@bridge_gpt/mcp-server 0.2.39 → 0.2.42

package/build/credentials-cli.js

@@ -25,6 +25,7 @@ import { readFile, mkdir, writeFile, rename, chmod, unlink, open } from "fs/prom
 import os from "os";
 import readline from "readline";
 import { migrateAgentConfigCredentialToStore, } from "./agent-config-credential-migration.js";
+import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
 /** The only agent-config sources the migration knows how to scan. */
 const ALLOWED_SOURCES = [".mcp.json", ".cursor/mcp.json"];
 /** Every subcommand this CLI accepts, in help order. */
@@ -33,7 +34,7 @@ const SUBCOMMANDS = ["migrate-agent-config"];
 export function getCredentialsUsage() {
     return [
         "Usage:",
-        "  npx -y @bridge_gpt/mcp-server credentials migrate-agent-config \\",
+        `  npx -y ${MCP_PACKAGE_NAME} credentials migrate-agent-config \\`,
         "    [--write-credentials|--no-write-credentials] \\",
         "    [--source=.mcp.json|--source=.cursor/mcp.json]",
         "",
@@ -222,7 +223,7 @@ export async function runCredentialsCli(argv, overrides) {
         deps.log(result.message);
         deps.log("");
         deps.log("To migrate it, re-run with --write-credentials:");
-        deps.log("  npx -y @bridge_gpt/mcp-server credentials migrate-agent-config --write-credentials");
+        deps.log(`  npx -y ${MCP_PACKAGE_NAME} credentials migrate-agent-config --write-credentials`);
         if (result.candidates && result.candidates.length > 0) {
             deps.log("");
             deps.log("Discovered source(s):");

package/build/doctor.js

@@ -28,11 +28,11 @@ import { createBridgeApiUrls } from "./bridge-api-urls.js";
 import { probeToolSurface } from "./tool-surface-gating.js";
 import { resolveBapiCredentials } from "./credential-store.js";
 import { resolveConductorBridgeApiAccess } from "./conductor/bridge-api-client.js";
-import { getIndexBranch } from "./conduct-epic/bridge-client.js";
 import { resolveConductEpicStateDirectory } from "./conduct-epic/checkpoint-store.js";
 import { isConductEpicLockOwnerAlive, parseConductEpicLock, } from "./conduct-epic/lock.js";
 import { resolveRequiredStartTicketsRepoName } from "./start-tickets-repo.js";
-import { BRIDGE_PACKAGE_NAME, describeLauncherReason, inspectLauncherConfigs, parseLauncherPin as parseSharedLauncherPin, } from "./launcher-config-inspection.js";
+import { BRIDGE_PACKAGE_NAME, describeLauncherReason, DUPLICATE_REGISTRATION_GUIDANCE, inspectLauncherConfigs, parseLauncherPin as parseSharedLauncherPin, } from "./launcher-config-inspection.js";
+import { MCP_SERVER_NAME, MCP_PACKAGE_NAME, } from "./mcp-identity.js";
 import { DEFAULT_AGENT_NAME, resolveAgentSpec, isAgentName, formatValidAgentNames, } from "./agent-registry.js";
 import { getDoctorPrereqDescriptors, probePrerequisite, resolveWorktrunkBinary, } from "./start-tickets-prereqs.js";
 import { resolveProfiles } from "./mcp-profile.js";
@@ -50,7 +50,7 @@ export const DOCTOR_REPORT_TITLE = "bridge doctor — read-only diagnostics";
 export function getDoctorUsage() {
     return [
         "Usage:",
-        "  npx -y @bridge_gpt/mcp-server doctor [--agent <name>]",
+        `  npx -y ${MCP_PACKAGE_NAME} doctor [--agent <name>]`,
         "",
         // BAPI-669 (U9b): `doctor` is the general Bridge diagnostic command, not a
         // start-tickets-only one — and its report leads with install status, so the
@@ -72,7 +72,7 @@ export function getDoctorUsage() {
         "the start-tickets preflight prerequisites plus",
         "uv, the selected agent's command, Bridge API credential resolution, and",
         "worktree MCP registration reachability, and a read-only check of whether the",
-        "Claude user config (~/.claude.json) registers a 'bridge-api' MCP server that",
+        `Claude user config (~/.claude.json) registers a '${MCP_SERVER_NAME}' MCP server that`,
         "could shadow the registration provisioned into a worker worktree. That check",
         "only reads the file and runs `git worktree list --porcelain`; it never edits,",
         "migrates, or writes any configuration. Credential resolution reports the",
@@ -428,7 +428,14 @@ export async function inspectLauncherCache(deps) {
         // but it is still a finding — doctor cannot determine its pin, and saying
         // nothing would read as "this config is fine". Classify it before the
         // no-entry skip below.
-        if (found.action === "invalid" || found.action === "unsupported") {
+        //
+        // `duplicate-registration` is included (BAPI-807) because its pin is
+        // genuinely indeterminate: there are two entries and doctor must not pick
+        // one. Omitting it here would fall through to the probe below with a null
+        // spec — the registration-status section reports the actual fault.
+        if (found.action === "invalid" ||
+            found.action === "unsupported" ||
+            found.action === "duplicate-registration") {
             inspections.push({
                 relPath,
                 spec,
@@ -494,11 +501,79 @@ export async function inspectLauncherCache(deps) {
     }
     return inspections;
 }
+/** The exact INFO body every legacy-registration finding renders (pinned text). */
+export const LEGACY_REGISTRATION_INFO_TEXT = `This registration remains supported. New installs use \`${MCP_SERVER_NAME}\`. No action is required.`;
+/**
+ * Select registration-status findings from shared launcher inspections.
+ *
+ * Pure: it derives from inspections that were already computed read-only, and
+ * performs no I/O of its own.
+ */
+export function collectRegistrationStatusFindings(inspections) {
+    const findings = [];
+    for (const found of inspections) {
+        if (!found.filePresent)
+            continue;
+        if (found.action === "duplicate-registration") {
+            findings.push({ relPath: found.relPath, kind: "duplicate" });
+            continue;
+        }
+        if (found.legacyRegistration && found.registrationKey) {
+            findings.push({
+                relPath: found.relPath,
+                kind: "legacy",
+                registrationKey: found.registrationKey,
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * True when any finding is a duplicate registration — the ONE registration-status
+ * state that affects doctor's exit code.
+ */
+export function hasDuplicateRegistrationFault(findings) {
+    return findings.some((f) => f.kind === "duplicate");
+}
+/**
+ * Collect registration-status findings read-only, reusing the shared launcher
+ * inspection. Takes the same injected deps as the cache probe minus the npx
+ * probe — this section spawns nothing at all.
+ */
+export async function inspectRegistrationStatus(deps) {
+    const shared = await inspectLauncherConfigs({
+        cwd: deps.cwd,
+        targetVersion: VERSION,
+        readFile: deps.readFile,
+    });
+    return collectRegistrationStatusFindings(shared);
+}
+/** Render the registration-status section of the doctor report (pure formatting). */
+export function formatRegistrationStatusReport(findings) {
+    const lines = ["", "MCP registration status", ""];
+    if (findings.length === 0) {
+        lines.push(`OK    Every inspected config registers Bridge as \`${MCP_SERVER_NAME}\`.`);
+        return lines.join("\n");
+    }
+    for (const finding of findings) {
+        if (finding.kind === "legacy") {
+            // Semantic status FIRST, then the affected path and the exact key, with
+            // code-like values in backticks.
+            lines.push(`INFO  Supported legacy registration — \`${finding.relPath}\` registers Bridge as ` +
+                `\`${finding.registrationKey}\`.`);
+            lines.push(`  ${LEGACY_REGISTRATION_INFO_TEXT}`);
+            continue;
+        }
+        lines.push(`ERROR  Duplicate Bridge registrations detected — \`${finding.relPath}\`.`);
+        lines.push(`  ${DUPLICATE_REGISTRATION_GUIDANCE}`);
+    }
+    return lines.join("\n");
+}
 /** Render the launcher-cache section of the doctor report (pure formatting). */
 export function formatLauncherCacheReport(inspections) {
     const lines = ["", "Launcher cache (MCP cold-start readiness)", ""];
     if (inspections.length === 0) {
-        lines.push("No project-local bridge-api launcher configs found to inspect.");
+        lines.push(`No project-local ${MCP_SERVER_NAME} launcher configs found to inspect.`);
         return lines.join("\n");
     }
     const labels = {
@@ -645,7 +720,7 @@ export function formatLocalCliOverrideDiagnosticReport(diagnostic) {
     const lines = ["", `Local CLI launcher (${LOCAL_CLI_OVERRIDE_ENV})`, ""];
     switch (diagnostic.state) {
         case "not-configured":
-            lines.push("NOT CONFIGURED  packaged launcher in use (npx -y @bridge_gpt/mcp-server)");
+            lines.push(`NOT CONFIGURED  packaged launcher in use (npx -y ${MCP_PACKAGE_NAME})`);
             lines.push("  No local override is set, so no launcher probe was run.");
             break;
         case "executable":
@@ -1062,7 +1137,6 @@ export async function collectConductEpicDiagnostic(deps) {
     const resolveAccess = deps.resolveAccess ?? resolveConductorBridgeApiAccess;
     let repo = null;
     let bridgeCredentialResolved = false;
-    let accessForIndexProbe = null;
     try {
         const result = await resolveAccess({
             env: deps.env,
@@ -1075,7 +1149,6 @@ export async function collectConductEpicDiagnostic(deps) {
         if (result.ok) {
             repo = result.access.repoName;
             bridgeCredentialResolved = true;
-            accessForIndexProbe = result;
         }
     }
     catch {
@@ -1124,21 +1197,6 @@ export async function collectConductEpicDiagnostic(deps) {
             locks.push({ epic, owner_pid: owner.owner_pid, host: owner.host, alive });
         }
     }
-    let indexOverrideBranch = null;
-    let indexOverrideChecked = false;
-    if (accessForIndexProbe !== null && accessForIndexProbe.ok) {
-        const probe = deps.getIndexBranch ?? getIndexBranch;
-        try {
-            const result = await probe(accessForIndexProbe.access);
-            if (result.ok) {
-                indexOverrideChecked = true;
-                indexOverrideBranch = result.value.override?.override_branch ?? null;
-            }
-        }
-        catch {
-            indexOverrideChecked = false;
-        }
-    }
     return {
         ghPresent,
         ghAuthenticated,
@@ -1150,8 +1208,6 @@ export async function collectConductEpicDiagnostic(deps) {
         stateDirectoryReadable,
         checkpoints,
         locks,
-        indexOverrideBranch,
-        indexOverrideChecked,
     };
 }
 /** Render the conduct-epic section. Advisory: never changes the exit code. */
@@ -1206,18 +1262,8 @@ export function formatConductEpicDiagnosticReport(diagnostic) {
             }
         }
     }
-    if (!diagnostic.indexOverrideChecked) {
-        lines.push("  SKIP     Indexed-branch override: not checked.");
-    }
-    else if (diagnostic.indexOverrideBranch === null) {
-        lines.push("  OK       Indexed-branch override: none active.");
-    }
-    else {
-        lines.push(`  WARN     Indexed-branch override: active on '${diagnostic.indexOverrideBranch}'.\n` +
-            "           If no epic is running, this is stale — run `conduct-epic finish <EPIC>`.");
-    }
-    lines.push("           Read-only: this section probes commands, reads local state, and issues one");
-    lines.push("           GET. It recovers no lock, rewrites no checkpoint, and never changes the exit code.");
+    lines.push("           Read-only: this section probes commands and reads local state. It recovers no");
+    lines.push("           lock, rewrites no checkpoint, and never changes the exit code.");
     return lines.join("\n");
 }
 /**
@@ -1314,6 +1360,25 @@ export async function runDoctorCli(argv, overrides = {}) {
             /* adapter diagnostics are advisory; never block the doctor report */
         }
     }
+    // Registration-status diagnostics (BAPI-807). Strictly read-only and spawns
+    // nothing. UNLIKE every other advisory section, one of its outcomes CAN change
+    // the exit code: a duplicate registration is an actionable fault that leaves
+    // Bridge unable to reconcile the config at all, so `doctor` must not exit 0 on
+    // it. A supported legacy registration is information only and never does.
+    let duplicateRegistrationFault = false;
+    try {
+        const registrationFindings = await inspectRegistrationStatus({
+            cwd: overrides.launcherProbe?.cwd ?? deps.cwd,
+            readFile: overrides.launcherProbe?.readFile ?? ((p) => readFile(p, "utf-8")),
+        });
+        duplicateRegistrationFault = hasDuplicateRegistrationFault(registrationFindings);
+        log(formatRegistrationStatusReport(registrationFindings));
+    }
+    catch {
+        // An unexpected failure must not invent a fault, and must not drop the
+        // section silently either — but it also cannot claim the configs are clean.
+        log(formatRegistrationStatusReport([]));
+    }
     // Strictly read-only launcher-cache diagnostics (BAPI-451). Best-effort: a probe
     // failure never changes the doctor exit code (cold-start readiness is advisory,
     // not a hard prerequisite). The exit code remains driven by required prereqs.
@@ -1480,7 +1545,6 @@ export async function runDoctorCli(argv, overrides = {}) {
                 readdir: overrides.conductEpic?.readdir ?? ((p) => readdir(p)),
                 runCommand: overrides.conductEpic?.runCommand ?? deps.runCommand,
                 resolveAccess: overrides.conductEpic?.resolveAccess,
-                getIndexBranch: overrides.conductEpic?.getIndexBranch,
                 isProcessAlive: overrides.conductEpic?.isProcessAlive,
             };
             log(formatConductEpicDiagnosticReport(await collectConductEpicDiagnostic(conductDeps)));
@@ -1499,12 +1563,14 @@ export async function runDoctorCli(argv, overrides = {}) {
                 stateDirectoryReadable: false,
                 checkpoints: [],
                 locks: [],
-                indexOverrideBranch: null,
-                indexOverrideChecked: false,
             }));
         }
     }
     if (!collection.ok)
         return 1;
+    // BAPI-807: a duplicate registration fails the run alongside a missing
+    // prerequisite. A supported legacy registration contributes nothing here.
+    if (duplicateRegistrationFault)
+        return 1;
     return collection.results.some((r) => !r.found) ? 1 : 0;
 }

package/build/executor/cli.js

@@ -14,6 +14,7 @@ import { DEFAULT_EXECUTOR_AGENT_ID } from "./agent-identity.js";
 import { createDefaultExecutorDeps } from "./deps.js";
 import { resolveBaseUrl, resolveExecutorApiAccess, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
 import { createExecutorHttpClient } from "./http-client.js";
+import { startExecutorSleepAssertion } from "./platform.js";
 import { runExecutor } from "./runner.js";
 import { runExecutorWatchCli } from "./watch-cli.js";
 /** Fixed executor timing/behavior defaults. */
@@ -210,6 +211,21 @@ export function parseExecutorArgs(argv, context) {
     };
     return { kind: "ok", options };
 }
+/**
+ * Default signal registrar: `process.on`, disposed with `process.off`.
+ *
+ * The SAME register-and-return-an-unsubscriber shape the notifications CLI and
+ * the plane supervisor already use. Defined here rather than inside `runExecutor`
+ * so the runner never touches `process` itself — the runner stays a pure loop
+ * over injected boundaries, and this bootstrap file remains the one place that
+ * knows the process object exists.
+ */
+function defaultSignalRegistrar(signal, handler) {
+    process.on(signal, handler);
+    return () => {
+        process.off(signal, handler);
+    };
+}
 function hasRepoFlag(argv) {
     return argv.some((a) => a === "--repo" || a === "--repos" || a.startsWith("--repos="));
 }
@@ -306,12 +322,43 @@ export async function runExecutorCli(argv, overrides = {}) {
     // Hand the loop the VALIDATED runtime configuration: the parsed options plus the
     // normalized base URL resolution actually settled on.
     const runtimeOptions = { ...options, resolvedBaseUrl };
+    // --- Sleep assertion (BAPI-828) ---------------------------------------
+    // Started HERE — after argument parsing, base-URL resolution, credential
+    // resolution, and HTTP client construction have all succeeded, and immediately
+    // before the loop begins. That position is the whole design: it guarantees the
+    // assertion exists before the first claim can spawn a worker, while a `--help`
+    // run, an unknown flag, a missing base URL, and a credential failure each
+    // return above without ever spawning `caffeinate`. Fail-open throughout — a
+    // host that cannot hold the assertion still claims and still works.
+    const sleepAssertion = startExecutorSleepAssertion({
+        platform: context.platform,
+        // The EXECUTOR's environment, read straight from deps. A worker environment
+        // never reaches this call, and the opt-out is never forwarded to one.
+        env: deps.env,
+        cwd: deps.cwd,
+        executorPid: context.pid,
+        spawnProcess: deps.spawnProcess,
+        setTimer: deps.setTimer,
+        clearTimer: deps.clearTimer,
+        errorLog,
+    });
+    const runnerSeams = {
+        onSignal: overrides.onSignal ?? defaultSignalRegistrar,
+    };
     try {
-        return await run(runtimeOptions, deps, httpClient);
+        return await run(runtimeOptions, deps, httpClient, runnerSeams);
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         errorLog(`Error: executor exited unexpectedly: ${message.slice(0, 200)}`);
         return 1;
     }
+    finally {
+        // Released for a normal completion, a graceful signal shutdown, AND a thrown
+        // runner error alike. Without the `finally` the throw path above would return
+        // its exit code while still holding a `caffeinate` child — which, being a
+        // live child of this process, is exactly the kind of thing that keeps a Node
+        // process from exiting when nobody calls `process.exit`.
+        await sleepAssertion.release();
+    }
 }

package/build/executor/env.js

@@ -40,6 +40,7 @@
  * (`Read(~/.config/bridge/**)` in `permissions.ts`).
  */
 import { PR_BASE_BRANCH_ENV_VAR } from "../pr-base-contract.js";
+import { INDEX_SCOPE_ENV_VAR, validateOptionalIndexScope } from "../index-scope-contract.js";
 /** Non-secret operational keys forwarded to the worker when present. */
 const ALLOWED_ENV_KEYS = [
     "PATH",
@@ -92,6 +93,14 @@ export const EXPLICIT_DENY_KEYS = [
     "GH_TOKEN",
     "CLAUDE_CONFIG_DIR",
     "XDG_CONFIG_HOME",
+    // BAPI-844: the index-scope declaration follows the BAPI_BASE_BRANCH rule —
+    // absent from ALLOWED_ENV_KEYS so it is never copied from `parentEnv`, and
+    // denied EXPLICITLY here so an operator's ambient `BAPI_INDEX_SCOPE` can never
+    // reach a worker. A worker's research index is a run-scoped decision; a value
+    // exported in the shell that happened to launch the executor is not that
+    // decision, and inheriting one would route an unscoped worker's plan and review
+    // at another epic's shadow index while nothing in the job said so.
+    INDEX_SCOPE_ENV_VAR,
 ];
 /**
  * True only when `key` is a safe, allowlisted operational key. Exported so the
@@ -130,10 +139,22 @@ export function buildExecutorBaseWorkerEnv(parentEnv, options = {}) {
         }
     }
     env.BRIDGE_SKIP_PREPUSH = "1";
+    env.MAX_MCP_OUTPUT_TOKENS = "50000";
     if (typeof options.effectiveBaseBranch === "string" &&
         options.effectiveBaseBranch.length > 0) {
         env[PR_BASE_BRANCH_ENV_VAR] = options.effectiveBaseBranch;
     }
+    // BAPI-844: the index-scope declaration, set ONLY from the explicit option and
+    // only after the shared shape check. A malformed explicit value throws here —
+    // before an environment exists — rather than being dropped: silently omitting it
+    // would spawn a worker that researches the canonical index while the job it came
+    // from declared a scope, which is the one outcome the declaration exists to
+    // prevent. An absent option adds no key at all, so the returned object is
+    // unchanged for every unscoped worker.
+    const indexScope = validateOptionalIndexScope(options.indexScope);
+    if (indexScope !== undefined) {
+        env[INDEX_SCOPE_ENV_VAR] = indexScope;
+    }
     // Nothing agent-specific is added here, and deliberately nothing secret. An
     // adapter that needs to forward an operator-owned credential declares it as a
     // passthrough and copies it onto the object this function returns; see

package/build/executor/index-scope.js

@@ -0,0 +1,39 @@
+/**
+ * Per-job index-scope resolution (BAPI-844).
+ *
+ * The server names the index scope a v2 job's worker must research against, as
+ * the top-level `index_scope_id` on the claimed job — the same wire position as
+ * `epic_run_id`, and for the same reason: it is a server-minted IDENTITY, not
+ * job-type-specific payload data. There is exactly one wire representation, and
+ * this module is the only place the executor reads it.
+ *
+ * Mirrors {@link ../executor/base-branch.ts} deliberately, including its posture:
+ *
+ * - ABSENT → an unscoped job. The worker's environment, command, and routing are
+ *   byte-identical to the pre-BAPI-844 ones.
+ * - PRESENT and well-formed → carried into the worker environment as an explicit
+ *   spawn option (never inherited).
+ * - PRESENT but malformed → a contract failure, resolved BEFORE any side effect.
+ *   Dropping it instead would spawn a worker that silently researched the
+ *   canonical index while the job it came from declared a scope.
+ */
+import { validateOptionalIndexScope } from "../index-scope-contract.js";
+/**
+ * Resolve the declared index scope for one executor job.
+ *
+ * The diagnostic names the contract only. The submitted value never appears in
+ * it, because this string reaches `/fail`, the job row, and operator output —
+ * all places an opaque routing token must not be persisted.
+ */
+export function resolveExecutorJobIndexScope(job) {
+    try {
+        const indexScope = validateOptionalIndexScope(job.index_scope_id);
+        return indexScope === undefined ? { ok: true } : { ok: true, indexScope };
+    }
+    catch {
+        return {
+            ok: false,
+            error: "job index_scope_id is present but is not a valid index-scope identity.",
+        };
+    }
+}

package/build/executor/job-log-registry.js

@@ -82,6 +82,75 @@ export async function markExecutorJobLogFinished(jobId, finishedAt, deps) {
     const filePath = jobLogRecordPath(stateDir, jobId, deps.platform ?? process.platform);
     await deps.writeFile(filePath, JSON.stringify(normalizeRecord(updated), null, 2));
 }
+// ---------------------------------------------------------------------------
+// Active worker logs (BAPI-828)
+// ---------------------------------------------------------------------------
+/**
+ * In-memory map of job id → worker-log path for jobs whose tee is currently open.
+ *
+ * DELIBERATELY SEPARATE FROM THE PERSISTED RECORD ABOVE, and deliberately not
+ * derived from it. The persisted record is a visibility nicety for a SEPARATE
+ * `executor watch` process, it is written with best-effort error swallowing, and
+ * it keeps its row after `finished_at` is stamped. This map answers a different
+ * question — "which worker logs can be appended to right now, in THIS process" —
+ * and the suspend diagnostic depends on that answer being correct. Deriving it
+ * from the persisted record would mean a failed registry write silently disables
+ * suspend annotation for a worker whose tee is perfectly healthy.
+ *
+ * Process-scoped module state rather than runner-scoped, unlike the live worker
+ * registry: entries are keyed by server-minted job id, so two concurrent
+ * `runExecutor` invocations in one process cannot collide, and each value is a
+ * path only its own job ever deactivates.
+ *
+ * SECRET-FREE: a filesystem path inside the job's own worktree, nothing else.
+ */
+const activeJobLogPaths = new Map();
+/**
+ * Mark a job's worker log as open and appendable.
+ *
+ * Called once the tee EXISTS, before any registry persistence — see the map's
+ * docstring for why the two are not chained. Re-activating the same job id simply
+ * overwrites the path.
+ */
+export function activateJobLog(jobId, logPath) {
+    if (typeof logPath !== "string" || logPath.length === 0)
+        return;
+    activeJobLogPaths.set(jobId, logPath);
+}
+/** Stop appending to a job's worker log. Idempotent. */
+export function deactivateJobLog(jobId) {
+    activeJobLogPaths.delete(jobId);
+}
+/** The distinct currently-appendable log paths (a snapshot, safe to iterate). */
+export function activeJobLogPathsSnapshot() {
+    return [...new Set(activeJobLogPaths.values())];
+}
+/**
+ * Append one diagnostic line to every currently active worker log.
+ *
+ * FAIL-OPEN PER PATH. Each append is contained independently, so one missing,
+ * deleted, or unwritable log cannot suppress the diagnostic for the others and
+ * cannot propagate an error into the executor's poll loop — this is annotation,
+ * never correctness.
+ *
+ * Paths are DEDUPLICATED (two jobs can legitimately name the same log during a
+ * re-entry window) and exactly one trailing newline is written, whether or not
+ * the caller supplied one.
+ */
+export async function appendToActiveJobLogs(line, deps) {
+    const paths = activeJobLogPathsSnapshot();
+    if (paths.length === 0)
+        return;
+    const payload = `${line.replace(/\n+$/, "")}\n`;
+    await Promise.all(paths.map(async (logPath) => {
+        try {
+            await deps.appendFile(logPath, payload);
+        }
+        catch {
+            /* one unwritable log never blocks the others, or the executor */
+        }
+    }));
+}
 /**
  * Load and validate a record for `executor watch <job>`. Returns a structured
  * missing/invalid result rather than throwing raw filesystem/JSON errors.