@bridge_gpt/mcp-server 0.2.41 → 0.2.43

package/build/executor/runner.js

@@ -8,7 +8,90 @@
  */
 import { collectExecutorPreflight, buildClaimManifest, createDenyProbeCache, } from "./preflight.js";
 import { runClaimedJob } from "./job-runner.js";
+import { appendToActiveJobLogs } from "./job-log-registry.js";
+import { createLiveWorkerRegistry } from "./live-worker-registry.js";
 import { sweepExecutorWorktrees } from "./worktree-gc.js";
+/**
+ * Signals that request a graceful executor shutdown (BAPI-828).
+ *
+ * Both, not just `SIGTERM`: an operator stopping a foreground executor types
+ * Ctrl-C, so a `SIGINT` that orphaned the worker would be the common case rather
+ * than the rare one. `SIGKILL` is deliberately absent — it cannot be trapped, and
+ * the worktree lock's stale-owner recovery is what covers it.
+ */
+export const EXECUTOR_SHUTDOWN_SIGNALS = ["SIGTERM", "SIGINT"];
+/**
+ * Extra wall-clock slack, beyond three poll intervals, before a COMPLETED poll
+ * sleep is called a host suspend (BAPI-828).
+ *
+ * The threshold is `3 * pollIntervalMs + SUSPEND_GAP_SLACK_MS`, so it scales with
+ * however the operator configured polling instead of pinning a constant that a
+ * long interval would trivially exceed and a short one would never reach. Three
+ * intervals plus a full minute is far outside anything ordinary scheduling jitter
+ * or a slow GC sweep produces, which keeps the diagnostic rare enough to mean
+ * something when it does appear.
+ */
+export const SUSPEND_GAP_SLACK_MS = 60_000;
+/**
+ * Render the fixed suspend-gap diagnostic.
+ *
+ * Exported so the stderr line and the worker-log annotation are the same string
+ * by construction — an operator correlating one against the other is the whole
+ * reason both exist.
+ */
+export function formatSuspendGapDiagnostic(elapsedMs) {
+    return `executor: host appears to have been suspended for ~${Math.round(elapsedMs / 1000)} s (poll gap)`;
+}
+function normalizeDispatcherAvailability(value) {
+    if (value === "fresh")
+        return "fresh";
+    if (value === "stale" || value === "never_seen")
+        return "absent";
+    return "unknown";
+}
+/**
+ * The unavailable diagnostic. Exported so the message has ONE definition that a
+ * test can assert against rather than a copy that drifts.
+ *
+ * Calm on purpose, and it says what the executor is going to do next: this is
+ * not a failure of the executor, it keeps polling, and the fix is on the server
+ * side. An executor that exited here would turn a restartable dispatcher outage
+ * into a second outage.
+ */
+export function formatDispatcherUnavailableDiagnostic(liveness) {
+    return (`executor: no fresh reconciler/dispatcher heartbeat is available ` +
+        `(reconciler_liveness=${liveness}); the dispatcher may not be running. ` +
+        "Check DISABLE_SCHEDULER and GET /automation/health; see " +
+        "docs/claude/epic-conductor-v2-operator-runbook.md. Continuing to poll.");
+}
+/** The recovery diagnostic, emitted once when an absent dispatcher comes back. */
+export function formatDispatcherRecoveredDiagnostic() {
+    return ("executor: reconciler/dispatcher heartbeat is fresh again; continuing to poll.");
+}
+/**
+ * How often the executor publishes PER-PROCESS liveness (BAPI-871).
+ *
+ * The server calls an executor stale at 300 s (`EXECUTOR_STALE_SECONDS`). 60 s is
+ * comfortably below that — four consecutive misses before anyone is alarmed —
+ * which keeps a transient network blip, a VPN reconnect, or one slow request from
+ * manufacturing an outage while still detecting a genuinely dead process within
+ * the server's own window.
+ *
+ * Deliberately INDEPENDENT of claim results and of any active job. An executor
+ * that is idle is exactly the executor whose liveness was previously invisible,
+ * so a cadence that paused while nothing was claimed would rebuild the blind spot
+ * this endpoint exists to remove.
+ */
+export const PROCESS_HEARTBEAT_INTERVAL_MS = 60_000;
+/** Delivery-failure diagnostic. Bounded, credential-free, stderr-only. */
+export function formatProcessHeartbeatFailureDiagnostic() {
+    return ("executor: process-heartbeat delivery is failing; the server may report this " +
+        "executor as stale. Claiming and running jobs are unaffected.");
+}
+/** Emitted once when delivery starts working again. */
+export function formatProcessHeartbeatRecoveredDiagnostic() {
+    return "executor: process-heartbeat delivery has recovered.";
+}
 /**
  * Run the executor loop. Returns 0 on the `once` path (a single cycle drained);
  * in continuous mode it does not return (the process is long-lived).
@@ -37,6 +120,50 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
     // the sole eligibility authority. Declared here, outside both loops below, so
     // it persists across poll cycles for the lifetime of this `runExecutor` call.
     let lastClaimedEpicRunId = null;
+    // BAPI-871 — the last normalized dispatcher availability OBSERVED on a
+    // successful claim response, retained for the lifetime of this `runExecutor`
+    // call. Declared here, outside both loops, so the suppression below spans poll
+    // cycles: an absent dispatcher must produce one diagnostic, not one per poll.
+    //
+    // `null` means "nothing EVALUABLE observed yet", which is what makes the FIRST
+    // absent observation announce itself rather than being treated as an unchanged
+    // state. Only `fresh` and `absent` are ever stored — see the transparency rule
+    // for `unknown` in the observer below.
+    //
+    // Read-only diagnostics, exactly like `lastClaimedEpicRunId` above: it never
+    // feeds claim eligibility, cadence, retries, dispatch, or exit.
+    let lastDispatcherAvailability = null;
+    /**
+     * Announce a dispatcher availability CHANGE, and only a change.
+     *
+     * Called after every successful claim response and before the runner branches
+     * on claimed-versus-no-job, because the no-job branch is precisely the one that
+     * used to say nothing at all.
+     */
+    const observeDispatcherLiveness = (liveness) => {
+        const availability = normalizeDispatcherAvailability(liveness);
+        // `unknown` is TRANSPARENT: it emits nothing and, just as importantly, does
+        // not overwrite what was last actually established. An operator who saw
+        // "the dispatcher may not be running", then a stretch of unevaluable polls,
+        // then a fresh heartbeat, must still be told it recovered — and swallowing
+        // that recovery because an unevaluable poll sat in between would leave the
+        // absence warning standing as the last word.
+        if (availability === "unknown")
+            return;
+        const previous = lastDispatcherAvailability;
+        lastDispatcherAvailability = availability;
+        if (availability === previous)
+            return;
+        if (availability === "absent") {
+            // stderr, never `console.log` — stdout is the MCP protocol channel.
+            deps.errorLog(formatDispatcherUnavailableDiagnostic(liveness));
+        }
+        else if (previous === "absent") {
+            // Only from `absent`. A first-ever `fresh` observation is the ordinary
+            // healthy start-up and deserves no announcement.
+            deps.errorLog(formatDispatcherRecoveredDiagnostic());
+        }
+    };
     // BAPI-722: ONE deny-probe cache per `runExecutor` invocation, created OUTSIDE
     // the claim loop below — that scope is the whole feature. A cache created inside
     // the loop would be discarded every cycle and re-probe exactly as before; a
@@ -50,6 +177,188 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
         denyProbeCache: createDenyProbeCache(),
         ...(seams.preflightSeams ?? {}),
     };
+    // --- Graceful shutdown state (BAPI-828) -------------------------------
+    // ONE registry per invocation — see `live-worker-registry.ts` for why this is
+    // not module-global. Every dispatched job receives it, so a worker spawned by
+    // any of them is reachable from the signal handlers installed below.
+    const liveWorkers = createLiveWorkerRegistry();
+    const control = { liveWorkers };
+    let shutdownRequested = false;
+    /**
+     * Wake functions for whichever poll sleep is currently in flight. A list whose
+     * entries are REMOVED when their sleep completes normally, rather than one
+     * long-lived promise every cycle races against: the latter would accumulate one
+     * pending reaction per poll for the entire life of a long-running executor.
+     */
+    const shutdownWaiters = [];
+    /**
+     * Handle the first shutdown signal. Idempotent across repeated and mixed
+     * `SIGTERM`/`SIGINT`: a second signal must not send a second `SIGTERM` to a
+     * worker, install a second grace timer, or start a second drain.
+     *
+     * Deliberately does NOT call `process.exit` and does NOT signal any child
+     * directly. The loop below is allowed to unwind normally so worker supervision,
+     * worker-log closure, and the ownership-checked worktree-lock release all still
+     * run — exiting here is precisely what would leave the lock behind.
+     */
+    const beginShutdown = () => {
+        if (shutdownRequested)
+            return;
+        shutdownRequested = true;
+        deps.errorLog("executor: shutdown signal received; terminating live workers and draining");
+        liveWorkers.requestShutdown();
+        for (const wake of shutdownWaiters.splice(0, shutdownWaiters.length))
+            wake();
+    };
+    /**
+     * Sleep one poll interval, or return early once shutdown is requested.
+     *
+     * The return value is load-bearing: only a `"slept"` result may feed the
+     * suspend-gap calculation. A shutdown wake is an INTERRUPTED wait whose elapsed
+     * time says nothing about the host, and reporting one as a suspend would
+     * manufacture a diagnostic out of an ordinary Ctrl-C.
+     */
+    const sleepUntilPollOrShutdown = async (ms) => {
+        if (shutdownRequested)
+            return "shutdown";
+        let wake;
+        const interrupted = new Promise((resolve) => {
+            wake = resolve;
+        });
+        shutdownWaiters.push(wake);
+        try {
+            return await Promise.race([
+                deps.sleep(ms).then(() => "slept"),
+                interrupted.then(() => "shutdown"),
+            ]);
+        }
+        finally {
+            const index = shutdownWaiters.indexOf(wake);
+            if (index !== -1)
+                shutdownWaiters.splice(index, 1);
+        }
+    };
+    // The heartbeat loop's OWN stop signal (BAPI-871). Deliberately separate from
+    // `shutdownRequested`: winding the loop down at the end of a `once` run must
+    // not flip the runner's shutdown flag, because `beginShutdown` is idempotent
+    // on that flag and a signal arriving late — after the loop ended but before the
+    // handlers are unsubscribed — must still reach the live workers.
+    let heartbeatStopRequested = false;
+    const heartbeatWaiters = [];
+    const stopProcessHeartbeats = () => {
+        heartbeatStopRequested = true;
+        for (const wake of heartbeatWaiters.splice(0, heartbeatWaiters.length))
+            wake();
+    };
+    /**
+     * Sleep one heartbeat interval, returning early on either stop condition.
+     *
+     * Races the interval against a real shutdown AND the loop's own wind-down, so
+     * process exit never waits out a full cadence.
+     */
+    const sleepUntilHeartbeatOrStop = async (ms) => {
+        if (heartbeatStopRequested || shutdownRequested)
+            return "stop";
+        let wake;
+        const interrupted = new Promise((resolve) => {
+            wake = resolve;
+        });
+        heartbeatWaiters.push(wake);
+        shutdownWaiters.push(wake);
+        try {
+            return await Promise.race([
+                deps.sleep(ms).then(() => "slept"),
+                interrupted.then(() => "stop"),
+            ]);
+        }
+        finally {
+            for (const list of [heartbeatWaiters, shutdownWaiters]) {
+                const index = list.indexOf(wake);
+                if (index !== -1)
+                    list.splice(index, 1);
+            }
+        }
+    };
+    /**
+     * Publish per-process liveness on a fixed cadence until shutdown (BAPI-871).
+     *
+     * Runs CONCURRENTLY with the poll loop rather than inside it, because the poll
+     * loop's cadence is the operator's to configure and its cycle time varies with
+     * whatever work it picks up — neither of which should be able to change how
+     * often this process proves it is alive.
+     *
+     * Every failure mode is contained here: delivery is non-critical monitoring, so
+     * a failure is reported to stderr and the loop keeps going. It cannot fail a
+     * claim, fail a job, or end the run.
+     */
+    const runProcessHeartbeatLoop = async () => {
+        const publish = httpClient.processHeartbeat;
+        // A client without the capability (every object-literal test fake) simply
+        // does not heartbeat. Nothing else about the run changes.
+        if (typeof publish !== "function")
+            return;
+        // `repoName` FIRST so the client authenticates with the primary repo's key in
+        // multi-repo mode, then the remaining configured repos, de-duplicated.
+        const repoNames = [options.repoName, ...options.repos].filter((repo, index, all) => repo && all.indexOf(repo) === index);
+        const request = {
+            component: "executor",
+            instance_id: options.executorId,
+            repo_names: repoNames,
+        };
+        // Suppression state: one message per CHANGE of delivery state, so a long
+        // outage produces one line rather than one per minute.
+        let lastFailed = false;
+        for (;;) {
+            let outcome;
+            try {
+                outcome = await publish.call(httpClient, request);
+            }
+            catch {
+                // The client already contains its own errors; this is belt-and-braces so
+                // an unexpected throw can never escape into the run.
+                outcome = "failed";
+            }
+            if (outcome === "failed" && !lastFailed) {
+                deps.errorLog(formatProcessHeartbeatFailureDiagnostic());
+            }
+            else if (outcome === "delivered" && lastFailed) {
+                deps.errorLog(formatProcessHeartbeatRecoveredDiagnostic());
+            }
+            lastFailed = outcome === "failed";
+            if (heartbeatStopRequested || shutdownRequested)
+                return;
+            // Woken by the same waiter list a real shutdown fires, so process exit does
+            // not have to wait out a full interval.
+            if ((await sleepUntilHeartbeatOrStop(PROCESS_HEARTBEAT_INTERVAL_MS)) === "stop") {
+                return;
+            }
+        }
+    };
+    /**
+     * Annotate an abnormally long COMPLETED poll gap (BAPI-828).
+     *
+     * ADVISORY BY CONSTRUCTION: it logs and appends, and touches nothing else.
+     * Preflight, claim eligibility, heartbeat cadence, leases, active jobs, retries,
+     * and worktree handling are all deliberately left alone — the host having slept
+     * is a fact for the operator reading the log, never an input to scheduling. The
+     * whole point is that an executor whose MacBook idled to sleep mid-run left
+     * nothing in its logs saying so, and the freeze was misdiagnosed for hours.
+     */
+    const reportSuspendGap = async (elapsedMs) => {
+        if (elapsedMs <= 3 * options.pollIntervalMs + SUSPEND_GAP_SLACK_MS)
+            return;
+        const diagnostic = formatSuspendGapDiagnostic(elapsedMs);
+        deps.errorLog(diagnostic);
+        const appendFile = deps.appendFile;
+        if (!appendFile)
+            return;
+        try {
+            await appendToActiveJobLogs(diagnostic, { appendFile });
+        }
+        catch {
+            /* annotation is never allowed to disturb the poll loop */
+        }
+    };
     /**
      * Run the conservative worktree GC sweep ONLY while the runner owns no active
      * job worktree. Failures are logged to stderr and never abort claiming
@@ -69,7 +378,12 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
     function dispatch(job, report) {
         const promise = (async () => {
             try {
-                await runJob(job, httpClient, options, deps, report);
+                // `undefined` for the behavior seams (the job runner defaults them), then
+                // the runner-scoped control object carrying the live-worker registry. A
+                // job dispatched after shutdown was requested still runs through here so
+                // its worktree lock unwinds through the normal `finally`; the registry's
+                // sticky flag terminates whatever it manages to spawn.
+                await runJob(job, httpClient, options, deps, report, undefined, control);
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
@@ -81,58 +395,150 @@ export async function runExecutor(options, deps, httpClient, seams = {}) {
         })();
         active.set(job.id, promise);
     }
-    for (;;) {
-        const report = await collectPreflight(options, deps, preflightSeams);
-        // BAPI-727: preflight warnings were previously collected but never emitted, so
-        // a non-fatal finding — an overridden MCP-shadowing collision, an unreadable
-        // ~/.claude.json — was invisible to the operator. Emit them before the claim
-        // decision; this only logs and never changes the existing `!report.ok`
-        // claim-skipping behavior below.
-        for (const warning of report.warnings) {
-            deps.errorLog(`executor preflight warning: ${warning}`);
-        }
-        if (!report.ok) {
-            deps.errorLog(`executor preflight refused claiming: ${report.fatalFindings.join("; ")}`);
+    // Handlers go on BEFORE preflight and before the first claim (BAPI-828).
+    // Preflight can take seconds and the first claim can spawn a worker immediately
+    // after it, so registering any later would leave a real window in which a
+    // `SIGTERM` reached the executor and nothing owned the child it had just made.
+    const unsubscribers = [];
+    const onSignal = seams.onSignal;
+    if (onSignal) {
+        for (const signal of EXECUTOR_SHUTDOWN_SIGNALS) {
+            try {
+                unsubscribers.push(onSignal(signal, beginShutdown));
+            }
+            catch {
+                // A host that refuses a handler for one signal must not stop the executor
+                // from running, or from handling the other signal.
+            }
         }
-        else {
-            let claiming = true;
-            while (claiming && options.maxConcurrent - active.size > 0) {
-                const freeSlots = options.maxConcurrent - active.size;
-                const manifest = buildClaimManifest(report, options, freeSlots);
-                const result = await httpClient.claim(manifest);
-                if (result.kind === "claimed") {
-                    const currentEpicRunId = result.job.epic_run_id ?? null;
-                    if (lastClaimedEpicRunId !== null &&
-                        currentEpicRunId !== null &&
-                        currentEpicRunId !== lastClaimedEpicRunId) {
-                        deps.errorLog(`executor claimed a job for a different epic run than the previous claim ` +
-                            `(repo=${result.job.repo_name} previous_epic_run_id=${lastClaimedEpicRunId} ` +
-                            `current_epic_run_id=${currentEpicRunId} scoped=${options.epicRunIds !== undefined})`);
+    }
+    // Started after the FIRST successful preflight and joined before the runner
+    // returns. Declared here so the `finally` below can await it.
+    let processHeartbeats = null;
+    try {
+        for (;;) {
+            const report = await collectPreflight(options, deps, preflightSeams);
+            // First heartbeat goes out immediately once preflight passes, so a freshly
+            // started executor is visible to the server without waiting one interval.
+            // Gated on `report.ok` because an executor that preflight refuses is not
+            // going to do any work, and advertising it as live would be a lie.
+            if (report.ok && processHeartbeats === null && !shutdownRequested) {
+                processHeartbeats = runProcessHeartbeatLoop();
+            }
+            // BAPI-727: preflight warnings were previously collected but never emitted, so
+            // a non-fatal finding — an overridden MCP-shadowing collision, an unreadable
+            // ~/.claude.json — was invisible to the operator. Emit them before the claim
+            // decision; this only logs and never changes the existing `!report.ok`
+            // claim-skipping behavior below.
+            for (const warning of report.warnings) {
+                deps.errorLog(`executor preflight warning: ${warning}`);
+            }
+            if (!report.ok) {
+                deps.errorLog(`executor preflight refused claiming: ${report.fatalFindings.join("; ")}`);
+            }
+            else if (shutdownRequested) {
+                // Shutdown arrived during preflight. Claiming now would take on work this
+                // executor is about to stop doing, and the server would have to wait out
+                // the whole lease before anyone else could have it.
+                deps.errorLog("executor: shutdown requested; not claiming new work");
+            }
+            else {
+                let claiming = true;
+                while (claiming && !shutdownRequested && options.maxConcurrent - active.size > 0) {
+                    const freeSlots = options.maxConcurrent - active.size;
+                    const manifest = buildClaimManifest(report, options, freeSlots);
+                    const result = await httpClient.claim(manifest);
+                    // Evaluated on every SUCCESSFUL claim response — 200 and 204 alike —
+                    // ahead of the branch below. An error result carries no verdict and is
+                    // not evidence about the dispatcher, so it is deliberately not observed.
+                    if (result.kind === "claimed" || result.kind === "none") {
+                        observeDispatcherLiveness(result.reconcilerLiveness);
+                    }
+                    if (result.kind === "claimed") {
+                        const currentEpicRunId = result.job.epic_run_id ?? null;
+                        if (lastClaimedEpicRunId !== null &&
+                            currentEpicRunId !== null &&
+                            currentEpicRunId !== lastClaimedEpicRunId) {
+                            deps.errorLog(`executor claimed a job for a different epic run than the previous claim ` +
+                                `(repo=${result.job.repo_name} previous_epic_run_id=${lastClaimedEpicRunId} ` +
+                                `current_epic_run_id=${currentEpicRunId} scoped=${options.epicRunIds !== undefined})`);
+                        }
+                        if (currentEpicRunId !== null)
+                            lastClaimedEpicRunId = currentEpicRunId;
+                        // Dispatched even when the signal landed while this claim was in
+                        // flight (BAPI-828). The job is OURS the moment the server answered,
+                        // so dropping it here would strand a claimed row under a live lease
+                        // and skip the worktree-lock unwind. The registry's sticky shutdown
+                        // terminates whatever it spawns, immediately, on registration.
+                        dispatch(result.job, report);
+                    }
+                    else if (result.kind === "none") {
+                        claiming = false;
+                    }
+                    else {
+                        deps.errorLog(`executor claim ${result.kind}: ${result.error}`);
+                        claiming = false;
                     }
-                    if (currentEpicRunId !== null)
-                        lastClaimedEpicRunId = currentEpicRunId;
-                    dispatch(result.job, report);
-                }
-                else if (result.kind === "none") {
-                    claiming = false;
-                }
-                else {
-                    deps.errorLog(`executor claim ${result.kind}: ${result.error}`);
-                    claiming = false;
                 }
+                // Conservative worktree GC runs once per cycle, AFTER the claim attempt and
+                // only while idle (`active.size === 0` — no owned job worktree). This covers
+                // both the startup cycle and between-poll-cycle cadence without ever
+                // sweeping while a job is running. Kept off the pre-claim path so it never
+                // delays claiming a ready job.
+                await maybeSweepWorktrees();
+            }
+            if (options.once || shutdownRequested)
+                break;
+            // Sample the clock immediately around the ACTUAL sleep, so the measured gap
+            // is the wait itself and not the claim/GC work on either side of it.
+            const sleepStartedAt = deps.now();
+            const wake = await sleepUntilPollOrShutdown(options.pollIntervalMs);
+            if (wake === "shutdown")
+                break;
+            await reportSuspendGap(deps.now() - sleepStartedAt);
+        }
+        // Drain every dispatched job — on the `once` path and the shutdown path alike.
+        // Terminated workers still have to finish supervision, flush final telemetry,
+        // close their worker logs, deregister, and release their worktree locks;
+        // returning ahead of that is exactly what would leave a lock owned by a
+        // process that has already exited.
+        //
+        // INSIDE the try, so the handlers are still installed while it runs: a second
+        // `SIGTERM` arriving mid-drain must reach `beginShutdown` (an idempotent no-op
+        // by then) rather than Node's default terminate action, which would kill the
+        // executor in the middle of releasing its locks.
+        await Promise.all(active.values());
+    }
+    finally {
+        // Join the heartbeat loop before returning, via its OWN stop signal. A `once`
+        // run breaks out of the poll loop with `shutdownRequested` still false, and
+        // it must stay false: `beginShutdown` is idempotent on that flag, so setting
+        // it here would silently swallow a signal that arrives during this wind-down.
+        if (processHeartbeats !== null) {
+            stopProcessHeartbeats();
+            try {
+                await processHeartbeats;
+            }
+            catch {
+                /* a monitoring loop must never change the runner's outcome */
+            }
+        }
+        // Unsubscribe in a runner-level `finally`, so a direct or repeated
+        // `runExecutor` call — an embedded runner, a `--once` invocation in a loop, a
+        // test suite — cannot leave stale listeners bound to a registry that has since
+        // gone out of scope.
+        for (const unsubscribe of unsubscribers) {
+            try {
+                unsubscribe();
+            }
+            catch {
+                /* a failed unsubscribe must not mask the runner's own outcome */
             }
-            // Conservative worktree GC runs once per cycle, AFTER the claim attempt and
-            // only while idle (`active.size === 0` — no owned job worktree). This covers
-            // both the startup cycle and between-poll-cycle cadence without ever
-            // sweeping while a job is running. Kept off the pre-claim path so it never
-            // delays claiming a ready job.
-            await maybeSweepWorktrees();
         }
-        if (options.once)
-            break;
-        await deps.sleep(options.pollIntervalMs);
     }
-    // `once`: ensure every dispatched job promise settles before returning.
-    await Promise.all(active.values());
+    // A graceful signal shutdown is a NORMAL executor exit, not an error: the run did
+    // exactly what it was asked to do. A distinct nonzero code here would make every
+    // deliberate operator stop look like a crash to launchd, systemd, and the CLI
+    // boundary alike.
     return 0;
 }

package/build/executor/test-clock.js

@@ -9,6 +9,7 @@
 import { resolveAgentSpec } from "../agent-registry.js";
 import { createClaudeExecutorAdapter } from "../agent-launchers/claude-executor-adapter.js";
 import { validateExecutorAdapterCapabilities } from "../agent-launchers/executor-adapter.js";
+import { MCP_SERVER_NAME } from "../mcp-identity.js";
 export class VirtualClock {
     t = 0;
     timers = [];
@@ -70,7 +71,7 @@ async function flushMicrotasks() {
 export const DEFAULT_WORKER_INIT_EVENT_LINE = `${JSON.stringify({
     type: "system",
     subtype: "init",
-    mcp_servers: [{ name: "bridge-api", status: "connected" }],
+    mcp_servers: [{ name: MCP_SERVER_NAME, status: "connected" }],
 })}\n`;
 /** A single-chunk stdout stream carrying {@link DEFAULT_WORKER_INIT_EVENT_LINE}. */
 async function* defaultWorkerStdout() {
@@ -136,7 +137,7 @@ export function makeFakeExecutorDeps(clock, overrides = {}) {
             // registration must therefore override this read explicitly — it will not
             // get that state by accident, which is the point.
             if (typeof filePath === "string" && filePath.endsWith(".mcp.json")) {
-                return JSON.stringify({ mcpServers: { "bridge-api": { command: "node", args: [] } } });
+                return JSON.stringify({ mcpServers: { [MCP_SERVER_NAME]: { command: "node", args: [] } } });
             }
             // Mirror real fs/promises: a missing-file rejection carries code "ENOENT"
             // (so BAPI-664 command provisioning treats absent files as fillable).