostics. */
+const CONDUCTOR_ERROR_PREVIEW_MAX = 200;
+/**
+ * Redact obvious secret-shaped tokens from a diagnostic preview string so a
+ * backend message that happens to echo a token/header never reaches a log line.
+ */
+function redactErrorPreview(text) {
+    return text
+        .replace(/sk-[A-Za-z0-9_-]{8,}/g, "[REDACTED]")
+        .replace(/(Bearer|X-API-Key|api[_-]?key)\b\s*[:=]?\s*\S+/gi, "$1 [REDACTED]");
+}
+/** Collapse whitespace, redact secrets, and bound a string to the preview cap. */
+function boundedErrorPreview(text) {
+    const redacted = redactErrorPreview(text).replace(/\s+/g, " ").trim();
+    return redacted.length > CONDUCTOR_ERROR_PREVIEW_MAX
+        ? `${redacted.slice(0, CONDUCTOR_ERROR_PREVIEW_MAX)}…`
+        : redacted;
+}
+/**
+ * Extract sanitized diagnostics from a parsed backend error body. Recognizes the
+ * FastAPI/backend shapes `{ detail: { error_code, message } }`,
+ * `{ detail: "..." }`, and `{ error_code, message }`; any other shape yields a
+ * bounded stringified preview. Never throws and never returns raw/unbounded text.
+ */
+export function extractSanitizedErrorDiagnostics(body) {
+    if (typeof body === "string") {
+        const trimmed = body.trim();
+        return trimmed ? { bodyPreview: boundedErrorPreview(trimmed) } : {};
+    }
+    if (!body || typeof body !== "object") {
+        return {};
+    }
+    const record = body;
+    const detail = record["detail"];
+    let errorCode;
+    let message;
+    if (detail && typeof detail === "object") {
+        const d = detail;
+        if (typeof d["error_code"] === "string")
+            errorCode = d["error_code"];
+        if (typeof d["message"] === "string")
+            message = d["message"];
+    }
+    else if (typeof detail === "string") {
+        message = detail;
+    }
+    if (!errorCode && typeof record["error_code"] === "string") {
+        errorCode = record["error_code"];
+    }
+    if (!message && typeof record["message"] === "string") {
+        message = record["message"];
+    }
+    const diagnostics = {};
+    if (errorCode)
+        diagnostics.errorCode = boundedErrorPreview(errorCode);
+    if (message)
+        diagnostics.bodyPreview = boundedErrorPreview(message);
+    return diagnostics;
+}
+/** Redact exact secret substrings (e.g. the API key from the request headers). */
+function redactDiagnosticValues(diagnostics, secrets) {
+    const scrub = (text) => {
+        let out = text;
+        for (const secret of secrets) {
+            if (secret && secret.length >= 4)
+                out = out.split(secret).join("[REDACTED]");
+        }
+        return out;
+    };
+    const out = {};
+    if (diagnostics.errorCode)
+        out.errorCode = scrub(diagnostics.errorCode);
+    if (diagnostics.bodyPreview)
+        out.bodyPreview = scrub(diagnostics.bodyPreview);
+    return out;
+}
+/**
+ * Best-effort read of a non-2xx response body into sanitized diagnostics. Never
+ * throws — a missing/invalid/non-JSON body simply yields `{}`. Any auth-header
+ * values in `headers` (e.g. `X-API-Key`) are additionally redacted from the
+ * preview so a body that echoes the credential can never surface it.
+ */
+async function readSanitizedErrorDiagnostics(resp, headers = {}) {
+    try {
+        const diagnostics = extractSanitizedErrorDiagnostics(await resp.json());
+        const secrets = Object.entries(headers)
+            .filter(([k]) => /key|authorization|token/i.test(k))
+            .map(([, v]) => v);
+        return redactDiagnosticValues(diagnostics, secrets);
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Sanitized HTTP error for conductor Bridge API calls — never leaks secrets.
+ *
+ * Construction is backward-compatible in two forms:
+ *   - `new ConductorBridgeApiError(kind, status?, diagnostics?)` — the canonical
+ *     form; builds a message from the coarse kind plus optional HTTP status,
+ *     backend `error_code`, and a bounded secret-redacted message preview.
+ *   - `new ConductorBridgeApiError("some legacy message")` — a bare message
+ *     string (not one of the known kinds) is preserved verbatim as the error
+ *     message, with `kind` defaulting to `"http"` and no diagnostic fields set.
+ */
 export class ConductorBridgeApiError extends Error {
     kind;
     status;
-    constructor(kind, status) {
-        super(`Conductor Bridge API request failed (${kind}${typeof status === "number" ? `, status ${status}` : ""})`);
+    errorCode;
+    bodyPreview;
+    constructor(kindOrMessage, status, diagnostics) {
+        const isKnownKind = CONDUCTOR_BRIDGE_API_ERROR_KINDS.includes(kindOrMessage);
+        const errorCode = diagnostics?.errorCode;
+        const bodyPreview = diagnostics?.bodyPreview;
+        if (isKnownKind) {
+            const parts = [
+                `Conductor Bridge API request failed (${kindOrMessage}${typeof status === "number" ? `, status ${status}` : ""})`,
+            ];
+            if (errorCode)
+                parts.push(`code=${errorCode}`);
+            if (bodyPreview)
+                parts.push(bodyPreview);
+            super(parts.join(": "));
+        }
+        else {
+            // Legacy/backward-compatible bare-message construction.
+            super(kindOrMessage);
+        }
         this.name = "ConductorBridgeApiError";
-        this.kind = kind;
-        this.status = status;
+        this.kind = (isKnownKind ? kindOrMessage : "http");
+        if (typeof status === "number")
+            this.status = status;
+        if (errorCode)
+            this.errorCode = errorCode;
+        if (bodyPreview)
+            this.bodyPreview = bodyPreview;
+    }
+}
+/**
+ * Build a bounded, secret-free diagnostic string from an unknown thrown error
+ * for tick warnings/logs. For a {@link ConductorBridgeApiError} it surfaces the
+ * coarse kind, HTTP status, backend error code, and sanitized message preview
+ * (never a stack, raw body, or secret). For any other Error it returns the
+ * constructor name; non-Errors fall back to `fallback`.
+ */
+export function safeDiagnosticMessage(err, fallback) {
+    if (err instanceof ConductorBridgeApiError) {
+        const parts = [`kind=${err.kind}`];
+        if (typeof err.status === "number")
+            parts.push(`status=${err.status}`);
+        if (err.errorCode)
+            parts.push(`code=${err.errorCode}`);
+        if (err.bodyPreview)
+            parts.push(err.bodyPreview);
+        return parts.join(" ");
+    }
+    if (err instanceof Error) {
+        return err.constructor.name;
     }
+    return fallback;
 }
 /** GET auth headers. The API key travels ONLY in a header, never in the URL. */
 function conductorGetHeaders(access) {
@@ -108,13 +266,14 @@ export async function fetchConductorJsonWithTimeout(url, headers, timeoutMs, fet
             throw new ConductorBridgeApiError(controller.signal.aborted ? "timeout" : "network");
         }
         if (!resp.ok) {
+            const diagnostics = await readSanitizedErrorDiagnostics(resp, headers);
             if (resp.status === 401 || resp.status === 403) {
-                throw new ConductorBridgeApiError("unauthorized", resp.status);
+                throw new ConductorBridgeApiError("unauthorized", resp.status, diagnostics);
             }
             if (resp.status >= 500) {
-                throw new ConductorBridgeApiError("server", resp.status);
+                throw new ConductorBridgeApiError("server", resp.status, diagnostics);
             }
-            throw new ConductorBridgeApiError("http", resp.status);
+            throw new ConductorBridgeApiError("http", resp.status, diagnostics);
         }
         try {
             return await resp.json();
@@ -252,13 +411,14 @@ async function fetchConductorJsonWithMethodAndTimeout(method, url, headers, body
             throw new ConductorBridgeApiError(controller.signal.aborted ? "timeout" : "network");
         }
         if (!resp.ok) {
+            const diagnostics = await readSanitizedErrorDiagnostics(resp, headers);
             if (resp.status === 401 || resp.status === 403) {
-                throw new ConductorBridgeApiError("unauthorized", resp.status);
+                throw new ConductorBridgeApiError("unauthorized", resp.status, diagnostics);
             }
             if (resp.status >= 500) {
-                throw new ConductorBridgeApiError("server", resp.status);
+                throw new ConductorBridgeApiError("server", resp.status, diagnostics);
             }
-            throw new ConductorBridgeApiError("http", resp.status);
+            throw new ConductorBridgeApiError("http", resp.status, diagnostics);
         }
         try {
             return await resp.json();
@@ -391,6 +551,8 @@ function requireNoSlashPathSegment(value) {
 const EPIC_TICKET_STATUS_VALUES = [
     "planned", "ready", "dispatched", "running", "blocked", "abandoned", "done", "ready_for_review",
     "reviewing",
+    // BAPI-527: asynchronous post-merge parse state (see EpicTicketStatusValue).
+    "parse_pending",
 ];
 function requireEpicTicketStatusValue(value) {
     if (typeof value !== "string" || !EPIC_TICKET_STATUS_VALUES.includes(value)) {
@@ -508,6 +670,26 @@ export async function fetchActiveEpicRuns(access, fetchImpl = globalThis.fetch)
     }
     return [];
 }
+/**
+ * PATCH `/jira/epic-runs/runs/{identifier}` to transition an epic run's
+ * lifecycle status. Drives the same backend `update_epic_run` CAS path the
+ * manual close-out used: passing `expectedStatus` makes the transition a safe
+ * compare-and-swap (a stale status surfaces as a sanitized
+ * {@link ConductorBridgeApiError} — HTTP 400 VALIDATION — rather than clobbering
+ * a concurrent terminal transition). Prefer passing the concrete run UUID as
+ * `epicKey` when the runtime has it. Returns the normalized {@link EpicRunRecord}.
+ */
+export async function updateEpicRunStatus(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicKey);
+    const url = buildConductorJiraUrl(access.baseUrl, epicRunApiPath(request.epicKey));
+    const body = JSON.stringify({
+        repo_name: access.repoName,
+        status: request.status,
+        ...(request.expectedStatus ? { expected_status: request.expectedStatus } : {}),
+    });
+    const parsed = await fetchConductorJsonPatchWithTimeout(url, conductorPostHeaders(access), body, CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+    return parsed;
+}
 // ---------------------------------------------------------------------------
 // Per-ticket CAS status advancement
 // ---------------------------------------------------------------------------
@@ -746,14 +928,12 @@ export async function getEpicPlan(access, epicKey, planVersion, fetchImpl = glob
     const parsed = await fetchConductorJsonWithTimeout(url, conductorGetHeaders(access), CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
     return parsed;
 }
-// ---------------------------------------------------------------------------
-// Parse pipeline helpers (BAPI-415)
-// ---------------------------------------------------------------------------
 /**
- * GET `/jira/parse-status?repo_name=<repo>` and return the live parse lock
- * status. Only two states are possible: `"in_progress"` (the async parse job
- * holds the lock) and `"idle"` (no lock is held). Throws a sanitized
- * {@link ConductorBridgeApiError} on any transport/auth/server failure.
+ * GET `/jira/parse-status?repo_name=<repo>` and return the durable parse-run
+ * status. See {@link ParseRepositoryStatusValue} for the full state set (the
+ * status surface distinguishes queued/running from terminal succeeded/failed).
+ * Throws a sanitized {@link ConductorBridgeApiError} on any transport/auth/server
+ * failure. URL + auth are unchanged from the pre-BAPI-527 two-state client.
  */
 export async function fetchParseStatus(access, fetchImpl = globalThis.fetch) {
     const url = buildConductorJiraUrl(access.baseUrl, "/parse-status", {

package/build/conductor/claude-hook.js

@@ -3,8 +3,11 @@
  *
  * This is a dependency-light command-hook entrypoint registered into a spawned
  * Claude worker's `.claude/settings.local.json` by `start-tickets`. Claude Code
- * invokes it for lifecycle events (SessionStart, Stop, SubagentStop,
- * Notification, optionally PreToolUse), passing the native hook JSON on stdin.
+ * invokes it for lifecycle events (SessionStart, SessionEnd, Notification,
+ * optionally PreToolUse), passing the native hook JSON on stdin. `Stop` and
+ * `SubagentStop` are intentionally NOT registered/emitted: they are per-turn /
+ * per-subagent events, not session-terminal (BAPI-507 N-1); only `SessionEnd`
+ * is a true session end and maps to `run.stopped`.
  * The writer:
  *
  *   1. reads + parses the native Claude hook payload from stdin,
@@ -50,15 +53,30 @@ export function resolveClaudeHookEventName(payload) {
 /**
  * Map a Claude lifecycle event name to a canonical conductor semantic type.
  * Unknown events map to `null` (the caller then skips emission).
+ *
+ * BAPI-507 (N-1): `Stop` and `SubagentStop` are intentionally ignored (→ null).
+ * Claude Code fires `Stop` at the end of EACH assistant turn and `SubagentStop`
+ * at each Task-subagent completion — NOT only at session termination. Mapping
+ * them to `run.stopped` folded a ticket to `ready_for_review` from minutes into
+ * the session, while the worker was still implementing with no branch pushed and
+ * no PR. The only true session-terminal event is `SessionEnd`, which maps to
+ * `run.stopped`. (Verified against the Claude Code lifecycle-hook contract:
+ * `SessionEnd` fires once when the session ends; `Stop`/`SubagentStop` are
+ * per-turn/per-subagent.)
  */
 export function mapClaudeHookEventToSemanticType(eventName) {
     switch (eventName) {
         case "SessionStart":
             return "run.started";
-        case "Stop":
+        case "SessionEnd":
+            // The one true session-terminal event: the worker's session has ended.
             return "run.stopped";
+        case "Stop":
+            // Per-turn boundary, NOT session end — deliberately ignored (BAPI-507 N-1).
+            return null;
         case "SubagentStop":
-            return "run.stopped";
+            // Per-subagent completion, NOT session end — deliberately ignored.
+            return null;
         case "Notification":
             return "agent.notification";
         case "PreToolUse":

package/build/conductor/cli.js

@@ -14,10 +14,12 @@
  * `process.exit` itself (the bin wrapper owns that).
  */
 import { readFileSync, unlinkSync } from "node:fs";
-import { ConductorValidationError, toConductorErrorEnvelope } from "./errors.js";
+import { ConductorValidationError, ConductorEpicTickV1FrozenError, toConductorErrorEnvelope, } from "./errors.js";
 import { emitConductorEvent, purgeConductorLedger, sendWorkerMessage, checkWorkerMessages, } from "./store.js";
+import { isDuplicateConstraintError } from "./producer-ledger.js";
 import { SEMANTIC_EVENT_TYPES } from "./taxonomy.js";
 import { installConductorGitHooks } from "./git-hooks.js";
+import { runFileScopeGuardCli } from "./file-scope-guard.js";
 import { runPostCommitHookProducer, runReferenceTransactionHookProducer } from "./git-producer.js";
 import { buildConductorDoctorReport, formatConductorDoctorReport } from "./doctor.js";
 import { resolveSupervisorConfig } from "./supervisor-config.js";
@@ -25,6 +27,21 @@ import { resolveSupervisorConfig } from "./supervisor-config.js";
 // pulls in the SQLite store, and a static import here would force every conductor
 // CLI invocation (and every test that mocks ./store.js for the other commands) to
 // resolve the full supervisor/store graph eagerly.
+/**
+ * Human-readable error line for a sanitized conductor error envelope. For the
+ * BAPI-526 LEDGER_NATIVE_MODULE_LOAD_FAILED envelope ONLY, append a compact,
+ * allowlisted `details:` suffix (module / node_version / node_modules_abi) so a
+ * CLI operator can see the ABI skew. Never prints arbitrary detail keys, paths,
+ * stacks, argv, or raw caught messages.
+ */
+export function formatConductorErrorLine(envelope) {
+    if (envelope.error === "LEDGER_NATIVE_MODULE_LOAD_FAILED" && envelope.details) {
+        const d = envelope.details;
+        return (`${envelope.message} ` +
+            `details: module=${d.module} node_version=${d.node_version} node_modules_abi=${d.node_modules_abi}`);
+    }
+    return envelope.message;
+}
 /** Human-readable usage text for the conductor CLI. */
 export function getConductorUsage() {
     return [
@@ -46,14 +63,14 @@ export function getConductorUsage() {
         "  git-hook post-commit Run the post-commit producer (invoked by the installed hook)",
         "  git-hook reference-transaction --phase <p> --stdin-file <f>",
         "                       Run the reference-transaction producer (invoked by the hook)",
+        "  file-scope-guard     Warn-only: compare the branch diff against the declared",
+        "                       touched-file set (always exits 0; never blocks a PR)",
         "",
         "supervise options:",
         "  --run-id <id>             Run/session identifier to supervise (required)",
         "  --wake-interval-ms <n>    Deterministic event-poll cadence (clamped 30000..60000)",
         "  --global-timeout-ms <n>   Total wall-clock ceiling for the run",
-        "  --llm-budget-calls <n>    Max LLM judgment calls per run before degraded-only mode",
         "  --escalation-cooldown-ms <n>  Min gap between escalations for the same worker+reason",
-        "  --no-llm                  Deterministic-only mode (never call the LLM judgment boundary)",
         "",
         "install-git-hooks notes:",
         "  Hooks are LOCAL, unversioned, opportunistic, and bypassable. Missing hooks are a",
@@ -102,6 +119,9 @@ export function getConductorUsage() {
         "",
         "doctor / purge options:",
         "  --json               Print machine-readable JSON",
+        "  --no-deny-probe      (doctor only) Skip the deny-enforcement preflight — no headless",
+        "                       agent is spawned; the deny_enforcement section reports an",
+        "                       explicit skipped state (enforcement UNVERIFIED, never enforced)",
         "",
         "Examples:",
         "  conductor emit-event --type run.started --source git-hook --run-id BAPI-393 \\",
@@ -151,6 +171,7 @@ const VALID_COMMANDS = new Set([
     "purge",
     "install-git-hooks",
     "git-hook",
+    "file-scope-guard",
 ]);
 /**
  * Parse the top-level conductor argv into a subcommand (without a CLI
@@ -215,6 +236,7 @@ function tokenizeFlags(argv, valueFlags, boolFlags) {
 const EMIT_VALUE_FLAGS = new Set([
     "--type",
     "--source",
+    "--id",
     "--subject",
     "--run-id",
     "--worker-id",
@@ -313,6 +335,10 @@ export function parseEmitEventArgs(argv, deps = {}) {
     const input = {
         source,
         type: type,
+        // Optional caller-supplied deterministic id (BAPI-527): forwarded to the store
+        // so a duplicate collides on the `events.id` UNIQUE constraint, giving the
+        // worker gate path server-side dedup without an in-process ledger poll.
+        id: values.get("--id"),
         subject: values.get("--subject"),
         run_id: values.get("--run-id"),
         worker_id: values.get("--worker-id"),
@@ -342,7 +368,22 @@ export async function runEmitEventCommand(argv, deps = {}) {
         console.log(getConductorUsage());
         return 0;
     }
-    const result = await emitConductorEvent(parsed.input);
+    let result;
+    try {
+        result = await emitConductorEvent(parsed.input);
+    }
+    catch (error) {
+        // A forwarded deterministic `--id` (BAPI-527) that collides on the events.id
+        // UNIQUE constraint is a server-side dedup, not a failure: report it as a
+        // structured duplicate so the worker gate path can treat it as a no-op emit
+        // without ever polling the ledger in-process.
+        if (isDuplicateConstraintError(error)) {
+            const dup = { ok: false, reason: "duplicate" };
+            console.log(parsed.json ? JSON.stringify(dup) : JSON.stringify(dup, null, 2));
+            return 0;
+        }
+        throw error;
+    }
     if (parsed.json) {
         console.log(JSON.stringify(result));
     }
@@ -514,21 +555,25 @@ export async function runCheckMessagesCommand(argv) {
     return 0;
 }
 const DIAGNOSTIC_BOOL_FLAGS = new Set(["--json", "--help"]);
+const DOCTOR_BOOL_FLAGS = new Set([...DIAGNOSTIC_BOOL_FLAGS, "--no-deny-probe"]);
 /**
  * Run the strictly read-only `doctor` command. Combines ledger health, git hook
  * health, and epic-tick schedule enablement status. `--json` emits the full
  * report with `epic_tick` alongside `git_hooks` at the top level.
+ * `--no-deny-probe` skips the deny-enforcement preflight (no headless agent
+ * spawn); the report then carries an explicit skipped state, never enforced.
  */
-export async function runDoctorCommand(argv) {
-    const { bools } = tokenizeFlags(argv, new Set(), DIAGNOSTIC_BOOL_FLAGS);
+export async function runDoctorCommand(argv, deps = {}) {
+    const { bools } = tokenizeFlags(argv, new Set(), DOCTOR_BOOL_FLAGS);
     if (bools.has("--help")) {
         console.log(getConductorUsage());
         return 0;
     }
     // scheduleDeps omitted: buildConductorDoctorReport lazily loads schedule-run.
-    const report = await buildConductorDoctorReport({});
+    // A caller may inject deps (e.g. a fake deny inspector in tests) to stay hermetic.
+    const report = await buildConductorDoctorReport(bools.has("--no-deny-probe") ? { ...deps, skipDenyProbe: true } : deps);
     if (bools.has("--json")) {
-        console.log(JSON.stringify({ ...report.ledger, git_hooks: report.git_hooks, epic_tick: report.epic_tick, mcp_profile: report.mcp_profile }));
+        console.log(JSON.stringify({ ...report.ledger, git_hooks: report.git_hooks, epic_tick: report.epic_tick, mcp_profile: report.mcp_profile, native_ledger: report.native_ledger, deny_enforcement: report.deny_enforcement }));
         return 0;
     }
     console.log(formatConductorDoctorReport(report));
@@ -685,7 +730,17 @@ export function applyEpicTickPreToolUseDefault(env = process.env) {
  * `conductor doctor` / `emit-event` invocation never eagerly resolves the
  * epic/store graph.
  */
-export async function runEpicTickCommand(argv) {
+export async function runEpicTickCommand(_argv) {
+    // BAPI-534 (Epic Conductor v2 slice 0): the v1 epic-tick path is FROZEN. This
+    // fail-loud guard is the FIRST executable statement — before argument parsing,
+    // `applyEpicTickPreToolUseDefault()`, and any lazy `import("./epic-runtime.js")`
+    // — so no v1 tick (or its store/supervisor graph) can ever run. Interactive
+    // `/start-tickets` is unaffected. `runConductorCli` catches this named error
+    // and formats it consistently (EPIC_TICK_V1_FROZEN → exit 1).
+    throw new ConductorEpicTickV1FrozenError();
+}
+/** @deprecated v1 epic-tick body — retained unreachable behind the freeze guard. */
+export async function runEpicTickCommandLegacy(argv) {
     const parsed = parseEpicTickArgs(argv);
     if (parsed.help) {
         console.log(getConductorUsage());
@@ -761,7 +816,7 @@ export async function runApprovePlanCommand(argv) {
     }
     catch (error) {
         const envelope = toConductorErrorEnvelope(error);
-        console.error(`Error: ${envelope.message}`);
+        console.error(`Error: ${formatConductorErrorLine(envelope)}`);
         return 1;
     }
     if (parsed.help) {
@@ -809,7 +864,7 @@ export async function runApprovePlanCommand(argv) {
             console.log(JSON.stringify(envelope));
         }
         else {
-            console.error(`Error: ${envelope.message}`);
+            console.error(`Error: ${formatConductorErrorLine(envelope)}`);
         }
         return envelope.status >= 500 ? 2 : 1;
     }
@@ -847,7 +902,7 @@ export async function runEpicStatusCommand(argv) {
     }
     catch (error) {
         const envelope = toConductorErrorEnvelope(error);
-        console.error(`Error: ${envelope.message}`);
+        console.error(`Error: ${formatConductorErrorLine(envelope)}`);
         return 1;
     }
     if (parsed.help) {
@@ -913,7 +968,7 @@ export async function runEpicStatusCommand(argv) {
             console.log(JSON.stringify(envelope));
         }
         else {
-            console.error(`Error: ${envelope.message}`);
+            console.error(`Error: ${formatConductorErrorLine(envelope)}`);
         }
         return envelope.status >= 500 ? 2 : 1;
     }
@@ -925,10 +980,9 @@ const SUPERVISE_VALUE_FLAGS = new Set([
     "--run-id",
     "--wake-interval-ms",
     "--global-timeout-ms",
-    "--llm-budget-calls",
     "--escalation-cooldown-ms",
 ]);
-const SUPERVISE_BOOL_FLAGS = new Set(["--no-llm", "--help"]);
+const SUPERVISE_BOOL_FLAGS = new Set(["--help"]);
 /** Parse a required positive-integer flag, raising a sanitized error otherwise. */
 function parsePositiveIntFlag(values, flag) {
     const raw = values.get(flag);
@@ -946,9 +1000,8 @@ function parsePositiveIntFlag(values, flag) {
 /**
  * Parse `supervise` flags. `--run-id` is required and must be non-empty /
  * non-whitespace. Numeric overrides are validated as non-negative integers (the
- * config resolver clamps them to safe bounds); `--no-llm` selects
- * deterministic-only mode. Malformed input raises a sanitized
- * {@link ConductorValidationError}.
+ * config resolver clamps them to safe bounds). Malformed input raises a
+ * sanitized {@link ConductorValidationError}.
  */
 export function parseSuperviseArgs(argv) {
     const { values, bools } = tokenizeFlags(argv, SUPERVISE_VALUE_FLAGS, SUPERVISE_BOOL_FLAGS);
@@ -966,14 +1019,9 @@ export function parseSuperviseArgs(argv) {
     const globalTimeout = parsePositiveIntFlag(values, "--global-timeout-ms");
     if (globalTimeout !== undefined)
         overrides.global_timeout_ms = globalTimeout;
-    const llmCalls = parsePositiveIntFlag(values, "--llm-budget-calls");
-    if (llmCalls !== undefined)
-        overrides.llm_max_calls = llmCalls;
     const cooldown = parsePositiveIntFlag(values, "--escalation-cooldown-ms");
     if (cooldown !== undefined)
         overrides.escalation_cooldown_ms = cooldown;
-    if (bools.has("--no-llm"))
-        overrides.llm_enabled = false;
     return { runId: runIdRaw.trim(), overrides, help: false };
 }
 /**
@@ -990,7 +1038,7 @@ export async function runSuperviseCommand(argv) {
     }
     const config = resolveSupervisorConfig(parsed.overrides);
     console.log(`[supervisor] starting run=${parsed.runId} wake=${config.wake_interval_ms}ms ` +
-        `global_timeout=${config.global_timeout_ms}ms llm=${config.llm_enabled ? `on(${config.llm_max_calls})` : "off"}`);
+        `global_timeout=${config.global_timeout_ms}ms`);
     const { runSupervisor } = await import("./supervisor-runtime.js");
     const result = await runSupervisor({ run_id: parsed.runId, config });
     return result.exit_code;
@@ -1056,6 +1104,9 @@ export async function runConductorCli(argv) {
                 return runInstallGitHooksCommand(parsed.argv);
             case "git-hook":
                 return await runGitHookCommand(parsed.argv);
+            case "file-scope-guard":
+                // BAPI-507 (N-2): warn-only worker file-scope guard. Always exits 0.
+                return runFileScopeGuardCli();
             default:
                 console.error('Error: Unknown command. Run "conductor --help" for usage.');
                 return 1;
@@ -1063,7 +1114,7 @@ export async function runConductorCli(argv) {
     }
     catch (error) {
         const envelope = toConductorErrorEnvelope(error);
-        console.error(`Error: ${envelope.message}`);
+        console.error(`Error: ${formatConductorErrorLine(envelope)}`);
         return envelope.status >= 500 ? 2 : 1;
     }
 }

package/build/conductor/deny-enforcement-preflight.js

@@ -0,0 +1,96 @@
+/**
+ * Executor deny-enforcement preflight (TDD §7 / §11, R8).
+ *
+ * v2's permission model is "skip-permissions + a deterministic deny-layer": workers
+ * run `claude -p … --dangerously-skip-permissions` with a small stable deny set. But
+ * whether `permissions.deny` is actually enforced under `--dangerously-skip-permissions`
+ * is version-specific and must be PROBED, never assumed. This module exports the single
+ * reusable predicate the T3a executor's claim loop calls at startup/preflight before
+ * claiming any job: on a failed deny probe with no working fallback it returns
+ * `enforced: false`, and the executor must refuse to claim jobs (a fatal finding).
+ *
+ * This ticket (T9) defines the INTERFACE only; the claim loop that consumes it lands in
+ * T3a. The predicate is a thin wrapper over the shared `runDenyEnforcementCheck` — it
+ * never re-derives probe logic, never touches the wider probe registry, and never runs
+ * the advisory output-format / stream-json probes. It is exception-safe: any unexpected
+ * failure resolves to a fatal `enforced: false` result rather than throwing.
+ */
+import { resolveAgentSpec } from "../agent-registry.js";
+import { createProbeContext } from "../agent-capabilities/probe-context.js";
+import { createDefaultAgentCapabilitiesDeps } from "../agent-capabilities/default-deps.js";
+import { runDenyEnforcementCheck } from "../agent-capabilities/probes.js";
+/** Canonical refuse-to-claim directive included in every fatal/degraded-fatal result. */
+const REFUSE_TO_CLAIM_WARNING = "The executor claim loop MUST refuse to claim jobs until settings permissions.deny " +
+    "or the PreToolUse fallback enforces the deny layer.";
+/**
+ * Run the deny-enforcement preflight and map the shared deny-check outcome onto the
+ * standard inspection shape. Never throws — unexpected exceptions become a fatal
+ * `enforced: false` result. Always cleans up the probe context's temp dirs.
+ */
+export async function runDenyEnforcementPreflight(opts = {}) {
+    try {
+        const agent = resolveAgentSpec("claude");
+        if (!agent) {
+            return {
+                enforced: false,
+                layer: "none",
+                degraded: true,
+                warnings: [
+                    "Could not resolve the 'claude' agent spec for the deny-enforcement preflight.",
+                    REFUSE_TO_CLAIM_WARNING,
+                ],
+            };
+        }
+        const deps = opts.capabilityDeps ?? createDefaultAgentCapabilitiesDeps();
+        const { ctx, cleanup } = await createProbeContext(deps, agent, opts.timeoutMs);
+        try {
+            const { result, layer } = await runDenyEnforcementCheck(ctx, {
+                model: opts.model,
+                timeoutMs: opts.timeoutMs,
+            });
+            if (result.status === "pass" && layer === "settings-deny") {
+                return {
+                    enforced: true,
+                    layer: "settings-deny",
+                    degraded: false,
+                    warnings: [],
+                    status: result.status,
+                    detail: result.detail,
+                };
+            }
+            if (result.status === "pass" && layer === "pretooluse-hook") {
+                return {
+                    enforced: true,
+                    layer: "pretooluse-hook",
+                    degraded: true,
+                    warnings: [
+                        "settings permissions.deny was not enforced under --dangerously-skip-permissions; relying on PreToolUse fallback.",
+                    ],
+                    status: result.status,
+                    detail: result.detail,
+                };
+            }
+            // Any other outcome (fail / hang / spawn-error) — deny is not enforced.
+            return {
+                enforced: false,
+                layer: "none",
+                degraded: true,
+                warnings: [`Deny-layer enforcement probe did not pass: ${result.detail}`, REFUSE_TO_CLAIM_WARNING],
+                status: result.status,
+                detail: result.detail,
+            };
+        }
+        finally {
+            await cleanup();
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            enforced: false,
+            layer: "none",
+            degraded: true,
+            warnings: [`Deny-layer enforcement preflight failed unexpectedly: ${msg}`, REFUSE_TO_CLAIM_WARNING],
+        };
+    }
+}