@bridge_gpt/mcp-server 0.2.65 → 0.2.66

package/build/install-doctor.js

@@ -25,6 +25,10 @@ import { resolveBapiCredentials } from "./credential-store.js";
 import { detectClaudeLogin, formatClaudeLoginAdvisory } from "./claude-login.js";
 import { getProjectJsonTargets, hostAdapterForTarget } from "./mcp-host-targets.js";
 import { existingRegistrationKey, MCP_PACKAGE_NAME, } from "./mcp-identity.js";
+import { readBridgeConfig } from "./bridge-config.js";
+import { PLACEHOLDER_REPO_NAME } from "./init.js";
+import { PROJECT_ROOT_REFUSAL_TEXT, validateExplicitProjectRoot, } from "./project-root.js";
+import { renderDiagnosticValue } from "./diagnostic-text.js";
 /** Default production base URL (mirrors install-bridge's DEFAULT_BAPI_BASE_URL). */
 const DEFAULT_BASE_URL = "https://bridgegpt-api.com";
 /**
@@ -50,6 +54,53 @@ const MCP_CONFIG_ENV_TARGETS = getProjectJsonTargets().map((target) => ({
 }));
 /** Timeout for each read-only probe request. */
 const PROBE_TIMEOUT_MS = 5_000;
+/**
+ * Read the Bridge env block of every project-local MCP config, in
+ * {@link MCP_CONFIG_ENV_TARGETS} order. Absent, unparseable, and Bridge-less
+ * configs contribute nothing. Shared by {@link resolveInstallDoctorTarget} and
+ * the BAPI-1318 identity-and-root section, so both read the same files the same
+ * way. Strictly read-only; the returned env is never rendered whole.
+ */
+export async function readProjectConfigEnvBlocks(deps) {
+    const blocks = [];
+    for (const { relPath, topLevelKey } of MCP_CONFIG_ENV_TARGETS) {
+        let raw;
+        try {
+            raw = await deps.readFile(path.join(deps.cwd, relPath));
+        }
+        catch {
+            continue; // absent config is not a finding
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            continue;
+        }
+        // BAPI-807: read the env block through the RESOLVED registration key. A
+        // config written before the rename registers `bridge-api`, and looking
+        // only under the canonical name would report a perfectly working install
+        // as having no repo/base-URL configured at all.
+        const servers = parsed && typeof parsed === "object"
+            ? // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                parsed[topLevelKey]
+            : undefined;
+        const registrationKey = existingRegistrationKey(servers);
+        if (registrationKey === null)
+            continue;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const envBlock = servers[registrationKey]?.env;
+        blocks.push({
+            relPath,
+            registrationKey,
+            env: envBlock && typeof envBlock === "object" && !Array.isArray(envBlock)
+                ? envBlock
+                : {},
+        });
+    }
+    return blocks;
+}
 /**
  * Resolve the repo name and base URL: environment first, then the NON-SECRET
  * env-block values of the project-local MCP configs (`BAPI_REPO_NAME` /
@@ -63,36 +114,7 @@ export async function resolveInstallDoctorTarget(deps) {
     let repoSource = repoName ? "env" : null;
     let baseUrl = envBase && envBase.length > 0 ? envBase : null;
     if (!repoName || !baseUrl) {
-        for (const { relPath, topLevelKey } of MCP_CONFIG_ENV_TARGETS) {
-            let raw;
-            try {
-                raw = await deps.readFile(path.join(deps.cwd, relPath));
-            }
-            catch {
-                continue; // absent config is not a finding
-            }
-            let parsed;
-            try {
-                parsed = JSON.parse(raw);
-            }
-            catch {
-                continue;
-            }
-            // BAPI-807: read the env block through the RESOLVED registration key. A
-            // config written before the rename registers `bridge-api`, and looking
-            // only under the canonical name would report a perfectly working install
-            // as having no repo/base-URL configured at all.
-            const servers = parsed && typeof parsed === "object"
-                ? // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                    parsed[topLevelKey]
-                : undefined;
-            const registrationKey = existingRegistrationKey(servers);
-            const envBlock = registrationKey !== null
-                ? // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                    servers[registrationKey]?.env
-                : undefined;
-            if (!envBlock)
-                continue;
+        for (const { env: envBlock } of await readProjectConfigEnvBlocks(deps)) {
             if (!repoName && typeof envBlock.BAPI_REPO_NAME === "string" && envBlock.BAPI_REPO_NAME.trim()) {
                 repoName = envBlock.BAPI_REPO_NAME.trim();
                 repoSource = "config";
@@ -106,6 +128,126 @@ export async function resolveInstallDoctorTarget(deps) {
     }
     return { repoName, repoSource, baseUrl: (baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "") };
 }
+/**
+ * Collect the identity-and-root facts `doctor` can know from its own process
+ * (BAPI-1318). It cannot see the server's MCP `roots/list`, so for the root it
+ * reports only what is checkable here: each explicit `BAPI_PROJECT_ROOT` (the
+ * shell, then each project MCP config env block), run through the SAME validator
+ * the server uses. For identity it compares `<cwd>/.bridge/config`'s `repo_name`
+ * with each project MCP config's `BAPI_REPO_NAME` — never with the shell's, which
+ * is not what worktrees and the `mcp-invoke` shim read.
+ */
+export async function collectProjectIdentityAndRoot(deps) {
+    const blocks = await readProjectConfigEnvBlocks(deps);
+    const roots = [];
+    const candidates = [
+        { source: "environment", value: deps.env.BAPI_PROJECT_ROOT },
+        ...blocks.map((b) => ({ source: b.relPath, value: b.env.BAPI_PROJECT_ROOT })),
+    ];
+    for (const { source, value } of candidates) {
+        if (typeof value !== "string" || value.trim().length === 0)
+            continue;
+        const trimmed = value.trim();
+        roots.push({ source, value: trimmed, verdict: await validateExplicitProjectRoot(trimmed, deps.statDir) });
+    }
+    const read = await readBridgeConfig(deps.cwd, { readFile: deps.readFile });
+    const manifest = read.ok
+        ? { state: "ok", repoName: read.manifest.repoName }
+        : read.kind === "missing"
+            ? { state: "missing" }
+            : { state: "malformed" };
+    const comparisons = blocks.map((b) => {
+        const raw = b.env.BAPI_REPO_NAME;
+        const name = typeof raw === "string" ? raw.trim() : "";
+        if (name.length === 0)
+            return { relPath: b.relPath, state: "not-set" };
+        if (name === PLACEHOLDER_REPO_NAME)
+            return { relPath: b.relPath, state: "placeholder" };
+        if (manifest.state !== "ok")
+            return { relPath: b.relPath, state: "not-set", configName: name };
+        return {
+            relPath: b.relPath,
+            state: name === manifest.repoName ? "match" : "mismatch",
+            configName: name,
+        };
+    });
+    return { roots, manifest, comparisons };
+}
+/** The fixed install command every remediation in the section names. */
+const PROJECT_INSTALL_COMMAND = `npx -y ${MCP_PACKAGE_NAME} install`;
+/** Render the "Project identity and root" section (pure formatting). */
+export function formatProjectIdentityAndRootReport(report) {
+    const lines = ["", "Project identity and root (advisory)", ""];
+    const v = renderDiagnosticValue;
+    lines.push("BAPI_PROJECT_ROOT:");
+    if (report.roots.length === 0) {
+        lines.push("INFO    not set in the environment or any project MCP config — the server uses MCP roots, " +
+            "CLAUDE_PROJECT_DIR, or its working directory.");
+    }
+    for (const root of report.roots) {
+        if (root.verdict.ok) {
+            lines.push(`PASS    ${root.source}: ${v(root.value)} — valid; the server will use it.`);
+        }
+        else {
+            lines.push(`WARN    ${root.source}: ${v(root.value)} — refused: ${PROJECT_ROOT_REFUSAL_TEXT[root.verdict.reason]}. ` +
+                "The server will fall back to MCP roots, CLAUDE_PROJECT_DIR, or its working directory.");
+        }
+    }
+    lines.push("INFO    doctor cannot see which fallback the running server picks; the server logs the root it " +
+        "chose and its source to stderr (\"Bridge MCP: project root ...\").");
+    lines.push("");
+    lines.push("Project name (.bridge/config vs project MCP configs):");
+    const configNamed = report.comparisons.filter((c) => c.configName !== undefined);
+    if (report.manifest.state === "missing") {
+        lines.push(`INFO    .bridge/config is missing, so the name was not compared. Run "${PROJECT_INSTALL_COMMAND}" ` +
+            "to create it.");
+    }
+    else if (report.manifest.state === "malformed") {
+        lines.push("INFO    .bridge/config could not be parsed, so the name was not compared. Fix the file by hand " +
+            `or re-run "${PROJECT_INSTALL_COMMAND}".`);
+    }
+    else {
+        const manifestName = report.manifest.repoName;
+        if (configNamed.length === 0) {
+            lines.push("INFO    no project MCP config carries BAPI_REPO_NAME, so the name was not compared. " +
+                `Run "${PROJECT_INSTALL_COMMAND}" to configure this project.`);
+        }
+        for (const c of report.comparisons) {
+            if (c.state === "mismatch") {
+                lines.push(`WARN    .bridge/config names '${v(manifestName)}' but ${c.relPath} names '${v(c.configName)}'. ` +
+                    "Worktrees and shell tools use .bridge/config. Fix: re-run " +
+                    `"${PROJECT_INSTALL_COMMAND}" to verify the name and repair .bridge/config, or set ` +
+                    `repo_name = "${v(c.configName)}" in .bridge/config.`);
+            }
+            else if (c.state === "placeholder") {
+                lines.push(`INFO    ${c.relPath} still uses the ${PLACEHOLDER_REPO_NAME} placeholder, so it was not compared. ` +
+                    `Run "${PROJECT_INSTALL_COMMAND}" to configure it.`);
+            }
+            else if (c.state === "not-set" && configNamed.length > 0) {
+                lines.push(`INFO    ${c.relPath} has no BAPI_REPO_NAME, so it was not compared. ` +
+                    `Run "${PROJECT_INSTALL_COMMAND}" to configure it.`);
+            }
+        }
+        const comparable = report.comparisons.filter((c) => c.state === "match" || c.state === "mismatch");
+        if (comparable.length > 0 && comparable.every((c) => c.state === "match")) {
+            lines.push(`PASS    .bridge/config and the project MCP configs agree on '${v(manifestName)}'.`);
+        }
+    }
+    lines.push("");
+    lines.push("This section is advisory and read-only; it never changes the doctor exit code.");
+    return lines.join("\n");
+}
+/** Sanitized stand-in rendered when collection unexpectedly throws. */
+export function formatProjectIdentityAndRootFallbackReport() {
+    return [
+        "",
+        "Project identity and root (advisory)",
+        "",
+        "SKIPPED the project identity and root checks could not be collected — re-run doctor.",
+        "",
+        "This section is advisory and read-only; it never changes the doctor exit code.",
+    ].join("\n");
+}
 /** Classify a thrown probe failure into the closed category vocabulary. */
 function classifyProbeFailure(error) {
     // `AbortSignal.timeout` rejects with a DOMException named `TimeoutError`;

package/build/install-reexec.js

@@ -49,6 +49,7 @@ import { isNewerVersion } from "./update-check.js";
 import { fetchLatestVersion } from "./cli-release.js";
 import { runInstallBridgeCli, INSTALL_REEXEC_KEY_SOURCE_ENV, INSTALL_REEXEC_KEY_SOURCE_FLAG, } from "./install-bridge.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
+import { defaultNpmEntryFileExists, resolveNpmEntry } from "./windows-npm-entry.js";
 /** The sentinel that marks an already-re-exec'd child. Matches `upgrade-cli.ts`. */
 export const INSTALL_REEXEC_SENTINEL = "--internal-reexec";
 /**
@@ -56,6 +57,14 @@ export const INSTALL_REEXEC_SENTINEL = "--internal-reexec";
  * no argv, no environment value, no raw exception message, no credential.
  */
 export const INSTALL_REEXEC_FAILURE_MESSAGE = "Bridge API install failed: could not run the latest installer.";
+/**
+ * The ONLY text emitted when, on Windows, the latest installer could not be
+ * STARTED and the installed copy runs instead (BAPI-1319). Carries the local
+ * version and nothing else — no argv, environment value, or exception text.
+ */
+export function buildInstallReexecFallbackNotice(localVersion) {
+    return `Could not start the latest installer; continuing with the installed copy (version ${localVersion}).`;
+}
 /**
  * Remove EVERY `--internal-reexec` occurrence and report whether any was present.
  *
@@ -223,7 +232,6 @@ export async function runInstallBridgeWithLatestCli(argv, deps = {}) {
         return runLocal(cleanedArgs);
     }
     const { forwardedArgs, secretEnv, provenanceEnv } = prepareInstallReexecArguments(cleanedArgs);
-    const npxCmd = platform === "win32" ? "npx.cmd" : "npx";
     const childArgs = [
         "-y",
         `${MCP_PACKAGE_NAME}@latest`,
@@ -231,8 +239,43 @@ export async function runInstallBridgeWithLatestCli(argv, deps = {}) {
         INSTALL_REEXEC_SENTINEL,
         ...forwardedArgs,
     ];
+    // Explicit CLI values win over an inherited value of the same key.
+    // The provenance label rides alongside so the child can attribute a 401
+    // to the flag the operator actually used (BAPI-931).
+    const childEnv = { ...env, ...secretEnv, ...provenanceEnv };
+    // WINDOWS ONLY (BAPI-1319): `npx.cmd` cannot be spawned without a shell since
+    // CVE-2024-27980, and a shell is never acceptable here because argv carries
+    // user input. Run npm's own `npx-cli.js` through Node instead. A launch that
+    // fails BEFORE the child starts falls back to the installed copy (rule 1, FAIL
+    // OPEN); macOS and Linux keep the exact spawn and failure handling they had.
+    const isWindows = platform === "win32";
+    let command = "npx";
+    let spawnArgs = childArgs;
+    let resolvedOnWindows = true;
+    if (isWindows) {
+        const resolved = resolveNpmEntry("npx", childArgs, {
+            platform,
+            env: childEnv,
+            execPath: deps.execPath ?? process.execPath,
+            fileExists: deps.fileExists ?? defaultNpmEntryFileExists,
+        });
+        if (resolved.status === "resolved") {
+            command = resolved.command;
+            spawnArgs = resolved.args;
+        }
+        else {
+            resolvedOnWindows = false;
+        }
+    }
+    const fallBackToLocal = () => {
+        errorLog(buildInstallReexecFallbackNotice(localVersion));
+        return runLocal(cleanedArgs);
+    };
+    if (!resolvedOnWindows)
+        return fallBackToLocal();
     return new Promise((resolve) => {
         let settled = false;
+        let started = false;
         const settle = (code) => {
             if (settled)
                 return;
@@ -243,22 +286,37 @@ export async function runInstallBridgeWithLatestCli(argv, deps = {}) {
             errorLog(INSTALL_REEXEC_FAILURE_MESSAGE);
             settle(1);
         };
+        // Windows pre-start failure: the child never ran, so running the installed
+        // copy cannot install twice. Settlement is claimed synchronously so a
+        // trailing `close` cannot race the fallback.
+        const fallBack = () => {
+            if (settled)
+                return;
+            settled = true;
+            fallBackToLocal().then(resolve, () => {
+                errorLog(INSTALL_REEXEC_FAILURE_MESSAGE);
+                resolve(1);
+            });
+        };
         let child;
         try {
-            child = doSpawn(npxCmd, childArgs, {
+            child = doSpawn(command, spawnArgs, {
                 shell: false,
                 stdio: "inherit",
                 cwd,
-                // Explicit CLI values win over an inherited value of the same key.
-                // The provenance label rides alongside so the child can attribute a 401
-                // to the flag the operator actually used (BAPI-931).
-                env: { ...env, ...secretEnv, ...provenanceEnv },
+                env: childEnv,
             });
         }
         catch {
-            fail();
+            if (isWindows)
+                fallBack();
+            else
+                fail();
             return;
         }
+        child.on("spawn", () => {
+            started = true;
+        });
         child.on("close", (code) => {
             // A signal termination or an absent numeric code is an abnormal exit.
             if (typeof code === "number") {
@@ -268,6 +326,10 @@ export async function runInstallBridgeWithLatestCli(argv, deps = {}) {
             fail();
         });
         child.on("error", () => {
+            if (isWindows && !started) {
+                fallBack();
+                return;
+            }
             fail();
         });
     });

package/build/macos-terminal-permission-guidance.js

@@ -0,0 +1,16 @@
+/**
+ * The one macOS permission hint shared by `start-tickets` and `install`
+ * (BAPI-1319).
+ *
+ * Opening a terminal tab on macOS drives the terminal through osascript. That
+ * needs Automation, and the Terminal.app path also sends Cmd-T through System
+ * Events keystrokes, which needs Accessibility. Both commands print this text
+ * when a tab fails to spawn, so the guidance cannot drift between them.
+ */
+export function macosTerminalPermissionGuidance() {
+    return ("If osascript reported a permission error, grant the " +
+        "required macOS permissions under System Settings -> Privacy & Security, then re-run: " +
+        "Automation (to let the terminal app be controlled) and, for the Terminal.app path, " +
+        "Accessibility (the new-tab step sends Cmd-T via System Events keystrokes, which Automation " +
+        "alone does not cover).");
+}

package/build/model-thresholds-tool.js

@@ -0,0 +1,185 @@
+/**
+ * model_thresholds — the conversational surface for model-tier thresholds (BAPI-1343).
+ *
+ * Wraps `GET` / `PUT /setup/model-thresholds` (BAPI-1342, BAPI-1349). It is the
+ * ONLY place a user-level threshold can be set: the Setup page edits project
+ * values only. Three actions:
+ *
+ *   get   -> GET  ?repo_name&scope[&member_email]
+ *   set   -> PUT  {repo_name, scope, member_email?, fields}
+ *   clear -> PUT  {repo_name, scope, member_email?, clear_fields}
+ *
+ * THE SERVER IS AUTHORITATIVE. This module checks only which inputs belong to
+ * which action and scope. It never validates ranges or pairs, and never computes
+ * an effective value, a source, or where a scope applies — it renders exactly
+ * what the server returned. Non-OK responses (403, 404, both 422 detail shapes)
+ * pass through the shared `handleResponse` unchanged.
+ *
+ * PRIVACY. The actor comes from the API key server-side, so no identity field is
+ * ever sent beyond the requested `member_email`. Tool-composed text (validation
+ * and transport failures) is fixed, so it can never carry the member email, the
+ * API key, a header, or a request URL. Nothing here writes to stderr.
+ */
+export const MODEL_THRESHOLD_FIELDS = [
+    "review_basic_min_difficulty",
+    "review_premium_min_difficulty",
+    "impl_basic_min_difficulty",
+    "impl_premium_min_difficulty",
+];
+const THRESHOLDS_PATH = "/setup/model-thresholds";
+/** The two server `applies_to` values, rendered as fixed sentences. */
+export const APPLIES_TO_SENTENCES = Object.freeze({
+    local_sessions: "Applies to: personal values apply to your local sessions only; backend review and planning use project values.",
+    backend_and_local_sessions: "Applies to: project values drive backend review and planning and are the default for everyone's local sessions.",
+});
+/** Shown when an older server omits `applies_to`; it states only that nothing was reported. */
+export const APPLIES_TO_NOT_REPORTED = "This server did not report where these values apply.";
+function textResult(text, isError = false) {
+    const result = { content: [{ type: "text", text }] };
+    if (isError)
+        result.isError = true;
+    return result;
+}
+function validationError(message) {
+    return textResult(JSON.stringify({ error: "BAD_REQUEST", status: 400, message }), true);
+}
+/**
+ * Check which inputs belong to the action and scope. Returns null when valid.
+ * Messages are fixed text and never echo an input value.
+ */
+export function validateModelThresholdsArgs(args) {
+    const scope = args.scope ?? "self";
+    const hasEmail = args.member_email !== undefined;
+    if (scope === "member") {
+        if (typeof args.member_email !== "string" || args.member_email.trim().length === 0) {
+            return validationError('model_thresholds scope "member" requires member_email.');
+        }
+    }
+    else if (hasEmail) {
+        return validationError('model_thresholds member_email is only accepted with scope "member".');
+    }
+    const setFields = MODEL_THRESHOLD_FIELDS.filter((name) => args[name] !== undefined);
+    const hasClearFields = args.fields !== undefined;
+    switch (args.action) {
+        case "get":
+            if (setFields.length > 0 || hasClearFields) {
+                return validationError('model_thresholds action "get" accepts only scope and member_email.');
+            }
+            return null;
+        case "set":
+            if (hasClearFields) {
+                return validationError('model_thresholds action "set" does not accept fields; use action "clear" to clear values.');
+            }
+            if (setFields.length === 0) {
+                return validationError(`model_thresholds action "set" requires at least one of ${MODEL_THRESHOLD_FIELDS.join(", ")}.`);
+            }
+            return null;
+        case "clear":
+            if (setFields.length > 0) {
+                return validationError('model_thresholds action "clear" accepts only fields; use action "set" to change values.');
+            }
+            if (!Array.isArray(args.fields) || args.fields.length === 0) {
+                return validationError('model_thresholds action "clear" requires a non-empty fields list.');
+            }
+            return null;
+        default:
+            return validationError('model_thresholds action must be one of "get", "set", "clear".');
+    }
+}
+function formatBoundary(label, boundary) {
+    if (!boundary || typeof boundary !== "object")
+        return `${label} (not reported)`;
+    const b = boundary;
+    return `${label} ${String(b.value)} (${String(b.source)})`;
+}
+function formatConsumer(label, consumer) {
+    if (!consumer || typeof consumer !== "object")
+        return `${label}: not reported`;
+    const c = consumer;
+    return (`${label} (mode: ${String(c.mode)}): ` +
+        `${formatBoundary("basic from", c.basic_min)} · ${formatBoundary("premium from", c.premium_min)}`);
+}
+/**
+ * Render a successful read-back. Every value, source, mode, and warning is the
+ * server's; the only translation is `applies_to` into its fixed sentence.
+ */
+export function renderModelThresholdsReadBack(body) {
+    const lines = [`Model-tier thresholds (scope: ${String(body.scope)})`];
+    lines.push(formatConsumer("Review", body.review));
+    lines.push(formatConsumer("Implementation", body.implementation));
+    const appliesTo = typeof body.applies_to === "string" ? body.applies_to : undefined;
+    lines.push(appliesTo !== undefined && APPLIES_TO_SENTENCES[appliesTo]
+        ? APPLIES_TO_SENTENCES[appliesTo]
+        : APPLIES_TO_NOT_REPORTED);
+    if (Array.isArray(body.changed_fields)) {
+        lines.push(`Changed: ${body.changed_fields.map(String).join(", ") || "(none)"}`);
+    }
+    if (Array.isArray(body.warnings) && body.warnings.length > 0) {
+        lines.push(`Warnings: ${JSON.stringify(body.warnings)}`);
+    }
+    return lines.join("\n");
+}
+async function renderResponse(resp, deps) {
+    if (!resp.ok) {
+        return textResult(await deps.handleResponse(resp));
+    }
+    const raw = await resp.text();
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return textResult(renderModelThresholdsReadBack(parsed));
+        }
+    }
+    catch {
+        // Not JSON — return the body as-is below.
+    }
+    return textResult(raw);
+}
+/** Handle one `model_thresholds` call. Never throws. */
+export async function modelThresholdsHandler(deps, args) {
+    const invalid = validateModelThresholdsArgs(args);
+    if (invalid)
+        return invalid;
+    const scope = args.scope ?? "self";
+    try {
+        if (args.action === "get") {
+            const params = { repo_name: deps.repoName, scope };
+            if (scope === "member")
+                params.member_email = String(args.member_email);
+            const resp = await deps.fetch(deps.buildGetUrl(THRESHOLDS_PATH, params), {
+                headers: await deps.getGetHeaders(),
+            });
+            return await renderResponse(resp, deps);
+        }
+        const body = { repo_name: deps.repoName, scope };
+        if (scope === "member")
+            body.member_email = args.member_email;
+        if (args.action === "set") {
+            const fields = {};
+            for (const name of MODEL_THRESHOLD_FIELDS) {
+                const value = args[name];
+                if (value !== undefined)
+                    fields[name] = value;
+            }
+            body.fields = fields;
+        }
+        else {
+            body.clear_fields = args.fields;
+        }
+        const resp = await deps.fetch(deps.buildUrl(THRESHOLDS_PATH), {
+            method: "PUT",
+            headers: await deps.getPostHeaders(),
+            body: JSON.stringify(body),
+        });
+        return await renderResponse(resp, deps);
+    }
+    catch {
+        // A transport error's message can carry the request URL (and so the member
+        // email in a GET query). Report a fixed message instead.
+        return textResult(JSON.stringify({
+            error: "REQUEST_FAILED",
+            status: 0,
+            message: "model_thresholds could not reach the Bridge API. Try again.",
+        }), true);
+    }
+}

package/build/pipelines.generated.js

@@ -372,7 +372,7 @@ export const PIPELINES = {
     },
     "implement-ticket": {
         "name": "implement-ticket",
-        "description": "Generate plan, produce artifacts, checkpoint them to origin, run the plan's remaining verification faithfully, commit, open PR, close post-PR gaps, and monitor CI. Re-entrant: recovery jobs (ci_fix/remediate/rebase) safely re-run this whole recipe from step 1 — the plan-generation step reuses a fresh existing plan (reused: true, no new run) and the produce phase recognizes work already recorded in the durable ledger instead of redoing it.",
+        "description": "Initial feature workflow: generate a plan, produce artifacts, checkpoint to origin, verify, commit, open a PR, close post-PR gaps, and monitor CI. Re-entry of this initial workflow may reuse a fresh plan, but remaining-work corrections and continuations use versioned focused intent on the retained branch and never re-enter this recipe.",
         "variables": [
             "ticket_key",
             "docs_dir",

package/build/plane/status.js

@@ -8,6 +8,7 @@
  */
 import { planeManifestLifecycle, probeManifestMembers, readPlaneManifest, } from "./manifest.js";
 import { PLANE_RUNTIME_DIR, PLANE_RUNTIME_LOG_PATH, } from "./types.js";
+import { WORKER_STALE_EXIT_CODE } from "./worker-exit-code.js";
 /** Read the manifest and probe every recorded pid. Strictly read-only. */
 export async function getPlaneStatus(repoRoot, deps) {
     const read = await readPlaneManifest(repoRoot, deps.fs);
@@ -150,6 +151,9 @@ export function describeMemberState(member, supervisorLiveness) {
         return `exited   (signal ${member.exitSignal})`.padEnd(34);
     }
     if (member.exitCode !== null) {
+        if ((member.name === "worker" || member.name === "observer") && member.exitCode === WORKER_STALE_EXIT_CODE) {
+            return `exited   (code 75: code changed; cycle the plane)`.padEnd(34);
+        }
         return `exited   (code ${member.exitCode})`.padEnd(34);
     }
     if (member.liveness === "unknown") {

package/build/plane/supervisor.js

@@ -30,6 +30,7 @@ import { appendPlaneManifestMembers, getPlanePaths, planeManifestLifecycle, read
 import { executorClaimScopeArgs, } from "../executor/claim-scope.js";
 import { attachMemberOutput, openMemberLog, openPlaneRuntimeLog, writeMemberStartupFailure, writeRuntimeTraceLine, PLANE_MEMBER_STARTUP_FAILURES, PLANE_SUPERVISOR_LOG_PREFIX, } from "./member-logs.js";
 import { absoluteLogPath, describePlaneMember } from "./member-roster.js";
+import { WORKER_STALE_EXIT_CODE } from "./worker-exit-code.js";
 import { PLANE_SHUTDOWN_GRACE_MS, PLANE_SHUTDOWN_KILL_WAIT_MS, PLANE_SHUTDOWN_POLL_MS, shutdownPlane, } from "./shutdown.js";
 /** How long the runtime waits for the launcher to record its pid. */
 export const PLANE_HANDSHAKE_TIMEOUT_MS = 10_000;
@@ -166,6 +167,9 @@ export function reportMemberCrash(sinks, report) {
     sinks.stderr(`!! at ${report.timestamp}`);
     sinks.stderr(`!! log: ${report.logPath}`);
     sinks.stderr("!! It was NOT restarted. Survivors keep running; `plane status` shows the hole.");
+    if ((report.member === "worker" || report.member === "observer") && report.exitCode === WORKER_STALE_EXIT_CODE) {
+        sinks.stderr("!! Code on disk changed under this worker. Run plane down && plane up.");
+    }
     sinks.stderr(rule);
 }
 /**

package/build/plane/worker-exit-code.js

@@ -0,0 +1,2 @@
+/** Matches WORKER_STALE_EXIT_CODE in worker.py. */
+export const WORKER_STALE_EXIT_CODE = 75;