@bridge_gpt/mcp-server 0.2.54 → 0.2.56

package/build/review-tickets.js

@@ -18,11 +18,21 @@
  * This path is worktree-free and base-branch-free; the human CLI path leaves
  * `epic` unset and retains byte-for-byte identical behavior.
  */
-import { createDefaultStartTicketsDeps, detectTerminal, runWithConcurrency, buildAgentInvocation, shSquoteInner, powershellSquote, isCommandOnPath, resolveFirstCommandOnPath, tmuxSessionNameForTicket, TICKET_KEY_PATTERN, DEFAULT_MAX_PARALLEL, validateBranchName, fetchAndResolveBaseSha, fetchStartTicketsConfigField, resolveStartTicketsBridgeApiAccess, } from "./start-tickets.js";
+import { createDefaultStartTicketsDeps, detectTerminal, runWithConcurrency, buildAgentInvocation, shSquoteInner, powershellSquote, isCommandOnPath, resolveFirstCommandOnPath, tmuxSessionNameForTicket, TICKET_KEY_PATTERN, DEFAULT_MAX_PARALLEL, validateBranchName, fetchAndResolveBaseSha, fetchStartTicketsConfigField, resolveStartTicketsBridgeApiAccess, buildCommandProvisioningDeps, buildMcpProvisioningDeps, } from "./start-tickets.js";
+import { provisionCommandsForWorktree } from "./command-provisioning.js";
+import { resolveCodexLaunchScope } from "./codex-launch-scope.js";
 import { WINDOWS_TERMINAL_COMMAND, WINDOWS_POWERSHELL_CANDIDATES, TMUX_COMMAND, isSupportedStartTicketsPlatform, unsupportedPlatformMessage, } from "./start-tickets-prereqs.js";
-import { DEFAULT_AGENT_NAME, resolveAgentSpec, isAgentName, formatValidAgentNames, isValidModelAlias, } from "./agent-registry.js";
+import { DEFAULT_AGENT_NAME, resolveAgentSpec, isAgentName, isValidModelAlias, } from "./agent-registry.js";
 import { injectConductorEnvIntoShellCommand, buildEpicIdentityEnv, mintStartTicketsRunId, } from "./start-tickets-conductor.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
+/** Every registered agent with a review workflow the launcher can provision. */
+const REVIEW_TICKETS_AGENT_NAMES = ["claude", "cursor-agent", "codex"];
+function isReviewTicketsAgentName(value) {
+    return REVIEW_TICKETS_AGENT_NAMES.includes(value);
+}
+function formatReviewTicketsAgentNames() {
+    return REVIEW_TICKETS_AGENT_NAMES.join(", ");
+}
 /** Default base context: no flags threaded through (matches pre-BAPI-474 behavior). */
 const NO_BASE_CONTEXT = { noRefreshBase: false };
 // ---------------------------------------------------------------------------
@@ -37,7 +47,7 @@ export function getReviewTicketsUsage() {
         "  --auto                            Auto-approve all review gates (global, applies to all tickets)",
         "  --rounds=1|2                      Review depth: 1=single-pass, 2=full two-pass (default: adaptive — backend routes by difficulty)",
         "  --review KEY=auto,rounds=1        Per-ticket review mode override (repeatable)",
-        "  --agent claude|cursor-agent       Agent command to launch in each tab (default: claude)",
+        "  --agent claude|cursor-agent|codex Agent command to launch in each tab (default: claude)",
         "  --model VALUE                     Model alias to pass as --model to the agent (optional passthrough)",
         "  --max-parallel N                  Max tabs to spawn concurrently (default: 3)",
         "  --dry-run                         Print intended commands; creates no tabs and opens no sessions",
@@ -289,10 +299,10 @@ export function parseReviewTicketsArgs(argv) {
                     return { status: "error", message: "--agent requires a value (an agent name)." };
                 }
             }
-            if (!isAgentName(value)) {
+            if (!isAgentName(value) || !isReviewTicketsAgentName(value)) {
                 return {
                     status: "error",
-                    message: `Invalid --agent value: '${value}' (allowed agents: ${formatValidAgentNames()}).`,
+                    message: `Invalid --agent value: '${value}' (allowed agents: ${formatReviewTicketsAgentNames()}).`,
                 };
             }
             agentName = value;
@@ -416,7 +426,7 @@ export function resolveEffectiveReviewMode(key, options) {
 // hard-wired to `/implement-ticket`. Review-aware builders are used instead so
 // the prompt uses `/review-ticket` and no directory change is prepended.
 // ---------------------------------------------------------------------------
-export function buildReviewTicketPrompt(key, mode, base = NO_BASE_CONTEXT) {
+export function buildReviewTicketPrompt(key, mode, base = NO_BASE_CONTEXT, agentName = "claude") {
     const autoFlag = mode.auto ? " --auto" : "";
     // Omit --rounds entirely when adaptive (mode.rounds === undefined) so the
     // backend routes by difficulty; only forward it for an explicit 1/2 override.
@@ -424,22 +434,23 @@ export function buildReviewTicketPrompt(key, mode, base = NO_BASE_CONTEXT) {
     const baseBranchFlag = base.baseBranch ? ` --base-branch=${base.baseBranch}` : "";
     const baseShaFlag = base.baseSha ? ` --base-sha=${base.baseSha}` : "";
     const noRefreshFlag = base.noRefreshBase ? " --no-refresh-base" : "";
-    return `/review-ticket ${key}${autoFlag}${roundsFlag}${baseBranchFlag}${baseShaFlag}${noRefreshFlag}`;
+    const command = agentName === "codex" ? "$bridge-review-ticket" : "/review-ticket";
+    return `${command} ${key}${autoFlag}${roundsFlag}${baseBranchFlag}${baseShaFlag}${noRefreshFlag}`;
 }
-export function buildPosixReviewAgentShellCommand(agent, key, mode, cwd, modelAlias, base = NO_BASE_CONTEXT) {
-    const prompt = buildReviewTicketPrompt(key, mode, base);
-    const invocation = buildAgentInvocation(agent, prompt, (p) => `'${shSquoteInner(p)}'`, modelAlias);
+export function buildPosixReviewAgentShellCommand(agent, key, mode, cwd, modelAlias, base = NO_BASE_CONTEXT, launchArgs = []) {
+    const prompt = buildReviewTicketPrompt(key, mode, base, agent.name);
+    const invocation = buildAgentInvocation(agent, prompt, (p) => `'${shSquoteInner(p)}'`, modelAlias, launchArgs);
     return `cd '${shSquoteInner(cwd)}' && ${invocation}`;
 }
-export function buildPowerShellReviewAgentShellCommand(agent, key, mode, modelAlias, base = NO_BASE_CONTEXT) {
-    const prompt = buildReviewTicketPrompt(key, mode, base);
-    return buildAgentInvocation(agent, prompt, powershellSquote, modelAlias);
+export function buildPowerShellReviewAgentShellCommand(agent, key, mode, modelAlias, base = NO_BASE_CONTEXT, launchArgs = []) {
+    const prompt = buildReviewTicketPrompt(key, mode, base, agent.name);
+    return buildAgentInvocation(agent, prompt, powershellSquote, modelAlias, launchArgs);
 }
-export function buildReviewAgentShellCommand(agent, key, mode, platform, cwd, modelAlias, base = NO_BASE_CONTEXT) {
+export function buildReviewAgentShellCommand(agent, key, mode, platform, cwd, modelAlias, base = NO_BASE_CONTEXT, launchArgs = []) {
     if (platform === "win32") {
-        return buildPowerShellReviewAgentShellCommand(agent, key, mode, modelAlias, base);
+        return buildPowerShellReviewAgentShellCommand(agent, key, mode, modelAlias, base, launchArgs);
     }
-    return buildPosixReviewAgentShellCommand(agent, key, mode, cwd, modelAlias, base);
+    return buildPosixReviewAgentShellCommand(agent, key, mode, cwd, modelAlias, base, launchArgs);
 }
 // ---------------------------------------------------------------------------
 // Unsupported platform message for review-tickets
@@ -535,17 +546,18 @@ export async function orchestrateReviewTickets(deps, options, overrides = {}) {
     if (!agent) {
         return {
             ok: false,
-            error: `Unknown agent: '${options.agentName}'. Valid agents: ${formatValidAgentNames()}.`,
+            error: `Unknown agent: '${options.agentName}'. Valid agents: ${formatReviewTicketsAgentNames()}.`,
+        };
+    }
+    // Reject an invalid multi-key claim before any Codex skill/config writes.
+    if (options.epic?.dispatch_key && options.keys.length > 1) {
+        return {
+            ok: false,
+            error: "epic.dispatch_key cannot be used with multiple keys: dispatch_key is a single-ticket claim " +
+                "and would be re-claimed for each key in the batch. Call orchestrateReviewTickets once per ticket instead.",
         };
     }
     if (options.dryRun) {
-        if (options.epic?.dispatch_key && options.keys.length > 1) {
-            return {
-                ok: false,
-                error: "epic.dispatch_key cannot be used with multiple keys: dispatch_key is a single-ticket claim " +
-                    "and would be re-claimed for each key in the batch. Call orchestrateReviewTickets once per ticket instead.",
-            };
-        }
         // --dry-run never performs the base-branch fetch (side-effect-free preview);
         // it reflects only what the user explicitly passed on the CLI.
         const rows = buildReviewPlanRows(deps, options, agent, "dry-run", overrides, previewBaseContextFromOptions(options));
@@ -554,15 +566,18 @@ export async function orchestrateReviewTickets(deps, options, overrides = {}) {
     const preflight = await runReviewTicketsPreflight(deps, options);
     if (!preflight.ok)
         return { ok: false, error: preflight.error };
-    // A dispatch_key embeds a single ticket (dispatch:{epic}:{ticket}:{plan_version}).
-    // Claiming the same key for every iteration of a multi-key batch would silently
-    // drop all but the first ticket; reject early with a clear error instead.
-    if (options.epic?.dispatch_key && options.keys.length > 1) {
-        return {
-            ok: false,
-            error: "epic.dispatch_key cannot be used with multiple keys: dispatch_key is a single-ticket claim " +
-                "and would be re-claimed for each key in the batch. Call orchestrateReviewTickets once per ticket instead.",
-        };
+    let codexLaunchArgs = [];
+    if (agent.name === "codex") {
+        const prepare = overrides.prepareCodexSession ?? (async (d) => {
+            const provision = await provisionCommandsForWorktree(d.cwd, buildCommandProvisioningDeps(d), true);
+            if (!provision.ok)
+                return { ok: false, error: provision.error };
+            return resolveCodexLaunchScope(d.cwd, buildMcpProvisioningDeps(d));
+        });
+        const scope = await prepare(deps);
+        if (!scope.ok)
+            return { ok: false, error: scope.error };
+        codexLaunchArgs = scope.argv;
     }
     // BAPI-474 D-3: parent-fetch-once — resolve ONE base_branch/base_sha pin for
     // the whole batch before any tab is spawned. D-4: on failure (and no
@@ -578,7 +593,7 @@ export async function orchestrateReviewTickets(deps, options, overrides = {}) {
     const terminal = detectTerminal(undefined, deps.env);
     const rows = await runWithConcurrency(options.keys, options.maxParallel, async (key) => {
         const mode = resolveEffectiveReviewMode(key, options);
-        const baseShellCommand = buildReviewAgentShellCommand(agent, key, mode, deps.platform, deps.cwd, options.modelAlias, baseContext);
+        const baseShellCommand = buildReviewAgentShellCommand(agent, key, mode, deps.platform, deps.cwd, options.modelAlias, baseContext, codexLaunchArgs);
         let shellCommand = baseShellCommand;
         let runId;
         if (options.epic) {
@@ -727,7 +742,7 @@ export async function runReviewTicketsCli(argv, overrides = {}) {
     if (options.dryRun) {
         const agent = resolveAgentSpec(options.agentName);
         if (!agent) {
-            errorLog(`Error: Unknown agent: '${options.agentName}'. Valid agents: ${formatValidAgentNames()}.`);
+            errorLog(`Error: Unknown agent: '${options.agentName}'. Valid agents: ${formatReviewTicketsAgentNames()}.`);
             return 1;
         }
         const rows = buildReviewPlanRows(deps, options, agent, "dry-run", overrides.orchestrateOverrides, previewBaseContextFromOptions(options));

package/build/run-unit-tests-launcher.js

@@ -55,7 +55,7 @@ export const MODULE_MOCK_MANIFEST = [
     // exist — the failure mode this manifest is for.
     "build/ci-check-wait.test.js",
     "build/conductor/cli-git-hooks.test.js",
-    "build/conductor/cli.test.js",
+    "build/conductor/epic-implementer-cli.test.js",
     "build/conductor/git-inspection.test.js",
     "build/conductor/paths.test.js",
     "build/conductor/pr-ci-producer-emit-seam.test.js",

package/build/setup-epic.js

@@ -47,7 +47,7 @@
  *      association is immutable server-side and can never be attached later.
  *   c. Cut or validate `origin/<feature>` at EXACTLY the canonical indexed SHA
  *      with the operator's LOCAL `git`, through the shared cut protocol
- *      `conduct-epic init` also drives, with the run id so the scope is minted
+ *      `implement-epic init` also drives, with the run id so the scope is minted
  *      owned by the run. An existing branch at a different commit fails closed.
  *      The GitHub App never pushes — it is `contents: read`.
  *   d. Store and approve (unchanged requests). The server now READ-validates the
@@ -81,7 +81,7 @@ import { createProductionEpicIntegrationGhRunner, ensureEpicIntegrationPullReque
 import { approveEpicPlan, createEpicRunWithDisposition, fetchConductorReadiness, fetchEpicRunState, replaceEpicRunPolicy, resolveConductorBridgeApiAccess, storeEpicPlan, validateEpicPlan, ConductorBridgeApiError, } from "./conductor/bridge-api-client.js";
 import { resolveTrackedPaths } from "./git-reachability.js";
 import { validateBranchName } from "./base-ref.js";
-// Reused from the conduct-epic client on purpose: adding a second wrapper under
+// Reused from the implement-epic client on purpose: adding a second wrapper under
 // `conductor/` would give the v2 path its own copy to drift from.
 //
 // BAPI-850 extends that reuse to the canonical parse read, the repository base
@@ -89,9 +89,10 @@ import { validateBranchName } from "./base-ref.js";
 // typed clients the pilot already has are the v2 path's clients too, so neither
 // conductor can drift on a field name or an endpoint shape. No MCP tool, no
 // input-schema field, and no description changes.
-import { getConfigFieldBaseBranch, getIndexScopeLifecycle, getParseStatus, } from "./conduct-epic/bridge-client.js";
-import { boundScopeLifecycleLabel, createExecFileRunCommand, ensureCommitResolvableLocally, normalizeCommitSha, performExactIndexScopeCut, pollIndexScopeLifecycle, readRemoteBranchHead, runGit, SCOPE_BOOTSTRAP_POLL_INTERVAL_MS, SCOPE_LIFECYCLE_LABELS, } from "./conduct-epic/cut-protocol.js";
+import { getConfigFieldBaseBranch, getIndexScopeLifecycle, getParseStatus, } from "./implement-epic/bridge-client.js";
+import { boundScopeLifecycleLabel, createExecFileRunCommand, ensureCommitResolvableLocally, normalizeCommitSha, performExactIndexScopeCut, pollIndexScopeLifecycle, readRemoteBranchHead, runGit, SCOPE_BOOTSTRAP_POLL_INTERVAL_MS, SCOPE_LIFECYCLE_LABELS, } from "./implement-epic/cut-protocol.js";
 import { hashPlan } from "./conductor/plan.js";
+import { BRING_UP_REFUSAL_MESSAGES, firstBringUpRefusal, } from "./conductor/bring-up-facts.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
 // BAPI-872: local plane-manifest binding, so `plane down` can later stop the
 // run this setup resolved WITHOUT guessing from repository-wide active-run
@@ -176,7 +177,7 @@ export function getSetupEpicUsage() {
         "single-node plan) is unchanged and composes no posture at all.",
         "",
         "Unattended runs have TWO one-time repository prerequisites, refused by name",
-        "before any run is created: repository consent (unattended_conductor_allowed) and",
+        "before any run is created: repository consent (unattended_epic_implementer_allowed) and",
         "a verified notify webhook default. `drive-epic` readiness lists both with their",
         "current state.",
         "",
@@ -1180,7 +1181,7 @@ export function evaluateSetupEpicUnattendedPrerequisites(readiness, requestedPol
         return {
             reason: "target_not_allowed",
             message: "this repository has not consented to unattended conductor runs. Set " +
-                "`unattended_conductor_allowed` for it (see " +
+                "`unattended_epic_implementer_allowed` for it (see " +
                 "docs/claude/account-settings-operator-runbook.md), or pass --attended to " +
                 "create an attended run. No run was created.",
         };
@@ -1218,6 +1219,31 @@ export function evaluateSetupEpicUnattendedPrerequisites(readiness, requestedPol
     }
     return null;
 }
+/** The closing sentence every pre-create refusal ends with. */
+const NO_RUN_WAS_CREATED = "No run was created.";
+/**
+ * Evaluate the bring-up facts against a readiness report.
+ *
+ * Pure and total: `null` is a readiness read that failed, which has proven
+ * nothing and refuses as `readiness_unreadable`. Otherwise at most ONE refusal,
+ * in the fixed {@link BRING_UP_REFUSAL_REASONS} order — each fact's
+ * "unreadable" before its "bad", so an operator is never told to repair a
+ * condition that could not be read.
+ */
+export function evaluateSetupEpicBringUpPrerequisites(readiness) {
+    if (readiness === null) {
+        return {
+            reason: "readiness_unreadable",
+            message: "the Bridge API conductor readiness report could not be read, so the database " +
+                "migration, worker presence, and single-reconciler facts could not be confirmed. " +
+                `Retry once the server is reachable. ${NO_RUN_WAS_CREATED}`,
+        };
+    }
+    const reason = firstBringUpRefusal(readiness.bring_up ?? null);
+    if (reason === null)
+        return null;
+    return { reason, message: `${BRING_UP_REFUSAL_MESSAGES[reason]} ${NO_RUN_WAS_CREATED}` };
+}
 /**
  * Does the policy this invocation will actually send request unattended operation?
  *
@@ -1619,13 +1645,13 @@ function scopeFailureGuidance(reason, featureBranch, epicRunId) {
     if (reason === "canonical_index_advanced") {
         return (`${SETUP_EPIC_SCOPE_REDRIVE_RECOVERY} The canonical index advanced before the ` +
             `scope could be seeded: delete origin/${featureBranch}, abandon this run ` +
-            `(conductor abandon-run --epic-run-id ${epicRunId}), and re-run setup-epic.`);
+            `(epic-implementer abandon-run --epic-run-id ${epicRunId}), and re-run setup-epic.`);
     }
     if (reason === "head_mismatch") {
         return (`${SETUP_EPIC_SCOPE_REDRIVE_RECOVERY} origin/${featureBranch} does not sit at the ` +
             `commit this scope was cut at, and setup-epic never force-updates an existing ` +
             `ref: delete origin/${featureBranch}, abandon this run ` +
-            `(conductor abandon-run --epic-run-id ${epicRunId}), and re-run setup-epic.`);
+            `(epic-implementer abandon-run --epic-run-id ${epicRunId}), and re-run setup-epic.`);
     }
     return `Recovery: ${SETUP_EPIC_SCOPE_RECOVERY_COMMAND}.`;
 }
@@ -1924,7 +1950,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         else if (err instanceof ConductorBridgeApiError && err.status === 409) {
             deps.errorLog(`Epic ${opts.epicKey} has MULTIPLE active runs — it is wedged, and every ` +
                 `plan call will keep failing. Abandon the duplicate before retrying:\n` +
-                `  conductor abandon-run --epic-run-id <duplicate_epic_run_id>\n` +
+                `  epic-implementer abandon-run --epic-run-id <duplicate_epic_run_id>\n` +
                 `Detail: ${errorDetail(err)}`);
             return 1;
         }
@@ -1982,7 +2008,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
                 `'${existingBaseBranch}', not the repository base '${repositoryBase}', and ` +
                 `--into-base asks for the repository base branch. setup-epic will not retarget ` +
                 `an existing run. Re-run without --into-base to reuse it unchanged, or abandon ` +
-                `the run (conductor abandon-run --epic-run-id ${existingRunId}) and recreate ` +
+                `the run (epic-implementer abandon-run --epic-run-id ${existingRunId}) and recreate ` +
                 `it on base.`);
             return 1;
         }
@@ -2112,7 +2138,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
                 `keep failing. This is TERMINAL: it will not clear on retry, and it is ` +
                 `NOT a problem with your plan. Adopt the run you want to keep, or ` +
                 `abandon the duplicate:\n` +
-                `  conductor abandon-run --epic-run-id <duplicate_epic_run_id>\n` +
+                `  epic-implementer abandon-run --epic-run-id <duplicate_epic_run_id>\n` +
                 `No run was created and no automation-start charge occurred.\n` +
                 `Detail: ${errorDetail(err)}`);
             return 1;
@@ -2186,7 +2212,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
     // used for status instead). A no-feature run performs none of this.
     //
     // The scope's BASE is the repository's configured base branch (the same
-    // resolution `conduct-epic init` uses), NOT `policy_json.base_branch` — that
+    // resolution `implement-epic init` uses), NOT `policy_json.base_branch` — that
     // key names the FEATURE branch. A feature branch equal to the configured base
     // needs no scope (dispatch already cuts from it) and matches the server's
     // long-standing no-op for that case.
@@ -2371,9 +2397,9 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         // run that is already going.
         //
         // Evaluated against the COMPOSED policy, so it covers the default profile and
-        // a `--policy-file` alike; skipped entirely for `--attended` and for any
-        // policy that is not unattended, which is what keeps an attended run from
-        // paying for a readiness read it does not need.
+        // a `--policy-file` alike; the UNATTENDED evaluation is skipped for
+        // `--attended` and for any policy that is not unattended. (The readiness
+        // read itself is no longer skipped — see BAPI-1153 below.)
         //
         // The file branch runs through `applySetupEpicUnattendedDefault` rather than
         // taking the file verbatim: a file bypasses the no-file composer entirely, so
@@ -2381,18 +2407,30 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         // which made the default profile unreachable by any documented invocation.
         // The composed object is what gets gated AND what gets sent, so the create
         // request carries exactly what was validated.
+        //
+        // BAPI-1153: ONE readiness read now serves both gates, and it happens for
+        // EVERY create — attended included — because the bring-up gate below applies
+        // to every run. Before any create request, manifest binding, or lane.
         {
+            let readiness = null;
+            try {
+                readiness = await fetchConductorReadiness(access, deps.fetch);
+            }
+            catch {
+                // Fail CLOSED, and silently as to WHY: the thrown value can carry a URL
+                // or a response excerpt, and this refusal is rendered to a terminal. The
+                // generic `readiness_unreadable` message says what to do about it.
+                readiness = null;
+            }
+            // Bring-up first: a behind database or a missing worker makes the
+            // unattended questions moot, and refusing on the cheaper, universal fact
+            // keeps the first-named blocker the same for attended and unattended runs.
+            const bringUpRefusal = evaluateSetupEpicBringUpPrerequisites(readiness);
+            if (bringUpRefusal !== null) {
+                deps.errorLog(`setup-epic REFUSED (${bringUpRefusal.reason}): ${bringUpRefusal.message}`);
+                return 1;
+            }
             if (requestedPolicyIsUnattended(composedForCreate, opts.attended)) {
-                let readiness = null;
-                try {
-                    readiness = await fetchConductorReadiness(access, deps.fetch);
-                }
-                catch {
-                    // Fail CLOSED, and silently as to WHY: the thrown value can carry a URL
-                    // or a response excerpt, and this refusal is rendered to a terminal. The
-                    // generic `readiness_unreadable` message says what to do about it.
-                    readiness = null;
-                }
                 // The COMPOSED policy, not the flags: a --policy-file declaring
                 // notify.webhook_url satisfies the escalation-channel prerequisite, and
                 // it is the same object the create request carries.
@@ -2456,7 +2494,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
                 say(`Run:        adopting existing active run ${run.epic_run_id} (status: ${run.status})`);
                 say(`            No second run was created — one epic has at most one active ` +
                     `run. Continue on this one, or abandon it first with ` +
-                    `\`conductor abandon-run --epic-run-id ${run.epic_run_id}\` to start over.`);
+                    `\`epic-implementer abandon-run --epic-run-id ${run.epic_run_id}\` to start over.`);
                 if (requestedPolicy !== undefined) {
                     const outcome = await applyReusedRunPolicy({
                         access,
@@ -2522,7 +2560,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
                     else {
                         const msg = `Could not bind the local plane to run ${result.epic_run_id} (${bound.message}). ` +
                             "A later `plane down` cannot be guaranteed to stop it automatically — if you need " +
-                            `to stop this run, run \`conductor stop-run --epic-run-id ${result.epic_run_id}\`.`;
+                            `to stop this run, run \`epic-implementer stop-run --epic-run-id ${result.epic_run_id}\`.`;
                         warnings.push(msg);
                         say(`Plane:      [warn] ${msg}`);
                     }
@@ -2542,7 +2580,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
                 const msg = `A local plane manifest exists but could not be validated (${manifestRead.error}), so ` +
                     `run ${result.epic_run_id} was NOT bound to it. If a plane is running, \`plane down\` ` +
                     "will not stop this run automatically — use " +
-                    `\`conductor stop-run --epic-run-id ${result.epic_run_id}\`. A manifest written by a ` +
+                    `\`epic-implementer stop-run --epic-run-id ${result.epic_run_id}\`. A manifest written by a ` +
                     "NEWER build must be wound down with that build's `plane down`.";
                 warnings.push(msg);
                 say(`Plane:      [warn] ${msg}`);
@@ -2553,7 +2591,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
             // an unexpected error here is reported as a warning, never thrown.
             const msg = `Could not check for a local plane to bind run ${result.epic_run_id} to (${errorDetail(err)}). ` +
                 "A later `plane down` cannot be guaranteed to stop it automatically — if you need to stop " +
-                `this run, run \`conductor stop-run --epic-run-id ${result.epic_run_id}\`.`;
+                `this run, run \`epic-implementer stop-run --epic-run-id ${result.epic_run_id}\`.`;
             warnings.push(msg);
             say(`Plane:      [warn] ${msg}`);
         }
@@ -2562,7 +2600,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
     // AFTER the run exists and BEFORE the plan is stored/approved: the scope's run
     // association is immutable server-side, so the cut is driven with this run's
     // id and the scope is minted owned by it. Everything from `cut/begin` to the
-    // hold's release is the SHARED protocol `conduct-epic init` drives — local git
+    // hold's release is the SHARED protocol `implement-epic init` drives — local git
     // only, an exact-SHA create-only push, never the GitHub App, never a force
     // update. A failure leaves the run non-active (never discoverable by the
     // reconciler) and re-running setup-epic reuses it and re-drives the cut.
@@ -2683,7 +2721,7 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
             deps.errorLog(`The plan was NOT approved: this repository is no longer authorized for ` +
                 `unattended runs. The run WAS created and is left in 'planning' with no ` +
                 `activation and no executor dispatch — nothing was half-applied.\n` +
-                `Restore \`unattended_conductor_allowed\` for this repository (see ` +
+                `Restore \`unattended_epic_implementer_allowed\` for this repository (see ` +
                 `docs/claude/account-settings-operator-runbook.md) and re-run setup-epic, ` +
                 `or deliberately convert this run to an attended posture through the ` +
                 `supported operator flow.\nDetail: ${errorDetail(err)}`);

package/build/start-tickets-conductor.js

@@ -83,9 +83,10 @@ export const DEFAULT_CONDUCTOR_GATE_NAME = "implement-ticket";
  * Exported since BAPI-1020 so the executor resolves the worker-guard bin through
  * the SAME resolver rather than growing a second one. Correct in both build
  * shapes because this module compiles to the build ROOT: the esbuild bundle puts
- * `import.meta.url` at `build/index.js` / `build/conductor-bin.js`, and `tsc` puts
- * it at `build/start-tickets-conductor.js`. A resolver living in a subdirectory
- * module would resolve to `build/<subdir>/<filename>` under `tsc` and be wrong.
+ * `import.meta.url` at `build/index.js` / `build/epic-implementer-bin.js`, and
+ * `tsc` puts it at `build/start-tickets-conductor.js`. A resolver living in a
+ * subdirectory module would resolve to `build/<subdir>/<filename>` under `tsc`
+ * and be wrong.
  */
 export function defaultResolveBinPath(filename) {
     return fileURLToPath(new URL(`./${filename}`, import.meta.url));
@@ -124,12 +125,12 @@ export async function createStartTicketsConductorContext(options, agent, deps) {
         gateName,
         supervisorMode,
         agentName: agent.name,
-        cliFile: resolveBinPath("conductor-bin.js"),
+        cliFile: resolveBinPath("epic-implementer-bin.js"),
         // Capture the conductor process's Node executable so dispatched workers run
-        // conductor-bin.js under THIS runtime (which owns the ledger), never the
-        // worker's own Node (BAPI-527).
+        // epic-implementer-bin.js under THIS runtime (which owns the ledger), never
+        // the worker's own Node (BAPI-527).
         conductorNodePath: deps.execPath ?? process.execPath,
-        hookBinPath: resolveBinPath("conductor-claude-hook-bin.js"),
+        hookBinPath: resolveBinPath("epic-implementer-claude-hook-bin.js"),
     };
     if (options.epic) {
         context.epic = options.epic;