@bridge_gpt/mcp-server 0.2.34 → 0.2.37

package/build/executor/test-clock.js

@@ -72,7 +72,15 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
         spawnProcess: () => {
             throw new Error("spawnProcess not configured for this test");
         },
-        readFile: async () => {
+        readFile: async (filePath) => {
+            // BAPI-731: the prepared worktree's own `.mcp.json` must carry the required
+            // `bridge-api` registration or the runner refuses to spawn (an isolated
+            // worker has no operator-scoped registration to fall back to). Serve a
+            // minimal valid one so pre-existing spawn tests still reach the spawn they
+            // were written to assert on.
+            if (typeof filePath === "string" && filePath.endsWith(".mcp.json")) {
+                return JSON.stringify({ mcpServers: { "bridge-api": { command: "node", args: [] } } });
+            }
             // Mirror real fs/promises: a missing-file rejection carries code "ENOENT"
             // (so BAPI-664 command provisioning treats absent files as fillable).
             throw Object.assign(new Error("ENOENT"), { code: "ENOENT" });
@@ -81,19 +89,80 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
         mkdir: async () => undefined,
         stat: async () => ({ mode: 0o644 }),
         statfs: async () => ({ bavail: 1_000_000, bsize: 4096 }),
+        // BAPI-731 worker config isolation boundaries. In-memory fakes: no test ever
+        // creates, permissions, or removes a real directory. Isolation is
+        // fail-CLOSED, so a spawn-path test that did not supply these would refuse to
+        // spawn — these defaults keep the many pre-existing spawn tests exercising
+        // what they were written to exercise.
+        mkdtemp: async (prefix) => `${prefix}test`,
+        chmod: async () => { },
+        rmRecursive: async () => { },
+        readdir: async () => [],
+        lstatPath: async () => ({ isDirectory: true, isSymbolicLink: false, mtimeMs: 0 }),
+        tmpdir: () => "/tmp",
         sleep: clock.sleep,
         now: clock.now,
         setTimer: clock.setTimer,
         clearTimer: clock.clearTimer,
-        env: {},
+        // `ANTHROPIC_API_KEY` is the isolation strategy's required credential source
+        // (see `worker-config-isolation.ts`); without it capability evaluation
+        // reports `unsupported-auth-layout` and no spawn test could run.
+        // `BAPI_API_KEY` is the seed credential for the isolated Bridge store
+        // (BAPI-740/F2); without it the runner refuses pre-spawn with
+        // `ContractError.BridgeCredentialUnavailable` and no spawn test could run.
+        env: {
+            ANTHROPIC_API_KEY: "test-key-not-a-real-credential",
+            BAPI_API_KEY: "test-bapi-key-not-a-real-credential",
+        },
         cwd: "/repo",
         platform: "linux",
         homedir: () => "/home/tester",
         fetch: async () => ({ status: 204, text: async () => "" }),
         log: () => { },
         errorLog: () => { },
+        mcpServerInvocation: {
+            form: "absolute-build-path",
+            nodeExecutable: "node",
+            serverEntryPath: "/repo/mcp_server/build/index.js",
+        },
     };
-    return { ...base, ...overrides };
+    const merged = { ...base, ...overrides };
+    // BAPI-731: two fail-CLOSED spawn gates depend on ambient fixture state that
+    // predates them, so an override supplied for an unrelated reason would
+    // silently turn a spawn test into a refusal test. Both are re-applied here as
+    // FALLBACKS — an override that deliberately exercises a refusal still wins,
+    // because it either supplies its own key/registration or explicitly omits one.
+    // 1. Isolation needs an Anthropic key, and the Bridge-store seeding refusal
+    //    (BAPI-740/F2) needs a resolvable `BAPI_API_KEY`. A test overriding `env`
+    //    for some other purpose keeps both unless it sets the key itself — an
+    //    override that deliberately exercises a refusal supplies its own value
+    //    (empty string included: presence wins over the fallback).
+    if (overrides.env) {
+        const fallbacks = {};
+        for (const key of ["ANTHROPIC_API_KEY", "BAPI_API_KEY"]) {
+            if (!(key in overrides.env))
+                fallbacks[key] = base.env[key];
+        }
+        merged.env = { ...fallbacks, ...overrides.env };
+    }
+    // 2. The required-registration check reads the worktree's `.mcp.json`. A test
+    //    overriding `readFile` (usually to script command provisioning) still gets
+    //    the default registration for that one path when its own read rejects.
+    if (overrides.readFile) {
+        const override = overrides.readFile;
+        merged.readFile = async (filePath) => {
+            try {
+                return await override(filePath);
+            }
+            catch (err) {
+                if (typeof filePath === "string" && filePath.endsWith(".mcp.json")) {
+                    return base.readFile(filePath);
+                }
+                throw err;
+            }
+        };
+    }
+    return merged;
 }
 /** Sensible default executor options for tests. */
 export function makeTestOptions(overrides = {}) {
@@ -111,6 +180,9 @@ export function makeTestOptions(overrides = {}) {
         baseBranch: "main",
         advisoryParserEnabled: false,
         defaultJobTimeoutSeconds: 1200,
+        // The executor requires an explicit base URL (BAPI-676) — supply a fake one
+        // so preflight-driven tests are not fatal on the URL prerequisite.
+        baseUrl: "http://localhost:8002",
         ...overrides,
     };
 }

package/build/executor/types.js

@@ -1,18 +1,4 @@
-/**
- * Epic Conductor v2 executor — core type/boundary definitions (BAPI-534, TDD §7).
- *
- * ARCHITECTURE BOUNDARY (TDD §12, Req 1): files under `mcp_server/src/executor/`
- * are a dumb, pull-based local worker. They MUST NOT import from the v1
- * conductor event/ledger graph — `conductor/store.ts`, `conductor/taxonomy.ts`,
- * `conductor/event-accessors.ts`, `conductor/epic-runtime.ts`,
- * `conductor/epic-reconcile.ts`, `conductor/epic-state.ts`, or any conductor
- * producer / supervisor-runtime module. Allowed conductor reuse is limited to
- * read-only / deterministic helpers — the deny-enforcement preflight
- * (`conductor/deny-enforcement-preflight.ts`), and (BAPI-535 T3b) the local merge
- * executor (`conductor/local-merge.ts`) plus the read-only Bridge API access +
- * merge request/response types (`conductor/bridge-api-client.ts`) for the
- * deterministic `merge` job.
- * All subprocess / HTTP / filesystem / clock access is behind injected deps so
- * every requirement is unit-testable on Linux CI with no real I/O.
- */
-export {};
+/** Normalize either heartbeat response form into the structured shape. */
+export function normalizeHeartbeatResult(response) {
+    return typeof response === "string" ? { outcome: response } : response;
+}

package/build/executor/worker-command.js

@@ -6,6 +6,7 @@
  * MCP config is ever added. When no safe alias is available, `--model` is omitted.
  */
 import { resolveAgentSpec, resolveModelAlias, isModelTier, isValidModelAlias, } from "../agent-registry.js";
+import { ExecutorNamedError } from "./job-errors.js";
 import { isRecoveryJobType } from "./job-types.js";
 /**
  * Resolve the Claude model alias from a job payload. Accepts a direct
@@ -38,13 +39,17 @@ export function resolveExecutorModelAlias(payload) {
  * `implement` and the recovery jobs, builds the conservative
  * `/implement-ticket <ticket_key> --auto` prompt.
  *
- * Structured `payload.prompt_spec` rendering (the `spec_review` path) is NOT done
- * here: it needs the prepared worktree/git state, so `job-runner.ts` renders it
- * in the prepared-spawn path AFTER worktree preparation. `spec_review` therefore
- * returns `ok:false` from this function by design — that non-ok result is the
- * signal for the runner to fall through to prompt-spec rendering, not a terminal
- * failure. A real spawn job with neither an explicit prompt, a synthesis path,
- * nor a `prompt_spec` is the genuine contract failure.
+ * Structured `payload.prompt_spec` rendering is NOT done here: it needs the
+ * prepared worktree/git state, so `job-runner.ts` renders it in the prepared-spawn
+ * path AFTER worktree preparation. A job with a `prompt_spec` and no explicit
+ * prompt therefore returns `ok:false` from this function by design — that non-ok
+ * result is the signal for the runner to fall through to prompt-spec rendering,
+ * not a terminal failure. A real spawn job with neither an explicit prompt, a
+ * synthesis path, nor a `prompt_spec` is the genuine contract failure.
+ *
+ * BAPI-725: `spec_review` now arrives with an explicit server-built
+ * `payload.prompt` and so resolves on the first branch, like `implement` with an
+ * explicit prompt. It no longer depends on the prompt-spec fall-through.
  */
 /**
  * True for the job types that synthesize `/implement-ticket <KEY> --auto` when no
@@ -75,10 +80,18 @@ export function resolveExecutorPrompt(job) {
     // change addressing, and merge-conflict resolution (see .claude/commands/
     // implement-ticket.md "Clean session exit"). So the recovery jobs that operate
     // on the ticket's existing branch/PR — `remediate`/`ci_fix`/`rebase` — resume
-    // through the same command, which detects the outstanding CI/review/conflict
-    // state and continues rather than restarting. Without this, a code_review
+    // by RE-ENTERING THE COMPLETE RECIPE from step 1, not a distinct resume path.
+    // That re-entry is safe (BAPI-746), backed by re-entry handling already
+    // present in three of the recipe's own steps, not a new assumption: plan
+    // generation is idempotent because the server reuses a fresh existing plan
+    // instead of regenerating it (BAPI-745, `reused: true`); commit-and-push.md
+    // treats a clean tree with an already-pushed branch/PR as a legitimate
+    // re-entry rather than an empty implementation; and create-pr.md treats an
+    // already-open pull request on the head branch as satisfying its success
+    // condition. Without synthesizing this command, a code_review
     // `changes_requested` (near-certain in real runs) enqueues a `remediate` job
-    // that fails `no usable prompt` and strands the run (BAPI-528 Milestone-A gap #3).
+    // that fails `no usable prompt` and strands the run (BAPI-528 Milestone-A gap
+    // #3).
     const ticketKey = typeof job.ticket_key === "string" && job.ticket_key.trim().length > 0
         ? job.ticket_key.trim()
         : null;
@@ -90,16 +103,64 @@ export function resolveExecutorPrompt(job) {
         error: `no usable prompt for job_type '${job.job_type}' (no payload.prompt and no ticket_key)`,
     };
 }
+/** The ratified default — the pre-BAPI-725 behavior for every job. */
+export const DEFAULT_WORKER_PERMISSION_POSTURE = "skip_permissions";
+const WORKER_PERMISSION_POSTURES = [
+    "skip_permissions",
+    "accept_edits",
+];
+/**
+ * Resolve the permission posture at the payload boundary.
+ *
+ * - ABSENT (`undefined`/`null`) → the ratified `skip_permissions` default, so
+ *   legacy jobs enqueued before BAPI-725 keep working unchanged.
+ * - a supported value → returned as-is.
+ * - present but unsupported → THROWS a named contract error before argv
+ *   construction, so the job fails loudly instead of spawning under a posture
+ *   nobody chose.
+ *
+ * The thrown message names the FIELD and nothing else. An operator can paste a
+ * credential into a policy value by mistake, and this error text travels to the
+ * server through `/fail` — so echoing the supplied value would turn a typo into
+ * an exfiltration path.
+ */
+export function resolveWorkerPermissionPosture(payload) {
+    const p = payload && typeof payload === "object" ? payload : {};
+    const raw = p.worker_permission_posture;
+    if (raw === undefined || raw === null) {
+        return DEFAULT_WORKER_PERMISSION_POSTURE;
+    }
+    if (typeof raw === "string" &&
+        WORKER_PERMISSION_POSTURES.includes(raw)) {
+        return raw;
+    }
+    throw new ExecutorNamedError("ContractError.PermissionPosture", "job payload worker_permission_posture is present but is not a supported posture " +
+        "(expected 'skip_permissions' or 'accept_edits').");
+}
 /**
  * Build the exact headless Claude argv. `--model <alias>` is included only when
  * an alias is provided. No MCP config arguments are ever emitted.
+ *
+ * Exactly ONE permission form is emitted, selected by `posture`:
+ * `--dangerously-skip-permissions` for `skip_permissions`, or the two adjacent
+ * entries `--permission-mode acceptEdits` for `accept_edits`. They are mutually
+ * exclusive by construction — emitting both would let the skip flag win silently
+ * and make the policy key look effective while doing nothing.
+ *
+ * The posture changes how Claude PROMPTS, not what it may do: the deny layer is
+ * provisioned by `job-runner.ts` before the spawn in both postures.
  */
-export function buildClaudeExecutorArgv(prompt, alias) {
+export function buildClaudeExecutorArgv(prompt, alias, posture = DEFAULT_WORKER_PERMISSION_POSTURE) {
     const argv = ["-p", prompt, "--output-format", "stream-json", "--verbose"];
     if (alias) {
         argv.push("--model", alias);
     }
-    argv.push("--dangerously-skip-permissions");
+    if (posture === "accept_edits") {
+        argv.push("--permission-mode", "acceptEdits");
+    }
+    else {
+        argv.push("--dangerously-skip-permissions");
+    }
     return argv;
 }
 /** The worker executable is always exactly `claude`. */

package/build/executor/worker-config-isolation.js

@@ -0,0 +1,287 @@
+/** Restrictive mode for the isolation directory itself (owner-only). */
+export const ISOLATION_DIR_MODE = 0o700;
+/** Owner-only mode for the seeded Bridge credential file. */
+export const ISOLATION_FILE_MODE = 0o600;
+/**
+ * Fixed name prefix for every directory this module creates. The startup sweep
+ * recognizes ONLY this prefix, which is what keeps it from deleting unrelated
+ * temporary directories that happen to share the parent.
+ */
+export const ISOLATION_DIR_PREFIX = "bapi-conductor-claude-cfg-";
+/**
+ * Age past which the startup sweep may remove an orphan, deliberately far above
+ * any supported worker lifetime (the longest executor job timeout is measured in
+ * hours, not days). A directory younger than this may still belong to a LIVE
+ * worker owned by a concurrent executor process, so the threshold is the only
+ * thing preventing the sweep from deleting an in-use configuration.
+ */
+export const ISOLATION_ORPHAN_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/** Platforms whose POSIX mode model supports the `0700` containment above. */
+const SUPPORTED_PLATFORMS = ["darwin", "linux"];
+/** Fixed remediation text per reason. Never includes a path or a value. */
+const REASON_MESSAGES = {
+    "unsupported-platform": "worker config isolation is not supported on this platform (POSIX 0700/0600 containment is required)",
+    "unsupported-auth-layout": "no ANTHROPIC_API_KEY is available to the executor; an OAuth/subscription-only login does not " +
+        "follow an isolated CLAUDE_CONFIG_DIR, and copying operator credentials is not permitted",
+    "missing-filesystem-dependency": "the executor was constructed without the filesystem boundaries worker config isolation requires",
+    "unsafe-isolation-parent": "the isolation parent directory is a symbolic link or not a directory; refusing to create an " +
+        "isolated config directory beneath it",
+    "directory-creation-failed": "the isolated config directory could not be created or permissioned",
+};
+/**
+ * Render a capability failure as a bounded, secret-free sentence naming only the
+ * platform and the fixed reason — the exact text posted as an `error_message`.
+ */
+export function formatWorkerConfigIsolationReason(platform, reason) {
+    return `worker config isolation unavailable on ${platform}: ${REASON_MESSAGES[reason]}`;
+}
+/**
+ * Decide whether isolation CAN be established here, without creating anything.
+ *
+ * Read-only by construction — this is what lets `doctor` reuse it (BAPI-731
+ * requirement 4) while keeping doctor's no-writes contract. It never reads the
+ * operator's `.claude.json`, never touches the credential store, and never
+ * returns a credential value: the auth check is presence-only.
+ */
+export function evaluateWorkerConfigIsolationCapability(deps) {
+    const platform = String(deps.platform);
+    if (!SUPPORTED_PLATFORMS.includes(deps.platform)) {
+        return { supported: false, platform, reason: "unsupported-platform" };
+    }
+    // Presence-only. The VALUE is never read into any result, log, or diagnostic.
+    const apiKey = deps.env?.ANTHROPIC_API_KEY;
+    if (typeof apiKey !== "string" || apiKey.trim().length === 0) {
+        return { supported: false, platform, reason: "unsupported-auth-layout" };
+    }
+    return { supported: true, platform, strategy: "api-key-env" };
+}
+function failure(platform, reason) {
+    return {
+        ok: false,
+        platform,
+        reason,
+        message: formatWorkerConfigIsolationReason(platform, reason),
+    };
+}
+/**
+ * Create a private, owner-only configuration directory for ONE job attempt.
+ *
+ * The directory lives under the executor's temporary root — never inside the
+ * worktree, which would put executor-owned state into the diff the worker is
+ * about to commit and would be destroyed by the worktree's own reset/clean paths.
+ *
+ * Seeds NOTHING of the operator's Claude configuration. Inventory finding 3
+ * established that no trust entry is needed to keep a headless worker from
+ * prompting, and finding 4 established that the ANTHROPIC credential travels in
+ * the environment. No projected fragment of the operator's configuration is
+ * written, so none can get stale or over-grant.
+ *
+ * The single exception is {@link SeededBridgeCredential} — see that type for why
+ * an empty directory is NOT sufficient for the Bridge credential specifically:
+ * finding 4 does not extend to `BAPI_API_KEY`, which is denied from the worker
+ * environment on purpose, leaving the redirected store as its only route in.
+ */
+export async function establishWorkerConfigIsolation(deps, options = {}) {
+    const capability = evaluateWorkerConfigIsolationCapability(deps);
+    if (!capability.supported) {
+        return failure(capability.platform, capability.reason);
+    }
+    const platform = capability.platform;
+    let parent;
+    try {
+        parent = deps.tmpdir();
+    }
+    catch {
+        return failure(platform, "unsafe-isolation-parent");
+    }
+    if (typeof parent !== "string" || parent.length === 0) {
+        return failure(platform, "unsafe-isolation-parent");
+    }
+    // Reject a symlinked or non-directory parent BEFORE creating anything beneath
+    // it: `mkdtemp` under a symlink would silently place a credential-adjacent
+    // directory wherever the link points.
+    try {
+        const parentMeta = await deps.lstatPath(parent);
+        if (!parentMeta || parentMeta.isSymbolicLink || !parentMeta.isDirectory) {
+            return failure(platform, "unsafe-isolation-parent");
+        }
+    }
+    catch {
+        return failure(platform, "unsafe-isolation-parent");
+    }
+    // `mkdtemp` is atomic and collision-free, so two concurrent jobs on the same
+    // executor can never be handed the same directory.
+    let created;
+    try {
+        created = await deps.mkdtemp(deps.join(parent, ISOLATION_DIR_PREFIX));
+        if (typeof created !== "string" || created.length === 0) {
+            return failure(platform, "directory-creation-failed");
+        }
+    }
+    catch {
+        // The raw error may carry a host path; only the fixed reason escapes.
+        return failure(platform, "directory-creation-failed");
+    }
+    // Verify what we actually got is a real directory and not a link, then narrow
+    // it to owner-only. `mkdtemp` already creates at 0700 on POSIX; the explicit
+    // chmod makes the guarantee independent of the platform's umask behavior.
+    try {
+        const meta = await deps.lstatPath(created);
+        if (!meta || meta.isSymbolicLink || !meta.isDirectory) {
+            await safeDispose(deps, created);
+            return failure(platform, "unsafe-isolation-parent");
+        }
+        await deps.chmod(created, ISOLATION_DIR_MODE);
+    }
+    catch {
+        await safeDispose(deps, created);
+        return failure(platform, "directory-creation-failed");
+    }
+    // The isolated XDG root lives INSIDE the disposable directory, so a single
+    // recursive removal reclaims both and no second lifetime needs tracking.
+    const xdgConfigHome = deps.join(created, "xdg");
+    try {
+        await deps.mkdir(xdgConfigHome, { recursive: true });
+        await deps.chmod(xdgConfigHome, ISOLATION_DIR_MODE);
+    }
+    catch {
+        await safeDispose(deps, created);
+        return failure(platform, "directory-creation-failed");
+    }
+    // Seed the one credential the redirect would otherwise strip. Fail-CLOSED,
+    // matching this module's posture: a worker that cannot reach its Bridge MCP
+    // tools cannot do the job it was dispatched for, and the failure mode is a
+    // clean exit that looks like success. Refusing to spawn is strictly better
+    // than spawning a worker guaranteed to accomplish nothing.
+    const credential = options.bridgeCredential;
+    if (credential) {
+        if (!deps.writeFile) {
+            await safeDispose(deps, created);
+            return failure(platform, "missing-filesystem-dependency");
+        }
+        try {
+            const bridgeDir = deps.join(xdgConfigHome, "bridge");
+            await deps.mkdir(bridgeDir, { recursive: true });
+            await deps.chmod(bridgeDir, ISOLATION_DIR_MODE);
+            const storePath = deps.join(bridgeDir, "credentials.json");
+            await deps.writeFile(storePath, 
+            // Exactly the shape resolveCredentialBundle reads: a logical target
+            // mapping to its named secret values.
+            `${JSON.stringify({ [`bapi:${credential.repoName}`]: { BAPI_API_KEY: credential.apiKey } }, null, 2)}\n`);
+            // Narrow AFTER writing: the content is secret, and a permissive window
+            // between create and chmod is the whole risk being closed here.
+            await deps.chmod(storePath, ISOLATION_FILE_MODE);
+        }
+        catch {
+            // The raw error may carry a host path or the secret; only the fixed
+            // reason escapes.
+            await safeDispose(deps, created);
+            return failure(platform, "directory-creation-failed");
+        }
+    }
+    let disposed = false;
+    return {
+        ok: true,
+        isolation: {
+            claudeConfigDir: created,
+            xdgConfigHome,
+            async dispose() {
+                if (disposed)
+                    return null;
+                disposed = true;
+                try {
+                    await deps.rmRecursive(created);
+                    return null;
+                }
+                catch {
+                    // Best-effort by contract: cleanup failure must never replace an
+                    // already-determined job outcome, and the raw error never escapes.
+                    return "worker config isolation directory could not be removed";
+                }
+            },
+        },
+    };
+}
+/** Remove a partially-created directory, swallowing every failure. */
+async function safeDispose(deps, path) {
+    try {
+        await deps.rmRecursive(path);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/**
+ * Remove stale isolation directories left behind by an ungraceful executor exit
+ * (SIGKILL, OOM, host reboot) where per-job disposal never ran.
+ *
+ * Deliberately conservative, because this function deletes directories: it looks
+ * only inside the executor's own temporary root, recognizes only entries
+ * carrying {@link ISOLATION_DIR_PREFIX}, requires NON-following metadata to say
+ * the entry is a real directory (so a symlink is skipped rather than followed),
+ * and requires an age beyond {@link ISOLATION_ORPHAN_MAX_AGE_MS} so a live
+ * concurrent executor's active job directory is never removed.
+ *
+ * Never throws: startup must proceed even if the sweep cannot run at all.
+ */
+export async function sweepOrphanedWorkerConfigDirectories(deps) {
+    const result = { removed: 0, skipped: 0, diagnostics: [] };
+    const maxAgeMs = typeof deps.maxAgeMs === "number" ? deps.maxAgeMs : ISOLATION_ORPHAN_MAX_AGE_MS;
+    let parent;
+    try {
+        parent = deps.tmpdir();
+        if (typeof parent !== "string" || parent.length === 0) {
+            result.diagnostics.push("worker config isolation sweep skipped: no temporary root");
+            return result;
+        }
+    }
+    catch {
+        result.diagnostics.push("worker config isolation sweep skipped: no temporary root");
+        return result;
+    }
+    let entries;
+    try {
+        entries = await deps.readdir(parent);
+    }
+    catch {
+        result.diagnostics.push("worker config isolation sweep skipped: temporary root unreadable");
+        return result;
+    }
+    const cutoff = deps.now() - maxAgeMs;
+    for (const entry of entries) {
+        // Prefix match FIRST: anything the module did not create is not ours to
+        // delete, whatever its age.
+        if (typeof entry !== "string" || !entry.startsWith(ISOLATION_DIR_PREFIX)) {
+            result.skipped += 1;
+            continue;
+        }
+        const candidate = deps.join(parent, entry);
+        let meta;
+        try {
+            meta = await deps.lstatPath(candidate);
+        }
+        catch {
+            result.skipped += 1;
+            continue;
+        }
+        // A symlink is skipped, never followed — removing it recursively could
+        // delete whatever it points at.
+        if (!meta || meta.isSymbolicLink || !meta.isDirectory) {
+            result.skipped += 1;
+            continue;
+        }
+        if (!(meta.mtimeMs < cutoff)) {
+            result.skipped += 1;
+            continue;
+        }
+        try {
+            await deps.rmRecursive(candidate);
+            result.removed += 1;
+        }
+        catch {
+            result.skipped += 1;
+            result.diagnostics.push("worker config isolation sweep could not remove a stale directory");
+        }
+    }
+    return result;
+}