@bridge_gpt/mcp-server 0.2.38 → 0.2.41

package/build/doctor.js

@@ -21,18 +21,24 @@ import path from "path";
 import { createDefaultStartTicketsDeps } from "./start-tickets.js";
 import { VERSION } from "./version.generated.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, formatInstallStatusFallbackReport, resolveInstallDoctorTarget, } from "./install-doctor.js";
+import { inspectExecutorAgentAdapter, inspectionForFailedResolution, } from "./agent-launchers/executor-adapter-inspection.js";
+import { resolveExecutorAgentAdapter } from "./agent-launchers/executor-adapter-registry.js";
 import { parseDefaultOnEnvFlag } from "./env-flags.js";
 import { createBridgeApiUrls } from "./bridge-api-urls.js";
 import { probeToolSurface } from "./tool-surface-gating.js";
 import { resolveBapiCredentials } from "./credential-store.js";
+import { resolveConductorBridgeApiAccess } from "./conductor/bridge-api-client.js";
+import { getIndexBranch } from "./conduct-epic/bridge-client.js";
+import { resolveConductEpicStateDirectory } from "./conduct-epic/checkpoint-store.js";
+import { isConductEpicLockOwnerAlive, parseConductEpicLock, } from "./conduct-epic/lock.js";
 import { resolveRequiredStartTicketsRepoName } from "./start-tickets-repo.js";
 import { BRIDGE_PACKAGE_NAME, describeLauncherReason, inspectLauncherConfigs, parseLauncherPin as parseSharedLauncherPin, } from "./launcher-config-inspection.js";
 import { DEFAULT_AGENT_NAME, resolveAgentSpec, isAgentName, formatValidAgentNames, } from "./agent-registry.js";
-import { getDoctorPrereqDescriptors, probePrerequisite, } from "./start-tickets-prereqs.js";
+import { getDoctorPrereqDescriptors, probePrerequisite, resolveWorktrunkBinary, } from "./start-tickets-prereqs.js";
 import { resolveProfiles } from "./mcp-profile.js";
 import { executorLaunchdDirForHome, executorSystemdDirForHome, executorIdFromLaunchdFilename, executorIdFromSystemdFilename, inspectExecutorServiceArtifact, EXECUTOR_SERVICE_BASE_URL_ENV, } from "./executor/index.js";
 import { DEFAULT_BAPI_BASE_URL } from "./executor/credentials.js";
-import { evaluateWorkerConfigIsolationCapability, formatWorkerConfigIsolationReason, } from "./executor/worker-config-isolation.js";
+import { detectClaudeLogin, formatClaudeLoginAdvisory } from "./claude-login.js";
 /**
  * The report/usage title (BAPI-669, U9b). `doctor` diagnoses the whole Bridge
  * install — install status, prerequisites, launcher cache, and tool surface — so it
@@ -75,14 +81,28 @@ export function getDoctorUsage() {
         "migrate a credential, use /install-bridge or the `credentials` subcommand —",
         "doctor stays strictly read-only.",
         "",
-        "On a host with a configured conductor executor service it also reports",
-        "whether worker config isolation is healthy: whether this platform and",
-        "authentication layout allow a worker to run with an executor-owned",
-        "CLAUDE_CONFIG_DIR, so operator-scoped MCP servers are unreachable from a",
-        "worker. This check is a read-only capability evaluation: it never seeds or",
-        "removes an isolated directory, never reads the credential store, and never",
-        "prints a credential value. It affects the exit code only when an executor",
-        "service is configured; otherwise it is advisory.",
+        // BAPI-815/R4: the old text here promised a 'Worker config isolation",
+        // (conductor executor)' section naming a CLAUDE_CONFIG_DIR strategy. BAPI-790
+        // replaced per-job config-directory isolation with --strict-mcp-config argv
+        // scoping, and BAPI-791 deleted that doctor section together with the whole
+        // worker-auth strategy vocabulary. The section it described exists in no
+        // doctor output, so the claim is removed rather than reworded.
+        "Worker containment is no longer reported here. A conductor worker is scoped",
+        "at spawn time with `--strict-mcp-config --mcp-config <file>`, and the",
+        "executor asserts that scope per spawn from the worker's own system/init",
+        "event — failing the job with ContractError.McpSurfaceMismatch on a confirmed",
+        "leak. That per-spawn assertion, not a doctor health line, is the containment",
+        "proof; see docs/claude/worker-config-isolation-drill.md.",
+        "",
+        "It also includes an advisory 'Local CLI launcher' section (BAPI-815): whether",
+        "the BAPI_MCP_CLI override is set, and whether the launcher it names can be",
+        "executed. When the override is unset, NO launcher probe runs at all. When it",
+        "is set, doctor runs that launcher exactly once with a single appended",
+        "--version argument through an array-based spawn — never a shell — reads only",
+        "its exit status, and discards its stdout and stderr so local output cannot",
+        "enter this report. A value containing shell operators or an unbalanced quote",
+        "is rejected without running anything. The whole section is advisory: a",
+        "missing, malformed, or unrunnable override never changes the exit code.",
         "",
         "It also includes an advisory 'MCP tool surface' section (BAPI-641): what",
         "dynamic capability gating would advertise for this repo. It performs at most",
@@ -262,6 +282,84 @@ export function formatDoctorReport(platform, agent, collection) {
         formatDoctorPrereqSection(platform, collection),
     ].join("\n");
 }
+/**
+ * Inspect the selected agent's executor adapter.
+ *
+ * Probes the executable version (cheap, read-only) but NOT deny enforcement:
+ * that probe spawns a real headless agent, and `conductor doctor` already owns
+ * that diagnostic behind its own `--no-deny-probe` switch. Duplicating it here
+ * would make a plain `doctor` run spawn an agent the operator did not ask for.
+ */
+export async function collectExecutorAdapterDiagnostic(agentName, deps) {
+    const resolve = deps.resolveAdapter ?? ((id) => resolveExecutorAgentAdapter(id));
+    const resolution = resolve(agentName);
+    if (!resolution.supported) {
+        // An unsupported agent is REPORTED as unsupported, never substituted with
+        // Claude's metadata. Showing Claude's adapter under another agent's name
+        // would tell an operator their agent is ready when nothing implements it.
+        return inspectionForFailedResolution(agentName, resolution);
+    }
+    const result = await inspectExecutorAgentAdapter(resolution.adapter, { platform: deps.platform, env: deps.env, runCommand: deps.runCommand }, { probeExecutable: true });
+    return result.inspection;
+}
+/** Render the adapter section. Pure formatting — no probing. */
+export function formatExecutorAdapterDiagnosticReport(inspection) {
+    const lines = [];
+    lines.push("");
+    lines.push("Executor agent adapter (conductor worker spawning)");
+    lines.push("─────────────────────────────────────────────────");
+    lines.push(`agent:                 ${inspection.identity.agentId}`);
+    lines.push(`adapter:               ${inspection.identity.adapterId}`);
+    lines.push(`adapter version:       ${inspection.identity.adapterVersion}`);
+    lines.push(`strategy:              ${inspection.identity.strategyId}`);
+    if (inspection.executable) {
+        const exe = inspection.executable;
+        const version = exe.version.length > 0 ? exe.version : "n/a";
+        lines.push(`executable:            ${exe.command}`);
+        lines.push(`runtime version:       ${version}`);
+        lines.push(`fingerprint:           ${exe.fingerprint ?? "n/a"}`);
+        if (exe.failure)
+            lines.push(`executable probe:      FAILED (${exe.failure})`);
+    }
+    if (inspection.platform) {
+        lines.push(inspection.platform.supported
+            ? `platform:              ${inspection.platform.platform} [SUPPORTED]`
+            : `platform:              ${inspection.platform.platform} [UNSUPPORTED] ${inspection.platform.message}`);
+    }
+    if (inspection.capabilities.length > 0) {
+        lines.push("capabilities:");
+        for (const capability of inspection.capabilities) {
+            const status = capability.supported ? "OK      " : "MISSING ";
+            const strategy = capability.strategyId ? ` (${capability.strategyId})` : "";
+            const reason = capability.reason ? ` — ${capability.reason}` : "";
+            lines.push(`  ${status} ${capability.capability}${strategy}${reason}`);
+        }
+    }
+    lines.push(`lifecycle:             ${inspection.lifecycleKind ?? "NOT DECLARED"}`);
+    if (inspection.auth) {
+        // Names, ownership, and billing class only — never a value.
+        const managed = inspection.auth.managedCarriers;
+        lines.push(managed.length === 0
+            ? "bridge-managed creds:  none (workers use the operator's own login)"
+            : `bridge-managed creds:  ${managed
+                .map((c) => `${c.carrierId} [${c.billingClass}] env=${c.secretEnvNames.join(",")}`)
+                .join("; ")}`);
+        lines.push(inspection.auth.passthroughs.length === 0
+            ? "operator passthroughs: none"
+            : `operator passthroughs: ${inspection.auth.passthroughs
+                .map((p) => `${p.envName} [${p.billingClass}, ${p.rule}]`)
+                .join("; ")}`);
+    }
+    if (!inspection.ok) {
+        lines.push("");
+        lines.push("This agent CANNOT spawn conductor workers. A missing or unsupported capability is " +
+            "refused outright — no other agent's behavior is substituted.");
+    }
+    for (const warning of inspection.warnings) {
+        lines.push(`  - ${warning}`);
+    }
+    return lines.join("\n");
+}
 /**
  * Extract the `@bridge_gpt/mcp-server[@version]` launcher spec from an args array.
  *
@@ -418,6 +516,159 @@ export function formatLauncherCacheReport(inspections) {
     }
     return lines.join("\n");
 }
+// ---------------------------------------------------------------------------
+// Local CLI launcher override (BAPI-815/R5) — advisory, strictly read-only.
+//
+// `BAPI_MCP_CLI` lets a packaged command shell out to a LOCAL build instead of
+// `npx -y @bridge_gpt/mcp-server`, so an executor or CLI change can be verified
+// before an npm publish. That is useful precisely because it is invisible: the
+// override lives in one environment variable, and `ping` cannot tell a published
+// 0.2.x from a local build at the same version. This section makes it visible.
+//
+// The probe is deliberately narrow. It runs the configured launcher ONCE with a
+// single appended `--version` argument, through the injected array-based command
+// runner — never a shell, never `eval`, never a concatenated command string. The
+// probe's stdout and stderr are discarded after its exit status is read, so
+// arbitrary local output cannot enter the doctor report. It is ADVISORY: a
+// missing, malformed, or unrunnable override never changes the exit code.
+// ---------------------------------------------------------------------------
+/** The environment variable carrying the local launcher override. */
+export const LOCAL_CLI_OVERRIDE_ENV = "BAPI_MCP_CLI";
+/**
+ * Longest configured value echoed back into the report. The contract forbids
+ * putting a credential in the launcher, but a bound is cheap insurance against
+ * a report that dumps an arbitrarily long environment value either way.
+ */
+const LOCAL_CLI_OVERRIDE_DISPLAY_LIMIT = 200;
+/**
+ * Characters that would turn the value into a shell command LINE rather than a
+ * command plus arguments. This runner never uses a shell, so these could not be
+ * interpreted anyway — but a value containing them means the operator EXPECTED
+ * shell semantics, and silently running only the first word would be a worse
+ * answer than refusing. Parentheses and braces are deliberately absent: they
+ * appear in ordinary macOS and Windows paths and are inert without a shell.
+ */
+const SHELL_OPERATOR_PATTERN = /[;&|<>$`\n\r]/;
+/**
+ * Split the override into an executable and its fixed arguments.
+ *
+ * A deliberately small, non-shell tokenizer: whitespace separates tokens, and
+ * single or double quotes group a token so a launcher path containing spaces
+ * (`node "/Applications/My Build/index.js"`) survives intact. It performs no
+ * expansion of any kind — no globbing, no variable substitution, no command
+ * substitution — because the result is passed to an array-based spawn where
+ * none of that would be interpreted.
+ */
+export function parseLocalCliLauncher(raw) {
+    if (SHELL_OPERATOR_PATTERN.test(raw)) {
+        return { ok: false, reason: "contains shell operators, which are not supported" };
+    }
+    const tokens = [];
+    let current = "";
+    let quote = null;
+    let started = false;
+    for (const ch of raw) {
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else
+                current += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            started = true;
+            continue;
+        }
+        if (ch === " " || ch === "\t") {
+            if (started) {
+                tokens.push(current);
+                current = "";
+                started = false;
+            }
+            continue;
+        }
+        current += ch;
+        started = true;
+    }
+    if (quote)
+        return { ok: false, reason: "has an unbalanced quote" };
+    if (started)
+        tokens.push(current);
+    const [executable, ...args] = tokens;
+    if (!executable)
+        return { ok: false, reason: "is empty after parsing" };
+    return { ok: true, executable, args };
+}
+/** Truncate a configured value for display without ever dropping it silently. */
+function boundConfiguredValue(raw) {
+    if (raw.length <= LOCAL_CLI_OVERRIDE_DISPLAY_LIMIT)
+        return raw;
+    return `${raw.slice(0, LOCAL_CLI_OVERRIDE_DISPLAY_LIMIT)}… (truncated)`;
+}
+/**
+ * Collect the advisory local-launcher diagnostic. Read-only and bounded: at most
+ * ONE `--version` invocation, and only when an override is actually configured.
+ *
+ * The "no override ⇒ no probe" rule is load-bearing beyond tidiness — doctor
+ * pins that an unsupported platform issues ZERO command probes, and a section
+ * that probed unconditionally would break that guarantee.
+ */
+export async function collectLocalCliOverrideDiagnostic(deps) {
+    const raw = deps.env[LOCAL_CLI_OVERRIDE_ENV];
+    if (typeof raw !== "string" || raw.trim().length === 0) {
+        return { state: "not-configured" };
+    }
+    const configured = boundConfiguredValue(raw.trim());
+    const parsed = parseLocalCliLauncher(raw.trim());
+    if (!parsed.ok) {
+        // Rejected WITHOUT running anything: an unsafe or malformed value must never
+        // reach the command runner, not even to discover that it fails.
+        return { state: "invalid", configured, reason: parsed.reason };
+    }
+    try {
+        const probe = await deps.runCommand(parsed.executable, [...parsed.args, "--version"]);
+        // Read the status, then drop the output. Nothing the local launcher printed
+        // is allowed into the report.
+        return probe.exitCode === 0
+            ? { state: "executable", configured }
+            : { state: "not-executable", configured };
+    }
+    catch {
+        // A spawn failure (missing file, not executable) is the same advisory
+        // outcome as a non-zero exit. The exception itself never escapes.
+        return { state: "not-executable", configured };
+    }
+}
+/** Render the local-launcher override section (pure formatting). */
+export function formatLocalCliOverrideDiagnosticReport(diagnostic) {
+    const lines = ["", `Local CLI launcher (${LOCAL_CLI_OVERRIDE_ENV})`, ""];
+    switch (diagnostic.state) {
+        case "not-configured":
+            lines.push("NOT CONFIGURED  packaged launcher in use (npx -y @bridge_gpt/mcp-server)");
+            lines.push("  No local override is set, so no launcher probe was run.");
+            break;
+        case "executable":
+            lines.push(`CONFIGURED      ${diagnostic.configured}`);
+            lines.push("  The launcher ran successfully with --version.");
+            lines.push("  A stale local build is exactly as misleading as a stale npm publish —");
+            lines.push("  rebuild with `cd mcp_server && npm run build` before relying on it.");
+            break;
+        case "not-executable":
+            lines.push(`CONFIGURED      ${diagnostic.configured}`);
+            lines.push("  The launcher could not be executed (--version did not succeed).");
+            lines.push("  Check that the path exists and has been built.");
+            break;
+        case "invalid":
+            lines.push(`CONFIGURED      ${diagnostic.configured}`);
+            lines.push(`  The value could not be used: it ${diagnostic.reason}.`);
+            lines.push("  No launcher was run. Expected form: node /absolute/path/to/index.js");
+            break;
+    }
+    lines.push("  Advisory only: this finding never blocks packaged CLI use and never changes");
+    lines.push("  the doctor exit code.");
+    return lines.join("\n");
+}
 /**
  * Collect the read-only tool-surface diagnostic. Evaluates the kill switch first
  * and returns without any network request when disabled. For an enabled flag and
@@ -523,57 +774,6 @@ export function formatToolSurfaceDiagnosticReport(diag) {
     lines.push("to observe surface changes; no project MCP configuration change is required.");
     return lines.join("\n");
 }
-/**
- * Adapt the executor's read-only capability evaluator for doctor.
- *
- * READ-ONLY BY CONSTRUCTION: it forwards only `platform` and `env`, and
- * `evaluateWorkerConfigIsolationCapability` accepts no mutating dependency at
- * all — no directory-creation, permission-setting, file-writing, or removal
- * operation is reachable from it even in principle. No directory is seeded, no
- * credential value is read, and nothing is persisted. That is what preserves
- * doctor's read-only contract while still answering AC-4's health question.
- *
- * NOTE: this module is pinned by `tests/pytest/mcp_server/test_doctor_static_contract.py`,
- * which asserts the literal token `write` + `File` appears nowhere in this file —
- * so describe write operations in prose here rather than naming that API.
- */
-export function collectWorkerConfigIsolationDiagnostic(input) {
-    const capability = evaluateWorkerConfigIsolationCapability({
-        platform: input.platform,
-        env: input.env,
-    });
-    if (capability.supported) {
-        return {
-            status: "healthy",
-            platform: capability.platform,
-            strategy: capability.strategy,
-            required: input.executorConfigured,
-        };
-    }
-    return {
-        status: "unhealthy",
-        platform: capability.platform,
-        remediation: formatWorkerConfigIsolationReason(capability.platform, capability.reason),
-        required: input.executorConfigured,
-    };
-}
-/** Render the isolation section: fixed labels plus already-bounded reason text. */
-export function formatWorkerConfigIsolationDiagnosticReport(diagnostic) {
-    const lines = ["", "Worker config isolation (conductor executor)"];
-    if (diagnostic.status === "healthy") {
-        lines.push(`  HEALTHY  ${diagnostic.platform}: isolation can be established (strategy: ${diagnostic.strategy})`);
-        lines.push("           Workers run with an executor-owned CLAUDE_CONFIG_DIR, so operator-scoped");
-        lines.push("           MCP servers are unreachable from a worker.");
-        return lines.join("\n");
-    }
-    // An executor host cannot dispatch workers safely without isolation, so the
-    // label distinguishes a blocking condition from an advisory one.
-    lines.push(`  ${diagnostic.required ? "UNHEALTHY" : "SKIP     "}  ${diagnostic.remediation ?? ""}`);
-    if (!diagnostic.required) {
-        lines.push("           Advisory only: no executor service is configured on this host.");
-    }
-    return lines.join("\n");
-}
 /** Where generated units live, and how their filenames encode the executor id. */
 function resolveExecutorServiceConvention(platform, homeDir) {
     if (platform === "darwin") {
@@ -765,8 +965,12 @@ export function formatExecutorServiceDiagnosticsReport(diagnostics) {
     return lines.join("\n");
 }
 export async function collectPlaneCredentialDiagnostic(deps) {
-    const anthropic = deps.env.ANTHROPIC_API_KEY;
-    const anthropicKeyPresent = typeof anthropic === "string" && anthropic.trim().length > 0;
+    // BAPI-791: worker authentication is no longer a plane-readiness question this
+    // section can answer — a worker authenticates through the executor host's own
+    // interactive `claude login`, reported once elsewhere (see
+    // `formatClaudeLoginAdvisory`), not per-repo here. This section is now scoped
+    // to exactly what `plane up` still refuses on for THIS repository: a resolvable
+    // Bridge credential.
     const resolveRepo = deps.resolveRepoName ?? resolveRequiredStartTicketsRepoName;
     let repo = null;
     try {
@@ -778,7 +982,7 @@ export async function collectPlaneCredentialDiagnostic(deps) {
         /* sanitized: identity resolution failure is reported as an absent repo */
     }
     if (repo === null) {
-        return { anthropicKeyPresent, repo: null, target: null, bridgeCredentialResolved: false };
+        return { repo: null, target: null, bridgeCredentialResolved: false };
     }
     // Resolve, then keep ONLY a label. The key never reaches the diagnostic.
     const status = await probeRepoCredential(repo, { platform: deps.platform, env: deps.env, homedir: deps.homedir, readdir: async () => [], readFile: deps.readFile, stat: deps.stat, resolveCredentials: deps.resolveCredentials }, {
@@ -792,7 +996,6 @@ export async function collectPlaneCredentialDiagnostic(deps) {
         },
     });
     return {
-        anthropicKeyPresent,
         repo,
         target: status.target,
         bridgeCredentialResolved: status.resolved,
@@ -803,10 +1006,6 @@ export async function collectPlaneCredentialDiagnostic(deps) {
 /** Render the plane readiness section. Advisory: never changes the exit code. */
 export function formatPlaneCredentialDiagnosticReport(diagnostic) {
     const lines = ["", "Conductor plane credentials (`plane up` — advisory)"];
-    lines.push(diagnostic.anthropicKeyPresent
-        ? "  OK       ANTHROPIC_API_KEY is set in this shell."
-        : "  MISSING  ANTHROPIC_API_KEY is not set in this shell. Isolated workers have no OAuth\n" +
-            "           session and refuse to spawn without it, so `plane up` will refuse.");
     if (diagnostic.repo === null) {
         lines.push("  MISSING  the Bridge repository identity could not be resolved. Set BAPI_REPO_NAME or\n" +
             "           add a valid .bridge/config at the repository root.");
@@ -823,6 +1022,204 @@ export function formatPlaneCredentialDiagnosticReport(diagnostic) {
     lines.push("           no .bridge/plane/ directory, persists nothing, and starts no plane member.");
     return lines.join("\n");
 }
+/**
+ * Collect conduct-epic readiness, read-only.
+ *
+ * The credential is resolved only to establish that it CAN be, and the resolved
+ * access object is discarded immediately: only the repo name and a boolean
+ * survive into the returned diagnostic, so no later formatting change can print
+ * a key it never received.
+ */
+export async function collectConductEpicDiagnostic(deps) {
+    const isAlive = deps.isProcessAlive ?? isConductEpicLockOwnerAlive;
+    let ghPresent = false;
+    let ghAuthenticated = false;
+    try {
+        const version = await deps.runCommand("gh", ["--version"], { cwd: deps.cwd });
+        ghPresent = version.exitCode === 0;
+    }
+    catch {
+        ghPresent = false;
+    }
+    if (ghPresent) {
+        try {
+            const auth = await deps.runCommand("gh", ["auth", "status"], { cwd: deps.cwd });
+            ghAuthenticated = auth.exitCode === 0;
+        }
+        catch {
+            ghAuthenticated = false;
+        }
+    }
+    const worktrunkBinary = resolveWorktrunkBinary(deps.platform, deps.env);
+    let worktrunkAvailable = false;
+    try {
+        const probe = await deps.runCommand(worktrunkBinary, ["--version"], { cwd: deps.cwd });
+        worktrunkAvailable = probe.exitCode === 0;
+    }
+    catch {
+        worktrunkAvailable = false;
+    }
+    const resolveAccess = deps.resolveAccess ?? resolveConductorBridgeApiAccess;
+    let repo = null;
+    let bridgeCredentialResolved = false;
+    let accessForIndexProbe = null;
+    try {
+        const result = await resolveAccess({
+            env: deps.env,
+            cwd: deps.cwd,
+            homedir: deps.homedir,
+            platform: deps.platform,
+            readFile: deps.readFile,
+            stat: deps.stat,
+        });
+        if (result.ok) {
+            repo = result.access.repoName;
+            bridgeCredentialResolved = true;
+            accessForIndexProbe = result;
+        }
+    }
+    catch {
+        bridgeCredentialResolved = false;
+    }
+    let stateDirectory = null;
+    let stateDirectoryReadable = false;
+    const checkpoints = [];
+    const locks = [];
+    if (repo !== null) {
+        stateDirectory = resolveConductEpicStateDirectory(repo, {
+            env: deps.env,
+            homedir: deps.homedir,
+        });
+        let entries = [];
+        try {
+            entries = await deps.readdir(stateDirectory);
+            stateDirectoryReadable = true;
+        }
+        catch {
+            stateDirectoryReadable = false;
+        }
+        for (const entry of entries) {
+            if (entry.endsWith(".json"))
+                checkpoints.push(entry);
+            if (!entry.endsWith(".lock"))
+                continue;
+            const epic = entry.slice(0, -".lock".length);
+            let raw;
+            try {
+                raw = await deps.readFile(path.join(stateDirectory, entry));
+            }
+            catch {
+                locks.push({ epic, owner_pid: null, host: null, alive: null, problem: "unreadable" });
+                continue;
+            }
+            const owner = parseConductEpicLock(raw);
+            if (owner === null) {
+                locks.push({ epic, owner_pid: null, host: null, alive: null, problem: "malformed or unsupported version" });
+                continue;
+            }
+            // Liveness is only meaningful for a lock taken on THIS host.
+            const alive = owner.host === deps.env.HOSTNAME || owner.host === os.hostname()
+                ? isAlive(owner.owner_pid)
+                : null;
+            locks.push({ epic, owner_pid: owner.owner_pid, host: owner.host, alive });
+        }
+    }
+    let indexOverrideBranch = null;
+    let indexOverrideChecked = false;
+    if (accessForIndexProbe !== null && accessForIndexProbe.ok) {
+        const probe = deps.getIndexBranch ?? getIndexBranch;
+        try {
+            const result = await probe(accessForIndexProbe.access);
+            if (result.ok) {
+                indexOverrideChecked = true;
+                indexOverrideBranch = result.value.override?.override_branch ?? null;
+            }
+        }
+        catch {
+            indexOverrideChecked = false;
+        }
+    }
+    return {
+        ghPresent,
+        ghAuthenticated,
+        worktrunkBinary,
+        worktrunkAvailable,
+        repo,
+        bridgeCredentialResolved,
+        stateDirectory,
+        stateDirectoryReadable,
+        checkpoints,
+        locks,
+        indexOverrideBranch,
+        indexOverrideChecked,
+    };
+}
+/** Render the conduct-epic section. Advisory: never changes the exit code. */
+export function formatConductEpicDiagnosticReport(diagnostic) {
+    const lines = ["", "conduct-epic readiness (advisory)"];
+    lines.push(diagnostic.ghAuthenticated
+        ? "  OK       gh: present and authenticated."
+        : diagnostic.ghPresent
+            ? "  MISSING  gh: present but NOT authenticated. Run `gh auth login`."
+            : "  MISSING  gh: not found on PATH. `conduct-epic init` and `status` need it.");
+    lines.push(diagnostic.worktrunkAvailable
+        ? `  OK       Worktrunk: '${diagnostic.worktrunkBinary}' resolves.`
+        : `  MISSING  Worktrunk: '${diagnostic.worktrunkBinary}' not found (honors BAPI_WORKTRUNK_BIN).`);
+    if (diagnostic.repo === null) {
+        lines.push("  MISSING  Bridge identity: the repository could not be resolved. Set BAPI_REPO_NAME\n" +
+            "           or add a valid .bridge/config at the repository root.");
+    }
+    else if (diagnostic.bridgeCredentialResolved) {
+        lines.push(`  OK       Bridge credential for ${diagnostic.repo}: resolved.`);
+    }
+    else {
+        lines.push(`  MISSING  Bridge credential for ${diagnostic.repo}: NOT resolved.`);
+    }
+    if (diagnostic.stateDirectory === null) {
+        lines.push("  SKIP     Checkpoint directory: not resolved (no repository identity).");
+    }
+    else if (!diagnostic.stateDirectoryReadable) {
+        lines.push(`  SKIP     Checkpoint directory ${diagnostic.stateDirectory}: absent or unreadable\n` +
+            "           (normal before the first `conduct-epic init`).");
+    }
+    else {
+        lines.push(`  OK       Checkpoint directory ${diagnostic.stateDirectory}: readable, ` +
+            `${diagnostic.checkpoints.length} checkpoint(s).`);
+    }
+    if (diagnostic.locks.length === 0) {
+        lines.push("  OK       Locks: none held.");
+    }
+    else {
+        for (const lock of diagnostic.locks) {
+            if (lock.problem !== undefined) {
+                lines.push(`  WARN     Lock ${lock.epic}: ${lock.problem}. Inspect it by hand.`);
+            }
+            else if (lock.alive === false) {
+                lines.push(`  WARN     Lock ${lock.epic}: owner pid ${lock.owner_pid} on ${lock.host} is gone (stale).\n` +
+                    "           The next mutating verb recovers it automatically.");
+            }
+            else if (lock.alive === null) {
+                lines.push(`  WARN     Lock ${lock.epic}: taken on host ${lock.host}; liveness is unknowable here.`);
+            }
+            else {
+                lines.push(`  OK       Lock ${lock.epic}: held by live pid ${lock.owner_pid}.`);
+            }
+        }
+    }
+    if (!diagnostic.indexOverrideChecked) {
+        lines.push("  SKIP     Indexed-branch override: not checked.");
+    }
+    else if (diagnostic.indexOverrideBranch === null) {
+        lines.push("  OK       Indexed-branch override: none active.");
+    }
+    else {
+        lines.push(`  WARN     Indexed-branch override: active on '${diagnostic.indexOverrideBranch}'.\n` +
+            "           If no epic is running, this is stale — run `conduct-epic finish <EPIC>`.");
+    }
+    lines.push("           Read-only: this section probes commands, reads local state, and issues one");
+    lines.push("           GET. It recovers no lock, rewrites no checkpoint, and never changes the exit code.");
+    return lines.join("\n");
+}
 /**
  * CLI entry for the read-only `doctor` subcommand. Returns a process exit code.
  * Help returns 0; parser errors return 1; otherwise it prints the report and
@@ -886,6 +1283,37 @@ export async function runDoctorCli(argv, overrides = {}) {
         }
     }
     log(formatDoctorPrereqSection(deps.platform, collection));
+    // Executor-adapter section (BAPI-781). Advisory with respect to the EXIT CODE
+    // — an unusable adapter is reported loudly but does not change doctor's
+    // pass/fail, which stays driven by the start-tickets prerequisites this
+    // command has always gated on. Read-only: one version probe, no writes, no
+    // credential resolution. Any unexpected throw is swallowed so a diagnostic
+    // cannot take down the report it is part of.
+    if (overrides.executorAdapter !== false) {
+        try {
+            const adapterDeps = {
+                platform: overrides.executorAdapter?.platform ?? deps.platform,
+                env: overrides.executorAdapter?.env ?? deps.env,
+                runCommand: overrides.executorAdapter?.runCommand ??
+                    (async (command, args) => {
+                        const probe = await deps.runCommand(command, args);
+                        return {
+                            stdout: probe.stdout ?? "",
+                            stderr: probe.stderr ?? "",
+                            exitCode: probe.exitCode ?? 1,
+                        };
+                    }),
+                ...(overrides.executorAdapter?.resolveAdapter
+                    ? { resolveAdapter: overrides.executorAdapter.resolveAdapter }
+                    : {}),
+            };
+            const inspection = await collectExecutorAdapterDiagnostic(agent.name, adapterDeps);
+            log(formatExecutorAdapterDiagnosticReport(inspection));
+        }
+        catch {
+            /* adapter diagnostics are advisory; never block the doctor report */
+        }
+    }
     // Strictly read-only launcher-cache diagnostics (BAPI-451). Best-effort: a probe
     // failure never changes the doctor exit code (cold-start readiness is advisory,
     // not a hard prerequisite). The exit code remains driven by required prereqs.
@@ -901,6 +1329,27 @@ export async function runDoctorCli(argv, overrides = {}) {
     catch {
         /* launcher-cache diagnostics are advisory; never block the doctor report */
     }
+    // Advisory local-launcher override section (BAPI-815/R5), placed beside the
+    // launcher-cache diagnostics because both answer "which build will actually
+    // run?". Strictly read-only: at most ONE `--version` probe, and only when an
+    // override is configured — an unset override runs no command at all, which is
+    // what keeps the "unsupported platform issues zero probes" guarantee intact.
+    // Advisory with respect to the EXIT CODE: an unusable override is reported
+    // loudly and changes nothing about doctor's pass/fail.
+    if (overrides.localCliOverride !== false) {
+        try {
+            const localCliDeps = {
+                env: overrides.localCliOverride?.env ?? deps.env,
+                runCommand: overrides.localCliOverride?.runCommand ??
+                    (async (command, args) => deps.runCommand(command, args)),
+            };
+            const diagnostic = await collectLocalCliOverrideDiagnostic(localCliDeps);
+            log(formatLocalCliOverrideDiagnosticReport(diagnostic));
+        }
+        catch {
+            /* local-launcher diagnostics are advisory; never block the doctor report */
+        }
+    }
     // Advisory MCP tool-surface capability section (BAPI-641). Strictly read-only:
     // one 500 ms GET (or none, under the kill switch). Any timeout, malformed
     // response, or unexpected throw degrades to a "fail-open to full surface" line
@@ -937,10 +1386,6 @@ export async function runDoctorCli(argv, overrides = {}) {
     // any key. It is collected independently of `DoctorCollectionResult` and, like
     // the sections above, never affects the exit code — missing units, malformed
     // units, and unresolved credentials are all advisory.
-    // BAPI-731: set only when isolation is unhealthy AND this host runs an
-    // executor, so an executor-only requirement never fails an ordinary MCP user's
-    // doctor run.
-    let isolationFailed = false;
     if (overrides.executorService !== false) {
         try {
             const injectedFs = deps;
@@ -957,19 +1402,19 @@ export async function runDoctorCli(argv, overrides = {}) {
             };
             const executorDiagnostics = await collectExecutorServiceDiagnostics(executorDeps);
             log(formatExecutorServiceDiagnosticsReport(executorDiagnostics));
-            // BAPI-731: worker config isolation health, rendered right after the
-            // executor-service section because it is only REQUIRED when this host
-            // actually runs an executor. Read-only: it evaluates capability and
-            // creates nothing (see the assertion in `collectWorkerConfigIsolationDiagnostic`).
-            const isolationDiagnostic = collectWorkerConfigIsolationDiagnostic({
-                platform: executorDeps.platform,
-                env: executorDeps.env,
-                executorConfigured: executorDiagnostics.status === "collected" && executorDiagnostics.units.length > 0,
+            // BAPI-791: the ONE shared, low-information Claude login advisory for this
+            // doctor report, rendered right after the executor-service section since
+            // that is what it is a prerequisite for. Replaces the retired worker config
+            // isolation health check and Anthropic OAuth lifecycle section — a worker
+            // is no longer isolated into its own configuration directory (BAPI-790) and
+            // no Anthropic credential is stored or diagnosed by Bridge any more
+            // (BAPI-791); this line reports only whether the host's own
+            // `~/.claude.json` carries a login marker. It never blocks the doctor run.
+            const loginResult = await detectClaudeLogin({
+                homedir: executorDeps.homedir,
+                readFile: executorDeps.readFile,
             });
-            log(formatWorkerConfigIsolationDiagnosticReport(isolationDiagnostic));
-            if (isolationDiagnostic.status === "unhealthy" && isolationDiagnostic.required) {
-                isolationFailed = true;
-            }
+            log(`\n${formatClaudeLoginAdvisory(loginResult)}`);
         }
         catch {
             // Any unexpected failure still renders a sanitized advisory SKIP line.
@@ -1004,16 +1449,62 @@ export async function runDoctorCli(argv, overrides = {}) {
             // Any unexpected failure still renders a sanitized advisory line rather
             // than dropping the section or leaking exception text.
             log(formatPlaneCredentialDiagnosticReport({
-                anthropicKeyPresent: false,
                 repo: null,
                 target: null,
                 bridgeCredentialResolved: false,
             }));
         }
     }
+    // Advisory conduct-epic section (BAPI-803). Read-only, and — like every
+    // section above — it cannot change the exit code: `conduct-epic init` enforces
+    // these same invariants at the point where they actually block, and someone who
+    // never conducts an epic should not see a failing doctor because of it.
+    //
+    // Skipped entirely on an unsupported platform. This section is the only
+    // advisory one that runs COMMAND probes (`gh`, Worktrunk), and doctor's
+    // standing contract is that an unsupported platform probes nothing at all —
+    // reporting on tooling for a `conduct-epic` that cannot run there would buy
+    // nothing and break that contract.
+    if (overrides.conductEpic !== false && collection.ok) {
+        try {
+            const injectedFs = deps;
+            const conductDeps = {
+                env: overrides.conductEpic?.env ?? deps.env,
+                cwd: overrides.conductEpic?.cwd ?? deps.cwd,
+                platform: overrides.conductEpic?.platform ?? deps.platform,
+                homedir: overrides.conductEpic?.homedir ?? injectedFs.homedir ?? os.homedir,
+                readFile: overrides.conductEpic?.readFile ??
+                    injectedFs.readFile ??
+                    ((p) => readFile(p, "utf-8")),
+                stat: overrides.conductEpic?.stat ?? injectedFs.stat ?? ((p) => stat(p)),
+                readdir: overrides.conductEpic?.readdir ?? ((p) => readdir(p)),
+                runCommand: overrides.conductEpic?.runCommand ?? deps.runCommand,
+                resolveAccess: overrides.conductEpic?.resolveAccess,
+                getIndexBranch: overrides.conductEpic?.getIndexBranch,
+                isProcessAlive: overrides.conductEpic?.isProcessAlive,
+            };
+            log(formatConductEpicDiagnosticReport(await collectConductEpicDiagnostic(conductDeps)));
+        }
+        catch {
+            // Any unexpected failure still renders a sanitized advisory section rather
+            // than dropping it or leaking exception text.
+            log(formatConductEpicDiagnosticReport({
+                ghPresent: false,
+                ghAuthenticated: false,
+                worktrunkBinary: resolveWorktrunkBinary(deps.platform, deps.env),
+                worktrunkAvailable: false,
+                repo: null,
+                bridgeCredentialResolved: false,
+                stateDirectory: null,
+                stateDirectoryReadable: false,
+                checkpoints: [],
+                locks: [],
+                indexOverrideBranch: null,
+                indexOverrideChecked: false,
+            }));
+        }
+    }
     if (!collection.ok)
         return 1;
-    if (isolationFailed)
-        return 1;
     return collection.results.some((r) => !r.found) ? 1 : 0;
 }