@bridge_gpt/mcp-server 0.2.42 → 0.2.43

package/build/conduct-epic/cli.js

@@ -45,6 +45,7 @@ import { acquireConductEpicLock, inspectConductEpicLock, isConductEpicLockOwnerA
 import { discoverConductEpicPrState, discoverTicketWorktree, parseGitWorktreePorcelain, } from "./pr-state.js";
 import { spawnConductEpicAgentTab, CONDUCT_EPIC_AGENTS, } from "./spawn.js";
 import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
+import { fetchLatestVersion } from "../cli-release.js";
 import { INDEX_SCOPE_CONFIGURATION_ERROR, validateOptionalIndexScope, } from "../index-scope-contract.js";
 // BAPI-850: the exact-cut protocol, the scope-readiness poll bounds, and the
 // local-git helpers live in ONE shared module that `setup-epic` drives too. This
@@ -125,6 +126,7 @@ export function createDefaultConductEpicDeps() {
         log: (m) => console.log(m),
         errorLog: (m) => console.error(m),
         resolveAccess: resolveConductorBridgeApiAccess,
+        resolveLatestPublishedVersion: () => fetchLatestVersion({ fetch: globalThis.fetch }),
         resolveRepoName: resolveRequiredStartTicketsRepoName,
     };
 }
@@ -568,6 +570,182 @@ function elapsedSeconds(from, now) {
 function inFlightTicket(checkpoint) {
     return checkpoint.tickets.find((ticket) => ticket.status !== "done") ?? null;
 }
+// ---------------------------------------------------------------------------
+// The published-build identity (BAPI-873)
+// ---------------------------------------------------------------------------
+/**
+ * Hard bound on launching the published package to read its identity. `npx` may
+ * have to download a tarball on a cold cache, so this is generous relative to
+ * the registry lookup — but it is a bound, because a wedged launch must never
+ * stall `init` indefinitely.
+ */
+export const PUBLISHED_IDENTITY_TIMEOUT_MS = 120_000;
+/** The identity shape `--version` emits: 12 lowercase hex, optionally `-dirty`. */
+const PUBLISHED_IDENTITY_PATTERN = /^commit: ([0-9a-f]{12})(-dirty)?$/;
+/** The sentinel a build with no git metadata reports. */
+const PUBLISHED_IDENTITY_UNKNOWN = "unknown";
+/** Human wording for each unavailable category, for the fail-open advisory. */
+export function describePublishedIdentityReason(reason) {
+    switch (reason) {
+        case "registry_unreadable":
+            return "the npm registry could not be read";
+        case "launch_failed":
+            return "the published package could not be launched";
+        case "unreadable_output":
+            return "the published package reported no readable build identity";
+        case "identity_unknown":
+            return "the published build reports an unknown build commit";
+    }
+}
+/**
+ * Read the commit identity embedded in the LATEST PUBLISHED package.
+ *
+ * Two bounded steps: resolve the exact latest version through the shared
+ * registry lookup, then run THAT EXACT VERSION with `--version`. The exactness
+ * matters — invoking a moving `@latest` would read whatever the registry served
+ * at that instant, so the version reported and the version inspected could
+ * differ, and the gate would be comparing an identity to the wrong build.
+ *
+ * Every failure is `unavailable`, never a mismatch: not knowing what was
+ * published is a different fact from knowing it is wrong, and only the second
+ * may block a run.
+ */
+export async function readPublishedBuildIdentity(deps) {
+    const resolveVersion = deps.resolveLatestPublishedVersion ?? (() => fetchLatestVersion({ fetch: deps.fetchImpl }));
+    let version;
+    try {
+        version = await resolveVersion();
+    }
+    catch {
+        return { kind: "unavailable", reason: "registry_unreadable" };
+    }
+    if (typeof version !== "string" || version.trim().length === 0) {
+        return { kind: "unavailable", reason: "registry_unreadable" };
+    }
+    const resolvedVersion = version.trim();
+    let probe;
+    try {
+        probe = await deps.runCommand("npx", ["-y", `${MCP_PACKAGE_NAME}@${resolvedVersion}`, "--version"], { cwd: deps.cwd, timeoutMs: PUBLISHED_IDENTITY_TIMEOUT_MS });
+    }
+    catch {
+        return { kind: "unavailable", reason: "launch_failed" };
+    }
+    if (!probe || probe.exitCode !== 0) {
+        return { kind: "unavailable", reason: "launch_failed" };
+    }
+    const lines = String(probe.stdout ?? "")
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    // The first line is the semver contract `--version` has always emitted. It
+    // must be the version we asked for, or the output does not describe the build
+    // this reader resolved.
+    if (lines[0] !== resolvedVersion) {
+        return { kind: "unavailable", reason: "unreadable_output" };
+    }
+    const commitLine = lines.slice(1).find((line) => line.startsWith("commit:"));
+    if (commitLine === undefined) {
+        return { kind: "unavailable", reason: "unreadable_output" };
+    }
+    if (commitLine === `commit: ${PUBLISHED_IDENTITY_UNKNOWN}`) {
+        return { kind: "unavailable", reason: "identity_unknown" };
+    }
+    const match = PUBLISHED_IDENTITY_PATTERN.exec(commitLine);
+    if (match === null) {
+        return { kind: "unavailable", reason: "unreadable_output" };
+    }
+    return { kind: "known", version: resolvedVersion, commit: match[1], dirty: match[2] !== undefined };
+}
+/**
+ * Decide whether the PUBLISHED build carries the code this epic will be cut at.
+ *
+ * The gate is expressed as CONTAINMENT, not as a version floor and not as an
+ * exact-commit match. "The published build is at least as new as the commit we
+ * are conducting" is the property that actually matters, and it is the property
+ * a version number could never express: the same semver spanned three different
+ * contents, which is why the old floor was unverifiable.
+ *
+ * Blocking and fail-open are separated deliberately. Knowing the published build
+ * is wrong blocks. NOT knowing what was published — a registry outage, a cold
+ * npx launch that failed, a build with no git metadata — is an advisory, because
+ * a network problem must never stop a run.
+ */
+export async function evaluatePublishGate(deps, expectedCommitSha) {
+    if (expectedCommitSha === null) {
+        // The canonical-index check already recorded its own failure; adding a
+        // second one for the same root cause only pads the report.
+        return {
+            failures: [],
+            advisories: [
+                "advisory: the publish gate was not evaluated because no canonical indexed commit is available to check against.",
+            ],
+        };
+    }
+    const expected = normalizeCommitSha(expectedCommitSha);
+    if (expected === null) {
+        return {
+            failures: [
+                "The publish gate cannot be evaluated: the expected commit is not a full 40-character SHA. " +
+                    "Refusing rather than comparing an arbitrary prefix.",
+            ],
+            advisories: [],
+        };
+    }
+    const identity = await readPublishedBuildIdentity(deps);
+    if (identity.kind === "unavailable") {
+        return {
+            failures: [],
+            advisories: [
+                `advisory: the publish gate could not be verified — ${describePublishedIdentityReason(identity.reason)}. ` +
+                    `Initialization is continuing; the published ${MCP_PACKAGE_NAME} build was NOT confirmed to contain ${expected}.`,
+            ],
+        };
+    }
+    if (identity.dirty) {
+        return {
+            failures: [
+                `The published ${MCP_PACKAGE_NAME}@${identity.version} reports build commit ${identity.commit}-dirty. ` +
+                    "A dirty build carries content that no commit represents, so it cannot be verified to contain " +
+                    `${expected}. Publish a build from a clean checkout.`,
+            ],
+            advisories: [],
+        };
+    }
+    // The published SHA must be an object THIS checkout knows about before any
+    // ancestry claim is possible. It is a short SHA, so it cannot be fetched by
+    // name — an unresolvable one is "cannot verify", never "wrong".
+    const present = await git(deps, ["rev-parse", "--verify", "--quiet", `${identity.commit}^{commit}`]);
+    if (present.exitCode !== 0) {
+        return {
+            failures: [],
+            advisories: [
+                `advisory: the published ${MCP_PACKAGE_NAME}@${identity.version} build commit ${identity.commit} ` +
+                    "is not present in this checkout, so the publish gate could not be verified. " +
+                    `Initialization is continuing; fetch origin and confirm that build contains ${expected}.`,
+            ],
+        };
+    }
+    const contains = await git(deps, ["merge-base", "--is-ancestor", expected, identity.commit]);
+    if (contains.exitCode === 0)
+        return { failures: [], advisories: [] };
+    if (contains.exitCode === 1) {
+        return {
+            failures: [
+                `The published ${MCP_PACKAGE_NAME}@${identity.version} was built from ${identity.commit}, ` +
+                    `which does not contain ${expected} — the canonical indexed commit this epic is cut at. ` +
+                    "Publish a build containing that commit before initializing.",
+            ],
+            advisories: [],
+        };
+    }
+    return {
+        failures: [],
+        advisories: [
+            `advisory: the publish gate could not be verified — the ancestry of published build commit ` +
+                `${identity.commit} could not be determined locally. Initialization is continuing.`,
+        ],
+    };
+}
 /**
  * Run every independent `init` check and ACCUMULATE the failures.
  *
@@ -588,6 +766,7 @@ function inFlightTicket(checkpoint) {
 export async function collectConductEpicInitPreflight(deps, options) {
     const failures = [];
     const announcements = [];
+    const advisories = [];
     const epicBranch = epicBranchFor(options.epicKey);
     let pendingSupervisorConfig = null;
     // (1) gh authentication.
@@ -760,6 +939,16 @@ export async function collectConductEpicInitPreflight(deps, options) {
                 }
             }
         }
+        // (13) BAPI-873: the publish gate. Evaluated HERE — after the cut commit is
+        // known and proven present locally, and still before anything mutates —
+        // because the gate's question is whether the PUBLISHED package (the one
+        // `start-tickets` spawns for every worker) already carries the code this
+        // epic is cut at. A readable mismatch joins `failures` so it is reported
+        // alongside every other readiness problem; an unreadable published identity
+        // becomes an advisory and the run continues.
+        const publishGate = await evaluatePublishGate(deps, cutCommitSha);
+        failures.push(...publishGate.failures);
+        advisories.push(...publishGate.advisories);
         // (9) `epic/<EPIC>` must be absent on origin, or already at exactly the
         // canonical indexed commit. An epic branch sitting at ANY other commit still
         // fails closed — including the base tip, which is no longer special.
@@ -797,6 +986,7 @@ export async function collectConductEpicInitPreflight(deps, options) {
     return {
         failures,
         announcements,
+        advisories,
         access,
         baseBranch,
         baseSha,
@@ -925,6 +1115,11 @@ export async function runConductEpicInit(deps, options) {
         ], { epic_key: options.epicKey, checkpoint_path: checkpointPath });
     }
     const preflight = await collectConductEpicInitPreflight(deps, options);
+    // BAPI-873: fail-open advisories are reported before the outcome is decided,
+    // on stderr, on both paths — an advisory that only printed on failure would
+    // let a run proceed silently past an unverified publish gate.
+    for (const line of preflight.advisories)
+        deps.errorLog(line);
     if (preflight.failures.length > 0) {
         for (const line of preflight.announcements)
             deps.errorLog(line);

package/build/conductor/bridge-api-client.js

@@ -214,6 +214,20 @@ export function extractSanitizedErrorDiagnostics(body) {
         diagnostics.errorCode = boundedErrorPreview(errorCode);
     if (message)
         diagnostics.bodyPreview = boundedErrorPreview(message);
+    // BAPI-872: extract the allowlisted stale-CAS `current_row_version`, from
+    // either the nested `detail` object or (defensively) the top level. Only a
+    // genuine non-negative safe integer is accepted — never a boolean (JS has no
+    // strict-int check, so `Number.isSafeInteger` alone would still accept `1`
+    // but not `true`), never a string, never negative — so a malformed value can
+    // never be mistaken for a usable CAS conflict downstream.
+    const rawCurrentRowVersion = detail && typeof detail === "object" && !Array.isArray(detail)
+        ? detail["current_row_version"]
+        : record["current_row_version"];
+    if (typeof rawCurrentRowVersion === "number" &&
+        Number.isSafeInteger(rawCurrentRowVersion) &&
+        rawCurrentRowVersion >= 0) {
+        diagnostics.currentRowVersion = rawCurrentRowVersion;
+    }
     return diagnostics;
 }
 /** Redact exact secret substrings (e.g. the API key from the request headers). */
@@ -231,6 +245,10 @@ function redactDiagnosticValues(diagnostics, secrets) {
         out.errorCode = scrub(diagnostics.errorCode);
     if (diagnostics.bodyPreview)
         out.bodyPreview = scrub(diagnostics.bodyPreview);
+    // A number has nothing to scrub; carried through unchanged (BAPI-872).
+    if (typeof diagnostics.currentRowVersion === "number") {
+        out.currentRowVersion = diagnostics.currentRowVersion;
+    }
     return out;
 }
 /**
@@ -267,6 +285,13 @@ export class ConductorBridgeApiError extends Error {
     status;
     errorCode;
     bodyPreview;
+    /**
+     * The stale-CAS `current_row_version` (BAPI-872), when the backend supplied
+     * one. Deliberately NOT interpolated into `.message` (unlike `bodyPreview`) —
+     * every recovery CLI surface must never print a row-version value, and callers
+     * that need it read this field directly.
+     */
+    currentRowVersion;
     constructor(kindOrMessage, status, diagnostics) {
         const isKnownKind = CONDUCTOR_BRIDGE_API_ERROR_KINDS.includes(kindOrMessage);
         const errorCode = diagnostics?.errorCode;
@@ -293,6 +318,9 @@ export class ConductorBridgeApiError extends Error {
             this.errorCode = errorCode;
         if (bodyPreview)
             this.bodyPreview = bodyPreview;
+        if (typeof diagnostics?.currentRowVersion === "number") {
+            this.currentRowVersion = diagnostics.currentRowVersion;
+        }
     }
 }
 /**
@@ -873,6 +901,27 @@ export async function updateEpicRunStatus(access, request, fetchImpl = globalThi
     const parsed = await fetchConductorJsonPatchWithTimeout(url, conductorPostHeaders(access), body, CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
     return parsed;
 }
+/**
+ * POST `/jira/epic-runs/runs/{epic_run_id}/stop` — the operator emergency brake
+ * (BAPI-732, wired to the conductor CLI in BAPI-872). Idempotent: a repeated stop
+ * returns HTTP 200 with `committed: false`; a terminal run (`done`/`abandoned`)
+ * returns a `409 RUN_TERMINAL` conflict, which surfaces as a thrown
+ * {@link ConductorBridgeApiError} with `status: 409` and `errorCode: "RUN_TERMINAL"`.
+ * Transport/auth/server failures throw a sanitized {@link ConductorBridgeApiError}.
+ */
+export async function stopEpicRun(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    const url = buildConductorJiraUrl(access.baseUrl, `${epicRunApiPath(request.epicRunId)}/stop`);
+    const body = JSON.stringify({
+        repo_name: access.repoName,
+        ...(request.reason !== undefined ? { reason: request.reason } : {}),
+        ...(request.expectedGeneration !== undefined
+            ? { expected_generation: request.expectedGeneration }
+            : {}),
+    });
+    const parsed = await fetchConductorJsonPostWithTimeout(url, conductorPostHeaders(access), body, CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+    return parsed;
+}
 // ---------------------------------------------------------------------------
 // Per-ticket CAS status advancement
 // ---------------------------------------------------------------------------
@@ -937,6 +986,78 @@ export async function advanceEpicTicketStatus(access, request, fetchImpl = globa
     const parsed = await fetchConductorJsonPatchWithTimeout(url, conductorPostHeaders(access), body, CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
     return parseAdvanceEpicTicketStatusResult(parsed);
 }
+// ---------------------------------------------------------------------------
+// Operator recovery: ticket unpark + adopt-current-head-and-unpark (BAPI-872)
+// ---------------------------------------------------------------------------
+/**
+ * Catch a stale-CAS 400 thrown by the POST transport and translate it into the
+ * SAME `{ok: false, kind: "cas-conflict", current_row_version}` result
+ * {@link parseAdvanceEpicTicketStatusResult} already produces for the PATCH CAS
+ * endpoint — the previously dormant conflict branch that now becomes production
+ * behavior for both unpark lanes. Only a genuine stale-CAS shape (400 status with
+ * a validated `currentRowVersion`) is translated; every other failure re-throws
+ * unchanged, preserving `ConductorBridgeApiError` for terminal, validation,
+ * authorization, and transport failures.
+ */
+async function postUnparkLikeRequest(url, headers, body, fetchImpl) {
+    try {
+        const parsed = await fetchConductorJsonPostWithTimeout(url, headers, body, CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+        return parseAdvanceEpicTicketStatusResult(parsed);
+    }
+    catch (err) {
+        if (err instanceof ConductorBridgeApiError &&
+            err.status === 400 &&
+            typeof err.currentRowVersion === "number") {
+            return parseAdvanceEpicTicketStatusResult({
+                ok: false,
+                kind: "cas-conflict",
+                current_row_version: err.currentRowVersion,
+            });
+        }
+        throw err;
+    }
+}
+/**
+ * POST `/jira/epic-runs/runs/{epic_run_id}/tickets/{ticket_key}/unpark` — move a
+ * parked `needs_human` ticket back into its gate machine (BAPI-536, wired to the
+ * conductor CLI in BAPI-872). A stale `expectedRowVersion` surfaces as the
+ * discriminated `{ok: false, kind: "cas-conflict", current_row_version}` result
+ * rather than a thrown error, so a bounded caller-side retry can re-read state and
+ * try again without special-casing an exception.
+ */
+export async function unparkEpicTicket(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    requireNonEmptyString(request.ticketKey);
+    requireNonNegativeSafeInteger(request.expectedRowVersion);
+    const url = buildConductorJiraUrl(access.baseUrl, `${epicRunApiPath(request.epicRunId)}/tickets/${encodeURIComponent(request.ticketKey)}/unpark`);
+    const body = JSON.stringify({
+        repo_name: access.repoName,
+        expected_row_version: request.expectedRowVersion,
+        ...(request.idempotencyKey !== undefined ? { idempotency_key: request.idempotencyKey } : {}),
+        ...(request.reason !== undefined ? { reason: request.reason } : {}),
+    });
+    return postUnparkLikeRequest(url, conductorPostHeaders(access), body, fetchImpl);
+}
+/**
+ * POST `/jira/epic-runs/runs/{epic_run_id}/tickets/{ticket_key}/adopt-current-head-and-unpark`
+ * — the recovery lane for a human/external push that drifted the PR head off the
+ * ticket's anchored `expected_head_sha` (BAPI-571 B3, wired to the conductor CLI
+ * in BAPI-872). Same CAS-conflict/result shape as {@link unparkEpicTicket}; shares
+ * {@link parseAdvanceEpicTicketStatusResult} rather than a second parser.
+ */
+export async function adoptCurrentHeadAndUnparkTicket(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    requireNonEmptyString(request.ticketKey);
+    requireNonNegativeSafeInteger(request.expectedRowVersion);
+    const url = buildConductorJiraUrl(access.baseUrl, `${epicRunApiPath(request.epicRunId)}/tickets/${encodeURIComponent(request.ticketKey)}/adopt-current-head-and-unpark`);
+    const body = JSON.stringify({
+        repo_name: access.repoName,
+        expected_row_version: request.expectedRowVersion,
+        ...(request.idempotencyKey !== undefined ? { idempotency_key: request.idempotencyKey } : {}),
+        ...(request.reason !== undefined ? { reason: request.reason } : {}),
+    });
+    return postUnparkLikeRequest(url, conductorPostHeaders(access), body, fetchImpl);
+}
 /**
  * Idempotently seed an epic ticket status row via POST to the per-epic tickets
  * endpoint. The backend uses ON CONFLICT DO NOTHING so repeated seeding across

package/build/conductor/cli.js

@@ -65,6 +65,15 @@ export function getConductorUsage() {
         "                       Run the reference-transaction producer (invoked by the hook)",
         "  file-scope-guard     Warn-only: compare the branch diff against the declared",
         "                       touched-file set (always exits 0; never blocks a PR)",
+        "  stop-run             Stop an epic run: block dispatch and cancel queued work",
+        "                       (the run record is preserved). Idempotent.",
+        "  abandon-run          Abandon an epic run — TERMINAL and IRREVERSIBLE.",
+        "                       Idempotent on an already-abandoned run.",
+        "  unpark               Move a parked (needs_human) ticket back into its gate",
+        "                       machine. Retries internally on a concurrent change.",
+        "  adopt-current-head-and-unpark",
+        "                       Recover a ticket parked by a PR-head drift: adopt the",
+        "                       CURRENT PR head and unpark in one step.",
         "",
         "supervise options:",
         "  --run-id <id>             Run/session identifier to supervise (required)",
@@ -157,6 +166,37 @@ export function getConductorUsage() {
         "  conductor approve-plan EPIC-405 --plan-version 2 --json",
         "  conductor epic-status --epic-key EPIC-405",
         "  conductor epic-status --epic-key EPIC-405 --json",
+        "",
+        "stop-run / abandon-run options:",
+        "  --epic-run-id <id>        Epic run identifier (required)",
+        "  --json                    Print compact JSON result",
+        "  --help                    Print this usage message",
+        "  stop-run BLOCKS new dispatch and CANCELS queued work; the run record is",
+        "  preserved and the run cannot resume on its own — it is an emergency brake,",
+        "  not a pause. abandon-run is the SAME plus a TERMINAL, IRREVERSIBLE close-out:",
+        "  once abandoned, the run can never resume or be reused. Both are idempotent —",
+        "  repeating either is a safe no-op once the run is already stopped/abandoned.",
+        "",
+        "unpark / adopt-current-head-and-unpark options:",
+        "  --epic-run-id <id>        Epic run identifier (required)",
+        "  --ticket-key <key>        Ticket key (required)",
+        "  --json                    Print compact JSON result",
+        "  --help                    Print this usage message",
+        "  unpark resumes a ticket PARKED with needs_human, once the underlying cause",
+        "  is resolved. adopt-current-head-and-unpark additionally REBINDS the ticket's",
+        "  anchored PR head to whatever the PR's head currently is, for a ticket parked",
+        "  by a human/external push. Both retry internally on a concurrent row change —",
+        "  neither accepts, nor ever asks for, a version counter.",
+        "",
+        "Incident examples:",
+        "  # A run is misbehaving and must stop immediately:",
+        "  conductor stop-run --epic-run-id 3f9c2b7e-...",
+        "  # The run is done for good — close it out:",
+        "  conductor abandon-run --epic-run-id 3f9c2b7e-...",
+        "  # A ticket parked itself (needs_human) and the cause is now fixed:",
+        "  conductor unpark --epic-run-id 3f9c2b7e-... --ticket-key BAPI-852",
+        "  # A human pushed directly to the PR and the ticket parked on head drift:",
+        "  conductor adopt-current-head-and-unpark --epic-run-id 3f9c2b7e-... --ticket-key BAPI-852",
     ].join("\n");
 }
 /**
@@ -180,6 +220,11 @@ const VALID_COMMANDS = new Set([
     "install-git-hooks",
     "git-hook",
     "file-scope-guard",
+    // BAPI-872: CLI-only operator recovery verbs — never registered as MCP tools.
+    "stop-run",
+    "abandon-run",
+    "unpark",
+    "adopt-current-head-and-unpark",
     // Private, and deliberately ABSENT from the usage text: `__hook-bin` exists as
     // the bundled-artifact regression guard for BAPI-772 (mirroring `plane
     // __entrypoint`), not as a supported operator workflow.
@@ -1152,6 +1197,24 @@ export async function runConductorCli(argv) {
             case "file-scope-guard":
                 // BAPI-507 (N-2): warn-only worker file-scope guard. Always exits 0.
                 return runFileScopeGuardCli();
+            case "stop-run": {
+                // BAPI-872: lazily imported so the Bridge credential/HTTP graph never
+                // loads for a local-only command (doctor, emit-event, etc.).
+                const { runStopRunCommand } = await import("./recovery-cli.js");
+                return await runStopRunCommand(parsed.argv);
+            }
+            case "abandon-run": {
+                const { runAbandonRunCommand } = await import("./recovery-cli.js");
+                return await runAbandonRunCommand(parsed.argv);
+            }
+            case "unpark": {
+                const { runUnparkCommand } = await import("./recovery-cli.js");
+                return await runUnparkCommand(parsed.argv);
+            }
+            case "adopt-current-head-and-unpark": {
+                const { runAdoptCurrentHeadAndUnparkCommand } = await import("./recovery-cli.js");
+                return await runAdoptCurrentHeadAndUnparkCommand(parsed.argv);
+            }
             default:
                 console.error('Error: Unknown command. Run "conductor --help" for usage.');
                 return 1;