@bridge_gpt/mcp-server 0.2.51 → 0.2.52

package/build/sfcc/log-query.js

@@ -110,7 +110,8 @@ function semanticCheck(args) {
     const start = Date.parse(args.time_range.start);
     const end = Date.parse(args.time_range.end);
     if (Number.isNaN(start) || Number.isNaN(end)) {
-        return "time_range.start and time_range.end must be valid ISO-8601 timestamps.";
+        return ("time_range.start and time_range.end must be ISO-8601 timestamps that " +
+            "include a seconds component and a UTC offset (e.g. 2026-07-15T00:00:00Z).");
     }
     if (!(start < end)) {
         return "time_range.start must be strictly before time_range.end.";

package/build/start-tickets-conductor.js

@@ -77,8 +77,17 @@ export function buildEpicIdentityEnv(epic) {
 // ---------------------------------------------------------------------------
 /** Default gate name when no `BAPI_CONDUCTOR_GATE_NAME` override is present. */
 export const DEFAULT_CONDUCTOR_GATE_NAME = "implement-ticket";
-/** Resolve a packaged build artifact path relative to this compiled module. */
-function defaultResolveBinPath(filename) {
+/**
+ * Resolve a packaged build artifact path relative to this compiled module.
+ *
+ * Exported since BAPI-1020 so the executor resolves the worker-guard bin through
+ * the SAME resolver rather than growing a second one. Correct in both build
+ * shapes because this module compiles to the build ROOT: the esbuild bundle puts
+ * `import.meta.url` at `build/index.js` / `build/conductor-bin.js`, and `tsc` puts
+ * it at `build/start-tickets-conductor.js`. A resolver living in a subdirectory
+ * module would resolve to `build/<subdir>/<filename>` under `tsc` and be wrong.
+ */
+export function defaultResolveBinPath(filename) {
     return fileURLToPath(new URL(`./${filename}`, import.meta.url));
 }
 function nonEmpty(value) {

package/build/start-tickets.js

@@ -54,7 +54,7 @@
  * unit-testable on Linux CI without spawning real commands or terminals.
  */
 import { execFile } from "child_process";
-import { readFile, writeFile, mkdir, mkdtemp, stat, readdir, rm } from "fs/promises";
+import { readFile, writeFile, mkdir, mkdtemp, stat, lstat, symlink, unlink, copyFile, readdir, rm, } from "fs/promises";
 import os from "node:os";
 import path from "path";
 import { VERSION } from "./version.generated.js";
@@ -965,6 +965,10 @@ export async function runWithConcurrency(items, limit, worker) {
 // imports of these names from `./start-tickets.js` keep resolving to the exact
 // same function references.
 import { resolveBranchForTicket, branchExists, buildWtSwitchArgs, pathApiForPlatform, extractWorktreePath, isExistingBranchSafeToReuse, createWorktreeForTicket, } from "./worktree-core.js";
+// BAPI-1019: interactive worktrees get the operator's `.env`/`.env.test` back as
+// SYMLINKS after `.config/wt.toml` stopped copying them. Imported HERE, in the
+// interactive orchestration module, and deliberately nowhere under `executor/`.
+import { linkOperatorEnvFiles } from "./env-file-link.js";
 export { resolveBranchForTicket, branchExists, buildWtSwitchArgs, pathApiForPlatform, extractWorktreePath, isExistingBranchSafeToReuse, createWorktreeForTicket, };
 /**
  * BAPI-941: emit the per-spawn `claude-review` workflow-drift advisory.
@@ -1033,7 +1037,70 @@ export async function createWorktrees(deps, options, worktrunkBinary, baseStartP
     const behavior = exactBase
         ? { alignExistingBranchTo: baseStartPoint, verifyHeadMatches: baseStartPoint }
         : {};
-    return runWithConcurrency(options.keys, options.maxParallel, (key) => createWorktreeForTicket(deps, key, options.branchOverrides, worktrunkBinary, baseStartPoint, options.guardStaleWorktree === true, behavior));
+    const link = deps.linkOperatorEnvFiles ?? linkOperatorEnvFiles;
+    const linkDeps = buildEnvFileLinkDeps(deps);
+    return runWithConcurrency(options.keys, options.maxParallel, async (key) => {
+        const row = await createWorktreeForTicket(deps, key, options.branchOverrides, worktrunkBinary, baseStartPoint, options.guardStaleWorktree === true, behavior);
+        // BAPI-1019 — re-provide the operator's env files by LINK, and only here.
+        //
+        // `.config/wt.toml` no longer copies `.env*` into any worktree, which is what
+        // keeps a conductor worker from ever holding a real database target. An
+        // interactive worktree still needs that configuration, so it gets a symlink to
+        // the main checkout's file instead of a second copy at rest.
+        //
+        // `deps.cwd` is the canonical main checkout — the same value every other
+        // Worktrunk/git call in this module resolves against — rather than a path
+        // inferred from the new worktree, which would be a guess.
+        //
+        // Deliberately NOT in `worktree-core.ts` or command provisioning: the executor
+        // shares those seams, and an executor worktree must receive neither a copy nor
+        // a link. Keeping the call in this interactive orchestration function is what
+        // makes that separation structural instead of a comment.
+        if (row.status !== "created" || typeof row.path !== "string" || row.path.length === 0) {
+            return row;
+        }
+        try {
+            const linked = await link(deps.cwd, row.path, linkDeps);
+            return linked.warnings.reduce((acc, warning) => appendSummaryRowWarning(acc, warning.message), row);
+        }
+        catch {
+            // The linker already bounds its own failures; this catch covers a seam that
+            // throws anyway (an injected fake, a future refactor). The worktree itself
+            // was created successfully, so the row stays `created` and carries a fixed
+            // warning — never the exception text, which can embed an absolute path.
+            return appendSummaryRowWarning(row, "worktree environment files: could not be provided from the main checkout, so this " +
+                "worktree has none. Commands that need them will fail until they are linked by hand.");
+        }
+    });
+}
+/**
+ * Build the interactive env-file linker's filesystem bag from this module's real
+ * `fs/promises` boundary (BAPI-1019), mirroring
+ * {@link buildCommandProvisioningDeps}.
+ *
+ * `stat`/`lstat` are adapted to resolve `null` for a missing path rather than
+ * rejecting, because "absent" is the ordinary case the linker branches on — most
+ * checkouts have `.env` and no `.env.test`. There is no `readFile` here and there
+ * must never be one: the linker's contract is that an environment file's contents
+ * are never read.
+ */
+export function buildEnvFileLinkDeps(deps) {
+    const metadata = (probe) => async (target) => {
+        try {
+            return await probe(target);
+        }
+        catch {
+            return null;
+        }
+    };
+    return {
+        stat: metadata((target) => stat(target)),
+        lstat: metadata((target) => lstat(target)),
+        symlink: (target, linkPath) => symlink(target, linkPath),
+        unlink: (target) => unlink(target),
+        copyFile: (source, destination) => copyFile(source, destination),
+        platform: deps.platform,
+    };
 }
 /**
  * Resume-mode worktree resolution (BAPI-441). Instead of creating worktrees,

package/build/version.generated.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.51";
-export const BUILD_COMMIT = "3cdbee6cfd9b";
-export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.51", "serve"];
+export const VERSION = "0.2.52";
+export const BUILD_COMMIT = "82534a279ae4";
+export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.52", "serve"];

package/build/worker-containment-diagnostic.js

@@ -0,0 +1,97 @@
+/**
+ * The `doctor` "Worker containment" advisory section (BAPI-1019, A.7).
+ *
+ * Reports the DECLARED containment posture a conductor worker runs under: that
+ * the executor strips operator environment files from a worker's worktree before
+ * it spawns, that a worker's database environment names a target that does not
+ * exist, and which permission posture the run policy defaults to.
+ *
+ * ZERO PROBES, and that is a hard constraint rather than an efficiency choice.
+ * `doctor` pins that an unsupported platform issues zero command probes (see the
+ * note on `collectLocalCliOverrideDiagnostic` in `doctor.ts`), and a section that
+ * probed unconditionally would break that guarantee for every platform. So this
+ * module runs no command, opens no file, makes no network call, and reads no
+ * environment variable. It has no dependency bag at all — there is nothing to
+ * inject because there is nothing to do.
+ *
+ * WHAT THAT MEANS FOR THE READER, stated plainly in the rendered copy: these are
+ * DECLARED constants, not measurements. The section says what this build does,
+ * not what it just observed on this host. Rendering a static policy as though a
+ * live verification had run would be worse than printing nothing — an operator
+ * would read "Yes" as evidence about their machine. The real per-spawn proof is
+ * the executor's own fail-closed refusal (`ContractError.WorkerEnvFilePresent`),
+ * which happens at spawn time on the host that actually runs workers.
+ *
+ * It also prints no secret and no identity: no sentinel URL (it carries
+ * `postgresql://` credential syntax and would teach a reader to paste it
+ * somewhere), no path, no username, no discovered filename beyond the generic
+ * `.env*`.
+ */
+import { DEFAULT_WORKER_PERMISSION_POSTURE } from "./executor/worker-command.js";
+/**
+ * Return the declared containment posture.
+ *
+ * Takes no dependencies and performs no I/O. The two booleans are `true` because
+ * this build unconditionally does both things — they are not feature flags, and
+ * there is deliberately no configuration that can turn either off. The posture
+ * comes from the executor's own exported default so this report and the runtime
+ * cannot drift.
+ */
+export function collectWorkerContainmentDiagnostic() {
+    return {
+        envFilesStripped: true,
+        sentinelDatabaseEnv: true,
+        permissionPosture: DEFAULT_WORKER_PERMISSION_POSTURE,
+    };
+}
+/** Rendered when a value is not a usable declaration. */
+const UNAVAILABLE = "Not confirmed";
+/**
+ * Column width for the aligned label/value rows. Wide enough that the longest
+ * label (`Sentinel DB environment:`) still leaves a gap before its value.
+ */
+const LABEL_WIDTH = 26;
+function row(label, value) {
+    return `${`${label}:`.padEnd(LABEL_WIDTH)}${value}`;
+}
+function yesNo(value) {
+    if (value === true)
+        return "Yes";
+    if (value === false)
+        return "No";
+    return UNAVAILABLE;
+}
+/**
+ * Render the section (pure formatting), mirroring
+ * `formatLocalCliOverrideDiagnosticReport`.
+ *
+ * Accepts `unknown` on purpose. The caller wraps this in the advisory `try` that
+ * never changes doctor's exit code, and a formatter that threw on a malformed
+ * input would make the section's own failure mode louder than the thing it
+ * reports. A value it cannot read renders as "Not confirmed" — never as "Yes",
+ * and never as a claim that a probe ran and came back empty.
+ */
+export function formatWorkerContainmentDiagnosticReport(diagnostic) {
+    const d = diagnostic && typeof diagnostic === "object"
+        ? diagnostic
+        : {};
+    const posture = typeof d.permissionPosture === "string" ? d.permissionPosture : UNAVAILABLE;
+    return [
+        "",
+        "Worker containment (conductor executor)",
+        "",
+        row("Env files stripped", yesNo(d.envFilesStripped)),
+        row("Sentinel DB environment", yesNo(d.sentinelDatabaseEnv)),
+        row("Permission posture", posture),
+        "",
+        "  A conductor worker never inherits this checkout's .env* files: the executor",
+        "  removes them from the worker's worktree as the last step before it starts,",
+        "  and refuses to start at all if it cannot confirm they are gone. The worker's",
+        "  database settings name a target that does not exist, so code that resolves a",
+        "  database from the environment reaches nothing rather than something real.",
+        "  Permission posture is the run policy's default and is informational here.",
+        "  Declared posture, not a live check: this section runs no command, reads no",
+        "  file, and makes no network call. The per-spawn proof is the executor's own",
+        "  refusal on the host that runs workers, not this line.",
+    ].join("\n");
+}

package/build/worker-guard-hook-bin.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import{readFileSync}from"node:fs";import path from"node:path";var WORKER_GUARD_REASON_PREFIX="bridge worker guard",WORKER_GUARD_MALFORMED_LINE=`${WORKER_GUARD_REASON_PREFIX}: payload could not be read; continuing fail-open`;function renderWorkerGuardReason(category,family){return`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This command family is restricted to the worker's own branch, worktree, and read-only network access. Use a different approach and continue.`}var UNSAFE_UNQUOTED=new Set(["$","`",">","<"]),SEPARATORS=new Set([";","|","&"]);function tokenizeShellCommand(command){let commands=[],argv=[],current="",hasCurrent=!1,unsafe=!1,endToken=()=>{hasCurrent&&(argv.push(current),current="",hasCurrent=!1)},endCommand=()=>{endToken(),(argv.length>0||unsafe)&&commands.push({argv,unsafe}),argv=[],unsafe=!1};for(let i=0;i<command.length;i+=1){let ch=command[i];if(ch==="\\"){let next=command[i+1];next!==void 0&&(current+=next,hasCurrent=!0,i+=1);continue}if(ch==="'"){let close=command.indexOf("'",i+1);if(close===-1){unsafe=!0,current+=command.slice(i+1),hasCurrent=!0;break}current+=command.slice(i+1,close),hasCurrent=!0,i=close;continue}if(ch==='"'){let j=i+1,body="",closed=!1;for(;j<command.length;){let c=command[j];if(c==="\\"&&j+1<command.length){body+=command[j+1],j+=2;continue}if(c==='"'){closed=!0;break}(c==="$"||c==="`")&&(unsafe=!0),body+=c,j+=1}closed||(unsafe=!0),current+=body,hasCurrent=!0,i=j;continue}if(UNSAFE_UNQUOTED.has(ch)){unsafe=!0,current+=ch,hasCurrent=!0;continue}if(SEPARATORS.has(ch)){endCommand();continue}if(ch===`
+`){endCommand();continue}if(ch===" "||ch==="	"||ch==="\r"){endToken();continue}current+=ch,hasCurrent=!0}return endCommand(),commands}var WORKER_GUARD_MAX_PAYLOAD_BYTES=1e6;function asRecord(value){return value!==null&&typeof value=="object"&&!Array.isArray(value)?value:void 0}function isInside(root,candidate){let rel=path.relative(root,candidate);return rel===""?!0:rel.startsWith("..")?!1:!path.isAbsolute(rel)}function resolveEffectiveCwd(ctx,payloadCwd){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root))return;let normalizedRoot=path.resolve(root);if(payloadCwd===void 0)return normalizedRoot;if(typeof payloadCwd!="string"||payloadCwd.length===0)return;let resolved=path.isAbsolute(payloadCwd)?path.resolve(payloadCwd):path.resolve(normalizedRoot,payloadCwd);return isInside(normalizedRoot,resolved)?resolved:void 0}function allTargetsContained(ctx,cwd,targets){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root)||cwd===void 0)return!1;let normalizedRoot=path.resolve(root);return targets.every(target=>{if(target.length===0||target==="~"||target.startsWith("~/"))return!1;let resolved=path.isAbsolute(target)?path.resolve(target):path.resolve(cwd,target);return isInside(normalizedRoot,resolved)})}function parseGitInvocation(argv,baseCwd){let cwd=baseCwd,unsafe=!1,i=1;for(;i<argv.length;){let token=argv[i];if(token==="-C"){let dir=argv[i+1];dir===void 0||cwd===void 0?(unsafe=!0,cwd=void 0):cwd=path.isAbsolute(dir)?path.resolve(dir):path.resolve(cwd,dir),i+=2;continue}if(token==="-c"||token==="--namespace"||token==="--git-dir"||token==="--work-tree"){unsafe=!0,i+=2;continue}if(token.startsWith("-")){i+=1;continue}break}return{subcommand:argv[i]??"",args:argv.slice(i+1),cwd,unsafe}}function isOwnBranchDestination(destination,workerBranch){let colon=destination.indexOf(":"),dst=colon===-1?destination:destination.slice(colon+1);if(dst.length===0)return!1;let bare=dst.startsWith("+")?dst.slice(1):dst;return bare===workerBranch||bare===`refs/heads/${workerBranch}`}function evaluateGitPush(args,ctx){let deny={kind:"deny",category:"git-push",family:"git"},positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}if(token.startsWith("-")){if(token==="--tags"||token==="--delete"||token==="-d"||token==="--mirror"||token==="--all"||token==="--follow-tags"||token.startsWith("--repo"))return deny;(token==="-o"||token==="--push-option"||token==="--receive-pack"||token==="--exec")&&(i+=1);continue}positional.push(token)}if(positional.length<=1)return{kind:"allow"};let workerBranch=ctx.workerBranch;return typeof workerBranch!="string"||workerBranch.length===0?deny:positional.slice(1).every(d=>isOwnBranchDestination(d,workerBranch))?{kind:"allow"}:deny}function evaluateGitReset(args,ctx){let deny={kind:"deny",category:"git-reset-hard",family:"git"};if(!args.includes("--hard"))return{kind:"allow"};let positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}token.startsWith("-")||positional.push(token)}if(positional.length===0)return{kind:"allow"};let workerBranch=ctx.workerBranch;if(typeof workerBranch!="string"||workerBranch.length===0)return deny;let allowed=new Set([workerBranch,`origin/${workerBranch}`,`refs/heads/${workerBranch}`,`refs/remotes/origin/${workerBranch}`]);return positional.every(ref=>allowed.has(ref))?{kind:"allow"}:deny}function evaluateGitClean(args,ctx,cwd){let deny={kind:"deny",category:"filesystem-clean",family:"git"};if(cwd===void 0||!allTargetsContained(ctx,cwd,[cwd]))return deny;let pathspecs=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){pathspecs.push(...args.slice(i+1));break}if(token==="-e"||token==="--exclude"){i+=1;continue}token.startsWith("-")||pathspecs.push(token)}return pathspecs.length===0?{kind:"allow"}:allTargetsContained(ctx,cwd,pathspecs)?{kind:"allow"}:deny}function isRecursiveForcedRemove(args){let recursive=!1,force=!1;for(let token of args){if(token==="--")break;if(token==="--recursive")recursive=!0;else if(token==="--force")force=!0;else{if(token.startsWith("--"))continue;if(token.startsWith("-")&&token.length>1)for(let flag of token.slice(1))(flag==="r"||flag==="R")&&(recursive=!0),flag==="f"&&(force=!0)}}return recursive&&force}function evaluateRemove(argv,ctx,cwd){let deny={kind:"deny",category:"filesystem-remove",family:"rm"},args=argv.slice(1);if(!isRecursiveForcedRemove(args))return{kind:"allow"};let targets=[],sawDoubleDash=!1;for(let token of args){if(!sawDoubleDash&&token==="--"){sawDoubleDash=!0;continue}!sawDoubleDash&&token.startsWith("-")&&token.length>1||targets.push(token)}return targets.length===0?deny:allTargetsContained(ctx,cwd,targets)?{kind:"allow"}:deny}function isDatabaseCommand(executable){let base=path.basename(executable);return base==="psql"||base.startsWith("pg_")}var DESTRUCTIVE_SQL=/\b(?:DROP|TRUNCATE)\b/i;function evaluateDatabase(argv){let deny={kind:"deny",category:"database-destructive",family:"psql"};return argv.slice(1).some(arg=>DESTRUCTIVE_SQL.test(arg))?deny:{kind:"allow"}}var MUTATING_METHODS=new Set(["POST","PUT","PATCH","DELETE"]);function evaluateNetwork(argv){let deny={kind:"deny",category:"network-mutating",family:"curl"},base=path.basename(argv[0]??""),args=argv.slice(1);for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="-X"||token==="--request"||token==="--method"){let value=args[i+1];if(value===void 0||MUTATING_METHODS.has(value.toUpperCase()))return deny;i+=1;continue}if(token.startsWith("-X")&&token.length>2){if(MUTATING_METHODS.has(token.slice(2).toUpperCase()))return deny;continue}if(token.startsWith("--request=")||token.startsWith("--method=")){let value=token.slice(token.indexOf("=")+1);if(MUTATING_METHODS.has(value.toUpperCase()))return deny;continue}if(token==="--data"||token.startsWith("--data=")||token.startsWith("--data-")||token==="--form"||token==="-F"||token==="--upload-file"||token==="-T"||token==="--post-data"||token.startsWith("--post-data=")||token==="--post-file"||token.startsWith("--post-file=")||token==="--body-data"||token.startsWith("--body-data=")||token==="--body-file"||token.startsWith("--body-file=")||base==="curl"&&token==="-d")return deny}return{kind:"allow"}}function classify(executable){let base=path.basename(executable);return base==="git"?"git":base==="rm"?"rm":isDatabaseCommand(base)?"database":base==="curl"||base==="wget"?"network":null}function unsafeSegmentDecision(family){switch(family){case"git":return{kind:"deny",category:"git-push",family:"git"};case"rm":return{kind:"deny",category:"filesystem-remove",family:"rm"};case"database":return{kind:"deny",category:"database-destructive",family:"psql"};case"network":return{kind:"deny",category:"network-mutating",family:"curl"}}}var TRANSPARENT_PREFIXES=new Set(["sudo","env","command","nohup","time","nice","exec"]),STDIN_ARGUMENT_PREFIXES=new Set(["xargs"]),SHELL_EXECUTABLES=new Set(["sh","bash","zsh","dash","ksh"]),EVAL_BUILTINS=new Set(["eval"]);function unwrapTransparentPrefixes(argv){let rest=argv;for(let depth=0;depth<8;depth+=1){let head=rest[0];if(head===void 0||!TRANSPARENT_PREFIXES.has(path.basename(head)))return rest;let i=1;for(;i<rest.length;){let token=rest[i];if(path.basename(head)==="env"&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)){i+=1;continue}if(token.startsWith("-")){i+=1;continue}break}rest=rest.slice(i)}return rest}function stripStdinPrefixOptions(argv){let VALUE_OPTS=new Set(["-I","-i","-L","-n","-P","-s","-d","-E","-e","-a","--replace","--max-lines","--max-args","--max-procs","--max-chars","--delimiter","--eof","--arg-file"]),i=1;for(;i<argv.length;){let token=argv[i];if(token==="--"){i+=1;break}if(!token.startsWith("-"))break;if(token.includes("=")){i+=1;continue}i+=VALUE_OPTS.has(token)?2:1}return argv.slice(i)}function evaluateSimpleCommand(segment,ctx,payloadCwd,depth=0,stdinFed=!1){let argv=unwrapTransparentPrefixes(segment.argv),executable=argv[0];if(executable===void 0)return{kind:"allow"};if(SHELL_EXECUTABLES.has(path.basename(executable))&&depth<4){let cIndex=argv.findIndex(t=>t==="-c"),inner=cIndex===-1?void 0:argv[cIndex+1];if(inner!==void 0){for(let nested of tokenizeShellCommand(inner)){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}}if(EVAL_BUILTINS.has(path.basename(executable))&&depth<4){for(let nested of tokenizeShellCommand(argv.slice(1).join(" "))){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}if(STDIN_ARGUMENT_PREFIXES.has(path.basename(executable))&&depth<4){let rest=stripStdinPrefixOptions(argv);return rest.length===0?{kind:"allow"}:evaluateSimpleCommand({argv:rest,unsafe:segment.unsafe},ctx,payloadCwd,depth+1,!0)}segment={argv,unsafe:segment.unsafe};let family=classify(executable);if(family===null)return{kind:"allow"};if(stdinFed||segment.unsafe)return unsafeSegmentDecision(family);let cwd=resolveEffectiveCwd(ctx,payloadCwd);if(family==="rm")return evaluateRemove(segment.argv,ctx,cwd);if(family==="database")return evaluateDatabase(segment.argv);if(family==="network")return evaluateNetwork(segment.argv);let git=parseGitInvocation(segment.argv,cwd);return git.subcommand==="push"?git.unsafe?{kind:"deny",category:"git-push",family:"git"}:evaluateGitPush(git.args,ctx):git.subcommand==="reset"?git.unsafe?{kind:"deny",category:"git-reset-hard",family:"git"}:evaluateGitReset(git.args,ctx):git.subcommand==="clean"?git.unsafe?{kind:"deny",category:"filesystem-clean",family:"git"}:evaluateGitClean(git.args,ctx,git.cwd):{kind:"allow"}}function evaluateWorkerGuardPayload(payload,ctx){let root=asRecord(payload);if(root===void 0)return{kind:"malformed"};let toolName=root.tool_name??root.toolName;if(typeof toolName!="string")return{kind:"malformed"};if(toolName!=="Bash")return{kind:"allow"};let input=asRecord(root.tool_input??root.toolInput);if(input===void 0)return{kind:"malformed"};let command=input.command;if(typeof command!="string")return{kind:"malformed"};let rawCwd=root.cwd??input.cwd,payloadCwd=typeof rawCwd=="string"?rawCwd:void 0;for(let segment of tokenizeShellCommand(command)){let decision=evaluateSimpleCommand(segment,ctx,payloadCwd);if(decision.kind==="deny")return decision}return{kind:"allow"}}function evaluateWorkerGuardInput(raw,ctx){if(typeof raw!="string")return{kind:"malformed"};if(raw.length>WORKER_GUARD_MAX_PAYLOAD_BYTES)return{kind:"malformed"};if(raw.trim().length===0)return{kind:"malformed"};let parsed;try{parsed=JSON.parse(raw)}catch{return{kind:"malformed"}}try{return evaluateWorkerGuardPayload(parsed,ctx)}catch{return{kind:"malformed"}}}var WORKER_GUARD_ROOT_FLAG="--worktree-root";function resolveWorkerGuardContext(env,cwd,argv=[]){let ctx={},root;for(let i=0;i<argv.length;i+=1){if(argv[i]===WORKER_GUARD_ROOT_FLAG){root=argv[i+1];break}if(argv[i].startsWith(`${WORKER_GUARD_ROOT_FLAG}=`)){root=argv[i].slice(WORKER_GUARD_ROOT_FLAG.length+1);break}}root===void 0&&typeof cwd=="string"&&(root=cwd),typeof root=="string"&&path.isAbsolute(root)&&(ctx.worktreePath=path.resolve(root));let branch=env.BAPI_WORKER_BRANCH;return typeof branch=="string"&&branch.trim().length>0&&(ctx.workerBranch=branch.trim()),ctx}function readStdinSync(){return readFileSync(0,"utf-8")}var exitCode=0;try{let raw=readStdinSync(),ctx=resolveWorkerGuardContext(process.env,process.cwd(),process.argv.slice(2)),decision=evaluateWorkerGuardInput(raw,ctx);decision.kind==="deny"?(process.stderr.write(`${renderWorkerGuardReason(decision.category,decision.family)}
+`),exitCode=2):decision.kind==="malformed"&&(process.stderr.write(`${WORKER_GUARD_MALFORMED_LINE}
+`),exitCode=0)}catch{try{process.stderr.write(`${WORKER_GUARD_MALFORMED_LINE}
+`)}catch{}exitCode=0}process.exit(exitCode);

package/docs/CONDUCTOR.md

@@ -64,6 +64,33 @@ pipeline step. `setup-epic` validates it locally (unique ticket keys, resolvable
 `depends_on`/edge references, acyclicity) before sending anything, so a malformed
 plan fails legibly instead of as a bare HTTP 400.
 
+### Branch strategy: the epic branch is the default (BAPI-1009)
+
+The command above — no branch flag — now runs a **multi-ticket** epic on a
+dedicated `epic/<KEY>` branch. Every child-ticket PR targets that branch, and one
+**draft** integration PR targets the repository base branch. This applies on every
+path, CI and `--json` included. `drive-epic` forwards both flags below to
+`setup-epic`, so the universal entry point can select either strategy.
+
+| You want | Pass |
+|---|---|
+| The epic branch on a plan with **2 or more** nodes | *nothing* — it is the default |
+| Your own branch name, or a branch for a **single-node** plan | `--feature-branch <name>` |
+| The old direct-to-base behavior | `--into-base` |
+
+> **Behavior change.** Before BAPI-1009 a run with no branch flag went straight to
+> the repository base branch. Automation that relied on that must now pass
+> `--into-base`. A single-node plan still keeps the base branch by default, matching
+> plain `start-tickets`. `--feature-branch` and `--into-base` together are a parse
+> error, refused before any file read, credential resolution, or network call.
+
+On an epic-branch run, a shadow-index verification that cannot be proven
+immediately resolves as bounded **hold-then-park** rather than blocking the run:
+independent tickets proceed, a dependent holds, and past the deadline it parks
+through the ordinary `needs_human` path. The epic run's gate snapshot carries a
+run-level `shadow_hold` object naming the reason and the recovery while that is
+live. This addresses BAPI-993 run issue A1.
+
 Since BAPI-754 it then calls the server's **real** validator
 (`POST /jira/epic-runs/plan/validate`) before creating anything, so a plan the
 server would reject — a node missing `status`, say, which the local checks do not

package/docs/install/mcp-tool-integrations.md

@@ -159,6 +159,7 @@ by tier.
 | Tool | Dependencies (class) |
 |---|---|
 | `second_opinion` | — none (pure LLM; repo access only) |
+| `clarify_task` | No Jira ticket, no repository connection required · VCS **[DEGRADE]** (a connected repository adds code-aware questions) |
 | `generate_image` | — none beyond an image provider |
 | `visual_diff` | — none (`LOCAL` render + pixel diff; needs a reachable `target_url`) |
 | `request_deep_research` / `get_deep_research` | Deep-research flag **[BLOCK]** (403 if `deep_research_enabled` off) |
@@ -301,8 +302,8 @@ wanting both selects `sfcc,sfcc-write` (or `full`).
 |---|---|---|
 | **Ticket backend** (jira mode) | `create_ticket`, `get_ticket(s)`, `update_ticket_description`, `update_jira_status`, and every AI generator (they read the ticket) | — |
 | **Jira (only)** | `get_comments`, `add_comment`, `attachment`, `estimate_epic` | — |
-| **Version control (VCS)** | `create_pull_request`, `merge_pull_request`, `resolve_ci_checks`, `poll_ci_checks`, `fresh_base`, `parse_repository`, `regenerate_directory_map`; **Tier-3** `request_plan_generation`/`get_plan`, `request_reimplement_context`/`get_reimplement_context`, `create_doc`(tdd/architecture) | **Tier-4** `request_ticket_review`, `create_doc`(prd/fsd) |
-| **Code index** (succeeded parse) | Tier-3 plan/reimplement/`create_doc`(tdd/architecture); `request_council` in `technical`/`discovery` modes | Tier-4 review/prd/fsd |
+| **Version control (VCS)** | `create_pull_request`, `merge_pull_request`, `resolve_ci_checks`, `poll_ci_checks`, `fresh_base`, `parse_repository`, `regenerate_directory_map`; **Tier-3** `request_plan_generation`/`get_plan`, `request_reimplement_context`/`get_reimplement_context`, `create_doc`(tdd/architecture) | **Tier-4** `request_ticket_review`, `create_doc`(prd/fsd), `clarify_task` |
+| **Code index** (succeeded parse) | Tier-3 plan/reimplement/`create_doc`(tdd/architecture); `request_council` in `technical`/`discovery` modes | Tier-4 review/prd/fsd, `clarify_task` |
 | **SFCC OCAPI** | `check_permissions` + every gated SFCC read and write tool | — |
 | **SFCC WebDAV logs** | `sfcc_log_query` | — |
 | **Deep-research flag** | `request_deep_research`, `get_deep_research` | — |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.51",
+  "version": "0.2.52",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -8,7 +8,8 @@
     "mcp-server": "./build/index.js",
     "bridge-api-mcp-server": "./build/index.js",
     "conductor": "./build/conductor-bin.js",
-    "conductor-claude-hook": "./build/conductor-claude-hook-bin.js"
+    "conductor-claude-hook": "./build/conductor-claude-hook-bin.js",
+    "bridge-worker-guard": "./build/worker-guard-hook-bin.js"
   },
   "files": [
     "build/",