@bridge_gpt/mcp-server 0.2.59 → 0.2.60

package/build/epic-implementer-claude-hook-bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 import path from"node:path";import{fileURLToPath}from"node:url";import{spawnSync}from"node:child_process";import{readFileSync}from"node:fs";var CONDUCTOR_HOOK_EMIT_FAILED_WARNING="Warning: conductor hook emit failed.";function resolveClaudeHookEventName(payload){if(payload===null||typeof payload!="object"||Array.isArray(payload))return null;let record=payload,candidates=["hook_event_name","hookEventName","event_name","event"];for(let key of candidates){let value=record[key];if(typeof value=="string"&&value.trim().length>0)return value.trim()}return null}function mapClaudeHookEventToSemanticType(eventName){switch(eventName){case"SessionStart":return"run.started";case"SessionEnd":return"run.stopped";case"Stop":return null;case"SubagentStop":return null;case"Notification":return"agent.notification";case"PreToolUse":return"tool.intent";default:return null}}var REQUIRED_IDENTITY_ENV=["BAPI_EPIC_IMPLEMENTER_RUN_ID","BAPI_EPIC_IMPLEMENTER_WORKER_ID","BAPI_EPIC_IMPLEMENTER_TICKET_KEY","BAPI_EPIC_IMPLEMENTER_WORKTREE_PATH"];function nonEmpty(value){return typeof value=="string"&&value.trim().length>0}function buildClaudeHookConductorEvent(payload,env){let eventName=resolveClaudeHookEventName(payload),type=mapClaudeHookEventToSemanticType(eventName);if(type===null||env.BAPI_EPIC_IMPLEMENTER_ENABLED!=="1")return null;for(let key of REQUIRED_IDENTITY_ENV)if(!nonEmpty(env[key]))return null;let ticketKey=env.BAPI_EPIC_IMPLEMENTER_TICKET_KEY.trim(),worktreePath=env.BAPI_EPIC_IMPLEMENTER_WORKTREE_PATH.trim(),details={ticket_key:ticketKey,worktree_path:worktreePath};nonEmpty(env.BAPI_EPIC_IMPLEMENTER_REPO_NAME)&&(details.repo=env.BAPI_EPIC_IMPLEMENTER_REPO_NAME.trim());let raw=payload!==null&&typeof payload=="object"&&!Array.isArray(payload)?payload:{payload};return{source:"claude-code",type,subject:ticketKey,run_id:env.BAPI_EPIC_IMPLEMENTER_RUN_ID.trim(),worker_id:env.BAPI_EPIC_IMPLEMENTER_WORKER_ID.trim(),producer:"claude-code-hook",observed_via:"claude-code-hook",data:{details,raw}}}function buildConductorEmitEventArgs(event){let args=["--type",event.type,"--source",event.source];return nonEmpty(event.subject??void 0)&&args.push("--subject",event.subject),nonEmpty(event.run_id??void 0)&&args.push("--run-id",event.run_id),nonEmpty(event.worker_id??void 0)&&args.push("--worker-id",event.worker_id),nonEmpty(event.producer??void 0)&&args.push("--producer",event.producer),nonEmpty(event.observed_via??void 0)&&args.push("--observed-via",event.observed_via),args.push("--data-json-stdin","--json"),args}function resolveConductorEmitCommand(env,emitArgs){let cliFile=env.BAPI_EPIC_IMPLEMENTER_CLI_FILE;return nonEmpty(cliFile)?{command:process.execPath,args:[cliFile.trim(),"emit-event",...emitArgs]}:{command:nonEmpty(env.BAPI_EPIC_IMPLEMENTER_BIN)?env.BAPI_EPIC_IMPLEMENTER_BIN.trim():"epic-implementer",args:["emit-event",...emitArgs]}}var defaultConductorSpawn=(command,args,input)=>{let result=spawnSync(command,args,{input,encoding:"utf-8",shell:!1});return{status:result.status,error:result.error}};function emitClaudeHookEventWithConductorCli(event,deps={}){let env=deps.env??process.env,spawn=deps.spawn??defaultConductorSpawn,emitArgs=buildConductorEmitEventArgs(event),{command,args}=resolveConductorEmitCommand(env,emitArgs),stdinPayload=JSON.stringify(event.data??{});try{let result=spawn(command,args,stdinPayload);return result.error?!1:result.status===0}catch{return!1}}function runClaudeConductorHookCli(deps={}){let env=deps.env??process.env,readStdin=deps.readStdin??(()=>readStdinSync()),warn=deps.warn??(m=>process.stderr.write(`${m}
-`)),payload;try{let raw=readStdin();payload=JSON.parse(raw)}catch{return warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}let event;try{event=buildClaudeHookConductorEvent(payload,env)}catch{return warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}return event===null||emitClaudeHookEventWithConductorCli(event,{env,spawn:deps.spawn})||warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}function readStdinSync(){return readFileSync(0,"utf-8")}var LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX="BAPI_CONDUCTOR_",EPIC_IMPLEMENTER_ENV_PREFIX="BAPI_EPIC_IMPLEMENTER_",LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV="CONDUCTOR_NODE_PATH",EPIC_IMPLEMENTER_NODE_PATH_ENV="EPIC_IMPLEMENTER_NODE_PATH",renamed=suffix=>[`${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX}${suffix}`,{kind:"renamed",successor:`${EPIC_IMPLEMENTER_ENV_PREFIX}${suffix}`}],RENAMED_SUFFIXES=["ALLOW_LIVE_SOURCE_DISPATCH","BIN","BUSY_TIMEOUT_MS","CLI_FILE","DEAD_AFTER_MS","DECLARED_TOUCHED_FILES_JSON","DENY_PROBE_TIMEOUT_MS","DISPATCH_DRY_RUN","ENABLE_PRE_TOOL_USE","ENABLED","EPIC_KEY","EPIC_RUN_ID","ESCALATION_COOLDOWN_MS","GATE_NAME","GLOBAL_TIMEOUT_MS","HOOK_COMMAND","LIVE_SOURCE_PATH","LIVENESS_STALLED_AFTER_MS","MESSAGE_COOLDOWN_MS","PLAN_VERSION","QUIET_AFTER_MS","REPO_NAME","RETENTION_DAYS","RETENTION_MAX_ROWS","RUN_ID","STALL_ACTIVE_MS","STALL_BLOCKED_MS","STALL_CANDIDATE_DONE_MS","STALL_NOT_STARTED_MS","STALL_STALLED_MS","STALL_UNKNOWN_MS","STALL_VERIFYING_MS","SUPERVISOR_MODE","SUPERVISOR_POLL_LIMIT","TICKET_KEY","WAKE_INTERVAL_MS","WORKER_ID","WORKTREE_PATH"],LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS=new Map([...RENAMED_SUFFIXES.map(renamed),[`${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX}ALLOW_CLAUDE_MCP_SHADOWING`,{kind:"retired"}],[LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV,{kind:"renamed",successor:EPIC_IMPLEMENTER_NODE_PATH_ENV}]]);function isLegacyEpicImplementerEnvKey(key){return key.startsWith(LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX)||key===LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV}function findLegacyEpicImplementerEnv(env){return Object.keys(env).filter(isLegacyEpicImplementerEnvKey).sort((a,b)=>a<b?-1:a>b?1:0).map(key=>({key,mapping:LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS.get(key)??null}))}var LEGACY_EPIC_IMPLEMENTER_ENV_ERROR_HEADER="Error: legacy Conductor environment variables are set. They were renamed to the Epic Implementer names and are no longer read. Update or remove each one, then retry:";function describeFinding(finding){let{key,mapping}=finding;return mapping===null?`  ${key}: unknown legacy setting. If it is still a current setting, rename the ${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX} prefix to ${EPIC_IMPLEMENTER_ENV_PREFIX}; otherwise remove it.`:mapping.kind==="retired"?`  ${key}: retired with no replacement. Remove it.`:`  ${key} -> ${mapping.successor}`}function formatLegacyEpicImplementerEnvError(findings){return[LEGACY_EPIC_IMPLEMENTER_ENV_ERROR_HEADER,...findings.map(describeFinding)].join(`
+`)),payload;try{let raw=readStdin();payload=JSON.parse(raw)}catch{return warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}let event;try{event=buildClaudeHookConductorEvent(payload,env)}catch{return warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}return event===null||emitClaudeHookEventWithConductorCli(event,{env,spawn:deps.spawn})||warn(CONDUCTOR_HOOK_EMIT_FAILED_WARNING),0}function readStdinSync(){return readFileSync(0,"utf-8")}var LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX="BAPI_CONDUCTOR_",EPIC_IMPLEMENTER_ENV_PREFIX="BAPI_EPIC_IMPLEMENTER_",LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV="CONDUCTOR_NODE_PATH",EPIC_IMPLEMENTER_NODE_PATH_ENV="EPIC_IMPLEMENTER_NODE_PATH",renamed=suffix=>[`${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX}${suffix}`,{kind:"renamed",successor:`${EPIC_IMPLEMENTER_ENV_PREFIX}${suffix}`}],RENAMED_SUFFIXES=["ALLOW_LIVE_SOURCE_DISPATCH","BIN","BUSY_TIMEOUT_MS","CLI_FILE","DEAD_AFTER_MS","DECLARED_TOUCHED_FILES_JSON","DENY_PROBE_TIMEOUT_MS","DISPATCH_DRY_RUN","ENABLE_PRE_TOOL_USE","ENABLED","EPIC_KEY","EPIC_RUN_ID","ESCALATION_COOLDOWN_MS","GATE_NAME","GLOBAL_TIMEOUT_MS","HOOK_COMMAND","LIVE_SOURCE_PATH","LIVENESS_STALLED_AFTER_MS","MESSAGE_COOLDOWN_MS","PLAN_VERSION","QUIET_AFTER_MS","REPO_NAME","RETENTION_DAYS","RETENTION_MAX_ROWS","RUN_ID","STALL_ACTIVE_MS","STALL_BLOCKED_MS","STALL_CANDIDATE_DONE_MS","STALL_NOT_STARTED_MS","STALL_STALLED_MS","STALL_UNKNOWN_MS","STALL_VERIFYING_MS","SUPERVISOR_MODE","SUPERVISOR_POLL_LIMIT","TICKET_KEY","WAKE_INTERVAL_MS","WORKER_ID","WORKTREE_PATH"],LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS=new Map([...RENAMED_SUFFIXES.map(renamed),[`${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX}ALLOW_CLAUDE_MCP_SHADOWING`,{kind:"retired"}],[LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV,{kind:"renamed",successor:EPIC_IMPLEMENTER_NODE_PATH_ENV}],["CONDUCTOR_DEAD_MAN_ONLY",{kind:"renamed",successor:"EPIC_IMPLEMENTER_DEAD_MAN_ONLY"}],["CONDUCTOR_DEADMAN_CHANNEL_TYPE",{kind:"renamed",successor:"EPIC_IMPLEMENTER_DEADMAN_CHANNEL_TYPE"}],["CONDUCTOR_DEADMAN_DESTINATION_REF",{kind:"renamed",successor:"EPIC_IMPLEMENTER_DEADMAN_DESTINATION_REF"}]]);function isLegacyEpicImplementerEnvKey(key){return key.startsWith(LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX)||key===LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV||key==="CONDUCTOR_DEAD_MAN_ONLY"||key==="CONDUCTOR_DEADMAN_CHANNEL_TYPE"||key==="CONDUCTOR_DEADMAN_DESTINATION_REF"}function findLegacyEpicImplementerEnv(env){return Object.keys(env).filter(isLegacyEpicImplementerEnvKey).sort((a,b)=>a<b?-1:a>b?1:0).map(key=>({key,mapping:LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS.get(key)??null}))}var LEGACY_EPIC_IMPLEMENTER_ENV_ERROR_HEADER="Error: legacy Conductor environment variables are set. They were renamed to the Epic Implementer names and are no longer read. Update or remove each one, then retry:";function describeFinding(finding){let{key,mapping}=finding;return mapping===null?`  ${key}: unknown legacy setting. If it is still a current setting, rename the ${LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX} prefix to ${EPIC_IMPLEMENTER_ENV_PREFIX}; otherwise remove it.`:mapping.kind==="retired"?`  ${key}: retired with no replacement. Remove it.`:`  ${key} -> ${mapping.successor}`}function formatLegacyEpicImplementerEnvError(findings){return[LEGACY_EPIC_IMPLEMENTER_ENV_ERROR_HEADER,...findings.map(describeFinding)].join(`
 `)+`
 `}function runLegacyEpicImplementerEnvPreflight(env,writeStderr){let findings=findLegacyEpicImplementerEnv(env);return findings.length===0?0:(writeStderr(formatLegacyEpicImplementerEnvError(findings)),1)}function runEpicImplementerClaudeHookBin(deps={}){let handler=deps.handler??runClaudeConductorHookCli,exit=deps.exit??process.exit.bind(process),writeStderr=deps.writeStderr??(chunk=>process.stderr.write(chunk));if(runLegacyEpicImplementerEnvPreflight(deps.env??process.env,writeStderr)!==0){exit(0);return}let exitCode=0;try{exitCode=handler()}catch{exitCode=0}exit(exitCode)}var invokedDirectly=process.argv[1]!==void 0&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);invokedDirectly&&runEpicImplementerClaudeHookBin();export{runEpicImplementerClaudeHookBin};

package/build/epic-implementer-env.js

@@ -14,22 +14,25 @@
  * any side effect, and refuses to start when an old name is present.
  *
  * Contract:
- *   - Detection is prefix-based: ANY key starting with `BAPI_CONDUCTOR_` is
- *     rejected, whether or not the table below knows it. `CONDUCTOR_NODE_PATH`
- *     is rejected by exact name (it has no `BAPI_` prefix).
+ *   - Detection is prefix-based for the `BAPI_CONDUCTOR_*` family: ANY key with
+ *     that prefix is rejected, whether or not the table below knows it.
+ *     `CONDUCTOR_NODE_PATH` and the three dead-man names below are rejected by
+ *     EXACT NAME only — none of them has a `BAPI_` prefix, and no `^CONDUCTOR_`
+ *     prefix rule exists or is ever added, so unrelated `CONDUCTOR`-containing
+ *     tokens (`CONDUCTOR_FETCH_TIMEOUT_MS`, `BRIDGE_CONDUCTOR_HOOK_START`,
+ *     `CURRENT_CONDUCTOR_SCHEMA_VERSION`) are never checked.
  *   - A key is rejected on presence alone, whatever its value (including empty).
  *   - All offending keys are reported in one message, sorted by code point.
  *   - Diagnostics carry key names only. An env value is never read into the
  *     findings, so it can never be printed — these variables can hold secrets.
  *   - The env is injectable, so tests never mutate the real process environment.
  *
- * This module is the ONLY non-test source file allowed to spell an old name.
- * Other modules import the prefix and node-path constants from here.
- *
- * Out of scope: the Python dead-man variables (`CONDUCTOR_DEAD_MAN_ONLY`,
- * `CONDUCTOR_DEADMAN_*`) keep their own exact-name contract (BAPI-1231), and
- * non-env tokens such as `BRIDGE_CONDUCTOR_HOOK_START` or
- * `CURRENT_CONDUCTOR_SCHEMA_VERSION` are never checked.
+ * This module is the ONLY non-test source file allowed to spell an old name —
+ * including the three dead-man names below, which are otherwise Python's own
+ * exact-name contract (BAPI-1231, `api/library/epic_implementer/legacy_env_guard.py`).
+ * Sharing the mapping here (BAPI-1237) lets one plane preflight check cover the
+ * TypeScript-side entry points too, instead of leaving them enforced only at
+ * Python worker boot.
  */
 /** Legacy env-var prefix. Any key with this prefix is refused. */
 export const LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX = "BAPI_CONDUCTOR_";
@@ -51,6 +54,11 @@ const renamed = (suffix) => [
  * retired `LLM_*` names (their literals are forbidden in production source by
  * `supervisor-retired-judgment.static.test.ts`), and test-only sentinels. All of
  * those still fall through to the generic prefix pointer.
+ *
+ * These 38 prefix-derived suffixes are distinct from the three BAPI-1237
+ * exact-name dead-man entries added directly to
+ * {@link LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS} below: the dead-man names carry no
+ * `BAPI_CONDUCTOR_` prefix at all, so they cannot be expressed as a suffix here.
  */
 const RENAMED_SUFFIXES = [
     "ALLOW_LIVE_SOURCE_DISPATCH",
@@ -93,9 +101,12 @@ const RENAMED_SUFFIXES = [
     "WORKTREE_PATH",
 ];
 /**
- * Old name -> resolution. Exactly 40 keys: the 38 renamed names above, the
- * retired shadowing override (inert since BAPI-790; this supersedes that
- * ticket's "no error" promise), and the exact-name node-path variable.
+ * Old name -> resolution. Exactly 43 keys: the 38 `BAPI_CONDUCTOR_*`
+ * prefix-derived renamed names above, the retired shadowing override (inert
+ * since BAPI-790; this supersedes that ticket's "no error" promise), the
+ * exact-name node-path variable, and the three BAPI-1237 exact-name dead-man
+ * entries shared with the Python guard's `LEGACY_DEADMAN_ENV_RENAMES`
+ * (`api/library/epic_implementer/legacy_env_guard.py`).
  */
 export const LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS = new Map([
     ...RENAMED_SUFFIXES.map(renamed),
@@ -104,10 +115,28 @@ export const LEGACY_EPIC_IMPLEMENTER_ENV_MAPPINGS = new Map([
         LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV,
         { kind: "renamed", successor: EPIC_IMPLEMENTER_NODE_PATH_ENV },
     ],
+    // BAPI-1237 — the three Python dead-man names (BAPI-1231), added here so
+    // this shared table is the single cross-runtime source of truth. Exact-name
+    // only, like CONDUCTOR_NODE_PATH above: none of these has a BAPI_ prefix.
+    ["CONDUCTOR_DEAD_MAN_ONLY", { kind: "renamed", successor: "EPIC_IMPLEMENTER_DEAD_MAN_ONLY" }],
+    [
+        "CONDUCTOR_DEADMAN_CHANNEL_TYPE",
+        { kind: "renamed", successor: "EPIC_IMPLEMENTER_DEADMAN_CHANNEL_TYPE" },
+    ],
+    [
+        "CONDUCTOR_DEADMAN_DESTINATION_REF",
+        { kind: "renamed", successor: "EPIC_IMPLEMENTER_DEADMAN_DESTINATION_REF" },
+    ],
 ]);
 /** True when `key` is a legacy env name this guard refuses. */
 export function isLegacyEpicImplementerEnvKey(key) {
-    return key.startsWith(LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX) || key === LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV;
+    return (key.startsWith(LEGACY_EPIC_IMPLEMENTER_ENV_PREFIX) ||
+        key === LEGACY_EPIC_IMPLEMENTER_NODE_PATH_ENV ||
+        // BAPI-1237 — exact-name only, like CONDUCTOR_NODE_PATH above. No
+        // `^CONDUCTOR_` prefix rule is introduced by these three comparisons.
+        key === "CONDUCTOR_DEAD_MAN_ONLY" ||
+        key === "CONDUCTOR_DEADMAN_CHANNEL_TYPE" ||
+        key === "CONDUCTOR_DEADMAN_DESTINATION_REF");
 }
 /**
  * Pure finder: env in, sorted findings out. Reads keys only, so a key is found

package/build/executor/ci-rerun-job.js

@@ -0,0 +1,269 @@
+/**
+ * Deterministic `ci_rerun` executor job (BAPI-1160).
+ *
+ * Re-runs ONE failed workflow run whose failure the SERVER already proved to be
+ * infrastructure rather than code. It has no worktree, no branch, no prompt, and
+ * no worker: it validates a server-authored payload, invokes
+ * `gh run rerun --failed <run_id> --repo <owner/repo>` through the executor's
+ * ambient `gh`, polls the run under a bounded deadline, and reports a FACT
+ * ENVELOPE.
+ *
+ * Three properties are load-bearing, and each exists because its absence caused
+ * or would cause a real failure:
+ *
+ * 1. **No transition authority (R14 rule 3).** The envelope carries a run id, a
+ *    conductor attempt, a lane, an observed conclusion, and optionally the
+ *    provider's own run-attempt counter. It carries NO verdict, gate name, or
+ *    requested transition, and the backend model is `extra="forbid"` so one
+ *    cannot be smuggled in. Successful actuation is not a CI verdict: the
+ *    ordinary CI observer must independently re-observe the current head before
+ *    the `ci` gate may move, exactly as it would had a human re-run the lane.
+ *
+ * 2. **The claude-review workflow is never re-run.** That workflow joins a
+ *    per-PR concurrency group with `cancel-in-progress: true`, so re-running it
+ *    could CANCEL a legitimately in-flight review of a NEWER head. The rendered
+ *    workflow is pinned never to contain `gh run rerun` for this reason; this
+ *    job enforces the other half, refusing any payload or looked-up run that
+ *    identifies it — BEFORE any subprocess is invoked.
+ *
+ * 3. **Ambient `gh` authentication only.** The Bridge GitHub App is
+ *    `contents: read` and gains no `actions: write` for this feature. The re-run
+ *    is actuated by the executor machine's own `gh`, so no token, credential
+ *    bundle, or environment credential is injected, added to argv, or returned.
+ *
+ * Diagnostics go to `console.error` only. MCP stdout is a protocol channel and
+ * writing child output to it corrupts the session.
+ */
+import { createProductionEpicIntegrationGhRunner, } from "../epic-integration-pr.js";
+import { CLAUDE_REVIEW_WORKFLOW_RELPATH } from "../claude-review-workflow-drift.js";
+/** Machine-readable, sanitized failure kinds for a refused or failed re-run. */
+export const CI_RERUN_REFUSED = "CiRerunRefused";
+export const CI_RERUN_FAILED = "CiRerunFailed";
+/** Bounded deadline for the post-rerun poll. */
+export const CI_RERUN_POLL_DEADLINE_MS = 3 * 60 * 1000;
+/** Interval between bounded poll reads. */
+export const CI_RERUN_POLL_INTERVAL_MS = 10 * 1000;
+/** Per-`gh`-invocation timeout. */
+export const CI_RERUN_GH_TIMEOUT_MS = 60 * 1000;
+const OWNER_REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+const CLAUDE_REVIEW_WORKFLOW_BASENAME = CLAUDE_REVIEW_WORKFLOW_RELPATH.split("/").pop() ?? "claude-review.yml";
+/**
+ * True when a workflow identity names the claude-review workflow.
+ *
+ * Matches on the workflow file BASENAME and on the conventional display name, so
+ * a `path` (`.github/workflows/claude-review.yml`) and a `name`
+ * (`claude-review`) are both recognized. Deliberately permissive in the REFUSING
+ * direction: a false positive costs one un-actuated re-run, while a false
+ * negative could cancel a real review of a newer head.
+ */
+export function identifiesClaudeReviewWorkflow(identity) {
+    if (typeof identity !== "string")
+        return false;
+    const normalized = identity.trim().toLowerCase();
+    if (!normalized)
+        return false;
+    return (normalized.endsWith(CLAUDE_REVIEW_WORKFLOW_BASENAME.toLowerCase()) ||
+        normalized.includes("claude-review") ||
+        normalized.includes("claude review"));
+}
+/**
+ * Validate a raw server payload into typed fields, SYNCHRONOUSLY and before any
+ * subprocess is invoked.
+ *
+ * Fails closed on every unusable shape. A job that cannot prove what it is about
+ * to re-run must not run `gh` and then discover the problem — that is how a
+ * malformed payload becomes a re-run of the wrong workflow.
+ */
+export function parseCiRerunPayload(payload) {
+    const refuse = (reason) => ({ ok: false, failure: { errorKind: CI_RERUN_REFUSED, reason } });
+    if (typeof payload !== "object" || payload === null) {
+        return refuse("payload_not_an_object");
+    }
+    const raw = payload;
+    const repoFullName = raw.repo_full_name;
+    if (typeof repoFullName !== "string" || !OWNER_REPO_RE.test(repoFullName.trim())) {
+        return refuse("repo_full_name_invalid");
+    }
+    const workflowRunId = raw.workflow_run_id;
+    if (typeof workflowRunId !== "number" ||
+        !Number.isInteger(workflowRunId) ||
+        workflowRunId <= 0) {
+        return refuse("workflow_run_id_invalid");
+    }
+    const lane = raw.required_check_lane;
+    if (typeof lane !== "string" || !lane.trim()) {
+        return refuse("required_check_lane_missing");
+    }
+    const attempt = raw.conductor_infra_attempt;
+    if (typeof attempt !== "number" || !Number.isInteger(attempt) || attempt <= 0) {
+        return refuse("conductor_infra_attempt_invalid");
+    }
+    const identityRaw = raw.workflow_identity;
+    const workflowIdentity = typeof identityRaw === "string" && identityRaw.trim() ? identityRaw.trim() : null;
+    // The review-workflow refusal, evaluated on the SERVER-SUPPLIED identity and
+    // on the lane name, before any subprocess exists.
+    if (identifiesClaudeReviewWorkflow(workflowIdentity) ||
+        identifiesClaudeReviewWorkflow(lane)) {
+        return refuse("claude_review_workflow_refused");
+    }
+    return {
+        ok: true,
+        fields: {
+            repoFullName: repoFullName.trim().toLowerCase(),
+            workflowRunId,
+            requiredCheckLane: lane.trim(),
+            conductorInfraAttempt: attempt,
+            workflowIdentity,
+        },
+    };
+}
+function parseRunView(stdout) {
+    let decoded;
+    try {
+        decoded = JSON.parse(stdout);
+    }
+    catch {
+        return null;
+    }
+    if (typeof decoded !== "object" || decoded === null)
+        return null;
+    const raw = decoded;
+    const str = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+    const repo = raw.repository;
+    return {
+        name: str(raw.name),
+        path: str(raw.path) ?? str(raw.workflowName),
+        status: str(raw.status),
+        conclusion: str(raw.conclusion),
+        runAttempt: typeof raw.attempt === "number" && Number.isInteger(raw.attempt) && raw.attempt > 0
+            ? raw.attempt
+            : null,
+        repoFullName: typeof repo === "object" && repo !== null
+            ? str(repo.nameWithOwner)
+            : str(raw.repository),
+    };
+}
+const RUN_VIEW_FIELDS = "name,status,conclusion,attempt,workflowName";
+/**
+ * Run one deterministic `ci_rerun` job.
+ *
+ * Returns the fact envelope on success, or a sanitized failure. Never throws for
+ * a provider or process condition, and never returns provider text.
+ */
+export async function runCiRerunJob(payload, deps) {
+    const parsed = parseCiRerunPayload(payload);
+    if (!parsed.ok) {
+        console.error(`[ci_rerun] payload refused: ${parsed.failure.reason}`);
+        return parsed;
+    }
+    const fields = parsed.fields;
+    const gh = deps.gh;
+    const now = deps.now ?? (() => Date.now());
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const refuse = (reason) => {
+        console.error(`[ci_rerun] refused: ${reason}`);
+        return { ok: false, failure: { errorKind: CI_RERUN_REFUSED, reason } };
+    };
+    // A CONDITIONAL lookup. It is issued only when the server supplied no workflow
+    // identity, because then nothing yet proves the run is not the review
+    // workflow. When the server DID supply one, it was already checked above and a
+    // second read would buy nothing.
+    let view = null;
+    if (fields.workflowIdentity === null) {
+        const lookup = await gh([
+            "run",
+            "view",
+            String(fields.workflowRunId),
+            "--repo",
+            fields.repoFullName,
+            "--json",
+            RUN_VIEW_FIELDS,
+        ], { timeoutMs: CI_RERUN_GH_TIMEOUT_MS });
+        if (lookup.exitCode !== 0) {
+            return refuse("run_lookup_failed");
+        }
+        view = parseRunView(lookup.stdout);
+        if (view === null) {
+            return refuse("run_lookup_unreadable");
+        }
+        if (identifiesClaudeReviewWorkflow(view.name) ||
+            identifiesClaudeReviewWorkflow(view.path)) {
+            return refuse("claude_review_workflow_refused");
+        }
+        if (view.repoFullName !== null &&
+            view.repoFullName.toLowerCase() !== fields.repoFullName) {
+            return refuse("run_repository_mismatch");
+        }
+    }
+    // The actuation. An ARGUMENT ARRAY with `shell: false` (the injected runner's
+    // contract), so no value here is ever interpolated into a command line. No
+    // token, credential, or environment addition: `gh` uses the executor
+    // machine's ambient authentication and nothing else.
+    const rerun = await gh([
+        "run",
+        "rerun",
+        "--failed",
+        String(fields.workflowRunId),
+        "--repo",
+        fields.repoFullName,
+    ], { timeoutMs: CI_RERUN_GH_TIMEOUT_MS });
+    if (rerun.exitCode !== 0) {
+        // The reserved infrastructure attempt stays CONSUMED. A re-run that the
+        // provider refused is a spent attempt, not a free retry: treating it as free
+        // would let a permanently refusing provider buy unbounded jobs.
+        console.error(`[ci_rerun] rerun invocation failed (exit=${rerun.exitCode ?? "null"}` +
+            `${rerun.timedOut ? ", timed out" : ""})`);
+        return {
+            ok: false,
+            failure: {
+                errorKind: CI_RERUN_FAILED,
+                reason: rerun.timedOut ? "rerun_timed_out" : "rerun_invocation_failed",
+            },
+        };
+    }
+    // Bounded poll for the conclusion. An expired deadline is a REPORTABLE
+    // outcome, not a failure: the re-run was actuated, the attempt was spent, and
+    // the server re-observes the head on its own schedule either way.
+    const deadline = now() + CI_RERUN_POLL_DEADLINE_MS;
+    let observedConclusion = null;
+    let providerRunAttempt = view?.runAttempt ?? null;
+    while (now() < deadline) {
+        await sleep(CI_RERUN_POLL_INTERVAL_MS);
+        const poll = await gh([
+            "run",
+            "view",
+            String(fields.workflowRunId),
+            "--repo",
+            fields.repoFullName,
+            "--json",
+            RUN_VIEW_FIELDS,
+        ], { timeoutMs: CI_RERUN_GH_TIMEOUT_MS });
+        if (poll.exitCode !== 0)
+            continue;
+        const polled = parseRunView(poll.stdout);
+        if (polled === null)
+            continue;
+        if (polled.runAttempt !== null)
+            providerRunAttempt = polled.runAttempt;
+        if (polled.status === "completed") {
+            observedConclusion = polled.conclusion;
+            break;
+        }
+    }
+    const result = {
+        run_id: fields.workflowRunId,
+        conductor_attempt: fields.conductorInfraAttempt,
+        lane: fields.requiredCheckLane,
+        observed_conclusion: observedConclusion,
+    };
+    if (providerRunAttempt !== null) {
+        result.provider_run_attempt = providerRunAttempt;
+    }
+    console.error(`[ci_rerun] run=${fields.workflowRunId} attempt=${fields.conductorInfraAttempt} ` +
+        `conclusion=${observedConclusion ?? "pending"}`);
+    return { ok: true, result };
+}
+/** Production dependency bundle: the existing bounded `execFile`-based runner. */
+export function createProductionCiRerunDeps() {
+    return { gh: createProductionEpicIntegrationGhRunner() };
+}

package/build/executor/cli.js

@@ -13,6 +13,7 @@ import { resolveStartTicketsRepoName } from "../start-tickets-repo.js";
 import { DEFAULT_EXECUTOR_AGENT_ID } from "./agent-identity.js";
 import { executorEpicRunIdRefusal, isValidExecutorEpicRunId, validateExecutorClaimScope, } from "./claim-scope.js";
 import { createDefaultExecutorDeps } from "./deps.js";
+import { scrubExecutorProcessGithubCredentials } from "./env.js";
 import { resolveBaseUrl, resolveExecutorApiAccess, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
 import { createExecutorHttpClient } from "./http-client.js";
 import { startExecutorSleepAssertion } from "./platform.js";
@@ -78,6 +79,7 @@ export function parseExecutorArgs(argv, context) {
     const repos = [];
     const epicRunIds = [];
     let repoWide = false;
+    let scrubInheritedGithubCredentials = false;
     let executorId;
     let maxConcurrent = DEFAULT_MAX_CONCURRENT;
     let once = false;
@@ -123,6 +125,9 @@ export function parseExecutorArgs(argv, context) {
         else if (arg === "--repo-wide") {
             repoWide = true;
         }
+        else if (arg === "--scrub-inherited-github-credentials") {
+            scrubInheritedGithubCredentials = true;
+        }
         else if (arg === "--executor-id") {
             executorId = argv[++i];
             if (!executorId)
@@ -231,6 +236,9 @@ export function parseExecutorArgs(argv, context) {
         // BAPI-1026 (R54) — same "truly absent, never a falsy placeholder"
         // discipline: `repoWide` is either `true` or the key is missing.
         ...(repoWide ? { repoWide: true } : {}),
+        // BAPI-1137: absent unless explicitly requested, so an ordinary executor's
+        // options object is byte-for-byte what it was before this slice.
+        ...(scrubInheritedGithubCredentials ? { scrubInheritedGithubCredentials: true } : {}),
     };
     return { kind: "ok", options };
 }
@@ -290,6 +298,29 @@ export async function runExecutorCli(argv, overrides = {}) {
         return 1;
     }
     const options = parsed.options;
+    // BAPI-1137 (R-4) — scrub inherited GitHub write variables, when this process
+    // was asked to. This is the earliest point the request is KNOWN, and it is
+    // still ahead of everything that could observe or forward the credential:
+    // base-URL resolution, Bridge credential resolution, the HTTP client,
+    // preflight, worker spawn, and even the claim-scope status line below.
+    //
+    // OPT-IN, and that is the load-bearing part. The executor's own `merge` job
+    // reaches `gh` through this very object (`deps.env` is `process.env`, which
+    // `buildDefaultMergeLocalDeps` hands to `local-merge.ts`'s `ghEnv`), and a
+    // token in the environment is a supported `gh` auth mechanism. An
+    // unconditional scrub would therefore break `merge_execution_mode: local` on
+    // any host whose operator started the executor from a shell exporting
+    // `GH_TOKEN` — a working merge turned into `local_gh_unauthenticated`. The
+    // durable host sets the flag in its generated unit because it holds no
+    // standing GitHub write credential by design and its merges leave the host.
+    //
+    // `process.env` deliberately, not `deps.env`: the deps bundle may be a test
+    // fake, while the thing children inherit is the real process environment.
+    // Values are never read — only key names are matched — so nothing here can
+    // log or leak what it deleted.
+    if (options.scrubInheritedGithubCredentials === true) {
+        scrubExecutorProcessGithubCredentials(process.env);
+    }
     // BAPI-794/BAPI-1026 — startup diagnostics: a bounded MODE label and, when
     // scoped, only the COUNT of runs. Never credentials, job payloads, command
     // arguments — and, since BAPI-1026, never the run IDs either, matching the

package/build/executor/credentials.js

@@ -5,6 +5,17 @@
  * through the shared credential store (`resolveBapiCredentials`) — never by
  * reading worktree-local MCP config, and never leaking secret values into
  * diagnostics/results.
+ *
+ * BAPI-1137 (R-4) leaves that lookup exactly as it was — parent environment
+ * first, then the user-scoped `bapi:<repo>` store — and adds nothing beside it.
+ * This module resolves ONE credential for ONE purpose: authenticating the
+ * executor's own Bridge calls. It gains no GitHub bundle, no GitHub registration
+ * field, no GitHub CLI argument, and no GitHub-derived diagnostic value, which is
+ * what lets a durable host assert it holds no standing GitHub write credential.
+ * `CLAUDE_CODE_OAUTH_TOKEN` is not part of that assertion either way: it is
+ * host-local worker authentication the operator manages independently, Bridge
+ * never resolves or stores it, and `ANTHROPIC_API_KEY` remains absolutely denied
+ * to a worker (`executor/env.ts`).
  */
 import { resolveBapiCredentials } from "../credential-store.js";
 import { normalizeBaseUrlCandidate } from "../base-url.js";

package/build/executor/env.js

@@ -170,6 +170,66 @@ export const EXPLICIT_DENY_KEYS = [
     // the allowlist.
     ...WORKER_SENTINEL_DATABASE_ENV_KEYS,
 ];
+// ---------------------------------------------------------------------------
+// Executor-PROCESS GitHub credential deny-list (BAPI-1137, R-4)
+//
+// Everything above this line governs what reaches a spawned WORKER. This block
+// governs the executor process itself, and it exists because the worker
+// allowlist cannot reach far enough: a manager-level environment injection — a
+// `launchctl setenv`, a systemd drop-in, a `~/.zprofile` that ran before the
+// operator started the executor by hand — puts a GitHub write token in the
+// executor's own environment, where a subprocess that builds its own environment
+// (or any future code path that reads one) could still find it.
+//
+// The durable-host claim is that the host holds NO STANDING GitHub write
+// credential. A unit that declares none (see `service-unit.ts`) and a process
+// that scrubs any it inherited are the two halves of that claim; without the
+// second, the first only proves the token did not come from the file Bridge
+// generated.
+// ---------------------------------------------------------------------------
+/**
+ * The GitHub write-credential variable names the executor process refuses to
+ * carry. Exactly the two names this repository's environment-safety conventions
+ * already recognize (`EXPLICIT_DENY_KEYS` above denies the same pair for a
+ * worker), so there is ONE vocabulary for "a GitHub write credential" rather
+ * than a second, drifting list.
+ */
+export const EXECUTOR_PROCESS_GITHUB_CREDENTIAL_DENY_KEYS = [
+    "GH_TOKEN",
+    "GITHUB_TOKEN",
+];
+/**
+ * Delete every prohibited GitHub credential variable from the executor's own
+ * environment, and report only HOW MANY were removed.
+ *
+ * Three properties are load-bearing and are what the return type is shaped
+ * around:
+ *
+ *  - **Names are compared case-insensitively.** `GH_TOKEN`, `gh_token`, and
+ *    `Gh_Token` are the same variable to a shell on a case-preserving platform,
+ *    and a scrubber that matched only the canonical spelling would leave the
+ *    other two in place.
+ *  - **Values are never read.** Nothing here dereferences a prohibited key
+ *    before deleting it, so no credential value can be logged, returned,
+ *    compared, or classified — not even as "looks like a PAT". A count is the
+ *    most a caller can learn.
+ *  - **It mutates in place.** The executor spawns children that inherit
+ *    `process.env`; returning a filtered COPY would leave the real environment
+ *    untouched and the guarantee imaginary.
+ */
+export function scrubExecutorProcessGithubCredentials(env = process.env) {
+    const prohibited = new Set(EXECUTOR_PROCESS_GITHUB_CREDENTIAL_DENY_KEYS.map((key) => key.toUpperCase()));
+    let removedCount = 0;
+    // A snapshot of the key names, because deleting while iterating the live
+    // object is exactly the kind of thing that silently skips an entry.
+    for (const key of Object.keys(env)) {
+        if (!prohibited.has(key.toUpperCase()))
+            continue;
+        delete env[key];
+        removedCount++;
+    }
+    return { removedCount };
+}
 /**
  * True only when `key` is a safe, allowlisted operational key. Exported so the
  * allowlist is locally auditable/testable. A key is allowed iff it is in the

package/build/executor/index.js

@@ -7,16 +7,33 @@
  */
 export { runExecutorCli, getExecutorUsage, parseExecutorArgs } from "./cli.js";
 export { runExecutor } from "./runner.js";
-// Persistent-service packaging (BAPI-688). The CLI entry plus the PURE helpers
-// doctor needs to enumerate and inspect generated units — doctor must share this
+// Persistent-service packaging (BAPI-688), the file-generation leg of
+// durable-host mode (BAPI-1137). The CLI entry plus the PURE helpers doctor
+// needs to enumerate and inspect generated units — doctor must share this
 // module's naming/format contract instead of maintaining a second parser.
+//
+// This group grants GENERATION only. It confers no lifecycle capability, which
+// is why the lifecycle exports stay in their own group below: a caller that
+// imports the generator still cannot start a persistent daemon.
 export { runExecutorInstallServiceCli, getExecutorInstallServiceUsage, buildExecutorServiceArtifact, writeExecutorServiceArtifact, inspectExecutorServiceArtifact, executorLaunchdDirForHome, executorSystemdDirForHome, executorIdFromLaunchdFilename, executorIdFromSystemdFilename, 
 // Programmatic, lifecycle-free plan/write seam (BAPI-779) — how
 // `install conductor` reaches the generator without shelling out to the CLI.
-planExecutorServiceInstall, writeExecutorServicePlan, resolvePackagedExecutorInvocation, EXECUTOR_SERVICE_BASE_URL_ENV, EXECUTOR_SERVICE_PATH_ENV, } from "./service-unit.js";
+planExecutorServiceInstall, writeExecutorServicePlan, resolvePackagedExecutorInvocation, 
+// Durable-host credential declaration contract (BAPI-1137, R-4). doctor needs
+// the shared inspector and the postcondition helper so its diagnostic and the
+// generator's write check are literally the same rule; exporting the allowlist
+// and the argument-contract predicate keeps the contract locally auditable
+// rather than discoverable only by reading the renderer.
+inspectExecutorServiceCredentialDeclaration, assertExecutorServiceCredentialPostcondition, checkExecutorServiceArgumentContract, isAllowedExecutorServiceUnitEnvKey, executorLaunchdLogPathsForId, EXECUTOR_SERVICE_BASE_URL_ENV, EXECUTOR_SERVICE_PATH_ENV, EXECUTOR_SERVICE_UNIT_ENV_ALLOWLIST, EXECUTOR_SERVICE_UNIT_FILE_MODE, } from "./service-unit.js";
 // Consented lifecycle (BAPI-779, R-1). Deliberately a SEPARATE module from the
 // generator above: importing the writer never grants the ability to start a
 // persistent daemon.
-export { buildExecutorServiceStartPlan, buildExecutorServiceStateProbe, formatExecutorServiceStartFailure, inspectExecutorServiceState, startExecutorService, } from "./service-lifecycle.js";
+export { buildExecutorServiceStartPlan, buildExecutorServiceStateProbe, formatExecutorServiceStartFailure, inspectExecutorServiceState, startExecutorService, 
+// Durability prerequisites (BAPI-1137). Exported SEPARATELY from the
+// generation group above, and alongside — not inside — the start group: these
+// are strictly read-only probes, so importing them grants the ability to ASK
+// whether this host survives logout, never the ability to change it. Nothing
+// here runs `loginctl enable-linger`.
+buildExecutorServiceDurabilityProbe, inspectExecutorServiceDurability, EXECUTOR_LINGER_REMEDIATION, EXECUTOR_MACOS_SESSION_REMEDIATION, } from "./service-lifecycle.js";
 export { collectExecutorInstallPreflight, formatExecutorInstallPreflight, EXECUTOR_INSTALL_REQUIRED_TOOLS, EXECUTOR_INSTALL_CLAUDE_LOGIN_REMEDIATION, } from "./install-preflight.js";
 export { runExecutorWatchCli, getExecutorWatchUsage, parseExecutorWatchArgs, } from "./watch-cli.js";