@bridge_gpt/mcp-server 0.2.60 → 0.2.65

package/build/scripts/executor-protocol-contract-driver.js

@@ -45,7 +45,7 @@
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import fs from "node:fs";
-import { API, SymbolFlags } from "typescript/unstable/sync";
+import { API, SymbolFlags, TypeFlags } from "typescript/unstable/sync";
 import { isInterfaceDeclaration, isTypeAliasDeclaration } from "typescript/unstable/ast";
 import { createExecutorHttpClient, RECONCILER_LIVENESS_HEADER, HEARTBEAT_STOP_FIELD, } from "../executor/http-client.js";
 import { EXECUTOR_JOB_TYPE_VALUES, EXECUTOR_CLASSIFICATION_VALUES, EXECUTOR_MUTATION_OUTCOME_VALUES, RECONCILER_LIVENESS_VALUES, } from "../executor/types.js";
@@ -192,7 +192,15 @@ const PROJECTED_SHAPE_NAMES = [
     "ExecutorFailureWireRequest",
     "ExecutorProcessHeartbeatRequest",
 ];
-/** Return the closed string-literal members of *type*, or `undefined` when it is not one. */
+/**
+ * Return the closed string-literal members of *type*, or `undefined` when it is not one.
+ *
+ * `undefined`/`null` union members are skipped (BAPI-1301): an OPTIONAL
+ * literal property (`marker?: "a" | "b"`) is typed `"a" | "b" | undefined`
+ * under `strictNullChecks`, and its vocabulary is still exactly `["a", "b"]` —
+ * mirroring the Python side, which unwraps `Optional[Literal[...]]` before
+ * reading its members. Requiredness is compared separately.
+ */
 function literalValuesOf(type) {
     if (type.isStringLiteralType()) {
         return [type.value];
@@ -200,11 +208,13 @@ function literalValuesOf(type) {
     if (type.isUnionType()) {
         const values = [];
         for (const member of type.getTypes()) {
+            if (member.flags & (TypeFlags.Undefined | TypeFlags.Null))
+                continue;
             if (!member.isStringLiteralType())
                 return undefined;
             values.push(member.value);
         }
-        return values.sort();
+        return values.length > 0 ? values.sort() : undefined;
     }
     return undefined;
 }

package/build/setup-epic.js

@@ -78,7 +78,7 @@
 import { readFile as fsReadFile, stat as fsStat } from "node:fs/promises";
 import os from "node:os";
 import { createProductionEpicIntegrationGhRunner, ensureEpicIntegrationPullRequest, formatEpicIntegrationPullRequestOutcome, } from "./epic-integration-pr.js";
-import { approveEpicPlan, buildConductorJiraUrl, conductorGetHeaders, createEpicRunWithDisposition, fetchConductorReadiness, fetchEpicRunState, replaceEpicRunPolicy, resolveConductorBridgeApiAccess, storeEpicPlan, validateEpicPlan, ConductorBridgeApiError, } from "./conductor/bridge-api-client.js";
+import { approveEpicPlan, buildConductorJiraUrl, conductorGetHeaders, createEpicRunWithDisposition, decodeCanonicalProvenance, fetchConductorReadiness, fetchEpicRunState, replaceEpicRunPolicy, resolveConductorBridgeApiAccess, resolveEpicLaunchBridgeApiAccess, storeEpicPlan, validateEpicPlan, ConductorBridgeApiError, } from "./conductor/bridge-api-client.js";
 // BAPI-1133 (A2) — the single legacy-to-typed merge-execution-mode mapping and
 // its total legacy resolver live in `merge-pull-request.ts` (no import cycle:
 // that module never imports from `setup-epic.ts`). Reused here rather than
@@ -97,7 +97,7 @@ import { validateBranchName } from "./base-ref.js";
 // conductor can drift on a field name or an endpoint shape. No MCP tool, no
 // input-schema field, and no description changes.
 import { getConfigFieldBaseBranch, getIndexScopeLifecycle, getParseStatus, } from "./epic-shared/bridge-client.js";
-import { boundScopeLifecycleLabel, createExecFileRunCommand, ensureCommitResolvableLocally, normalizeCommitSha, performExactIndexScopeCut, pollIndexScopeLifecycle, readRemoteBranchHead, runGit, SCOPE_BOOTSTRAP_POLL_INTERVAL_MS, SCOPE_LIFECYCLE_LABELS, } from "./epic-shared/cut-protocol.js";
+import { boundScopeLifecycleLabel, createExecFileRunCommand, ensureCommitResolvableLocally, performExactIndexScopeCut, pollIndexScopeLifecycle, readRemoteBranchHead, runGit, SCOPE_BOOTSTRAP_POLL_INTERVAL_MS, SCOPE_LIFECYCLE_LABELS, } from "./epic-shared/cut-protocol.js";
 import { hashPlan } from "./conductor/plan.js";
 import { BRING_UP_REFUSAL_MESSAGES, firstBringUpRefusal, } from "./conductor/bring-up-facts.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
@@ -148,6 +148,16 @@ export const SETUP_EPIC_AUTO_MERGE_POLICY_KEY = "v2_auto_merge_enabled";
  * neither changes merge execution until a later A2 child.
  */
 export const SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY = "merge_execution_mode";
+/**
+ * BAPI-1259 — the opt-in for automatic integration-PR preparation. Written into
+ * the UNATTENDED epic-branch default only (fill-if-absent), so a run the
+ * operator starts unattended is prepared and handed off without a manual base
+ * merge or a manual un-draft. Attended runs, `--into-base` runs, and runs whose
+ * `--policy-file` already declares the key keep exactly what they had; a run
+ * approved before this key existed is never changed retroactively.
+ */
+export const SETUP_EPIC_INTEGRATION_PREPARATION_POLICY_KEY = "integration_preparation";
+const SETUP_EPIC_INTEGRATION_PREPARATION_DEFAULT = { enabled: true };
 /** Accepted `policy_json.review_policy.source` values (the `ReviewPolicy` surface). */
 export const SETUP_EPIC_REVIEW_POLICY_SOURCES = [
     "verdict_protocol",
@@ -199,10 +209,11 @@ export function getSetupEpicUsage() {
         "that selects no epic branch (--into-base, or a single-node plan) is unchanged",
         "and composes no posture at all.",
         "",
-        "Unattended runs have TWO one-time repository prerequisites, refused by name",
-        "before any run is created: repository consent (unattended_epic_implementer_allowed) and",
-        "a verified notify webhook default. `drive-epic` readiness lists both with their",
-        "current state.",
+        "Unattended runs have TWO repository prerequisites, refused by name before any",
+        "run is created: repository consent (ON by default; the repository owner can",
+        "switch 'Allow unattended Epic Implementer runs' off and on in the Bridge admin",
+        "panel's Setup page) and a verified notify webhook default. `drive-epic`",
+        "readiness lists both with their current state.",
         "",
         "Required:",
         "  --epic-key <KEY>       Jira epic key (e.g. BAPI-405)",
@@ -249,6 +260,11 @@ export function getSetupEpicUsage() {
         "                         sets no review policy of its own, so a value supplied",
         "                         here always wins.",
         "  --json                 Emit a single JSON result object on stdout",
+        "  --launch-profile <name>  (BAPI-1260) Resolve the target, repository, and bound",
+        "                         credential from this host-local launch profile. Passed",
+        "                         by drive-epic. The profile names its own target; it",
+        "                         never falls back to production by itself.",
+        "  --base-url <url>       (BAPI-1260) Explicit target; must agree with the profile.",
         "  -h, --help             Show this help",
         "",
         "Policy controls:",
@@ -349,6 +365,8 @@ export function parseSetupEpicArgs(argv) {
     let localOnly = false;
     let dryRun = false;
     let json = false;
+    let launchProfile;
+    let baseUrl;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         // `--policy-file=<path>` inline form (BAPI-754).
@@ -450,6 +468,19 @@ export function parseSetupEpicArgs(argv) {
                 i++;
                 break;
             }
+            // BAPI-1260 — the launch selection forwarded by drive-epic.
+            case "--launch-profile":
+            case "--base-url": {
+                const v = takeValue(argv, i, arg);
+                if (v === null || v.trim() === "")
+                    return { status: "error", message: `${arg} requires a value.` };
+                if (arg === "--launch-profile")
+                    launchProfile = v.trim();
+                else
+                    baseUrl = v.trim();
+                i++;
+                break;
+            }
             case "--into-base":
                 intoBase = true;
                 break;
@@ -531,6 +562,9 @@ export function parseSetupEpicArgs(argv) {
             localOnly,
             dryRun,
             json,
+            // BAPI-1260 — only when supplied, so a legacy options object is unchanged.
+            ...(launchProfile ? { launchProfile } : {}),
+            ...(baseUrl ? { baseUrl } : {}),
         },
     };
 }
@@ -1203,10 +1237,10 @@ export function evaluateSetupEpicUnattendedPrerequisites(readiness, requestedPol
     if (!unattended.conductor_allowed) {
         return {
             reason: "target_not_allowed",
-            message: "this repository has not consented to unattended conductor runs. Set " +
-                "`unattended_epic_implementer_allowed` for it (see " +
-                "docs/claude/account-settings-operator-runbook.md), or pass --attended to " +
-                "create an attended run. No run was created.",
+            message: "unattended runs are off for this repository. Turn on 'Allow unattended " +
+                "Epic Implementer runs' on the repository's Setup page in the Bridge admin " +
+                "panel, or pass --attended to create an attended run. If it is already on, " +
+                "contact Bridge support. No run was created.",
         };
     }
     // Two independent sources satisfy the escalation channel, and the check has to
@@ -1221,13 +1255,21 @@ export function evaluateSetupEpicUnattendedPrerequisites(readiness, requestedPol
     // Presence, not verification: the server probes the URL at activation and is
     // the authority on whether it is reachable. This gate exists to spare the
     // operator a created-and-refused run, not to duplicate the probe.
+    //
+    // BAPI-1274 — a third source: when no webhook is declared anywhere, the
+    // account's email address is the escalation channel, and the server reports
+    // its presence (never the address). A declared webhook stays authoritative;
+    // email only fills the gap when none is declared. `notify.local_sink` still
+    // satisfies nothing.
     if (!unattended.notify_webhook_default_declared &&
-        !policyDeclaresNotifyWebhook(requestedPolicy)) {
+        !policyDeclaresNotifyWebhook(requestedPolicy) &&
+        unattended.escalation_email_available !== true) {
         return {
             reason: "webhook_unverified",
-            message: "an unattended run must have a verified escalation channel, and neither this " +
-                "repository nor this run declares one. Supply a --policy-file declaring " +
-                "notify.webhook_url (notify.local_sink does not satisfy this), or pass " +
+            message: "an unattended run must have an escalation channel, and this repository, this " +
+                "run, and the account provide none. Supply a --policy-file declaring " +
+                "notify.webhook_url (notify.local_sink does not satisfy this), or add an email " +
+                "address to the account so escalation alerts can be emailed, or pass " +
                 "--attended to create an attended run. No run was created.",
         };
     }
@@ -1367,9 +1409,10 @@ export function requestedPolicyIsUnattended(policy, attended) {
  *   requested `review_policy`, and nothing else. Byte-identical to the
  *   pre-BAPI-1102 composition, which is precisely what the opt-out promises.
  * * **Feature branch, default** → adds `posture: "unattended"`,
- *   `v2_auto_merge_enabled: true`, and (BAPI-1133, A2) `merge_execution_mode`
+ *   `v2_auto_merge_enabled: true`, (BAPI-1133, A2) `merge_execution_mode`
  *   when the caller resolved one — the server refuses an unattended auto-merge
- *   policy that omits it.
+ *   policy that omits it — and (BAPI-1259) `integration_preparation:
+ *   { enabled: true }`, so the run prepares its own integration PR.
  *
  * Deliberately absent from every shape:
  *
@@ -1394,6 +1437,9 @@ export function composeDefaultSetupEpicPolicy(args) {
             if (args.mergeExecutionMode !== undefined) {
                 policy[SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY] = args.mergeExecutionMode;
             }
+            policy[SETUP_EPIC_INTEGRATION_PREPARATION_POLICY_KEY] = {
+                ...SETUP_EPIC_INTEGRATION_PREPARATION_DEFAULT,
+            };
         }
     }
     if (args.reviewPolicy !== undefined) {
@@ -1465,6 +1511,11 @@ export function applySetupEpicUnattendedDefault(policy, args) {
         args.mergeExecutionMode !== undefined) {
         composed[SETUP_EPIC_MERGE_EXECUTION_MODE_POLICY_KEY] = args.mergeExecutionMode;
     }
+    if (!(SETUP_EPIC_INTEGRATION_PREPARATION_POLICY_KEY in composed)) {
+        composed[SETUP_EPIC_INTEGRATION_PREPARATION_POLICY_KEY] = {
+            ...SETUP_EPIC_INTEGRATION_PREPARATION_DEFAULT,
+        };
+    }
     return composed;
 }
 /**
@@ -1654,14 +1705,51 @@ export function resolveEffectiveFeatureBranch(featureBranch, requestedPolicy) {
     return trimmed;
 }
 /**
- * Read canonical parse truth and require a `succeeded` parse with a full
- * indexed commit — the commit `origin/<feature>` will be cut at.
+ * BAPI-1252: the operator sentence for each canonical refusal. Every one names
+ * the situation and what to do; none names a SHA, generation, or server error.
+ */
+export function canonicalRefusalMessage(repoName, reason) {
+    switch (reason) {
+        case "canonical_capability_unsupported":
+            return (`The Bridge server for ${repoName} did not report verified canonical index provenance ` +
+                `(it predates this contract, or sent a value this CLI cannot verify). Upgrade the ` +
+                `server; a cut is never authorized from the legacy indexed commit.`);
+        case "canonical_index_unverified":
+            return (`${SETUP_EPIC_PARSE_FIRST_MESSAGE}: the canonical index for ${repoName} has no verified ` +
+                `generation (legacy, interrupted, or still-writing content is never trusted), so there ` +
+                `is no commit to cut the feature branch at.`);
+        case "canonical_source_missing":
+            return (`${SETUP_EPIC_PARSE_FIRST_MESSAGE}: the last canonical parse of ${repoName} observed no ` +
+                `source commit (for example it parsed a supplied directory), so its content cannot be ` +
+                `verified. Re-parse it from its remote.`);
+        case "canonical_manifest_mismatch":
+            return (`The canonical index content for ${repoName} no longer matches its verified manifest ` +
+                `and has been marked unverified. Re-parse the repository before cutting.`);
+        case "canonical_generation_mismatch":
+        case "canonical_index_advanced":
+            return (`The canonical index for ${repoName} advanced while it was being checked. Retry once ` +
+                `the current parse finishes.`);
+        case "canonical_validity_unavailable":
+        default:
+            return (`The canonical validity for ${repoName} could not be read. Retry — this is not ` +
+                `evidence the repository is unindexed.`);
+    }
+}
+/**
+ * Read canonical parse truth and require AFFIRMATIVE verified provenance — the
+ * commit `origin/<feature>` will be cut at (BAPI-1252).
+ *
+ * The cut commit is the server's VERIFIED canonical source SHA, decoded through
+ * `decodeCanonicalProvenance`. Lifecycle fields (`status`, `indexed_commit_sha`)
+ * are display history and are never consulted: a `succeeded` row can describe a
+ * newer-created parse whose content the index does not hold. An absent field
+ * (an older server), an unknown state, a read failure, or an unverified
+ * generation all refuse before any branch or run mutation.
  *
  * Fails CLOSED (ratified R-2). The first line of every refusal is the exact
- * operator instruction; the closing lines state what did NOT happen. An
- * UNREADABLE status is kept distinct from an unsuccessful one — "could not read"
- * is not evidence the repository is unindexed, and telling that operator to
- * re-index would send them to re-parse a repository that may be fine.
+ * operator instruction; the closing line states what did NOT happen. An
+ * UNREADABLE status is kept distinct from an unverified one — "could not read"
+ * is not evidence the repository is unindexed.
  */
 export async function readCanonicalParseTruth(access, fetchImpl) {
     const notCreated = [
@@ -1678,30 +1766,14 @@ export async function readCanonicalParseTruth(access, fetchImpl) {
             ],
         };
     }
-    if (parse.value.status !== "succeeded") {
+    const evidence = decodeCanonicalProvenance(parse.value);
+    if (!evidence.verified) {
         return {
             ok: false,
-            lines: [
-                `${SETUP_EPIC_PARSE_FIRST_MESSAGE}: the canonical index for ${access.repoName} has no ` +
-                    `successful parse (status: ${String(parse.value.status)}), so there is no commit to ` +
-                    `cut the feature branch at.`,
-                ...notCreated,
-            ],
+            lines: [canonicalRefusalMessage(access.repoName, evidence.reason), ...notCreated],
         };
     }
-    const indexed = normalizeCommitSha(parse.value.indexed_commit_sha);
-    if (indexed === null) {
-        return {
-            ok: false,
-            lines: [
-                `${SETUP_EPIC_PARSE_FIRST_MESSAGE}: the canonical index for ${access.repoName} published ` +
-                    `no commit for its last successful parse, so there is no commit to cut the feature ` +
-                    `branch at.`,
-                ...notCreated,
-            ],
-        };
-    }
-    return { ok: true, cutCommitSha: indexed };
+    return { ok: true, cutCommitSha: evidence.sourceCommitSha };
 }
 /** The strict subset of `SetupEpicDeps` the shared cut protocol consumes. */
 function cutProtocolDeps(deps, runCommand) {
@@ -1936,7 +2008,10 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         return 0;
     }
     // --- Resolve access ------------------------------------------------------
-    const accessResult = await resolveConductorBridgeApiAccess({
+    // BAPI-1260: a caller that selected the epic-launch contract (drive-epic
+    // forwards --launch-profile / --base-url) gets the target-first resolver and
+    // the bound credential; the legacy resolver is kept byte-for-byte otherwise.
+    const accessDeps = {
         env: deps.env,
         cwd: deps.cwd,
         homedir: deps.homedir,
@@ -1944,7 +2019,13 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
         readFile: deps.readFile,
         stat: deps.stat,
         repoName: opts.repo,
-    });
+    };
+    const accessResult = opts.launchProfile !== undefined || opts.baseUrl !== undefined
+        ? await resolveEpicLaunchBridgeApiAccess({
+            ...(opts.launchProfile ? { profileName: opts.launchProfile } : {}),
+            ...(opts.baseUrl ? { baseUrl: opts.baseUrl } : {}),
+        }, accessDeps)
+        : await resolveConductorBridgeApiAccess(accessDeps);
     if (!accessResult.ok) {
         deps.errorLog(`Cannot reach the Bridge API: ${accessResult.error}`);
         return 1;
@@ -2875,10 +2956,11 @@ async function executeSetupEpic(argv, overrides, runIdSink) {
             deps.errorLog(`The plan was NOT approved: this repository is no longer authorized for ` +
                 `unattended runs. The run WAS created and is left in 'planning' with no ` +
                 `activation and no executor dispatch — nothing was half-applied.\n` +
-                `Restore \`unattended_epic_implementer_allowed\` for this repository (see ` +
-                `docs/claude/account-settings-operator-runbook.md) and re-run setup-epic, ` +
-                `or deliberately convert this run to an attended posture through the ` +
-                `supported operator flow.\nDetail: ${errorDetail(err)}`);
+                `Turn 'Allow unattended Epic Implementer runs' back on in the repository's ` +
+                `Setup page in the Bridge admin panel and re-run setup-epic, or ` +
+                `deliberately convert this run to an attended posture through the ` +
+                `supported operator flow. If it is already on, contact Bridge support.` +
+                `\nDetail: ${errorDetail(err)}`);
         }
         else {
             deps.errorLog(`Failed to approve the plan: ${errorDetail(err)}`);

package/build/version.generated.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.60";
-export const BUILD_COMMIT = "1920a31997d2";
-export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.60", "serve"];
+export const VERSION = "0.2.65";
+export const BUILD_COMMIT = "a6ee899f43d8";
+export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.65", "serve"];

package/build/worker-guard-hook-bin.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import{readFileSync}from"node:fs";import path from"node:path";var WORKER_GUARD_REASON_PREFIX="bridge worker guard",WORKER_GUARD_MALFORMED_LINE=`${WORKER_GUARD_REASON_PREFIX}: payload could not be read; continuing fail-open`;function renderWorkerGuardReason(category,family){return`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This command family is restricted to the worker's own branch, worktree, and read-only network access. Use a different approach and continue.`}var UNSAFE_UNQUOTED=new Set(["$","`",">","<"]),SEPARATORS=new Set([";","|","&"]);function tokenizeShellCommand(command){let commands=[],argv=[],current="",hasCurrent=!1,unsafe=!1,endToken=()=>{hasCurrent&&(argv.push(current),current="",hasCurrent=!1)},endCommand=()=>{endToken(),(argv.length>0||unsafe)&&commands.push({argv,unsafe}),argv=[],unsafe=!1};for(let i=0;i<command.length;i+=1){let ch=command[i];if(ch==="\\"){let next=command[i+1];next!==void 0&&(current+=next,hasCurrent=!0,i+=1);continue}if(ch==="'"){let close=command.indexOf("'",i+1);if(close===-1){unsafe=!0,current+=command.slice(i+1),hasCurrent=!0;break}current+=command.slice(i+1,close),hasCurrent=!0,i=close;continue}if(ch==='"'){let j=i+1,body="",closed=!1;for(;j<command.length;){let c=command[j];if(c==="\\"&&j+1<command.length){body+=command[j+1],j+=2;continue}if(c==='"'){closed=!0;break}(c==="$"||c==="`")&&(unsafe=!0),body+=c,j+=1}closed||(unsafe=!0),current+=body,hasCurrent=!0,i=j;continue}if(UNSAFE_UNQUOTED.has(ch)){unsafe=!0,current+=ch,hasCurrent=!0;continue}if(SEPARATORS.has(ch)){endCommand();continue}if(ch===`
-`){endCommand();continue}if(ch===" "||ch==="	"||ch==="\r"){endToken();continue}current+=ch,hasCurrent=!0}return endCommand(),commands}var WORKER_GUARD_MAX_PAYLOAD_BYTES=1e6;function asRecord(value){return value!==null&&typeof value=="object"&&!Array.isArray(value)?value:void 0}function isInside(root,candidate){let rel=path.relative(root,candidate);return rel===""?!0:rel.startsWith("..")?!1:!path.isAbsolute(rel)}function resolveEffectiveCwd(ctx,payloadCwd){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root))return;let normalizedRoot=path.resolve(root);if(payloadCwd===void 0)return normalizedRoot;if(typeof payloadCwd!="string"||payloadCwd.length===0)return;let resolved=path.isAbsolute(payloadCwd)?path.resolve(payloadCwd):path.resolve(normalizedRoot,payloadCwd);return isInside(normalizedRoot,resolved)?resolved:void 0}function allTargetsContained(ctx,cwd,targets){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root)||cwd===void 0)return!1;let normalizedRoot=path.resolve(root);return targets.every(target=>{if(target.length===0||target==="~"||target.startsWith("~/"))return!1;let resolved=path.isAbsolute(target)?path.resolve(target):path.resolve(cwd,target);return isInside(normalizedRoot,resolved)})}function parseGitInvocation(argv,baseCwd){let cwd=baseCwd,unsafe=!1,i=1;for(;i<argv.length;){let token=argv[i];if(token==="-C"){let dir=argv[i+1];dir===void 0||cwd===void 0?(unsafe=!0,cwd=void 0):cwd=path.isAbsolute(dir)?path.resolve(dir):path.resolve(cwd,dir),i+=2;continue}if(token==="-c"||token==="--namespace"||token==="--git-dir"||token==="--work-tree"){unsafe=!0,i+=2;continue}if(token.startsWith("-")){i+=1;continue}break}return{subcommand:argv[i]??"",args:argv.slice(i+1),cwd,unsafe}}function isOwnBranchDestination(destination,workerBranch){let colon=destination.indexOf(":"),dst=colon===-1?destination:destination.slice(colon+1);if(dst.length===0)return!1;let bare=dst.startsWith("+")?dst.slice(1):dst;return bare===workerBranch||bare===`refs/heads/${workerBranch}`}function evaluateGitPush(args,ctx){let deny={kind:"deny",category:"git-push",family:"git"},positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}if(token.startsWith("-")){if(token==="--tags"||token==="--delete"||token==="-d"||token==="--mirror"||token==="--all"||token==="--follow-tags"||token.startsWith("--repo"))return deny;(token==="-o"||token==="--push-option"||token==="--receive-pack"||token==="--exec")&&(i+=1);continue}positional.push(token)}let workerBranch=ctx.workerBranch;return typeof workerBranch!="string"||workerBranch.length===0?deny:positional.length<=1?{kind:"allow"}:positional.slice(1).every(d=>isOwnBranchDestination(d,workerBranch))?{kind:"allow"}:deny}function evaluateGitReset(args,ctx){let deny={kind:"deny",category:"git-reset-hard",family:"git"};if(!args.includes("--hard"))return{kind:"allow"};let positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}token.startsWith("-")||positional.push(token)}if(positional.length===0)return{kind:"allow"};let workerBranch=ctx.workerBranch;if(typeof workerBranch!="string"||workerBranch.length===0)return deny;let allowed=new Set([workerBranch,`origin/${workerBranch}`,`refs/heads/${workerBranch}`,`refs/remotes/origin/${workerBranch}`]);return positional.every(ref=>allowed.has(ref))?{kind:"allow"}:deny}function evaluateGitClean(args,ctx,cwd){let deny={kind:"deny",category:"filesystem-clean",family:"git"};if(cwd===void 0||!allTargetsContained(ctx,cwd,[cwd]))return deny;let pathspecs=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){pathspecs.push(...args.slice(i+1));break}if(token==="-e"||token==="--exclude"){i+=1;continue}token.startsWith("-")||pathspecs.push(token)}return pathspecs.length===0?{kind:"allow"}:allTargetsContained(ctx,cwd,pathspecs)?{kind:"allow"}:deny}function isRecursiveForcedRemove(args){let recursive=!1,force=!1;for(let token of args){if(token==="--")break;if(token==="--recursive")recursive=!0;else if(token==="--force")force=!0;else{if(token.startsWith("--"))continue;if(token.startsWith("-")&&token.length>1)for(let flag of token.slice(1))(flag==="r"||flag==="R")&&(recursive=!0),flag==="f"&&(force=!0)}}return recursive&&force}function evaluateRemove(argv,ctx,cwd){let deny={kind:"deny",category:"filesystem-remove",family:"rm"},args=argv.slice(1);if(!isRecursiveForcedRemove(args))return{kind:"allow"};let targets=[],sawDoubleDash=!1;for(let token of args){if(!sawDoubleDash&&token==="--"){sawDoubleDash=!0;continue}!sawDoubleDash&&token.startsWith("-")&&token.length>1||targets.push(token)}return targets.length===0?deny:allTargetsContained(ctx,cwd,targets)?{kind:"allow"}:deny}function isDatabaseCommand(executable){let base=path.basename(executable);return base==="psql"||base.startsWith("pg_")}var DESTRUCTIVE_SQL=/\b(?:DROP|TRUNCATE)\b/i;function evaluateDatabase(argv){let deny={kind:"deny",category:"database-destructive",family:"psql"};return argv.slice(1).some(arg=>DESTRUCTIVE_SQL.test(arg))?deny:{kind:"allow"}}var MUTATING_METHODS=new Set(["POST","PUT","PATCH","DELETE"]);function evaluateNetwork(argv){let deny={kind:"deny",category:"network-mutating",family:"curl"},base=path.basename(argv[0]??""),args=argv.slice(1);for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="-X"||token==="--request"||token==="--method"){let value=args[i+1];if(value===void 0||MUTATING_METHODS.has(value.toUpperCase()))return deny;i+=1;continue}if(token.startsWith("-X")&&token.length>2){if(MUTATING_METHODS.has(token.slice(2).toUpperCase()))return deny;continue}if(token.startsWith("--request=")||token.startsWith("--method=")){let value=token.slice(token.indexOf("=")+1);if(MUTATING_METHODS.has(value.toUpperCase()))return deny;continue}if(token==="--data"||token.startsWith("--data=")||token.startsWith("--data-")||token==="--form"||token==="-F"||token==="--upload-file"||token==="-T"||token==="--post-data"||token.startsWith("--post-data=")||token==="--post-file"||token.startsWith("--post-file=")||token==="--body-data"||token.startsWith("--body-data=")||token==="--body-file"||token.startsWith("--body-file=")||base==="curl"&&token==="-d")return deny}return{kind:"allow"}}function classify(executable){let base=path.basename(executable);return base==="git"?"git":base==="rm"?"rm":isDatabaseCommand(base)?"database":base==="curl"||base==="wget"?"network":null}function unsafeSegmentDecision(family){switch(family){case"git":return{kind:"deny",category:"git-push",family:"git"};case"rm":return{kind:"deny",category:"filesystem-remove",family:"rm"};case"database":return{kind:"deny",category:"database-destructive",family:"psql"};case"network":return{kind:"deny",category:"network-mutating",family:"curl"}}}var TRANSPARENT_PREFIXES=new Set(["sudo","env","command","nohup","time","nice","exec"]),STDIN_ARGUMENT_PREFIXES=new Set(["xargs"]),SHELL_EXECUTABLES=new Set(["sh","bash","zsh","dash","ksh"]),EVAL_BUILTINS=new Set(["eval"]);function unwrapTransparentPrefixes(argv){let rest=argv;for(let depth=0;depth<8;depth+=1){let head=rest[0];if(head===void 0||!TRANSPARENT_PREFIXES.has(path.basename(head)))return rest;let i=1;for(;i<rest.length;){let token=rest[i];if(path.basename(head)==="env"&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)){i+=1;continue}if(token.startsWith("-")){i+=1;continue}break}rest=rest.slice(i)}return rest}function stripStdinPrefixOptions(argv){let VALUE_OPTS=new Set(["-I","-i","-L","-n","-P","-s","-d","-E","-e","-a","--replace","--max-lines","--max-args","--max-procs","--max-chars","--delimiter","--eof","--arg-file"]),i=1;for(;i<argv.length;){let token=argv[i];if(token==="--"){i+=1;break}if(!token.startsWith("-"))break;if(token.includes("=")){i+=1;continue}i+=VALUE_OPTS.has(token)?2:1}return argv.slice(i)}function evaluateSimpleCommand(segment,ctx,payloadCwd,depth=0,stdinFed=!1){let argv=unwrapTransparentPrefixes(segment.argv),executable=argv[0];if(executable===void 0)return{kind:"allow"};if(SHELL_EXECUTABLES.has(path.basename(executable))&&depth<4){let cIndex=argv.findIndex(t=>t==="-c"),inner=cIndex===-1?void 0:argv[cIndex+1];if(inner!==void 0){for(let nested of tokenizeShellCommand(inner)){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}}if(EVAL_BUILTINS.has(path.basename(executable))&&depth<4){for(let nested of tokenizeShellCommand(argv.slice(1).join(" "))){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}if(STDIN_ARGUMENT_PREFIXES.has(path.basename(executable))&&depth<4){let rest=stripStdinPrefixOptions(argv);return rest.length===0?{kind:"allow"}:evaluateSimpleCommand({argv:rest,unsafe:segment.unsafe},ctx,payloadCwd,depth+1,!0)}segment={argv,unsafe:segment.unsafe};let family=classify(executable);if(family===null)return{kind:"allow"};if(stdinFed||segment.unsafe)return unsafeSegmentDecision(family);let cwd=resolveEffectiveCwd(ctx,payloadCwd);if(family==="rm")return evaluateRemove(segment.argv,ctx,cwd);if(family==="database")return evaluateDatabase(segment.argv);if(family==="network")return evaluateNetwork(segment.argv);let git=parseGitInvocation(segment.argv,cwd);return git.subcommand==="push"?git.unsafe?{kind:"deny",category:"git-push",family:"git"}:evaluateGitPush(git.args,ctx):git.subcommand==="reset"?git.unsafe?{kind:"deny",category:"git-reset-hard",family:"git"}:evaluateGitReset(git.args,ctx):git.subcommand==="clean"?git.unsafe?{kind:"deny",category:"filesystem-clean",family:"git"}:evaluateGitClean(git.args,ctx,git.cwd):{kind:"allow"}}function evaluateWorkerGuardPayload(payload,ctx){let root=asRecord(payload);if(root===void 0)return{kind:"malformed"};let toolName=root.tool_name??root.toolName;if(typeof toolName!="string")return{kind:"malformed"};if(toolName!=="Bash")return{kind:"allow"};let input=asRecord(root.tool_input??root.toolInput);if(input===void 0)return{kind:"malformed"};let command=input.command;if(typeof command!="string")return{kind:"malformed"};let rawCwd=root.cwd??input.cwd,payloadCwd=typeof rawCwd=="string"?rawCwd:void 0;for(let segment of tokenizeShellCommand(command)){let decision=evaluateSimpleCommand(segment,ctx,payloadCwd);if(decision.kind==="deny")return decision}return{kind:"allow"}}function evaluateWorkerGuardInput(raw,ctx){if(typeof raw!="string")return{kind:"malformed"};if(raw.length>WORKER_GUARD_MAX_PAYLOAD_BYTES)return{kind:"malformed"};if(raw.trim().length===0)return{kind:"malformed"};let parsed;try{parsed=JSON.parse(raw)}catch{return{kind:"malformed"}}try{return evaluateWorkerGuardPayload(parsed,ctx)}catch{return{kind:"malformed"}}}var WORKER_GUARD_ROOT_FLAG="--worktree-root";function resolveWorkerGuardContext(env,cwd,argv=[]){let ctx={},root;for(let i=0;i<argv.length;i+=1){if(argv[i]===WORKER_GUARD_ROOT_FLAG){root=argv[i+1];break}if(argv[i].startsWith(`${WORKER_GUARD_ROOT_FLAG}=`)){root=argv[i].slice(WORKER_GUARD_ROOT_FLAG.length+1);break}}root===void 0&&typeof cwd=="string"&&(root=cwd),typeof root=="string"&&path.isAbsolute(root)&&(ctx.worktreePath=path.resolve(root));let branch=env.BAPI_WORKER_BRANCH;return typeof branch=="string"&&branch.trim().length>0&&(ctx.workerBranch=branch.trim()),ctx}function readStdinSync(){return readFileSync(0,"utf-8")}var exitCode=0;try{let raw=readStdinSync(),ctx=resolveWorkerGuardContext(process.env,process.cwd(),process.argv.slice(2)),decision=evaluateWorkerGuardInput(raw,ctx);decision.kind==="deny"?(process.stderr.write(`${renderWorkerGuardReason(decision.category,decision.family)}
+import{readFileSync}from"node:fs";import path from"node:path";var WORKER_GUARD_REASON_PREFIX="bridge worker guard",WORKER_GUARD_MALFORMED_LINE=`${WORKER_GUARD_REASON_PREFIX}: payload could not be read; continuing fail-open`;function renderWorkerGuardReason(category,family){return category==="git-ambiguous"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This shell form cannot be safely resolved: substitution, redirection, or stdin-fed arguments hide what git will run. Use literal arguments instead; for a commit message, write it to a file and run git commit -F <file>.`:`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This command family is restricted to the worker's own branch, worktree, and read-only network access. Use a different approach and continue.`}var UNSAFE_UNQUOTED=new Set(["$","`",">","<"]),SEPARATORS=new Set([";","|","&"]);function tokenizeShellCommand(command){let commands=[],argv=[],current="",hasCurrent=!1,unsafe=!1,endToken=()=>{hasCurrent&&(argv.push(current),current="",hasCurrent=!1)},endCommand=()=>{endToken(),(argv.length>0||unsafe)&&commands.push({argv,unsafe}),argv=[],unsafe=!1};for(let i=0;i<command.length;i+=1){let ch=command[i];if(ch==="\\"){let next=command[i+1];next!==void 0&&(current+=next,hasCurrent=!0,i+=1);continue}if(ch==="'"){let close=command.indexOf("'",i+1);if(close===-1){unsafe=!0,current+=command.slice(i+1),hasCurrent=!0;break}current+=command.slice(i+1,close),hasCurrent=!0,i=close;continue}if(ch==='"'){let j=i+1,body="",closed=!1;for(;j<command.length;){let c=command[j];if(c==="\\"&&j+1<command.length){body+=command[j+1],j+=2;continue}if(c==='"'){closed=!0;break}(c==="$"||c==="`")&&(unsafe=!0),body+=c,j+=1}closed||(unsafe=!0),current+=body,hasCurrent=!0,i=j;continue}if(UNSAFE_UNQUOTED.has(ch)){unsafe=!0,current+=ch,hasCurrent=!0;continue}if(SEPARATORS.has(ch)){endCommand();continue}if(ch===`
+`){endCommand();continue}if(ch===" "||ch==="	"||ch==="\r"){endToken();continue}current+=ch,hasCurrent=!0}return endCommand(),commands}var WORKER_GUARD_MAX_PAYLOAD_BYTES=1e6;function asRecord(value){return value!==null&&typeof value=="object"&&!Array.isArray(value)?value:void 0}function isInside(root,candidate){let rel=path.relative(root,candidate);return rel===""?!0:rel.startsWith("..")?!1:!path.isAbsolute(rel)}function resolveEffectiveCwd(ctx,payloadCwd){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root))return;let normalizedRoot=path.resolve(root);if(payloadCwd===void 0)return normalizedRoot;if(typeof payloadCwd!="string"||payloadCwd.length===0)return;let resolved=path.isAbsolute(payloadCwd)?path.resolve(payloadCwd):path.resolve(normalizedRoot,payloadCwd);return isInside(normalizedRoot,resolved)?resolved:void 0}function allTargetsContained(ctx,cwd,targets){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root)||cwd===void 0)return!1;let normalizedRoot=path.resolve(root);return targets.every(target=>{if(target.length===0||target==="~"||target.startsWith("~/"))return!1;let resolved=path.isAbsolute(target)?path.resolve(target):path.resolve(cwd,target);return isInside(normalizedRoot,resolved)})}function parseGitInvocation(argv,baseCwd){let cwd=baseCwd,unsafe=!1,i=1;for(;i<argv.length;){let token=argv[i];if(token==="-C"){let dir=argv[i+1];dir===void 0||cwd===void 0?(unsafe=!0,cwd=void 0):cwd=path.isAbsolute(dir)?path.resolve(dir):path.resolve(cwd,dir),i+=2;continue}if(token==="-c"||token==="--namespace"||token==="--git-dir"||token==="--work-tree"){unsafe=!0,i+=2;continue}if(token.startsWith("-")){i+=1;continue}break}return{subcommand:argv[i]??"",args:argv.slice(i+1),cwd,unsafe}}function isOwnBranchDestination(destination,workerBranch){let colon=destination.indexOf(":"),dst=colon===-1?destination:destination.slice(colon+1);if(dst.length===0)return!1;let bare=dst.startsWith("+")?dst.slice(1):dst;return bare===workerBranch||bare===`refs/heads/${workerBranch}`}function evaluateGitPush(args,ctx){let deny={kind:"deny",category:"git-push",family:"git"},positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}if(token.startsWith("-")){if(token==="--tags"||token==="--delete"||token==="-d"||token==="--mirror"||token==="--all"||token==="--follow-tags"||token.startsWith("--repo"))return deny;(token==="-o"||token==="--push-option"||token==="--receive-pack"||token==="--exec")&&(i+=1);continue}positional.push(token)}let workerBranch=ctx.workerBranch;return typeof workerBranch!="string"||workerBranch.length===0?deny:positional.length<=1?{kind:"allow"}:positional.slice(1).every(d=>isOwnBranchDestination(d,workerBranch))?{kind:"allow"}:deny}function evaluateGitReset(args,ctx){let deny={kind:"deny",category:"git-reset-hard",family:"git"};if(!args.includes("--hard"))return{kind:"allow"};let positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}token.startsWith("-")||positional.push(token)}if(positional.length===0)return{kind:"allow"};let workerBranch=ctx.workerBranch;if(typeof workerBranch!="string"||workerBranch.length===0)return deny;let allowed=new Set([workerBranch,`origin/${workerBranch}`,`refs/heads/${workerBranch}`,`refs/remotes/origin/${workerBranch}`]);return positional.every(ref=>allowed.has(ref))?{kind:"allow"}:deny}function evaluateGitClean(args,ctx,cwd){let deny={kind:"deny",category:"filesystem-clean",family:"git"};if(cwd===void 0||!allTargetsContained(ctx,cwd,[cwd]))return deny;let pathspecs=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){pathspecs.push(...args.slice(i+1));break}if(token==="-e"||token==="--exclude"){i+=1;continue}token.startsWith("-")||pathspecs.push(token)}return pathspecs.length===0?{kind:"allow"}:allTargetsContained(ctx,cwd,pathspecs)?{kind:"allow"}:deny}function isRecursiveForcedRemove(args){let recursive=!1,force=!1;for(let token of args){if(token==="--")break;if(token==="--recursive")recursive=!0;else if(token==="--force")force=!0;else{if(token.startsWith("--"))continue;if(token.startsWith("-")&&token.length>1)for(let flag of token.slice(1))(flag==="r"||flag==="R")&&(recursive=!0),flag==="f"&&(force=!0)}}return recursive&&force}function evaluateRemove(argv,ctx,cwd){let deny={kind:"deny",category:"filesystem-remove",family:"rm"},args=argv.slice(1);if(!isRecursiveForcedRemove(args))return{kind:"allow"};let targets=[],sawDoubleDash=!1;for(let token of args){if(!sawDoubleDash&&token==="--"){sawDoubleDash=!0;continue}!sawDoubleDash&&token.startsWith("-")&&token.length>1||targets.push(token)}return targets.length===0?deny:allTargetsContained(ctx,cwd,targets)?{kind:"allow"}:deny}function isDatabaseCommand(executable){let base=path.basename(executable);return base==="psql"||base.startsWith("pg_")}var DESTRUCTIVE_SQL=/\b(?:DROP|TRUNCATE)\b/i;function evaluateDatabase(argv){let deny={kind:"deny",category:"database-destructive",family:"psql"};return argv.slice(1).some(arg=>DESTRUCTIVE_SQL.test(arg))?deny:{kind:"allow"}}var MUTATING_METHODS=new Set(["POST","PUT","PATCH","DELETE"]);function evaluateNetwork(argv){let deny={kind:"deny",category:"network-mutating",family:"curl"},base=path.basename(argv[0]??""),args=argv.slice(1);for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="-X"||token==="--request"||token==="--method"){let value=args[i+1];if(value===void 0||MUTATING_METHODS.has(value.toUpperCase()))return deny;i+=1;continue}if(token.startsWith("-X")&&token.length>2){if(MUTATING_METHODS.has(token.slice(2).toUpperCase()))return deny;continue}if(token.startsWith("--request=")||token.startsWith("--method=")){let value=token.slice(token.indexOf("=")+1);if(MUTATING_METHODS.has(value.toUpperCase()))return deny;continue}if(token==="--data"||token.startsWith("--data=")||token.startsWith("--data-")||token==="--form"||token==="-F"||token==="--upload-file"||token==="-T"||token==="--post-data"||token.startsWith("--post-data=")||token==="--post-file"||token.startsWith("--post-file=")||token==="--body-data"||token.startsWith("--body-data=")||token==="--body-file"||token.startsWith("--body-file=")||base==="curl"&&token==="-d")return deny}return{kind:"allow"}}function classify(executable){let base=path.basename(executable);return base==="git"?"git":base==="rm"?"rm":isDatabaseCommand(base)?"database":base==="curl"||base==="wget"?"network":null}function unsafeGitCategory(argv){let{subcommand}=parseGitInvocation(argv,void 0);return subcommand==="push"?"git-push":subcommand==="reset"?"git-reset-hard":subcommand==="clean"?"filesystem-clean":"git-ambiguous"}function unsafeSegmentDecision(family,argv){switch(family){case"git":return{kind:"deny",category:unsafeGitCategory(argv),family:"git"};case"rm":return{kind:"deny",category:"filesystem-remove",family:"rm"};case"database":return{kind:"deny",category:"database-destructive",family:"psql"};case"network":return{kind:"deny",category:"network-mutating",family:"curl"}}}var TRANSPARENT_PREFIXES=new Set(["sudo","env","command","nohup","time","nice","exec"]),STDIN_ARGUMENT_PREFIXES=new Set(["xargs"]),SHELL_EXECUTABLES=new Set(["sh","bash","zsh","dash","ksh"]),EVAL_BUILTINS=new Set(["eval"]);function unwrapTransparentPrefixes(argv){let rest=argv;for(let depth=0;depth<8;depth+=1){let head=rest[0];if(head===void 0||!TRANSPARENT_PREFIXES.has(path.basename(head)))return rest;let i=1;for(;i<rest.length;){let token=rest[i];if(path.basename(head)==="env"&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)){i+=1;continue}if(token.startsWith("-")){i+=1;continue}break}rest=rest.slice(i)}return rest}function stripStdinPrefixOptions(argv){let VALUE_OPTS=new Set(["-I","-i","-L","-n","-P","-s","-d","-E","-e","-a","--replace","--max-lines","--max-args","--max-procs","--max-chars","--delimiter","--eof","--arg-file"]),i=1;for(;i<argv.length;){let token=argv[i];if(token==="--"){i+=1;break}if(!token.startsWith("-"))break;if(token.includes("=")){i+=1;continue}i+=VALUE_OPTS.has(token)?2:1}return argv.slice(i)}function evaluateSimpleCommand(segment,ctx,payloadCwd,depth=0,stdinFed=!1){let argv=unwrapTransparentPrefixes(segment.argv),executable=argv[0];if(executable===void 0)return{kind:"allow"};if(SHELL_EXECUTABLES.has(path.basename(executable))&&depth<4){let cIndex=argv.findIndex(t=>t==="-c"),inner=cIndex===-1?void 0:argv[cIndex+1];if(inner!==void 0){for(let nested of tokenizeShellCommand(inner)){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}}if(EVAL_BUILTINS.has(path.basename(executable))&&depth<4){for(let nested of tokenizeShellCommand(argv.slice(1).join(" "))){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}if(STDIN_ARGUMENT_PREFIXES.has(path.basename(executable))&&depth<4){let rest=stripStdinPrefixOptions(argv);return rest.length===0?{kind:"allow"}:evaluateSimpleCommand({argv:rest,unsafe:segment.unsafe},ctx,payloadCwd,depth+1,!0)}segment={argv,unsafe:segment.unsafe};let family=classify(executable);if(family===null)return{kind:"allow"};if(stdinFed||segment.unsafe)return unsafeSegmentDecision(family,segment.argv);let cwd=resolveEffectiveCwd(ctx,payloadCwd);if(family==="rm")return evaluateRemove(segment.argv,ctx,cwd);if(family==="database")return evaluateDatabase(segment.argv);if(family==="network")return evaluateNetwork(segment.argv);let git=parseGitInvocation(segment.argv,cwd);return git.subcommand==="push"?git.unsafe?{kind:"deny",category:"git-push",family:"git"}:evaluateGitPush(git.args,ctx):git.subcommand==="reset"?git.unsafe?{kind:"deny",category:"git-reset-hard",family:"git"}:evaluateGitReset(git.args,ctx):git.subcommand==="clean"?git.unsafe?{kind:"deny",category:"filesystem-clean",family:"git"}:evaluateGitClean(git.args,ctx,git.cwd):{kind:"allow"}}function evaluateWorkerGuardPayload(payload,ctx){let root=asRecord(payload);if(root===void 0)return{kind:"malformed"};let toolName=root.tool_name??root.toolName;if(typeof toolName!="string")return{kind:"malformed"};if(toolName!=="Bash")return{kind:"allow"};let input=asRecord(root.tool_input??root.toolInput);if(input===void 0)return{kind:"malformed"};let command=input.command;if(typeof command!="string")return{kind:"malformed"};let rawCwd=root.cwd??input.cwd,payloadCwd=typeof rawCwd=="string"?rawCwd:void 0;for(let segment of tokenizeShellCommand(command)){let decision=evaluateSimpleCommand(segment,ctx,payloadCwd);if(decision.kind==="deny")return decision}return{kind:"allow"}}function evaluateWorkerGuardInput(raw,ctx){if(typeof raw!="string")return{kind:"malformed"};if(raw.length>WORKER_GUARD_MAX_PAYLOAD_BYTES)return{kind:"malformed"};if(raw.trim().length===0)return{kind:"malformed"};let parsed;try{parsed=JSON.parse(raw)}catch{return{kind:"malformed"}}try{return evaluateWorkerGuardPayload(parsed,ctx)}catch{return{kind:"malformed"}}}var WORKER_GUARD_ROOT_FLAG="--worktree-root";function resolveWorkerGuardContext(env,cwd,argv=[]){let ctx={},root;for(let i=0;i<argv.length;i+=1){if(argv[i]===WORKER_GUARD_ROOT_FLAG){root=argv[i+1];break}if(argv[i].startsWith(`${WORKER_GUARD_ROOT_FLAG}=`)){root=argv[i].slice(WORKER_GUARD_ROOT_FLAG.length+1);break}}root===void 0&&typeof cwd=="string"&&(root=cwd),typeof root=="string"&&path.isAbsolute(root)&&(ctx.worktreePath=path.resolve(root));let branch=env.BAPI_WORKER_BRANCH;return typeof branch=="string"&&branch.trim().length>0&&(ctx.workerBranch=branch.trim()),ctx}function readStdinSync(){return readFileSync(0,"utf-8")}var exitCode=0;try{let raw=readStdinSync(),ctx=resolveWorkerGuardContext(process.env,process.cwd(),process.argv.slice(2)),decision=evaluateWorkerGuardInput(raw,ctx);decision.kind==="deny"?(process.stderr.write(`${renderWorkerGuardReason(decision.category,decision.family)}
 `),exitCode=2):decision.kind==="malformed"&&(process.stderr.write(`${WORKER_GUARD_MALFORMED_LINE}
 `),exitCode=0)}catch{try{process.stderr.write(`${WORKER_GUARD_MALFORMED_LINE}
 `)}catch{}exitCode=0}process.exit(exitCode);

package/docs/CONDUCTOR.md

@@ -314,6 +314,111 @@ hook presence and managed-snippet status **read-only** (a new `git hooks` sectio
 `git_hooks` JSON object alongside the ledger report), and the reconciler drives CI
 polling and gate evaluation regardless of whether hooks are installed.
 
+### Durable hook installation (BAPI-1290)
+
+A managed hook embeds one absolute entry path and runs it on every commit for as
+long as the hook file lives. So the installer embeds only a **qualified persistent
+runtime** and refuses anything that can disappear under it.
+
+**Supported installation.** Install the package persistently, then install the hooks
+from that install:
+
+```bash
+npm i -g @bridge_gpt/mcp-server
+epic-implementer install-git-hooks
+```
+
+A user-owned persistent prefix (`npm i -g --prefix <dir>`, with `<dir>/bin` on PATH)
+works the same way. The hook embeds the fixed package entry
+`<prefix>/lib/node_modules/@bridge_gpt/mcp-server/build/epic-implementer-bin.js`
+(POSIX single-quoted, so spaces and shell metacharacters stay literal) and launches it
+with `node` from PATH. It never embeds npm's `.bin` shim and never pins
+`process.execPath`.
+
+Running the installer through `npx` is allowed only as a front door: it looks up an
+**already installed** persistent global package with a bounded, offline
+`npm root -g` (at install time only) and embeds that package's entry. When no
+qualified persistent install exists, it refuses.
+
+**What "qualified" means.** Before touching any hook, the installer checks, read-only:
+
+| Check | Refusal classification |
+|---|---|
+| The entry is not inside the prunable `_npx` cache | `ephemeral-cache` |
+| The canonical entry is a regular `build/epic-implementer-bin.js` | `missing` |
+| It is not the retired `conductor-bin.js` name | `legacy-name` |
+| It sits at `…/node_modules/@bridge_gpt/mcp-server/build/`, and the adjacent `package.json` has that `name`, a compatible `version` (`>=0.2.0 <1.0.0`), and `bin.epic-implementer` → `./build/epic-implementer-bin.js` | `unqualified-runtime` |
+| The platform is macOS or Linux | `unqualified-runtime` |
+| `node` from PATH launches the entry's private probe within 15 seconds | `node-unavailable` / `unknown` |
+| That Node is an even LTS line ≥ 20 | `unqualified-runtime` |
+| `better-sqlite3` loads for that Node | `native-unavailable` |
+
+A refusal exits 1, prints only the classification and a fixed action (never a path or
+error text), and leaves both existing hooks byte-for-byte and mode-for-mode unchanged.
+Hooks are optional observability: a refusal is **not** an engine-admission failure and
+not a setup-permission stop.
+
+**Qualified matrix.** Recorded evidence, not inference:
+
+| OS | Install | Node | Native | Status |
+|---|---|---|---|---|
+| macOS 26 (Darwin 25.6, arm64) | persistent `npm i -g --prefix` (npm 11.13.0) | v24.16.0 (ABI 137) | better-sqlite3 13.0.3 | qualified by `packaged-git-hooks-lifetime.test.ts` |
+| Linux | persistent `npm i -g` | even LTS ≥ 20 | better-sqlite3 13.x | accepted by policy; **not yet locally qualified** |
+| Windows | any | any | any | **unqualified** — always refused |
+| Any | `npx` cache only, version-manager switches (nvm/fnm/volta), other layouts | — | — | **unqualified** |
+
+A package-layout change or a Node/native ABI change must be requalified by re-running
+`npm run test:hooks-lifetime` before this table changes.
+
+**Publication.** The installer plans both hooks before writing either. It refuses a
+symlinked, non-regular, unreadable, or binary hook with a per-hook reason and changes
+nothing. Each hook is then written to a same-directory temporary file with its original
+mode plus only the missing execute bits, re-checked against its planned snapshot, and
+renamed atomically over the target. A hook edited in the meantime is left untouched
+(`intervening-edit`). Two renames are not a transaction: if one hook publishes and the
+other does not, the result is `PARTIAL` (exit 1), the published hook is not rolled
+back, and re-running the installer converges to exactly one managed block per hook.
+User content before and after the managed block is preserved.
+
+**Behavior changes to note.** A symlinked hook is refused rather than written
+through; one unsafe hook (symlinked, unreadable, binary, or not a regular file)
+blocks installing both; a source-checkout build is refused as
+`unqualified-runtime`; and on Windows `doctor` always reports `unqualified-runtime`.
+A persistent install older than this change cannot answer the runtime probe and is
+reported `unknown` — upgrade it with `npm i -g @bridge_gpt/mcp-server@latest`.
+
+**Diagnosis.** `epic-implementer doctor` (and `install doctor`) report each hook's
+`state` and `usable` verdict read-only: no npm lookup, no download, no hook rewrite,
+no service start, no ledger write. Its only subprocess is the bounded runtime probe.
+A hook that exists but points into the npx cache (`ephemeral-cache`), at a removed
+install (`missing`), at the retired name (`legacy-name`), or at a runtime whose native
+binding no longer loads (`native-unavailable`) is **unavailable**, never healthy. The
+raw embedded path appears only in `--json` output (`embedded_bin_path`).
+
+**Repairing old cache-backed hooks.** Hooks installed from `npx` before BAPI-1290
+point into the npx cache. Doctor reports them as `ephemeral-cache`. To repair:
+install persistently (`npm i -g @bridge_gpt/mcp-server`), then re-run
+`epic-implementer install-git-hooks` (or `install conductor` and accept the
+local-observability consent). The managed block is replaced in place; user content,
+modes, and the local ledger are preserved.
+
+**Upgrades and rollback.** `npm i -g @bridge_gpt/mcp-server@<version>` replaces the
+package in place, so the embedded path is unchanged and hooks keep working **without
+being rewritten**. While the replacement is in progress, or if it is interrupted,
+optional delivery may be temporarily unavailable and doctor reports it as degraded;
+completing the install (or re-running it) restores delivery. To roll back, install the
+previous compatible version the same way, then run `epic-implementer doctor` and, if
+it reports degraded, `epic-implementer install-git-hooks`. Removing the global package
+deliberately is outside the availability guarantee but stays diagnosable (`missing`).
+
+**What is not promised.** Events that occur while hook delivery is unavailable are
+**lost and not replayed**; the ledger is not complete for those intervals, and anyone
+relying on a missed observation must reconcile it from Git itself. Git commits and ref
+updates are never blocked or slowed by an unavailable runtime (the hook is detached and
+ends in `|| true`), and engine admission never depends on hooks. No run-speed
+improvement is claimed. Activating a hook build against a live or shared control plane
+remains a separately authorized operation.
+
 ## Supervisor config — where the done gate and auto-merge live
 
 > **These are not config fields.** They used to be `conductor_done_gate` and
@@ -327,7 +432,14 @@ Two scopes exist for each: a per-repo **project default**, and a per-epic overri
 | Setting | Endpoint (project default) |
 | --- | --- |
 | `done_gate_config` | `PUT /jira/epic-runs/supervisor-setup/defaults/?repo_name=<repo>` |
-| `auto_merge_enabled`, `merge_approval_required` | `PUT /jira/epic-runs/supervisor-config/defaults/?repo_name=<repo>` |
+| `auto_merge_enabled`, `merge_approval_required` | `PUT /jira/epic-runs/supervisor-config/defaults/?repo_name=<repo>` (see note below) |
+
+Since BAPI-1288 every project-default write is protected. A write that removes a
+configured requirement needs a preview (`POST …/defaults/preview/`) and the exact
+approval it returns. Turning `auto_merge_enabled` **on**, or dropping a required
+`merge_approval_required`, on the project default is refused (`409 NON_RELAXABLE`)
+whatever the approval. That is an operator decision; see the account-settings
+operator runbook (`docs/claude/account-settings-operator-runbook.md`).
 
 Swap `…/defaults/` for `…/runs/{epic_key}/…` to scope a setting to one epic. The
 matching `GET` on each returns the effective value, with a `source` of `epic`,
@@ -356,7 +468,9 @@ strictly `true`), malformed, empty, or unsupported config emits no `gate.met`.
 
 When a worker's PR meets the done gate (`gate.met`), the supervisor can autonomously
 merge it — but **only** when the repo has explicitly opted in.
-`auto_merge_enabled` on the supervisor-config endpoint is the opt-in switch.
+`auto_merge_enabled` on the supervisor-config endpoint is the opt-in switch. On the
+project default it can no longer be turned on through the API (BAPI-1288); an
+operator sets it, as the note above describes. A per-epic override is unchanged.
 
 **Auto-merge is disabled by default.** Behavior:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge_gpt/mcp-server",
-  "version": "0.2.60",
+  "version": "0.2.65",
   "description": "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents",
   "license": "MIT",
   "type": "module",
@@ -37,6 +37,7 @@
     "test:module-mocks": "node scripts/run-unit-tests.js module-mocks",
     "test:integration": "node scripts/run-integration-tests.js",
     "test:smoke": "node --test build/integration/packaged-cli-smoke.test.js",
+    "test:hooks-lifetime": "node --test build/integration/packaged-git-hooks-lifetime.test.js",
     "canary:agent-capabilities": "npm run build && node scripts/agent-capabilities-canary.mjs",
     "prepublishOnly": "node scripts/bundle-assets.js && npm run build && node scripts/verify-shebang.cjs && npm run assert:release-identity"
   },