@bridge_gpt/mcp-server 0.2.33 → 0.2.36

package/build/doctor.js

@@ -14,7 +14,7 @@
  * spawning, no MCP server startup. It only ever runs read-only PATH probes
  * (`which`/`where`, `bash --version`, `git rev-parse`) through the injected deps.
  */
-import { readFile, stat } from "fs/promises";
+import { readdir, readFile, stat } from "fs/promises";
 import { spawn } from "child_process";
 import os from "os";
 import path from "path";
@@ -28,6 +28,8 @@ import { resolveBapiCredentials } from "./credential-store.js";
 import { DEFAULT_AGENT_NAME, resolveAgentSpec, isAgentName, formatValidAgentNames, } from "./agent-registry.js";
 import { getDoctorPrereqDescriptors, probePrerequisite, } from "./start-tickets-prereqs.js";
 import { resolveProfiles } from "./mcp-profile.js";
+import { executorLaunchdDirForHome, executorSystemdDirForHome, executorIdFromLaunchdFilename, executorIdFromSystemdFilename, inspectExecutorServiceArtifact, EXECUTOR_SERVICE_BASE_URL_ENV, } from "./executor/index.js";
+import { DEFAULT_BAPI_BASE_URL } from "./executor/credentials.js";
 /**
  * The report/usage title (BAPI-669, U9b). `doctor` diagnoses the whole Bridge
  * install — install status, prerequisites, launcher cache, and tool surface — so it
@@ -74,6 +76,16 @@ export function getDoctorUsage() {
         "ignore notifications/tools/list_changed must reconnect or start a new MCP",
         "session to observe surface changes; no project MCP config change is required.",
         "",
+        "It also includes an advisory 'Executor provisioning' section (BAPI-688): the",
+        "generated executor service units on this host. It enumerates them read-only by",
+        "fixed convention — ~/Library/LaunchAgents/com.bridge-gpt.executor.*.plist on",
+        "macOS, ~/.config/systemd/user/bridge-gpt-executor-*.service on Linux (Windows",
+        "Task Scheduler setup is manual, so it reports SKIP) — and reports each unit's",
+        "embedded BAPI_BASE_URL and repositories plus whether a Bridge API credential",
+        "resolves for each repo (target bapi:<repo>, source only, never the key value).",
+        "It reads no install-state file, writes nothing, runs no launchctl/systemctl, and",
+        "is advisory: missing, malformed, or credential-less units never change the exit code.",
+        "",
         "Conductor ledger / native-module diagnostics (the SQLite ledger's native",
         "binding load status and Node-version skew) live under a separate command:",
         "  conductor doctor",
@@ -513,6 +525,196 @@ export function formatToolSurfaceDiagnosticReport(diag) {
     lines.push("to observe surface changes; no project MCP configuration change is required.");
     return lines.join("\n");
 }
+/** Where generated units live, and how their filenames encode the executor id. */
+function resolveExecutorServiceConvention(platform, homeDir) {
+    if (platform === "darwin") {
+        return {
+            dir: executorLaunchdDirForHome(homeDir),
+            kind: "launchd-plist",
+            idFromFilename: executorIdFromLaunchdFilename,
+        };
+    }
+    if (platform === "linux") {
+        return {
+            dir: executorSystemdDirForHome(homeDir),
+            kind: "systemd-service",
+            idFromFilename: executorIdFromSystemdFilename,
+        };
+    }
+    return null;
+}
+/**
+ * Resolve one repository's credential and IMMEDIATELY discard the key, keeping
+ * only a source/status label. The resolved value never enters a diagnostic
+ * object, a warning, or the rendered report.
+ */
+async function probeRepoCredential(repo, deps, credDeps) {
+    const target = `bapi:${repo}`;
+    const resolve = deps.resolveCredentials ?? resolveBapiCredentials;
+    try {
+        const result = await resolve(repo, credDeps);
+        if (result.ok) {
+            return { repo, target, resolved: true, source: String(result.credentials.source) };
+        }
+        return { repo, target, resolved: false, kind: String(result.kind) };
+    }
+    catch {
+        // Sanitized: a resolver throw is reported as a kind, never as exception text.
+        return { repo, target, resolved: false, kind: "unavailable" };
+    }
+}
+/**
+ * Collect read-only diagnostics for every convention-named executor service unit
+ * on this host. Never throws: a vanished directory entry, an unreadable unit, or
+ * a malformed body becomes a sanitized advisory warning and collection continues.
+ */
+export async function collectExecutorServiceDiagnostics(deps) {
+    if (deps.platform === "win32") {
+        return {
+            status: "skipped",
+            reason: "Windows executor services are set up manually through Task Scheduler, so there is no " +
+                "generated unit to enumerate (`executor install-service` prints the command line instead).",
+        };
+    }
+    const convention = resolveExecutorServiceConvention(deps.platform, deps.homedir());
+    if (!convention) {
+        return {
+            status: "skipped",
+            reason: `platform '${deps.platform}' has no generated executor service format.`,
+        };
+    }
+    let entries;
+    try {
+        entries = await deps.readdir(convention.dir);
+    }
+    catch {
+        return {
+            status: "skipped",
+            reason: `no executor service units found (${convention.dir} is absent or unreadable).`,
+        };
+    }
+    // Sort BEFORE inspection so report ordering is deterministic regardless of the
+    // order the filesystem happened to return entries in.
+    const matching = entries
+        .filter((name) => convention.idFromFilename(name) !== null)
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    if (matching.length === 0) {
+        return {
+            status: "skipped",
+            reason: `no executor service units found in ${convention.dir}.`,
+        };
+    }
+    const credDeps = {
+        env: deps.env,
+        homedir: deps.homedir,
+        platform: deps.platform,
+        readFile: deps.readFile,
+        stat: deps.stat,
+        stderr: () => { },
+    };
+    // Only darwin/linux reach here (win32 and unsupported platforms returned
+    // above), so unit paths always use POSIX semantics — matching the generators.
+    const pathApi = path.posix;
+    const units = [];
+    const warnings = [];
+    for (const name of matching) {
+        const unitPath = pathApi.join(convention.dir, name);
+        const executorId = convention.idFromFilename(name) ?? name;
+        try {
+            await deps.stat(unitPath);
+        }
+        catch {
+            // The entry vanished or became unreadable between enumeration and stat.
+            warnings.push(`${unitPath}: disappeared or became unreadable during collection.`);
+            continue;
+        }
+        let content;
+        try {
+            content = await deps.readFile(unitPath);
+        }
+        catch {
+            units.push({
+                path: unitPath,
+                executorId,
+                baseUrl: null,
+                baseUrlClass: "missing",
+                repos: [],
+                credentials: [],
+                warnings: ["unit could not be read; its configuration cannot be verified."],
+            });
+            continue;
+        }
+        const inspection = inspectExecutorServiceArtifact(convention.kind, content);
+        const unitWarnings = [...inspection.problems];
+        let baseUrlClass;
+        if (!inspection.baseUrl) {
+            baseUrlClass = "missing";
+            unitWarnings.push(`no ${EXECUTOR_SERVICE_BASE_URL_ENV} in the unit — the executor requires an explicit base ` +
+                "URL and will fail to start.");
+        }
+        else if (inspection.baseUrl.replace(/\/+$/, "") === DEFAULT_BAPI_BASE_URL) {
+            baseUrlClass = "production-default";
+            unitWarnings.push(`${EXECUTOR_SERVICE_BASE_URL_ENV} points at production (${DEFAULT_BAPI_BASE_URL}) — legal, ` +
+                "but worth confirming this host is meant to serve production jobs.");
+        }
+        else {
+            baseUrlClass = "configured";
+        }
+        // Probe each DISTINCT repository once per unit, even when the unit repeats it.
+        const distinctRepos = Array.from(new Set(inspection.repos));
+        const credentials = [];
+        for (const repo of distinctRepos) {
+            credentials.push(await probeRepoCredential(repo, deps, credDeps));
+        }
+        units.push({
+            path: unitPath,
+            executorId,
+            baseUrl: inspection.baseUrl,
+            baseUrlClass,
+            repos: inspection.repos,
+            credentials,
+            warnings: unitWarnings,
+        });
+    }
+    return { status: "collected", units, warnings };
+}
+/**
+ * Render the advisory "Executor provisioning" section (pure formatting — no I/O).
+ * Every line is found / WARN / SKIP; nothing here changes the exit code.
+ */
+export function formatExecutorServiceDiagnosticsReport(diagnostics) {
+    const lines = ["", "Executor provisioning (generated service units — advisory)", ""];
+    if (diagnostics.status === "skipped") {
+        lines.push(`SKIP  ${diagnostics.reason}`);
+        lines.push("");
+        lines.push("This section is read-only and advisory: it enumerates units by fixed directory and filename");
+        lines.push("prefix, and never changes the doctor exit code.");
+        return lines.join("\n");
+    }
+    for (const warning of diagnostics.warnings) {
+        lines.push(`WARN  ${warning}`);
+    }
+    for (const unit of diagnostics.units) {
+        lines.push(`found ${unit.path}`);
+        lines.push(`      executor id: ${unit.executorId}`);
+        lines.push(`      ${EXECUTOR_SERVICE_BASE_URL_ENV}: ${unit.baseUrl ?? "(absent)"} [${unit.baseUrlClass}]`);
+        lines.push(`      repos: ${unit.repos.length > 0 ? unit.repos.join(", ") : "(none parsed)"}`);
+        for (const cred of unit.credentials) {
+            lines.push(cred.resolved
+                ? `      credential ${cred.target}: resolved (source: ${cred.source})`
+                : `      credential ${cred.target}: NOT resolved (${cred.kind})`);
+        }
+        for (const warning of unit.warnings) {
+            lines.push(`WARN  ${unit.path}: ${warning}`);
+        }
+    }
+    lines.push("");
+    lines.push("Generated units carry only the base URL, the generating shell's PATH, repositories, and", "executor id — credentials resolve at");
+    lines.push("launch time from BAPI_API_KEY or the user-scoped bapi:<repo> store, so no key value is stored on");
+    lines.push("disk or printed here. Starting, stopping, and enabling a unit stay operator-managed. This section");
+    lines.push("is advisory and never changes the doctor exit code.");
+    return lines.join("\n");
+}
 /**
  * CLI entry for the read-only `doctor` subcommand. Returns a process exit code.
  * Help returns 0; parser errors return 1; otherwise it prints the report and
@@ -621,6 +823,37 @@ export async function runDoctorCli(argv, overrides = {}) {
             }));
         }
     }
+    // Advisory executor-provisioning section (BAPI-688). Strictly read-only: it
+    // enumerates convention-named units under a fixed OS directory, parses their
+    // non-secret configuration, and probes credential resolution WITHOUT retaining
+    // any key. It is collected independently of `DoctorCollectionResult` and, like
+    // the sections above, never affects the exit code — missing units, malformed
+    // units, and unresolved credentials are all advisory.
+    if (overrides.executorService !== false) {
+        try {
+            const injectedFs = deps;
+            const executorDeps = {
+                platform: overrides.executorService?.platform ?? deps.platform,
+                env: overrides.executorService?.env ?? deps.env,
+                homedir: overrides.executorService?.homedir ?? injectedFs.homedir ?? os.homedir,
+                readdir: overrides.executorService?.readdir ?? ((p) => readdir(p)),
+                readFile: overrides.executorService?.readFile ??
+                    injectedFs.readFile ??
+                    ((p) => readFile(p, "utf-8")),
+                stat: overrides.executorService?.stat ?? injectedFs.stat ?? ((p) => stat(p)),
+                resolveCredentials: overrides.executorService?.resolveCredentials,
+            };
+            const executorDiagnostics = await collectExecutorServiceDiagnostics(executorDeps);
+            log(formatExecutorServiceDiagnosticsReport(executorDiagnostics));
+        }
+        catch {
+            // Any unexpected failure still renders a sanitized advisory SKIP line.
+            log(formatExecutorServiceDiagnosticsReport({
+                status: "skipped",
+                reason: "executor service units could not be enumerated on this host.",
+            }));
+        }
+    }
     if (!collection.ok)
         return 1;
     return collection.results.some((r) => !r.found) ? 1 : 0;

package/build/executor/cli.js

@@ -11,7 +11,7 @@ import { VERSION } from "../version.generated.js";
 import { resolveWorktrunkBinary } from "../start-tickets-prereqs.js";
 import { resolveStartTicketsRepoName } from "../start-tickets-repo.js";
 import { createDefaultExecutorDeps } from "./deps.js";
-import { resolveExecutorApiAccess, } from "./credentials.js";
+import { resolveBaseUrl, resolveExecutorApiAccess, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
 import { createExecutorHttpClient } from "./http-client.js";
 import { runExecutor } from "./runner.js";
 import { runExecutorWatchCli } from "./watch-cli.js";
@@ -22,7 +22,12 @@ const DEFAULT_DEADMAN_MS = 120_000;
 const DEFAULT_TERM_GRACE_MS = 10_000;
 const DEFAULT_BASE_BRANCH = "main";
 const DEFAULT_JOB_TIMEOUT_SECONDS = 20 * 60;
-const DEFAULT_MAX_CONCURRENT = 1;
+/**
+ * ONE job per executor process. Exported so the invariant can be pinned against
+ * the real constant rather than a copy: BAPI-688 adds more executor *processes*
+ * (persistent service units), and must never turn one process into multi-slot.
+ */
+export const DEFAULT_MAX_CONCURRENT = 1;
 export function getExecutorUsage() {
     return [
         "Usage: mcp-server executor --repo <name> [--repo <name> ...] [options]",
@@ -32,6 +37,7 @@ export function getExecutorUsage() {
         "Options:",
         "  --repo <name>                 Repo to serve (repeatable).",
         "  --repos=<a,b>                 Comma-separated repos.",
+        "  --base-url <url>              Bridge API endpoint (overrides BAPI_BASE_URL).",
         "  --executor-id <id>            Stable executor id (default: <hostname>-<pid>).",
         "  --max-concurrent <n>          Max concurrent jobs (>= 1, default 1).",
         "  --once                        Run a single preflight/claim cycle and exit.",
@@ -41,6 +47,12 @@ export function getExecutorUsage() {
         "  --base-branch <name>          Base branch (default main).",
         "  --no-advisory-parser          Disable the advisory stream-json parser.",
         "  -h, --help                    Show this help.",
+        "",
+        "Subcommands:",
+        "  executor watch <job>          Attach (read-only) to a running job's worker log.",
+        "  executor install-service      Generate a launchd/systemd user service unit for a",
+        "                                stable --executor-id so the executor survives reboot.",
+        "                                See `executor install-service --help`.",
     ].join("\n");
 }
 function parseIntArg(value, flag) {
@@ -63,6 +75,7 @@ export function parseExecutorArgs(argv, context) {
     let deadmanMs = DEFAULT_DEADMAN_MS;
     let baseBranch = DEFAULT_BASE_BRANCH;
     let advisoryParserEnabled = true;
+    let baseUrl;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         if (arg === "--help" || arg === "-h")
@@ -120,6 +133,12 @@ export function parseExecutorArgs(argv, context) {
                 return { kind: "error", message: "--base-branch requires a value" };
             baseBranch = v;
         }
+        else if (arg === "--base-url") {
+            const v = argv[++i];
+            if (!v)
+                return { kind: "error", message: "--base-url requires a value" };
+            baseUrl = v;
+        }
         else if (arg === "--no-advisory-parser") {
             advisoryParserEnabled = false;
         }
@@ -150,6 +169,7 @@ export function parseExecutorArgs(argv, context) {
         baseBranch,
         advisoryParserEnabled,
         defaultJobTimeoutSeconds: DEFAULT_JOB_TIMEOUT_SECONDS,
+        baseUrl,
     };
     return { kind: "ok", options };
 }
@@ -194,20 +214,27 @@ export async function runExecutorCli(argv, overrides = {}) {
         return 1;
     }
     const options = parsed.options;
+    // The mutating executor requires an EXPLICIT base URL (BAPI-676): `--base-url`
+    // then `BAPI_BASE_URL`, never an implicit production default. Fail here —
+    // before any credential resolution, HTTP client, or claim side effect.
+    const baseUrlResult = resolveBaseUrl(deps.env, options.baseUrl);
+    if (!baseUrlResult.ok) {
+        errorLog(`Error: ${EXECUTOR_BASE_URL_REQUIRED_MESSAGE}`);
+        return 1;
+    }
+    const baseUrl = baseUrlResult.baseUrl;
     // Resolve credentials for EVERY configured repo so multi-repo mode sends the
     // correct repo-bound `X-API-Key` per claim/heartbeat/complete/fail — not just
     // the first repo's key. Uses the (injectable) single-repo resolver per repo.
     const resolveApi = overrides.resolveApiAccess ?? resolveExecutorApiAccess;
     const apiKeyByRepo = {};
-    let baseUrl = "";
     for (const repo of options.repos) {
-        const access = await resolveApi(repo, deps);
+        const access = await resolveApi(repo, deps, baseUrl);
         if (!access.ok) {
             errorLog(`Error: ${access.error}`);
             return 1;
         }
         apiKeyByRepo[repo] = access.apiKey;
-        baseUrl = access.baseUrl;
     }
     const createHttpClient = overrides.createHttpClient ?? createExecutorHttpClient;
     const httpClient = createHttpClient({

package/build/executor/credentials.js

@@ -7,25 +7,59 @@
  * diagnostics/results.
  */
 import { resolveBapiCredentials } from "../credential-store.js";
-/** Default Bridge API base URL when `BAPI_BASE_URL` is unset/blank. */
+/**
+ * The documented production Bridge API base URL — the value an operator pastes
+ * into `BAPI_BASE_URL` or `--base-url` when they *do* mean production.
+ *
+ * It is NOT an implicit executor fallback (BAPI-676): the executor requires an
+ * explicit base URL and fails fast when none is supplied, so pointing at
+ * production is always a deliberate act. Other flows (MCP server,
+ * install-bridge) legitimately keep their own production defaults.
+ */
 export const DEFAULT_BAPI_BASE_URL = "https://bridgegpt-api.com";
-function resolveBaseUrl(env) {
-    const raw = env.BAPI_BASE_URL;
-    if (typeof raw === "string" && raw.trim().length > 0) {
-        return raw.trim().replace(/\/+$/, "");
-    }
-    return DEFAULT_BAPI_BASE_URL;
+/**
+ * Shared, secret-free prerequisite message for a missing executor base URL.
+ * Names both supported sources and states the no-production-default contract so
+ * the CLI and preflight diagnostics stay identically worded. It interpolates no
+ * configuration or credential value.
+ */
+export const EXECUTOR_BASE_URL_REQUIRED_MESSAGE = "no Bridge API base URL configured for the executor: pass --base-url <url> or set BAPI_BASE_URL " +
+    `(production is ${DEFAULT_BAPI_BASE_URL}). The executor never defaults to production.`;
+/** Trim, strip every trailing slash, and treat an empty result as absent. */
+function normalizeBaseUrlCandidate(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const normalized = raw.trim().replace(/\/+$/, "");
+    return normalized.length > 0 ? normalized : null;
+}
+/**
+ * Resolve the executor's base URL: explicit override (`--base-url`) first, then
+ * `BAPI_BASE_URL`, then failure. A blank override is treated as absent so a
+ * nonblank environment value can still win; there is NO production fallback.
+ */
+export function resolveBaseUrl(env, explicitBaseUrl) {
+    const fromFlag = normalizeBaseUrlCandidate(explicitBaseUrl);
+    if (fromFlag !== null)
+        return { ok: true, baseUrl: fromFlag };
+    const fromEnv = normalizeBaseUrlCandidate(env?.BAPI_BASE_URL);
+    if (fromEnv !== null)
+        return { ok: true, baseUrl: fromEnv };
+    return { ok: false };
 }
 /**
  * Resolve API access for a single repo. Returns a structured, secret-free
  * failure for credential-not-found, read/parse failure, missing key, or an
  * invalid repo name — never throwing, never echoing credential-file contents.
  */
-export async function resolveExecutorApiAccess(repoName, deps) {
+export async function resolveExecutorApiAccess(repoName, deps, explicitBaseUrl) {
     const trimmed = typeof repoName === "string" ? repoName.trim() : "";
     if (trimmed.length === 0) {
         return { ok: false, error: "invalid repo name: repo name is required" };
     }
+    const url = resolveBaseUrl(deps.env, explicitBaseUrl);
+    if (!url.ok) {
+        return { ok: false, error: EXECUTOR_BASE_URL_REQUIRED_MESSAGE };
+    }
     const storeDeps = {
         env: deps.env,
         homedir: deps.homedir,
@@ -43,17 +77,17 @@ export async function resolveExecutorApiAccess(repoName, deps) {
     return {
         ok: true,
         apiKey: result.credentials.apiKey,
-        baseUrl: resolveBaseUrl(deps.env),
+        baseUrl: url.baseUrl,
     };
 }
 /**
  * Resolve credentials for every configured repo before the executor starts
  * claiming. Each repo resolves independently; failures are reported per-repo.
  */
-export async function resolveAllExecutorApiAccess(repos, deps) {
+export async function resolveAllExecutorApiAccess(repos, deps, explicitBaseUrl) {
     const out = [];
     for (const repo of repos) {
-        const access = await resolveExecutorApiAccess(repo, deps);
+        const access = await resolveExecutorApiAccess(repo, deps, explicitBaseUrl);
         if (access.ok) {
             out.push({ ok: true, repoName: repo, apiKey: access.apiKey, baseUrl: access.baseUrl });
         }

package/build/executor/deps.js

@@ -8,9 +8,11 @@
  * server's JSON-RPC channel in adjacent tooling).
  */
 import { execFile, spawn } from "node:child_process";
+import { existsSync } from "node:fs";
 import { readFile, writeFile, appendFile, mkdir, stat, statfs } from "node:fs/promises";
 import os from "node:os";
 import { promisify } from "node:util";
+import { resolveMcpShimInvocationForRuntime } from "../mcp-server-invocation.js";
 const execFileAsync = promisify(execFile);
 /** Bounded subprocess output buffer (bytes). */
 const MAX_COMMAND_BUFFER = 10 * 1024 * 1024;
@@ -113,5 +115,17 @@ export function createDefaultExecutorDeps() {
         },
         log: (message) => console.error(message),
         errorLog: (message) => console.error(message),
+        // Resolve how the worker MCP shim launches at dispatch time from THIS
+        // running executor's own on-disk build (absolute-build-path primary,
+        // npm-channel fallback) — never from process.cwd(). Mirrors
+        // `buildMcpProvisioningDeps` in `start-tickets.ts`. `nodeExecutable` stays
+        // "node" (not `process.execPath`) to preserve today's worker runtime
+        // selection; see `mcp-server-invocation.ts`'s scope-boundary note.
+        mcpServerInvocation: resolveMcpShimInvocationForRuntime({
+            moduleUrl: import.meta.url,
+            nodeExecutable: "node",
+            argv1: process.argv[1],
+            fileExists: existsSync,
+        }),
     };
 }

package/build/executor/env.js

@@ -1,12 +1,21 @@
 /**
  * Secret-free executor worker environment (BAPI-534, TDD §7).
  *
- * v2 executor workers get NO Bridge MCP and NO conductor identity: unlike the
- * conductor worker env builder, this one omits `BRIDGE_MCP_PROFILE`, every
- * `BAPI_CONDUCTOR_*` key, `CONDUCTOR_NODE_PATH`, and all secret-bearing keys.
- * It constructs a FRESH object from a strict allowlist of non-secret operational
- * keys — it never copies arbitrary `process.env`, so credentials/tokens/headers
- * cannot leak into the spawned `claude` process.
+ * v2 executor workers get Bridge MCP access by default (BAPI-724), but NOT
+ * through this environment. Access is provisioned into the worktree's
+ * `.mcp.json`/`.cursor/mcp.json` (secret-free shim registration, resolved and
+ * written BEFORE spawn — see `../mcp-provisioning.js` wiring in
+ * `job-runner.ts`), never via env vars. This builder still omits
+ * `BRIDGE_MCP_PROFILE` (an absent profile selects the intended `core` tool
+ * group default), every `BAPI_CONDUCTOR_*` key, `CONDUCTOR_NODE_PATH` (the
+ * shim's node executable is resolved into the registration's command/args at
+ * provisioning time instead), and all secret-bearing keys. It constructs a
+ * FRESH object from a strict allowlist of non-secret operational keys — it
+ * never copies arbitrary `process.env`, so credentials/tokens/headers cannot
+ * leak into the spawned `claude` process. The `mcp-invoke` shim (a separate
+ * process) resolves `BAPI_API_KEY` itself at call time from
+ * `~/.config/bridge/credentials.json` — this worker environment never carries
+ * it.
  */
 import { PR_BASE_BRANCH_ENV_VAR } from "../pr-base-contract.js";
 /** Non-secret operational keys forwarded to the worker when present. */
@@ -42,6 +51,14 @@ const EXPLICIT_DENY_KEYS = [
  * allowlist is locally auditable/testable. A key is allowed iff it is in the
  * allowlist AND is not explicitly denied, does not begin with `BAPI_CONDUCTOR_`,
  * and does not contain a secret-name fragment.
+ *
+ * The `BAPI_CONDUCTOR_` rejection is a WHOLE-PREFIX rule, not an enumerated list,
+ * which is what makes it hold for keys added later. BAPI-722's
+ * `BAPI_CONDUCTOR_DENY_PROBE_TIMEOUT_MS` is rejected twice over — it is absent from
+ * `ALLOWED_ENV_KEYS` and it carries the prefix — so it stays executor-process
+ * configuration and can never reach a spawned worker. That is deliberate: a worker
+ * runs no deny probe, and letting job-side state influence the executor's own
+ * safety-probe budget would invert the trust boundary.
  */
 export function isExecutorEnvKeyAllowed(key) {
     if (!ALLOWED_ENV_KEYS.includes(key))

package/build/executor/index.js

@@ -7,4 +7,8 @@
  */
 export { runExecutorCli, getExecutorUsage, parseExecutorArgs } from "./cli.js";
 export { runExecutor } from "./runner.js";
+// Persistent-service packaging (BAPI-688). The CLI entry plus the PURE helpers
+// doctor needs to enumerate and inspect generated units — doctor must share this
+// module's naming/format contract instead of maintaining a second parser.
+export { runExecutorInstallServiceCli, getExecutorInstallServiceUsage, buildExecutorServiceArtifact, writeExecutorServiceArtifact, inspectExecutorServiceArtifact, executorLaunchdDirForHome, executorSystemdDirForHome, executorIdFromLaunchdFilename, executorIdFromSystemdFilename, EXECUTOR_SERVICE_BASE_URL_ENV, EXECUTOR_SERVICE_PATH_ENV, } from "./service-unit.js";
 export { runExecutorWatchCli, getExecutorWatchUsage, parseExecutorWatchArgs, } from "./watch-cli.js";