@bridge_gpt/mcp-server 0.2.57 → 0.2.59

package/build/init.js

@@ -818,41 +818,33 @@ export async function runInit(cwd, options = {}) {
     // ---- Phase 4a: Scaffold GitHub Copilot command artifacts ----
     // VS Code Local agent discovers prompt files; Agent Host discovers project
     // skills. Both artifacts are rendered from COMMANDS above, never a second
-    // Copilot-specific command catalog.
+    // Copilot-specific command catalog. Each representation reports its own
+    // counts, so a written prompt never implies its skill exists (or vice versa).
     if (ideDetection.vscode) {
         const promptsDir = path.join(cwd, ".github", "prompts");
         const skillsDir = path.join(cwd, ".github", "skills");
-        const copilotWritten = new Set();
-        const copilotSkipped = new Set();
-        const copilotOverwritten = new Set();
         const artifacts = commandEntries.map(([filename, content]) => ({
-            filename,
             commandName: filename.replace(/\.md$/, ""),
             ...translateCommandToCopilot(filename, content),
         }));
-        const outcomes = await Promise.all(artifacts.flatMap(({ filename, commandName, prompt, skill }) => [
-            scaffoldFile(path.join(promptsDir, filename.replace(/\.md$/, ".prompt.md")), prompt, promptsDir),
-            scaffoldFile(path.join(skillsDir, commandName, "SKILL.md"), skill, path.join(skillsDir, commandName)),
-        ]));
-        artifacts.forEach(({ commandName }, i) => {
-            const commandOutcomes = outcomes.slice(i * 2, i * 2 + 2);
-            if (commandOutcomes.every((outcome) => outcome === "skipped")) {
-                copilotSkipped.add(commandName);
-                return;
-            }
-            if (commandOutcomes.some((outcome) => outcome === "overwritten")) {
-                copilotOverwritten.add(commandName);
-            }
-            copilotWritten.add(commandName);
-        });
-        console.log(`\nCopilot workflows: scaffolded ${total} prompt files and ${total} Agent Host skills`);
-        if (copilotWritten.size > 0)
-            console.log(`  Written: ${copilotWritten.size}`);
-        if (copilotOverwritten.size > 0)
-            console.log(`  Overwritten (content changed): ${copilotOverwritten.size}`);
-        if (copilotSkipped.size > 0)
-            console.log(`  Skipped (unchanged): ${copilotSkipped.size}`);
-        console.log("  .github/prompts/ (VS Code Local agent) and .github/skills/ (Agent Host)");
+        const promptOutcomes = await Promise.all(artifacts.map(({ commandName, prompt }) => scaffoldFile(path.join(promptsDir, `${commandName}.prompt.md`), prompt, promptsDir)));
+        const skillOutcomes = await Promise.all(artifacts.map(({ commandName, skill }) => scaffoldFile(path.join(skillsDir, commandName, "SKILL.md"), skill, path.join(skillsDir, commandName))));
+        const copilotReports = [
+            ["VS Code Local-agent prompt files", ".github/prompts/", promptOutcomes],
+            ["Agent Host skills", ".github/skills/", skillOutcomes],
+        ];
+        for (const [label, dir, outcomes] of copilotReports) {
+            const written = outcomes.filter((outcome) => outcome !== "skipped").length;
+            const overwritten = outcomes.filter((outcome) => outcome === "overwritten").length;
+            const skipped = outcomes.filter((outcome) => outcome === "skipped").length;
+            console.log(`\n${label}: scaffolded ${outcomes.length} into ${dir}`);
+            if (written > 0)
+                console.log(`  Written: ${written}`);
+            if (overwritten > 0)
+                console.log(`  Overwritten (content changed): ${overwritten}`);
+            if (skipped > 0)
+                console.log(`  Skipped (unchanged): ${skipped}`);
+        }
     }
     // ---- Phase 4b: Scaffold shipped documentation assets ----
     // Every doc asset the /install-bridge capability report points a human at,

package/build/install-bridge-conductor.js

@@ -136,7 +136,7 @@ export function getInstallBridgeConductorUsage() {
         "production when unset). The bootstrap POST then asks its own, separate write",
         "consent. Without a TTY there is no consent, so the command aborts.",
         "",
-        "Tool visibility (its own consent): adds the `conductor` token to the",
+        "Tool visibility (its own consent): adds the `epic_implementer` token to the",
         "BRIDGE_MCP_PROFILE of the Bridge entry in host MCP configurations that",
         "ALREADY have one. Automatic merging covers .mcp.json, .vscode/mcp.json, and",
         ".cursor/mcp.json only — never Codex or Copilot, which are neither inspected",
@@ -556,10 +556,10 @@ async function runExecutorProvisioningPhase(deps, executor, plans, access) {
  * said nothing would reasonably conclude the tools were already visible.
  */
 export function formatConductorRestartAdvisory(mergedProfile) {
-    return (`⚠️  Conductor profile updated: BRIDGE_MCP_PROFILE is now set to \`${mergedProfile}\` ` +
+    return (`⚠️  Epic Implementer profile updated: BRIDGE_MCP_PROFILE is now set to \`${mergedProfile}\` ` +
         "in your local MCP config file(s). The running MCP server captured its active groups " +
         "at startup, so this activates on the next MCP server launch — restart your MCP " +
-        "client to gain access to the conductor tools.");
+        "client to gain access to the Epic Implementer tools.");
 }
 /** Remediation printed when no supported host config carries a Bridge entry. */
 export const CONDUCTOR_PROFILE_EMPTY_MERGE_REMEDIATION = `run \`npx ${MCP_PACKAGE_NAME} install\` to create and register the host MCP entry, ` +
@@ -570,14 +570,14 @@ export const CONDUCTOR_HOOKS_MANUAL_REMEDIATION = "re-run `install conductor` an
 /**
  * Phase: tool visibility.
  *
- * Adds the `conductor` token to EXISTING supported host MCP entries behind its
+ * Adds the `epic_implementer` token to EXISTING supported host MCP entries behind its
  * own consent, then prints the restart advisory. It never creates a host config
  * — the merge helper's never-create rule is what keeps a declined or
  * unconfigured repository from acquiring files it did not ask for.
  */
 async function runConductorToolVisibilityPhase(deps, local) {
     const consented = await confirm(deps, "Update existing supported host MCP configurations (.mcp.json, .vscode/mcp.json, " +
-        ".cursor/mcp.json) to add the `conductor` profile? [y/N]: ");
+        ".cursor/mcp.json) to add the `epic_implementer` profile? [y/N]: ");
     if (!consented) {
         deps.log("  declined — no host MCP configuration and no install state were written.");
         return {
@@ -620,7 +620,7 @@ async function runConductorToolVisibilityPhase(deps, local) {
     }
     deps.log(carrying.length > 0
         ? `  updated: ${carrying.join(", ")}`
-        : "  the conductor profile was merged into your supported host MCP config(s).");
+        : "  the Epic Implementer profile was merged into your supported host MCP config(s).");
     // Coverage honesty: the merge path writes these three files and no others.
     deps.log("  Codex and Copilot host configuration was NOT inspected or changed.");
     deps.log(`  ${formatConductorRestartAdvisory(mergedProfile)}`);
@@ -1027,7 +1027,7 @@ export async function runInstallBridgeConductorCli(argv, deps) {
     else {
         deps.log("  skipped — this caller supplied no local-provisioning seams.");
         manualActions.push("tool visibility: run the packaged `install conductor` command to add the " +
-            "`conductor` profile to your host MCP configuration.");
+            "`epic_implementer` profile to your host MCP configuration.");
     }
     deps.log("");
     deps.log("Phase 5/8 — conductor local observability…");

package/build/install-bridge.js

@@ -167,7 +167,7 @@ import { executorLaunchdLabelForId, executorSystemdUnitNameForId, executorLaunch
 import { collectConductorNativeLedgerSafe, } from "./conductor/doctor.js";
 import { installConductorGitHooks, } from "./conductor/git-hooks.js";
 import { runInstallBridgeConductorCli, } from "./install-bridge-conductor.js";
-import { runConductorInstallDoctor, CONDUCTOR_PROFILE_TOKEN, } from "./conductor/install-doctor.js";
+import { runConductorInstallDoctor, EPIC_IMPLEMENTER_PROFILE_TOKEN, } from "./conductor/install-doctor.js";
 import { resolveConductorBridgeApiAccess, } from "./conductor/bridge-api-client.js";
 import { claudeReviewWorkflowPath, writeClaudeReviewWorkflow, } from "./claude-review-workflow.js";
 // BAPI-941: read-only workflow-lineage probe, wired into the conductor install
@@ -300,7 +300,7 @@ export const INSTALL_BRIDGE_AGENT_PROMPT = "Run /install-bridge now, with no arg
     "duplicate. This silence applies ONLY to success and ONLY in the install-spawn context: a Stage 6 " +
     "FAILURE is still reported loudly and in full, and in JOIN MODE or a direct/manual /install-bridge " +
     "invocation Stage 6 reports its success exactly as it does today. " +
-    "The install-spawn skip set is exactly Stage 8, Stage 9, and Stage 10. The command-owned Stage 11 " +
+    "The install-spawn skip set is exactly Stage 8 and Stage 9. The command-owned Stage 11 " +
     "(invite teammates) is NOT in that skip set: it is independently gated and may run only when the " +
     "caller's role is admin AND customer_type is b2b AND an interactive response is available; " +
     "otherwise it is skipped silently. If Stage 11 mints a teammate key, show that plaintext key " +
@@ -520,7 +520,8 @@ export function getInstallBridgeUsage(baseUrl = DEFAULT_BAPI_BASE_URL) {
         "                                launches nothing.",
         "  --codex-profile on|off       Opt in to Bridge workflow MCP approvals for",
         "                                Codex workers, or explicitly decline. With a",
-        "                                Codex TTY selection, the installer asks.",
+        "                                Codex TTY selection, the installer asks",
+        "                                with Yes as the default (press Enter).",
         "  --force                       Overwrite an existing real BAPI_API_KEY in a",
         "                                host config (or in the credential store) without",
         "                                prompting. It does NOT bypass the git-tracked",
@@ -571,7 +572,7 @@ export function getInstallBridgeUsage(baseUrl = DEFAULT_BAPI_BASE_URL) {
         "                                (its own separate consent), then closes the local",
         "                                out-of-the-box gap in two more phases, each behind",
         "                                its OWN consent: tool visibility adds the",
-        "                                `conductor` token to existing .mcp.json /",
+        "                                `epic_implementer` token to existing .mcp.json /",
         "                                .vscode/mcp.json / .cursor/mcp.json entries (never",
         "                                Codex or Copilot, and never creating a file) and",
         "                                prints the MCP-client restart advisory; local",
@@ -1122,9 +1123,9 @@ export function buildAgentNotesSummaryLine(offer, result, writeFailed, unsupport
  * Exported so `index.ts`'s `--init` can share the exact same prompt mechanics
  * as `install`'s missing-project-root confirmation (BAPI-818, R1).
  */
-export function promptLineViaReadline(promptText) {
+export function promptLineViaReadline(promptText, input = process.stdin, output = process.stderr) {
     return new Promise((resolve) => {
-        const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+        const rl = readline.createInterface({ input, output });
         // See promptSecretViaReadline: EOF must resolve rather than deadlock the
         // top-level await, and `answered` guards the synchronous `close` from
         // discarding a real answer.
@@ -1453,8 +1454,8 @@ function buildConductorExecutorDeps(deps, baseUrl) {
  */
 function buildConductorLocalDeps(deps) {
     return {
-        mergeProfileToken: () => mergeBridgeApiProfileToken(deps.cwd, CONDUCTOR_PROFILE_TOKEN),
-        inspectProfileToken: () => inspectBridgeApiProfileToken(deps.cwd, CONDUCTOR_PROFILE_TOKEN, {
+        mergeProfileToken: () => mergeBridgeApiProfileToken(deps.cwd, EPIC_IMPLEMENTER_PROFILE_TOKEN),
+        inspectProfileToken: () => inspectBridgeApiProfileToken(deps.cwd, EPIC_IMPLEMENTER_PROFILE_TOKEN, {
             readFile: deps.readFile,
         }),
         // The repository root is this command's cwd, which is what the hook
@@ -2012,6 +2013,174 @@ export function promptMultiSelectViaReadline(promptText, options, input = proces
         prompt();
     });
 }
+/**
+ * Subscription display name for the three platforms whose maximize-posture
+ * option-three wording names the actual tool, keyed by the SAME
+ * `HostPlatformId` `resolveSelectedHostPlatforms` returns. Deliberately does
+ * NOT project `MCP_HOST_TARGETS[id].label` — that registry label reads
+ * "OpenAI Codex", which is not this feature's approved wording.
+ */
+const OPTIMIZATION_POSTURE_SUBSCRIPTION_NAMES = {
+    "claude-code": "Claude Code",
+    codex: "Codex",
+    cursor: "Cursor",
+};
+/**
+ * `"{name} subscription"` for the three eligible platforms, and the generic
+ * `"coding subscription"` for every other input — Copilot, Windsurf, an
+ * unrecognized id, or no primary platform at all (empty tool selection).
+ */
+export function optimizationPostureSubscriptionNounPhrase(primaryPlatform) {
+    const mapped = primaryPlatform ? OPTIMIZATION_POSTURE_SUBSCRIPTION_NAMES[primaryPlatform] : undefined;
+    return mapped ? `${mapped} subscription` : "coding subscription";
+}
+/** Option three's exact wording, platform-aware (BAPI-1221 Step 2). */
+function buildOptimizationPostureOptionThree(primaryPlatform) {
+    return `Get the most out of your ${optimizationPostureSubscriptionNounPhrase(primaryPlatform)}?`;
+}
+/** The neutral single-line correction reprompted for any malformed answer. */
+const OPTIMIZATION_POSTURE_CORRECTION = "Enter a single number from 1 to 3.";
+/**
+ * Bounds the picker's correction reprompts, mirroring this file's existing
+ * {@link INSTALL_BRIDGE_MAX_CODE_REJECTIONS} convention. A real interactive
+ * user always reaches a terminal answer well inside this many tries — Enter
+ * (blank) or Ctrl+D (EOF) both resolve immediately — so this cap exists only
+ * to stop a `promptLine` seam that NEVER produces a digit or a blank answer
+ * from reprompting forever. Set comfortably above the widest malformed-input
+ * sweep this picker is tested against (a comma list, a range, signed and
+ * decimal values, `0`, `4`, blank-with-more-input, and arbitrary text).
+ */
+const OPTIMIZATION_POSTURE_MAX_CORRECTIONS = 20;
+/**
+ * Render the one-time posture menu and its input instruction. Exactly three
+ * vertically ordered numbered options; option three is platform-aware. Plain,
+ * wrap-safe text — no color-only state, icons, or decorative framing.
+ */
+function buildOptimizationPostureMenu(primaryPlatform) {
+    return ("How should Bridge optimize its work on this repository?\n" +
+        "  1. Quality\n" +
+        "  2. Speed\n" +
+        `  3. ${buildOptimizationPostureOptionThree(primaryPlatform)}\n` +
+        `${OPTIMIZATION_POSTURE_CORRECTION} `);
+}
+/**
+ * The purpose-built, strict single-select optimization-posture picker
+ * (BAPI-1221 Step 2). Renders the three-option menu exactly once and loops
+ * ONLY the neutral correction line on a malformed answer — never
+ * `promptMultiSelectViaReadline()`, whose comma-separated contract this
+ * picker deliberately does not share.
+ *
+ * Accepts only a trimmed single digit `1`, `2`, or `3`; every other answer
+ * (a comma list, a range, a signed or decimal value, blank text, or
+ * unrelated text) is malformed and reprompted. EOF, an unavailable
+ * `deps.promptLine` seam, or a genuinely blank/no-answer result all resolve
+ * `null` rather than looping indefinitely — `promptLineViaReadline` itself
+ * already collapses real EOF and an empty typed answer to the same `""`, so
+ * there is no seam-level way (or need) to tell them apart here.
+ */
+export async function promptOptimizationPosture(deps, primaryPlatform) {
+    if (!deps.isTTY || !deps.promptLine)
+        return null;
+    const promptLine = deps.promptLine;
+    try {
+        let answer = (await promptLine(buildOptimizationPostureMenu(primaryPlatform))).trim();
+        for (let attempts = 0;; attempts++) {
+            if (answer === "1")
+                return "quality";
+            if (answer === "2")
+                return "speed";
+            if (answer === "3")
+                return "maximize_subscription";
+            if (answer === "")
+                return null;
+            if (attempts >= OPTIMIZATION_POSTURE_MAX_CORRECTIONS)
+                return null;
+            answer = (await promptLine(`${OPTIMIZATION_POSTURE_CORRECTION} `)).trim();
+        }
+    }
+    catch {
+        // Prompt/stream exception at the posture-step boundary: fail open to a
+        // no-answer outcome rather than aborting an otherwise-complete install.
+        return null;
+    }
+}
+/** Build the posture config-field URL, matching {@link buildPingUrl}'s normalization. */
+function buildOptimizationPostureUrl(baseUrl) {
+    return `${baseUrl.replace(/\/+$/, "")}/jira/config-field/optimization_posture`;
+}
+/**
+ * Persist the captured posture through the existing, generic configuration
+ * endpoint (BAPI-1221 Step 4) — the SAME `PUT /jira/config-field/{field_name}`
+ * every other config-field write uses; this ticket adds no new endpoint,
+ * model, or migration. Fail-open by design: a missing repo identity, a
+ * forbidden write, any other non-OK response, or a network/timeout failure
+ * all return a coarse outcome rather than throwing, and none of them retries
+ * or blocks the rest of installation. The response body is never read or
+ * logged, and the API key never appears in the URL, body, or any returned
+ * message.
+ */
+export async function persistOptimizationPosture(deps, baseUrl, apiKey, repoName, value) {
+    if (!repoName || repoName.trim().length === 0) {
+        return { kind: "missing-repo-identity" };
+    }
+    let resp;
+    try {
+        resp = await deps.fetch(buildOptimizationPostureUrl(baseUrl), {
+            method: "PUT",
+            headers: { "X-API-Key": apiKey, "Content-Type": "application/json" },
+            body: JSON.stringify({ repo_name: repoName, value }),
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch {
+        return { kind: "request-failed" };
+    }
+    if (resp.ok)
+        return { kind: "success" };
+    if (resp.status === 403)
+        return { kind: "forbidden" };
+    return { kind: "http-error", status: resp.status };
+}
+/** Confirmation noun phrase used in the deferred-activation success message. */
+function optimizationPostureConfirmationPhrase(value, primaryPlatform) {
+    if (value === "quality")
+        return "quality";
+    if (value === "speed")
+        return "speed";
+    return `getting the most out of your ${optimizationPostureSubscriptionNounPhrase(primaryPlatform)}`;
+}
+/** Printed immediately after a successful posture write, on its own line. */
+const OPTIMIZATION_POSTURE_BLOG_URL = "https://bridgegpt.ai/blog/how-we-optimize-your-setup";
+const OPTIMIZATION_POSTURE_REMEDIATION = "Update it later with /teach-bridge or the optimization_posture setting in the web UI.";
+/**
+ * The generic, secret-free fail-open message shared by every non-success,
+ * non-forbidden outcome — an interactive no-answer/prompt-exception (no PUT
+ * was ever attempted) and a missing-repo-identity/HTTP-error/network failure
+ * (a PUT was attempted and did not take). States plainly that the current
+ * server value is unchanged; a new repository merely READS as Quality via
+ * the BAPI-1220 server-side default, so this never claims every repository
+ * IS now Quality.
+ */
+const OPTIMIZATION_POSTURE_UNCHANGED_MESSAGE = `  Optimization posture was not changed; new repositories use Quality by default. ${OPTIMIZATION_POSTURE_REMEDIATION}`;
+/**
+ * Report the outcome of the optional posture capture/persistence step
+ * (BAPI-1221 Step 5) — called only when an explicit interactive selection was
+ * captured and the PUT helper actually ran.
+ */
+function reportOptimizationPostureOutcome(log, result, value, primaryPlatform) {
+    if (result.kind === "success") {
+        log(`  Preference saved for later activation — we'll optimize for ${optimizationPostureConfirmationPhrase(value, primaryPlatform)}.`);
+        log(`  ${OPTIMIZATION_POSTURE_BLOG_URL}`);
+        return;
+    }
+    if (result.kind === "forbidden") {
+        log(`  Optimization posture was not changed (an admin API key is required). ${OPTIMIZATION_POSTURE_REMEDIATION}`);
+        return;
+    }
+    // missing-repo-identity, http-error, request-failed: none carries
+    // user-actionable detail beyond "it didn't take."
+    log(OPTIMIZATION_POSTURE_UNCHANGED_MESSAGE);
+}
 /**
  * Resolve the selected host platforms with strict precedence (BAPI-635):
  *   1. explicit `--tools` (including an explicit EMPTY selection — never falls
@@ -4947,14 +5116,26 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
     // global (Codex) or manual (Windsurf) target is provisioned by the
     // registry-driven emitter after the connectivity check.
     const selectedPlatforms = await resolveSelectedHostPlatforms(deps, options);
+    // ---- BAPI-1221 (S2): capture the optimization-posture preference ----
+    // Asked immediately after tool selection, on every otherwise-eligible
+    // interactive install (including reinstalls and an explicit empty
+    // selection) — a prior posture is never read first. `--dry-run` already
+    // returns long before this point (see the NOTE below), so this gate is
+    // belt-and-suspenders, not the sole guard. The primary platform is
+    // `selectedPlatforms[0]` exclusively, relying on the resolver's own
+    // `HOST_PLATFORM_ORDER` normalization even when several tools were chosen.
+    const optimizationPostureEligible = deps.isTTY && Boolean(deps.promptLine) && !options.dryRun;
+    const optimizationPostureSelection = optimizationPostureEligible
+        ? await promptOptimizationPosture(deps, selectedPlatforms[0])
+        : null;
     if (options.codexProfile && !selectedPlatforms.includes("codex")) {
         errorLog("Error: --codex-profile requires Codex in --tools or the interactive selection.");
         return 1;
     }
     let codexProfileChoice = options.codexProfile;
     if (selectedPlatforms.includes("codex") && !options.dryRun && !codexProfileChoice && deps.isTTY && deps.promptLine) {
-        const answer = (await deps.promptLine("Install the opt-in Bridge Codex approval profile for spawned workers? (y/N) ")).trim().toLowerCase();
-        codexProfileChoice = answer === "y" || answer === "yes" ? "on" : "off";
+        const answer = (await deps.promptLine("Install the opt-in Bridge Codex approval profile for spawned workers? (Y/n) ")).trim().toLowerCase();
+        codexProfileChoice = answer === "" || answer === "y" || answer === "yes" ? "on" : "off";
     }
     const targets = hostConfigTargetsForPlatforms(selectedPlatforms);
     // Read-only detection (safe in dry-run) of global-config editors we can't write.
@@ -5647,6 +5828,18 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                 : `Error: ${ping.message}`);
         }
         log("  connectivity OK");
+        // ---- BAPI-1221 (S2): persist the captured posture, now that connectivity
+        // is validated and `repoName`/`apiKey` are both final. Overwrites any
+        // existing value unconditionally — the old value is never read first. A
+        // no-answer (or a prompt/stream exception the picker already absorbed)
+        // reports the same fail-open remediation without ever attempting a write.
+        if (optimizationPostureSelection) {
+            const postureResult = await persistOptimizationPosture(deps, baseUrl, apiKey, repoName, optimizationPostureSelection);
+            reportOptimizationPostureOutcome(log, postureResult, optimizationPostureSelection, selectedPlatforms[0]);
+        }
+        else if (optimizationPostureEligible) {
+            log(OPTIMIZATION_POSTURE_UNCHANGED_MESSAGE);
+        }
         const entry = buildInstallBridgeServerEntry(deps.cwd, repoName, apiKey, baseUrl, docsDir);
         // BAPI-666: the secret-free variant (no BAPI_API_KEY) is written instead of the
         // real entry into any git-tracked project config the user did not explicitly

package/build/install-doctor.js

@@ -104,7 +104,7 @@ export async function resolveInstallDoctorTarget(deps) {
                 break;
         }
     }
-    return { repoName, repoSource, baseUrl: baseUrl ?? DEFAULT_BASE_URL };
+    return { repoName, repoSource, baseUrl: (baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "") };
 }
 /** Classify a thrown probe failure into the closed category vocabulary. */
 function classifyProbeFailure(error) {

package/build/mcp-host-entry-adapter.js

@@ -10,6 +10,12 @@ export function adaptBridgeEntryForHostTarget(entry, target) {
         args: [...entry.args],
         env: { ...entry.env },
     };
+    // The marker belongs to the installed physical registration, never the
+    // portable logical entry or committed .bridge/config. Replacing an entry
+    // refreshes it; removing the registration removes it automatically.
+    delete physical.env.BAPI_MCP_HOST_FAMILY;
+    if (target.routingHostFamily)
+        physical.env.BAPI_MCP_HOST_FAMILY = target.routingHostFamily;
     if (adapter.transportType !== undefined)
         physical.type = adapter.transportType;
     if (adapter.extraEntryKeys)

package/build/mcp-host-targets.js

@@ -67,6 +67,7 @@ export function hostAdapterForTarget(target) {
 export const MCP_HOST_TARGETS = {
     "claude-code": {
         id: "claude-code",
+        routingHostFamily: "claude_code",
         label: "Claude Code",
         scope: "project",
         relPath: ".mcp.json",
@@ -106,6 +107,7 @@ export const MCP_HOST_TARGETS = {
     },
     codex: {
         id: "codex",
+        routingHostFamily: "codex",
         label: "OpenAI Codex",
         scope: "global",
         absPathResolver: (homedir) => joinPath(homedir, ".codex/config.toml"),

package/build/mcp-invoke.js

@@ -306,21 +306,21 @@ export async function resolveBapiInvocation(projectRoot, deps) {
         BAPI_PROJECT_ROOT: projectRoot,
         BAPI_REPO_NAME: repoName,
     };
-    // BAPI-527: `CONDUCTOR_NODE_PATH` is NON-SECRET operational metadata (the
+    // BAPI-527: `EPIC_IMPLEMENTER_NODE_PATH` is NON-SECRET operational metadata (the
     // captured conductor Node path used by the worker-ledger CLI subprocess).
     // `buildChildEnv` already inherits the full parent env, so this re-affirms the
     // pass-through explicitly and ONLY when present — it is a non-secret allowlist
     // entry, never a credential. It is emphatically NOT the MCP server's re-exec
     // command: the spawned command stays `deps.execPath` + `[scriptPath]` below.
-    const conductorNodePath = deps.env.CONDUCTOR_NODE_PATH;
+    const conductorNodePath = deps.env.EPIC_IMPLEMENTER_NODE_PATH;
     if (typeof conductorNodePath === "string" && conductorNodePath.trim().length > 0) {
-        overlay.CONDUCTOR_NODE_PATH = conductorNodePath;
+        overlay.EPIC_IMPLEMENTER_NODE_PATH = conductorNodePath;
     }
     // BAPI-727: overlay the endpoint ONLY when `--base-url` was supplied, mirroring
-    // the conditional `CONDUCTOR_NODE_PATH` overlay directly above. The absent case
+    // the conditional `EPIC_IMPLEMENTER_NODE_PATH` overlay directly above. The absent case
     // must add, delete, normalize, and override nothing — `buildChildEnv` already
     // inherits the parent's `BAPI_BASE_URL`, and the server keeps its own production
-    // default for callers that were never given a URL. Like `CONDUCTOR_NODE_PATH`,
+    // default for callers that were never given a URL. Like `EPIC_IMPLEMENTER_NODE_PATH`,
     // this is non-secret routing metadata, not a credential.
     if (typeof deps.baseUrl === "string" && deps.baseUrl.length > 0) {
         overlay.BAPI_BASE_URL = deps.baseUrl;

package/build/mcp-profile.js

@@ -15,7 +15,7 @@
  */
 const VALID_GROUPS = new Set([
     "core",
-    "conductor",
+    "epic_implementer",
     "estimation",
     "pipeline-authoring",
     "sfcc",
@@ -49,7 +49,7 @@ export function resolveProfiles(raw) {
         // rather than an implicit widening of an existing user's surface.
         return new Set([
             "core",
-            "conductor",
+            "epic_implementer",
             "estimation",
             "pipeline-authoring",
             "sfcc",

package/build/mcp-provisioning.js

@@ -67,7 +67,7 @@ export function serverNameForMcpTarget(target) {
  * node executable is a single substitutable field), and the npm-channel fallback
  * as `{ command: "npx", args: ["-y", "<spec>", "mcp-invoke", …] }`.
  *
- * BAPI-527: `.mcp.json` remains intentionally ENV-FREE. `CONDUCTOR_NODE_PATH`
+ * BAPI-527: `.mcp.json` remains intentionally ENV-FREE. `EPIC_IMPLEMENTER_NODE_PATH`
  * (the captured conductor Node path for the worker-ledger CLI subprocess) is NOT
  * written here — it is inherited at runtime from the worker SHELL env that
  * `start-tickets` injects at the spawn boundary, never stored as a registration
@@ -77,7 +77,7 @@ export function serverNameForMcpTarget(target) {
  *
  * BAPI-724: the executor caller's `invocation` is resolved BEFORE spawn from its
  * OWN running process (`resolveMcpShimInvocationForRuntime`, absolute-build-path
- * form preferred) and never depends on a worker-injected `CONDUCTOR_NODE_PATH`
+ * form preferred) and never depends on a worker-injected `EPIC_IMPLEMENTER_NODE_PATH`
  * or any other worker-shell env — the executor worker environment carries no
  * such key at all (see `executor/env.ts`).
  *

package/build/mcp-server-invocation.js

@@ -17,7 +17,7 @@
  * server file is invoked (`node <absPath>/index.js` vs `npx @…`). It does NOT
  * change WHICH Node binary runs that file — the `nodeExecutable` field is kept as
  * a single substitutable value (never string-concatenated into the command) so
- * the later Ticket 3 (P2) work can point it at `CONDUCTOR_NODE_PATH` without
+ * the later Ticket 3 (P2) work can point it at `EPIC_IMPLEMENTER_NODE_PATH` without
  * re-plumbing argv construction.
  */
 import path from "node:path";
@@ -48,7 +48,7 @@ export function isTransientNpxEntryPath(entryPath) {
  * Build the concrete `{ command, args }` launch pair for a target + worktree from
  * a structured invocation. Pure — no filesystem or process access. The
  * `nodeExecutable` is returned as the standalone `command`, never concatenated
- * with the server entry path, so `CONDUCTOR_NODE_PATH` can substitute it later.
+ * with the server entry path, so `EPIC_IMPLEMENTER_NODE_PATH` can substitute it later.
  */
 export function buildMcpShimCommand(invocation, target, absoluteWorktreePath) {
     if (invocation.form === "absolute-build-path") {
@@ -141,7 +141,7 @@ function basenameAnySep(filePath) {
  * NOTE (scope boundary): this ticket changes WHICH server file is invoked, not
  * WHICH Node runtime runs it. `nodeExecutable` defaults to `"node"` (NOT
  * `process.execPath`) to preserve today's worker runtime selection; Ticket 3 (P2)
- * can later inject `CONDUCTOR_NODE_PATH` into this single field.
+ * can later inject `EPIC_IMPLEMENTER_NODE_PATH` into this single field.
  */
 export function resolveMcpShimInvocationForRuntime(deps) {
     const nodeExecutable = deps.nodeExecutable ?? "node";

package/build/merge-pull-request.js

@@ -102,6 +102,19 @@ const CI_NOT_GREEN_REASON = "ci_not_green";
  * moves an unreadable, unsupported, or malformed review configuration.
  */
 const REVIEW_NOT_APPROVED_REASON = "review_not_approved";
+/**
+ * BAPI-1234 — the server's migration-graph merge guard. Both are named here so
+ * the mapping is explicit rather than an accident of the default branch, and
+ * both are `needs_human`: repeating the call against the same base and head
+ * reproduces the same refusal. `migration_graph_invalid` means a human must
+ * renumber the PR's own migration; `migration_graph_unreadable` means the graph
+ * could not be proven either way. The exact reason is returned unchanged so the
+ * caller can tell them apart; no server-supplied text is added.
+ */
+const MIGRATION_GRAPH_REFUSAL_REASONS = new Set([
+    "migration_graph_invalid",
+    "migration_graph_unreadable",
+]);
 // ---------------------------------------------------------------------------
 // Envelope construction
 // ---------------------------------------------------------------------------
@@ -560,6 +573,8 @@ function retryHintForFailure(reason, ciSummary) {
     }
     if (reason === REVIEW_NOT_APPROVED_REASON)
         return "retry_later";
+    if (MIGRATION_GRAPH_REFUSAL_REASONS.has(reason))
+        return "needs_human";
     return "needs_human";
 }
 /**

package/build/model-routing-host.js

@@ -0,0 +1,25 @@
+const CLIENT_NAMES = {
+    // `claude-code` is observed in the handshake captured in learn-tool-gating.ts.
+    "claude-code": "claude_code",
+    "codex": "codex",
+};
+export function resolveRoutingHost(clientName, marker) {
+    const fromClient = typeof clientName === "string" && Object.hasOwn(CLIENT_NAMES, clientName)
+        ? CLIENT_NAMES[clientName] : null;
+    const fromMarker = marker === "codex" || marker === "claude_code" ? marker : null;
+    if (marker != null && !fromMarker)
+        return { family: fromClient, source: fromClient ? "initialized_client" : "neutral", warning: "invalid_marker" };
+    if (fromClient && fromMarker && fromClient !== fromMarker)
+        return {
+            family: null, source: "neutral", warning: "marker_conflict",
+        };
+    if (fromClient)
+        return { family: fromClient, source: "initialized_client" };
+    if (fromMarker)
+        return { family: fromMarker, source: "installer_marker" };
+    return { family: null, source: "neutral" };
+}
+export function resolveInitializedRoutingHost(server, marker = process.env.BAPI_MCP_HOST_FAMILY) {
+    // Called from a registered handler, after MCP initialization.
+    return resolveRoutingHost(server.server.getClientVersion?.()?.name, marker);
+}