@bridge_gpt/mcp-server 0.2.58 → 0.2.60

package/build/epic-implementer-claude-hook-bin.js

@@ -1,3 +1,5 @@
 #!/usr/bin/env node
-import path from"node:path";import{fileURLToPath}from"node:url";import{spawnSync}from"node:child_process";import{readFileSync}from"node:fs";var CONDUCTOR_HOOK_EMIT_FAILED_WARNING="Warning: conductor hook emit failed.";function resolveClaudeHookEventName(payload){if(payload===null||typeof payload!="object"||Array.isArray(payload))return null;let record=payload,candidates=["hook_event_name","hookEventName","event_name","event"];for(let key of candidates){let value=record[key];if(typeof value=="string"&&value.trim().length>0)return value.trim()}return null}function mapClaudeHookEventToSemanticType(eventName){switch(eventName){case"SessionStart":return"run.started";case"SessionEnd":return"run.stopped";case"Stop":return null;case"SubagentStop":return null;case"Notification":return"agent.notification";case"PreToolUse":return"tool.intent";default:return null}}var REQUIRED_IDENTITY_ENV=["BAPI_CONDUCTOR_RUN_ID","BAPI_CONDUCTOR_WORKER_ID","BAPI_CONDUCTOR_TICKET_KEY","BAPI_CONDUCTOR_WORKTREE_PATH"];function nonEmpty(value){return typeof value=="string"&&value.trim().length>0}function buildClaudeHookConductorEvent(payload,env){let eventName=resolveClaudeHookEventName(payload),type=mapClaudeHookEventToSemanticType(eventName);if(type===null||env.BAPI_CONDUCTOR_ENABLED!=="1")return null;for(let key of REQUIRED_IDENTITY_ENV)if(!nonEmpty(env[key]))return null;let ticketKey=env.BAPI_CONDUCTOR_TICKET_KEY.trim(),worktreePath=env.BAPI_CONDUCTOR_WORKTREE_PATH.trim(),details={ticket_key:ticketKey,worktree_path:worktreePath};nonEmpty(env.BAPI_CONDUCTOR_REPO_NAME)&&(details.repo=env.BAPI_CONDUCTOR_REPO_NAME.trim());let raw=payload!==null&&typeof payload=="object"&&!Array.isArray(payload)?payload:{payload};return{source:"claude-code",type,subject:ticketKey,run_id:env.BAPI_CONDUCTOR_RUN_ID.trim(),worker_id:env.BAPI_CONDUCTOR_WORKER_ID.trim(),producer:"claude-code-hook",observed_via:"claude-code-hook",data:{details,raw}}}function buildConductorEmitEventArgs(event){let args=["--type",event.type,"--source",event.source];return nonEmpty(event.subject??void 0)&&args.push("--subject",event.subject),nonEmpty(event.run_id??void 0)&&args.push("--run-id",event.run_id),nonEmpty(event.worker_id??void 0)&&args.push("--worker-id",event.worker_id),nonEmpty(event.producer??void 0)&&args.push("--producer",event.producer),nonEmpty(event.observed_via??void 0)&&args.push("--observed-via",event.observed_via),args.push("--data-json-stdin","--json"),args}function resolveConductorEmitCommand(env,emitArgs){let cliFile=env.BAPI_CONDUCTOR_CLI_FILE;return nonEmpty(cliFile)?{command:process.execPath,args:[cliFile.trim(),"emit-event",...emitArgs]}:{command:nonEmpty(env.BAPI_CONDUCTOR_BIN)?env.BAPI_CONDUCTOR_BIN.trim():"epic-implementer",args:["emit-event",...emitArgs]}}var defaultConductorSpawn=(command,args,input)=>{let result=spawnSync(command,args,{input,encoding:"utf-8",shell:!1});return{status:result.status,error:result.error}};function emitClaudeHookEventWithConductorCli(event,deps={}){let env=deps.env??process.env,spawn=deps.spawn??defaultConductorSpawn,emitArgs=buildConductorEmitEventArgs(event),{command,args}=resolveConductorEmitCommand(env,emitArgs),stdinPayload=JSON.stringify(event.data??{});try{let result=spawn(command,args,stdinPayload);return result.error?!1:result.status===0}catch{return!1}}function runClaudeConductorHookCli(deps={}){let env=deps.env??process.env,readStdin=deps.readStdin??(()=>readStdinSync()),warn=deps.warn??(m=>process.stderr.write(`${m}
-`)),payload;try{let raw=readStdin();payload=JSON.parse(raw)}catch{return warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}let event;try{event=buildClaudeHookConductorEvent(payload,env)}catch{return warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}return event===null||emitClaudeHookEventWithConductorCli(event,{env,spawn:deps.spawn})||warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}function readStdinSync(){return readFileSync(0,"utf-8")}function runEpicImplementerClaudeHookBin(deps={}){let handler=deps.handler??runClaudeConductorHookCli,exit=deps.exit??process.exit.bind(process),exitCode=0;try{exitCode=handler()}catch{exitCode=0}exit(exitCode)}var invokedDirectly=process.argv[1]!==void 0&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);invokedDirectly&&runEpicImplementerClaudeHookBin();export{runEpicImplementerClaudeHookBin};
+import path from"node:path";import{fileURLToPath}from"node:url";import{spawnSync}from"node:child_process";import{readFileSync}from"node:fs";var CONDUCTOR_HOOK_EMIT_FAILED_WARNING="Warning: conductor hook emit failed.";function resolveClaudeHookEventName(payload){if(payload===null||typeof payload!="object"||Array.isArray(payload))return null;let record=payload,candidates=["hook_event_name","hookEventName","event_name","event"];for(let key of candidates){let value=record[key];if(typeof value=="string"&&value.trim().length>0)return value.trim()}return null}function mapClaudeHookEventToSemanticType(eventName){switch(eventName){case"SessionStart":return"run.started";case"SessionEnd":return"run.stopped";case"Stop":return null;case"SubagentStop":return null;case"Notification":return"agent.notification";case"PreToolUse":return"tool.intent";default:return null}}var REQUIRED_IDENTITY_ENV=["BAPI_EPIC_IMPLEMENTER_RUN_ID","BAPI_EPIC_IMPLEMENTER_WORKER_ID","BAPI_EPIC_IMPLEMENTER_TICKET_KEY","BAPI_EPIC_IMPLEMENTER_WORKTREE_PATH"];function nonEmpty(value){return typeof value=="string"&&value.trim().length>0}function buildClaudeHookConductorEvent(payload,env){let eventName=resolveClaudeHookEventName(payload),type=mapClaudeHookEventToSemanticType(eventName);if(type===null||env.BAPI_EPIC_IMPLEMENTER_ENABLED!=="1")return null;for(let key of REQUIRED_IDENTITY_ENV)if(!nonEmpty(env[key]))return null;let ticketKey=env.BAPI_EPIC_IMPLEMENTER_TICKET_KEY.trim(),worktreePath=env.BAPI_EPIC_IMPLEMENTER_WORKTREE_PATH.trim(),details={ticket_key:ticketKey,worktree_path:worktreePath};nonEmpty(env.BAPI_EPIC_IMPLEMENTER_REPO_NAME)&&(details.repo=env.BAPI_EPIC_IMPLEMENTER_REPO_NAME.trim());let raw=payload!==null&&typeof payload=="object"&&!Array.isArray(payload)?payload:{payload};return{source:"claude-code",type,subject:ticketKey,run_id:env.BAPI_EPIC_IMPLEMENTER_RUN_ID.trim(),worker_id:env.BAPI_EPIC_IMPLEMENTER_WORKER_ID.trim(),producer:"claude-code-hook",observed_via:"claude-code-hook",data:{details,raw}}}function buildConductorEmitEventArgs(event){let args=["--type",event.type,"--source",event.source];return nonEmpty(event.subject??void 0)&&args.push("--subject",event.subject),nonEmpty(event.run_id??void 0)&&args.push("--run-id",event.run_id),nonEmpty(event.worker_id??void 0)&&args.push("--worker-id",event.worker_id),nonEmpty(event.producer??void 0)&&args.push("--producer",event.producer),nonEmpty(event.observed_via??void 0)&&args.push("--observed-via",event.observed_via),args.push("--data-json-stdin","--json"),args}function resolveConductorEmitCommand(env,emitArgs){let cliFile=env.BAPI_EPIC_IMPLEMENTER_CLI_FILE;return nonEmpty(cliFile)?{command:process.execPath,args:[cliFile.trim(),"emit-event",...emitArgs]}:{command:nonEmpty(env.BAPI_EPIC_IMPLEMENTER_BIN)?env.BAPI_EPIC_IMPLEMENTER_BIN.trim():"epic-implementer",args:["emit-event",...emitArgs]}}var defaultConductorSpawn=(command,args,input)=>{let result=spawnSync(command,args,{input,encoding:"utf-8",shell:!1});return{status:result.status,error:result.error}};function emitClaudeHookEventWithConductorCli(event,deps={}){let env=deps.env??process.env,spawn=deps.spawn??defaultConductorSpawn,emitArgs=buildConductorEmitEventArgs(event),{command,args}=resolveConductorEmitCommand(env,emitArgs),stdinPayload=JSON.stringify(event.data??{});try{let result=spawn(command,args,stdinPayload);return result.error?!1:result.status===0}catch{return!1}}function runClaudeConductorHookCli(deps={}){let env=deps.env??process.env,readStdin=deps.readStdin??(()=>readStdinSync()),warn=deps.warn??(m=>process.stderr.write(`${m}
+`)),payload;try{let raw=readStdin();payload=JSON.parse(raw)}catch{return warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}let event;try{event=buildClaudeHookConductorEvent(payload,env)}catch{return warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}return event===null||emitClaudeHookEventWithConductorCli(event,{env,spawn:deps.spawn})||warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}function readStdinSync(){return readFileSync(0,"utf-8")}var LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX="BAPI_CONDUCTOR_",EPIC_IMPLEMENTER_ENV_PREFIX="BAPI_EPIC_IMPLEMENTER_",LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV="CONDUCTOR_NODE_PATH",EPIC_IMPLEMENTER_NODE_PATH_ENV="EPIC_IMPLEMENTER_NODE_PATH",renamed=suffix=>[`${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX}${suffix}`,{kind:"renamed",successor:`${EPIC_IMPLEMENTER_ENV_PREFIX}${suffix}`}],RENAMED_SUFFIXES=["ALLOW_LIVE_SOURCE_DISPATCH","BIN","BUSY_TIMEOUT_MS","CLI_FILE","DEAD_AFTER_MS","DECLARED_TOUCHED_FILES_JSON","DENY_PROBE_TIMEOUT_MS","DISPATCH_DRY_RUN","ENABLE_PRE_TOOL_USE","ENABLED","EPIC_KEY","EPIC_RUN_ID","ESCALATION_COOLDOWN_MS","GATE_NAME","GLOBAL_TIMEOUT_MS","HOOK_COMMAND","LIVE_SOURCE_PATH","LIVENESS_STALLED_AFTER_MS","MESSAGE_COOLDOWN_MS","PLAN_VERSION","QUIET_AFTER_MS","REPO_NAME","RETENTION_DAYS","RETENTION_MAX_ROWS","RUN_ID","STALL_ACTIVE_MS","STALL_BLOCKED_MS","STALL_CANDIDATE_DONE_MS","STALL_NOT_STARTED_MS","STALL_STALLED_MS","STALL_UNKNOWN_MS","STALL_VERIFYING_MS","SUPERVISOR_MODE","SUPERVISOR_POLL_LIMIT","TICKET_KEY","WAKE_INTERVAL_MS","WORKER_ID","WORKTREE_PATH"],LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS=new Map([...RENAMED_SUFFIXES.map(renamed),[`${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX}ALLOW_CLAUDE_MCP_SHADOWING`,{kind:"retired"}],[LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV,{kind:"renamed",successor:EPIC_IMPLEMENTER_NODE_PATH_ENV}],["CONDUCTOR_DEAD_MAN_ONLY",{kind:"renamed",successor:"EPIC_IMPLEMENTER_DEAD_MAN_ONLY"}],["CONDUCTOR_DEADMAN_CHANNEL_TYPE",{kind:"renamed",successor:"EPIC_IMPLEMENTER_DEADMAN_CHANNEL_TYPE"}],["CONDUCTOR_DEADMAN_DESTINATION_REF",{kind:"renamed",successor:"EPIC_IMPLEMENTER_DEADMAN_DESTINATION_REF"}]]);function isLegacyEpicImplementerEnvKey(key){return key.startsWith(LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX)||key===LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV||key==="CONDUCTOR_DEAD_MAN_ONLY"||key==="CONDUCTOR_DEADMAN_CHANNEL_TYPE"||key==="CONDUCTOR_DEADMAN_DESTINATION_REF"}function findLegacyEpicImplementerEnv(env){return Object.keys(env).filter(isLegacyEpicImplementerEnvKey).sort((a,b)=>a<b?-1:a>b?1:0).map(key=>({key,mapping:LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS.get(key)??null}))}var LEGACY_EPIC_IMPLEMENTER_ENV_ERROR_HEADER="Error: legacy Conductor environment variables are set. They were renamed to the Epic Implementer names and are no longer read. Update or remove each one, then retry:";function describeFinding(finding){let{key,mapping}=finding;return mapping===null?`  ${key}: unknown legacy setting. If it is still a current setting, rename the ${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX} prefix to ${EPIC_IMPLEMENTER_ENV_PREFIX}; otherwise remove it.`:mapping.kind==="retired"?`  ${key}: retired with no replacement. Remove it.`:`  ${key} -> ${mapping.successor}`}function formatLegacyEpicImplementerEnvError(findings){return[LEGACY_EPIC_IMPLEMENTER_ENV_ERROR_HEADER,...findings.map(describeFinding)].join(`
+`)+`
+`}function runLegacyEpicImplementerEnvPreflight(env,writeStderr){let findings=findLegacyEpicImplementerEnv(env);return findings.length===0?0:(writeStderr(formatLegacyEpicImplementerEnvError(findings)),1)}function runEpicImplementerClaudeHookBin(deps={}){let handler=deps.handler??runClaudeConductorHookCli,exit=deps.exit??process.exit.bind(process),writeStderr=deps.writeStderr??(chunk=>process.stderr.write(chunk));if(runLegacyEpicImplementerEnvPreflight(deps.env??process.env,writeStderr)!==0){exit(0);return}let exitCode=0;try{exitCode=handler()}catch{exitCode=0}exit(exitCode)}var invokedDirectly=process.argv[1]!==void 0&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);invokedDirectly&&runEpicImplementerClaudeHookBin();export{runEpicImplementerClaudeHookBin};

package/build/epic-implementer-env.js

@@ -0,0 +1,184 @@
+/**
+ * Legacy Epic Implementer environment guard (BAPI-1190).
+ *
+ * Every TypeScript `BAPI_CONDUCTOR_*` environment variable was renamed to
+ * `BAPI_EPIC_IMPLEMENTER_*`, and the worker Node-path variable
+ * `CONDUCTOR_NODE_PATH` to `EPIC_IMPLEMENTER_NODE_PATH`. The rule is a pure
+ * token swap: replace `CONDUCTOR` with `EPIC_IMPLEMENTER` and keep the rest of
+ * the name. There are no compatibility aliases and no dual reads (epic rule
+ * R-3, clean break).
+ *
+ * A clean break must not be a silent one. An operator who still exports an old
+ * name would otherwise see the setting quietly ignored. So every guarded
+ * process entry point calls {@link runLegacyEpicImplementerEnvPreflight} before
+ * any side effect, and refuses to start when an old name is present.
+ *
+ * Contract:
+ *   - Detection is prefix-based for the `BAPI_CONDUCTOR_*` family: ANY key with
+ *     that prefix is rejected, whether or not the table below knows it.
+ *     `CONDUCTOR_NODE_PATH` and the three dead-man names below are rejected by
+ *     EXACT NAME only — none of them has a `BAPI_` prefix, and no `^CONDUCTOR_`
+ *     prefix rule exists or is ever added, so unrelated `CONDUCTOR`-containing
+ *     tokens (`CONDUCTOR_FETCH_TIMEOUT_MS`, `BRIDGE_CONDUCTOR_HOOK_START`,
+ *     `CURRENT_CONDUCTOR_SCHEMA_VERSION`) are never checked.
+ *   - A key is rejected on presence alone, whatever its value (including empty).
+ *   - All offending keys are reported in one message, sorted by code point.
+ *   - Diagnostics carry key names only. An env value is never read into the
+ *     findings, so it can never be printed — these variables can hold secrets.
+ *   - The env is injectable, so tests never mutate the real process environment.
+ *
+ * This module is the ONLY non-test source file allowed to spell an old name —
+ * including the three dead-man names below, which are otherwise Python's own
+ * exact-name contract (BAPI-1231, `api/library/epic_implementer/legacy_env_guard.py`).
+ * Sharing the mapping here (BAPI-1237) lets one plane preflight check cover the
+ * TypeScript-side entry points too, instead of leaving them enforced only at
+ * Python worker boot.
+ */
+/** Legacy env-var prefix. Any key with this prefix is refused. */
+export const LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX = "BAPI_CONDUCTOR_";
+/** Supported env-var prefix that replaced {@link LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX}. */
+export const EPIC_IMPLEMENTER_ENV_PREFIX = "BAPI_EPIC_IMPLEMENTER_";
+/** Legacy worker Node-path variable, refused by exact name. */
+export const LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV = "CONDUCTOR_NODE_PATH";
+/** Supported worker Node-path variable that replaced {@link LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV}. */
+export const EPIC_IMPLEMENTER_NODE_PATH_ENV = "EPIC_IMPLEMENTER_NODE_PATH";
+const renamed = (suffix) => [
+    `${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX}${suffix}`,
+    { kind: "renamed", successor: `${EPIC_IMPLEMENTER_ENV_PREFIX}${suffix}` },
+];
+/**
+ * The 38 live renamed `BAPI_CONDUCTOR_*` suffixes, as inventoried from non-test
+ * `mcp_server/src/**\/*.ts` at HEAD `45d854081` (re-confirmed at `315572187`).
+ *
+ * Deliberately absent: `PUBLISHED_IDENTITY_FIXTURE` (removed from source), the
+ * retired `LLM_*` names (their literals are forbidden in production source by
+ * `supervisor-retired-judgment.static.test.ts`), and test-only sentinels. All of
+ * those still fall through to the generic prefix pointer.
+ *
+ * These 38 prefix-derived suffixes are distinct from the three BAPI-1237
+ * exact-name dead-man entries added directly to
+ * {@link LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS} below: the dead-man names carry no
+ * `BAPI_CONDUCTOR_` prefix at all, so they cannot be expressed as a suffix here.
+ */
+const RENAMED_SUFFIXES = [
+    "ALLOW_LIVE_SOURCE_DISPATCH",
+    "BIN",
+    "BUSY_TIMEOUT_MS",
+    "CLI_FILE",
+    "DEAD_AFTER_MS",
+    "DECLARED_TOUCHED_FILES_JSON",
+    "DENY_PROBE_TIMEOUT_MS",
+    "DISPATCH_DRY_RUN",
+    "ENABLE_PRE_TOOL_USE",
+    "ENABLED",
+    "EPIC_KEY",
+    "EPIC_RUN_ID",
+    "ESCALATION_COOLDOWN_MS",
+    "GATE_NAME",
+    "GLOBAL_TIMEOUT_MS",
+    "HOOK_COMMAND",
+    "LIVE_SOURCE_PATH",
+    "LIVENESS_STALLED_AFTER_MS",
+    "MESSAGE_COOLDOWN_MS",
+    "PLAN_VERSION",
+    "QUIET_AFTER_MS",
+    "REPO_NAME",
+    "RETENTION_DAYS",
+    "RETENTION_MAX_ROWS",
+    "RUN_ID",
+    "STALL_ACTIVE_MS",
+    "STALL_BLOCKED_MS",
+    "STALL_CANDIDATE_DONE_MS",
+    "STALL_NOT_STARTED_MS",
+    "STALL_STALLED_MS",
+    "STALL_UNKNOWN_MS",
+    "STALL_VERIFYING_MS",
+    "SUPERVISOR_MODE",
+    "SUPERVISOR_POLL_LIMIT",
+    "TICKET_KEY",
+    "WAKE_INTERVAL_MS",
+    "WORKER_ID",
+    "WORKTREE_PATH",
+];
+/**
+ * Old name -> resolution. Exactly 43 keys: the 38 `BAPI_CONDUCTOR_*`
+ * prefix-derived renamed names above, the retired shadowing override (inert
+ * since BAPI-790; this supersedes that ticket's "no error" promise), the
+ * exact-name node-path variable, and the three BAPI-1237 exact-name dead-man
+ * entries shared with the Python guard's `LEGACY_DEADMAN_ENV_RENAMES`
+ * (`api/library/epic_implementer/legacy_env_guard.py`).
+ */
+export const LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS = new Map([
+    ...RENAMED_SUFFIXES.map(renamed),
+    [`${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX}ALLOW_CLAUDE_MCP_SHADOWING`, { kind: "retired" }],
+    [
+        LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV,
+        { kind: "renamed", successor: EPIC_IMPLEMENTER_NODE_PATH_ENV },
+    ],
+    // BAPI-1237 — the three Python dead-man names (BAPI-1231), added here so
+    // this shared table is the single cross-runtime source of truth. Exact-name
+    // only, like CONDUCTOR_NODE_PATH above: none of these has a BAPI_ prefix.
+    ["CONDUCTOR_DEAD_MAN_ONLY", { kind: "renamed", successor: "EPIC_IMPLEMENTER_DEAD_MAN_ONLY" }],
+    [
+        "CONDUCTOR_DEADMAN_CHANNEL_TYPE",
+        { kind: "renamed", successor: "EPIC_IMPLEMENTER_DEADMAN_CHANNEL_TYPE" },
+    ],
+    [
+        "CONDUCTOR_DEADMAN_DESTINATION_REF",
+        { kind: "renamed", successor: "EPIC_IMPLEMENTER_DEADMAN_DESTINATION_REF" },
+    ],
+]);
+/** True when `key` is a legacy env name this guard refuses. */
+export function isLegacyEpicImplementerEnvKey(key) {
+    return (key.startsWith(LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX) ||
+        key === LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV ||
+        // BAPI-1237 — exact-name only, like CONDUCTOR_NODE_PATH above. No
+        // `^CONDUCTOR_` prefix rule is introduced by these three comparisons.
+        key === "CONDUCTOR_DEAD_MAN_ONLY" ||
+        key === "CONDUCTOR_DEADMAN_CHANNEL_TYPE" ||
+        key === "CONDUCTOR_DEADMAN_DESTINATION_REF");
+}
+/**
+ * Pure finder: env in, sorted findings out. Reads keys only, so a key is found
+ * on presence even when its value is `undefined` or empty.
+ */
+export function findLegacyEpicImplementerEnv(env) {
+    return Object.keys(env)
+        .filter(isLegacyEpicImplementerEnvKey)
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
+        .map((key) => ({ key, mapping: LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS.get(key) ?? null }));
+}
+/** Fixed first line of the refusal. */
+export const LEGACY_EPIC_IMPLEMENTER_ENV_ERROR_HEADER = "Error: legacy Conductor environment variables are set. They were renamed to the Epic Implementer names and are no longer read. Update or remove each one, then retry:";
+function describeFinding(finding) {
+    const { key, mapping } = finding;
+    if (mapping === null) {
+        return (`  ${key}: unknown legacy setting. If it is still a current setting, rename the ` +
+            `${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX} prefix to ${EPIC_IMPLEMENTER_ENV_PREFIX}; otherwise remove it.`);
+    }
+    if (mapping.kind === "retired") {
+        return `  ${key}: retired with no replacement. Remove it.`;
+    }
+    return `  ${key} -> ${mapping.successor}`;
+}
+/**
+ * Format the refusal: one fixed header, one line per finding (in the order
+ * given), and a trailing newline. Only key names and table metadata appear.
+ */
+export function formatLegacyEpicImplementerEnvError(findings) {
+    return [LEGACY_EPIC_IMPLEMENTER_ENV_ERROR_HEADER, ...findings.map(describeFinding)].join("\n") + "\n";
+}
+/**
+ * Process-entry preflight. On a hit, writes the complete diagnostic to
+ * `writeStderr` exactly once and returns `1`; otherwise writes nothing and
+ * returns `0`. It never exits, throws, or touches the filesystem, network, or
+ * the global process environment — the caller owns the exit code (the Claude hook bin
+ * deliberately exits `0` on a hit).
+ */
+export function runLegacyEpicImplementerEnvPreflight(env, writeStderr) {
+    const findings = findLegacyEpicImplementerEnv(env);
+    if (findings.length === 0)
+        return 0;
+    writeStderr(formatLegacyEpicImplementerEnvError(findings));
+    return 1;
+}

package/build/epic-integration-pr.js

@@ -7,7 +7,7 @@
  * branches" 422 from a credential or provider failure — both of which this
  * helper must classify without throwing.
  *
- * A draft PR still receives the `conductor-ci / gate` required check (BAPI-949's
+ * A draft PR still receives the `epic-implementer-ci / gate` required check (BAPI-949's
  * trigger has no draft exclusion), while `claude-review.yml` excludes drafts
  * until the PR is marked ready. So opening the integration PR as a draft earns
  * the epic branch its required CI immediately, without paying for a paid review
@@ -62,7 +62,7 @@ export function buildEpicIntegrationPullRequestBody(epicKey, command) {
     return [
         `\`${command}\` opened this pull request automatically.`,
         "",
-        `It exists so the \`conductor-ci / gate\` required check runs for the ${epicKey} ` +
+        `It exists so the \`epic-implementer-ci / gate\` required check runs for the ${epicKey} ` +
             "epic integration branch (BAPI-949). Draft status postpones the paid Claude " +
             "review until a human marks this pull request ready for review.",
         "",

package/build/executor/ci-rerun-job.js

@@ -0,0 +1,269 @@
+/**
+ * Deterministic `ci_rerun` executor job (BAPI-1160).
+ *
+ * Re-runs ONE failed workflow run whose failure the SERVER already proved to be
+ * infrastructure rather than code. It has no worktree, no branch, no prompt, and
+ * no worker: it validates a server-authored payload, invokes
+ * `gh run rerun --failed <run_id> --repo <owner/repo>` through the executor's
+ * ambient `gh`, polls the run under a bounded deadline, and reports a FACT
+ * ENVELOPE.
+ *
+ * Three properties are load-bearing, and each exists because its absence caused
+ * or would cause a real failure:
+ *
+ * 1. **No transition authority (R14 rule 3).** The envelope carries a run id, a
+ *    conductor attempt, a lane, an observed conclusion, and optionally the
+ *    provider's own run-attempt counter. It carries NO verdict, gate name, or
+ *    requested transition, and the backend model is `extra="forbid"` so one
+ *    cannot be smuggled in. Successful actuation is not a CI verdict: the
+ *    ordinary CI observer must independently re-observe the current head before
+ *    the `ci` gate may move, exactly as it would had a human re-run the lane.
+ *
+ * 2. **The claude-review workflow is never re-run.** That workflow joins a
+ *    per-PR concurrency group with `cancel-in-progress: true`, so re-running it
+ *    could CANCEL a legitimately in-flight review of a NEWER head. The rendered
+ *    workflow is pinned never to contain `gh run rerun` for this reason; this
+ *    job enforces the other half, refusing any payload or looked-up run that
+ *    identifies it — BEFORE any subprocess is invoked.
+ *
+ * 3. **Ambient `gh` authentication only.** The Bridge GitHub App is
+ *    `contents: read` and gains no `actions: write` for this feature. The re-run
+ *    is actuated by the executor machine's own `gh`, so no token, credential
+ *    bundle, or environment credential is injected, added to argv, or returned.
+ *
+ * Diagnostics go to `console.error` only. MCP stdout is a protocol channel and
+ * writing child output to it corrupts the session.
+ */
+import { createProductionEpicIntegrationGhRunner, } from "../epic-integration-pr.js";
+import { CLAUDE_REVIEW_WORKFLOW_RELPATH } from "../claude-review-workflow-drift.js";
+/** Machine-readable, sanitized failure kinds for a refused or failed re-run. */
+export const CI_RERUN_REFUSED = "CiRerunRefused";
+export const CI_RERUN_FAILED = "CiRerunFailed";
+/** Bounded deadline for the post-rerun poll. */
+export const CI_RERUN_POLL_DEADLINE_MS = 3 * 60 * 1000;
+/** Interval between bounded poll reads. */
+export const CI_RERUN_POLL_INTERVAL_MS = 10 * 1000;
+/** Per-`gh`-invocation timeout. */
+export const CI_RERUN_GH_TIMEOUT_MS = 60 * 1000;
+const OWNER_REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+const CLAUDE_REVIEW_WORKFLOW_BASENAME = CLAUDE_REVIEW_WORKFLOW_RELPATH.split("/").pop() ?? "claude-review.yml";
+/**
+ * True when a workflow identity names the claude-review workflow.
+ *
+ * Matches on the workflow file BASENAME and on the conventional display name, so
+ * a `path` (`.github/workflows/claude-review.yml`) and a `name`
+ * (`claude-review`) are both recognized. Deliberately permissive in the REFUSING
+ * direction: a false positive costs one un-actuated re-run, while a false
+ * negative could cancel a real review of a newer head.
+ */
+export function identifiesClaudeReviewWorkflow(identity) {
+    if (typeof identity !== "string")
+        return false;
+    const normalized = identity.trim().toLowerCase();
+    if (!normalized)
+        return false;
+    return (normalized.endsWith(CLAUDE_REVIEW_WORKFLOW_BASENAME.toLowerCase()) ||
+        normalized.includes("claude-review") ||
+        normalized.includes("claude review"));
+}
+/**
+ * Validate a raw server payload into typed fields, SYNCHRONOUSLY and before any
+ * subprocess is invoked.
+ *
+ * Fails closed on every unusable shape. A job that cannot prove what it is about
+ * to re-run must not run `gh` and then discover the problem — that is how a
+ * malformed payload becomes a re-run of the wrong workflow.
+ */
+export function parseCiRerunPayload(payload) {
+    const refuse = (reason) => ({ ok: false, failure: { errorKind: CI_RERUN_REFUSED, reason } });
+    if (typeof payload !== "object" || payload === null) {
+        return refuse("payload_not_an_object");
+    }
+    const raw = payload;
+    const repoFullName = raw.repo_full_name;
+    if (typeof repoFullName !== "string" || !OWNER_REPO_RE.test(repoFullName.trim())) {
+        return refuse("repo_full_name_invalid");
+    }
+    const workflowRunId = raw.workflow_run_id;
+    if (typeof workflowRunId !== "number" ||
+        !Number.isInteger(workflowRunId) ||
+        workflowRunId <= 0) {
+        return refuse("workflow_run_id_invalid");
+    }
+    const lane = raw.required_check_lane;
+    if (typeof lane !== "string" || !lane.trim()) {
+        return refuse("required_check_lane_missing");
+    }
+    const attempt = raw.conductor_infra_attempt;
+    if (typeof attempt !== "number" || !Number.isInteger(attempt) || attempt <= 0) {
+        return refuse("conductor_infra_attempt_invalid");
+    }
+    const identityRaw = raw.workflow_identity;
+    const workflowIdentity = typeof identityRaw === "string" && identityRaw.trim() ? identityRaw.trim() : null;
+    // The review-workflow refusal, evaluated on the SERVER-SUPPLIED identity and
+    // on the lane name, before any subprocess exists.
+    if (identifiesClaudeReviewWorkflow(workflowIdentity) ||
+        identifiesClaudeReviewWorkflow(lane)) {
+        return refuse("claude_review_workflow_refused");
+    }
+    return {
+        ok: true,
+        fields: {
+            repoFullName: repoFullName.trim().toLowerCase(),
+            workflowRunId,
+            requiredCheckLane: lane.trim(),
+            conductorInfraAttempt: attempt,
+            workflowIdentity,
+        },
+    };
+}
+function parseRunView(stdout) {
+    let decoded;
+    try {
+        decoded = JSON.parse(stdout);
+    }
+    catch {
+        return null;
+    }
+    if (typeof decoded !== "object" || decoded === null)
+        return null;
+    const raw = decoded;
+    const str = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+    const repo = raw.repository;
+    return {
+        name: str(raw.name),
+        path: str(raw.path) ?? str(raw.workflowName),
+        status: str(raw.status),
+        conclusion: str(raw.conclusion),
+        runAttempt: typeof raw.attempt === "number" && Number.isInteger(raw.attempt) && raw.attempt > 0
+            ? raw.attempt
+            : null,
+        repoFullName: typeof repo === "object" && repo !== null
+            ? str(repo.nameWithOwner)
+            : str(raw.repository),
+    };
+}
+const RUN_VIEW_FIELDS = "name,status,conclusion,attempt,workflowName";
+/**
+ * Run one deterministic `ci_rerun` job.
+ *
+ * Returns the fact envelope on success, or a sanitized failure. Never throws for
+ * a provider or process condition, and never returns provider text.
+ */
+export async function runCiRerunJob(payload, deps) {
+    const parsed = parseCiRerunPayload(payload);
+    if (!parsed.ok) {
+        console.error(`[ci_rerun] payload refused: ${parsed.failure.reason}`);
+        return parsed;
+    }
+    const fields = parsed.fields;
+    const gh = deps.gh;
+    const now = deps.now ?? (() => Date.now());
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const refuse = (reason) => {
+        console.error(`[ci_rerun] refused: ${reason}`);
+        return { ok: false, failure: { errorKind: CI_RERUN_REFUSED, reason } };
+    };
+    // A CONDITIONAL lookup. It is issued only when the server supplied no workflow
+    // identity, because then nothing yet proves the run is not the review
+    // workflow. When the server DID supply one, it was already checked above and a
+    // second read would buy nothing.
+    let view = null;
+    if (fields.workflowIdentity === null) {
+        const lookup = await gh([
+            "run",
+            "view",
+            String(fields.workflowRunId),
+            "--repo",
+            fields.repoFullName,
+            "--json",
+            RUN_VIEW_FIELDS,
+        ], { timeoutMs: CI_RERUN_GH_TIMEOUT_MS });
+        if (lookup.exitCode !== 0) {
+            return refuse("run_lookup_failed");
+        }
+        view = parseRunView(lookup.stdout);
+        if (view === null) {
+            return refuse("run_lookup_unreadable");
+        }
+        if (identifiesClaudeReviewWorkflow(view.name) ||
+            identifiesClaudeReviewWorkflow(view.path)) {
+            return refuse("claude_review_workflow_refused");
+        }
+        if (view.repoFullName !== null &&
+            view.repoFullName.toLowerCase() !== fields.repoFullName) {
+            return refuse("run_repository_mismatch");
+        }
+    }
+    // The actuation. An ARGUMENT ARRAY with `shell: false` (the injected runner's
+    // contract), so no value here is ever interpolated into a command line. No
+    // token, credential, or environment addition: `gh` uses the executor
+    // machine's ambient authentication and nothing else.
+    const rerun = await gh([
+        "run",
+        "rerun",
+        "--failed",
+        String(fields.workflowRunId),
+        "--repo",
+        fields.repoFullName,
+    ], { timeoutMs: CI_RERUN_GH_TIMEOUT_MS });
+    if (rerun.exitCode !== 0) {
+        // The reserved infrastructure attempt stays CONSUMED. A re-run that the
+        // provider refused is a spent attempt, not a free retry: treating it as free
+        // would let a permanently refusing provider buy unbounded jobs.
+        console.error(`[ci_rerun] rerun invocation failed (exit=${rerun.exitCode ?? "null"}` +
+            `${rerun.timedOut ? ", timed out" : ""})`);
+        return {
+            ok: false,
+            failure: {
+                errorKind: CI_RERUN_FAILED,
+                reason: rerun.timedOut ? "rerun_timed_out" : "rerun_invocation_failed",
+            },
+        };
+    }
+    // Bounded poll for the conclusion. An expired deadline is a REPORTABLE
+    // outcome, not a failure: the re-run was actuated, the attempt was spent, and
+    // the server re-observes the head on its own schedule either way.
+    const deadline = now() + CI_RERUN_POLL_DEADLINE_MS;
+    let observedConclusion = null;
+    let providerRunAttempt = view?.runAttempt ?? null;
+    while (now() < deadline) {
+        await sleep(CI_RERUN_POLL_INTERVAL_MS);
+        const poll = await gh([
+            "run",
+            "view",
+            String(fields.workflowRunId),
+            "--repo",
+            fields.repoFullName,
+            "--json",
+            RUN_VIEW_FIELDS,
+        ], { timeoutMs: CI_RERUN_GH_TIMEOUT_MS });
+        if (poll.exitCode !== 0)
+            continue;
+        const polled = parseRunView(poll.stdout);
+        if (polled === null)
+            continue;
+        if (polled.runAttempt !== null)
+            providerRunAttempt = polled.runAttempt;
+        if (polled.status === "completed") {
+            observedConclusion = polled.conclusion;
+            break;
+        }
+    }
+    const result = {
+        run_id: fields.workflowRunId,
+        conductor_attempt: fields.conductorInfraAttempt,
+        lane: fields.requiredCheckLane,
+        observed_conclusion: observedConclusion,
+    };
+    if (providerRunAttempt !== null) {
+        result.provider_run_attempt = providerRunAttempt;
+    }
+    console.error(`[ci_rerun] run=${fields.workflowRunId} attempt=${fields.conductorInfraAttempt} ` +
+        `conclusion=${observedConclusion ?? "pending"}`);
+    return { ok: true, result };
+}
+/** Production dependency bundle: the existing bounded `execFile`-based runner. */
+export function createProductionCiRerunDeps() {
+    return { gh: createProductionEpicIntegrationGhRunner() };
+}

package/build/executor/cli.js

@@ -13,6 +13,7 @@ import { resolveStartTicketsRepoName } from "../start-tickets-repo.js";
 import { DEFAULT_EXECUTOR_AGENT_ID } from "./agent-identity.js";
 import { executorEpicRunIdRefusal, isValidExecutorEpicRunId, validateExecutorClaimScope, } from "./claim-scope.js";
 import { createDefaultExecutorDeps } from "./deps.js";
+import { scrubExecutorProcessGithubCredentials } from "./env.js";
 import { resolveBaseUrl, resolveExecutorApiAccess, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
 import { createExecutorHttpClient } from "./http-client.js";
 import { startExecutorSleepAssertion } from "./platform.js";
@@ -78,6 +79,7 @@ export function parseExecutorArgs(argv, context) {
     const repos = [];
     const epicRunIds = [];
     let repoWide = false;
+    let scrubInheritedGithubCredentials = false;
     let executorId;
     let maxConcurrent = DEFAULT_MAX_CONCURRENT;
     let once = false;
@@ -123,6 +125,9 @@ export function parseExecutorArgs(argv, context) {
         else if (arg === "--repo-wide") {
             repoWide = true;
         }
+        else if (arg === "--scrub-inherited-github-credentials") {
+            scrubInheritedGithubCredentials = true;
+        }
         else if (arg === "--executor-id") {
             executorId = argv[++i];
             if (!executorId)
@@ -231,6 +236,9 @@ export function parseExecutorArgs(argv, context) {
         // BAPI-1026 (R54) — same "truly absent, never a falsy placeholder"
         // discipline: `repoWide` is either `true` or the key is missing.
         ...(repoWide ? { repoWide: true } : {}),
+        // BAPI-1137: absent unless explicitly requested, so an ordinary executor's
+        // options object is byte-for-byte what it was before this slice.
+        ...(scrubInheritedGithubCredentials ? { scrubInheritedGithubCredentials: true } : {}),
     };
     return { kind: "ok", options };
 }
@@ -290,6 +298,29 @@ export async function runExecutorCli(argv, overrides = {}) {
         return 1;
     }
     const options = parsed.options;
+    // BAPI-1137 (R-4) — scrub inherited GitHub write variables, when this process
+    // was asked to. This is the earliest point the request is KNOWN, and it is
+    // still ahead of everything that could observe or forward the credential:
+    // base-URL resolution, Bridge credential resolution, the HTTP client,
+    // preflight, worker spawn, and even the claim-scope status line below.
+    //
+    // OPT-IN, and that is the load-bearing part. The executor's own `merge` job
+    // reaches `gh` through this very object (`deps.env` is `process.env`, which
+    // `buildDefaultMergeLocalDeps` hands to `local-merge.ts`'s `ghEnv`), and a
+    // token in the environment is a supported `gh` auth mechanism. An
+    // unconditional scrub would therefore break `merge_execution_mode: local` on
+    // any host whose operator started the executor from a shell exporting
+    // `GH_TOKEN` — a working merge turned into `local_gh_unauthenticated`. The
+    // durable host sets the flag in its generated unit because it holds no
+    // standing GitHub write credential by design and its merges leave the host.
+    //
+    // `process.env` deliberately, not `deps.env`: the deps bundle may be a test
+    // fake, while the thing children inherit is the real process environment.
+    // Values are never read — only key names are matched — so nothing here can
+    // log or leak what it deleted.
+    if (options.scrubInheritedGithubCredentials === true) {
+        scrubExecutorProcessGithubCredentials(process.env);
+    }
     // BAPI-794/BAPI-1026 — startup diagnostics: a bounded MODE label and, when
     // scoped, only the COUNT of runs. Never credentials, job payloads, command
     // arguments — and, since BAPI-1026, never the run IDs either, matching the

package/build/executor/credentials.js

@@ -5,6 +5,17 @@
  * through the shared credential store (`resolveBapiCredentials`) — never by
  * reading worktree-local MCP config, and never leaking secret values into
  * diagnostics/results.
+ *
+ * BAPI-1137 (R-4) leaves that lookup exactly as it was — parent environment
+ * first, then the user-scoped `bapi:<repo>` store — and adds nothing beside it.
+ * This module resolves ONE credential for ONE purpose: authenticating the
+ * executor's own Bridge calls. It gains no GitHub bundle, no GitHub registration
+ * field, no GitHub CLI argument, and no GitHub-derived diagnostic value, which is
+ * what lets a durable host assert it holds no standing GitHub write credential.
+ * `CLAUDE_CODE_OAUTH_TOKEN` is not part of that assertion either way: it is
+ * host-local worker authentication the operator manages independently, Bridge
+ * never resolves or stores it, and `ANTHROPIC_API_KEY` remains absolutely denied
+ * to a worker (`executor/env.ts`).
  */
 import { resolveBapiCredentials } from "../credential-store.js";
 import { normalizeBaseUrlCandidate } from "../base-url.js";