@bridge_gpt/mcp-server 0.2.65 → 0.2.67

package/build/executor/worker-guard-hook.js

@@ -69,6 +69,24 @@ export function renderWorkerGuardReason(category, family) {
             "stdin-fed arguments hide what git will run. Use literal arguments instead; " +
             "for a commit message, write it to a file and run git commit -F <file>.");
     }
+    if (category === "workflow-entry" ||
+        category === "workflow-launch-skill" ||
+        category === "workflow-launch-shell" ||
+        category === "workflow-planner-tool") {
+        return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "A correction worker must not start a full workflow. Reading or editing files " +
+            "that mention a workflow is allowed; make the focused correction directly.");
+    }
+    if (category === "correction-context-invalid") {
+        return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "The correction context for this worker is not valid, so no tool call can be " +
+            "checked. Stop and report the launch problem.");
+    }
+    if (category === "correction-payload-invalid") {
+        return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
+            "The tool call could not be read as a tool name with a tool input, so it cannot " +
+            "be checked. Retry with a well-formed call.");
+    }
     return (`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ` +
         "This command family is restricted to the worker's own branch, worktree, and " +
         "read-only network access. Use a different approach and continue.");
@@ -780,6 +798,52 @@ function stripStdinPrefixOptions(argv) {
     }
     return argv.slice(i);
 }
+/** The workflow names a correction worker must never launch. */
+const WORKFLOW_NAMES = "implement-ticket|plan-ticket|idea-to-pr|review-and-implement";
+/**
+ * A slash-form workflow launch: the slash starts the text or follows whitespace, and
+ * the name ends at whitespace or the end. A file path such as
+ * `docs/claude/idea-to-pr.md` has neither, so it never matches.
+ */
+const WORKFLOW_SLASH_LAUNCH = new RegExp(`(?:^|\\s)/(?:bridge-)?(?:${WORKFLOW_NAMES})(?=\\s|$)`, "i");
+/** A bare skill or command name, with optional leading slash and `plugin:` prefix. */
+const WORKFLOW_NAME_EXACT = new RegExp(`^/?(?:[A-Za-z0-9_-]+:)?(?:bridge-)?(?:${WORKFLOW_NAMES})$`, "i");
+/** The token after `npx` that names the Claude CLI package. */
+const CLAUDE_PACKAGE_TOKEN = /^(?:@anthropic-ai\/)?claude(?:-code)?(?:@\S+)?$/;
+/** The argv after the Claude CLI name, or `undefined` when this is not a Claude launch. */
+function claudeLaunchArgs(argv) {
+    const base = path.basename(argv[0] ?? "");
+    if (base === "claude")
+        return argv.slice(1);
+    if (base === "npx") {
+        const index = argv.findIndex((token, i) => i > 0 && CLAUDE_PACKAGE_TOKEN.test(token));
+        return index === -1 ? undefined : argv.slice(index + 1);
+    }
+    return undefined;
+}
+/**
+ * Is this a correction-mode Claude print run that launches a workflow (or that cannot
+ * be read well enough to rule one out)?
+ *
+ * Runs on tokenized, de-quoted argv, so a quoted prompt is one plain token. The whole
+ * argv is scanned for the print flag and for a workflow slash launch, because the
+ * prompt may sit anywhere among the options. A print run in a segment the tokenizer
+ * marked unsafe denies without trying to resolve the substitution.
+ */
+function isClaudeWorkflowPrintLaunch(segment) {
+    const args = claudeLaunchArgs(segment.argv);
+    if (args === undefined)
+        return false;
+    const printing = args.some((token) => token === "-p" || token === "--print" || token.startsWith("--print="));
+    if (!printing)
+        return false;
+    if (segment.unsafe)
+        return true;
+    return args.some((token) => {
+        const value = token.startsWith("--print=") ? token.slice("--print=".length) : token;
+        return WORKFLOW_SLASH_LAUNCH.test(value);
+    });
+}
 /** Evaluate one already-tokenized simple command. */
 function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = false) {
     const argv = unwrapTransparentPrefixes(segment.argv);
@@ -828,6 +892,9 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
         return evaluateSimpleCommand({ argv: rest, unsafe: segment.unsafe }, ctx, payloadCwd, depth + 1, true);
     }
     segment = { argv, unsafe: segment.unsafe };
+    if (ctx.correctionEnforced && isClaudeWorkflowPrintLaunch(segment)) {
+        return { kind: "deny", category: "workflow-launch-shell", family: "workflow" };
+    }
     const family = classify(executable);
     if (family === null)
         return { kind: "allow" };
@@ -865,6 +932,55 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
     }
     return { kind: "allow" };
 }
+function workflowDeny(category) {
+    return { kind: "deny", category, family: "workflow" };
+}
+/**
+ * Tools that read or change files. Their path and pattern fields name files, and a
+ * file named after a workflow is not a workflow launch, so they are never matched.
+ */
+const FILE_TOOLS = new Set(["Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Grep", "Glob"]);
+/** The fields of each invocation tool that can carry a workflow launch. */
+const INVOCATION_FIELDS = {
+    Skill: ["skill", "args"],
+    Task: ["prompt", "description"],
+    Agent: ["prompt", "description"],
+    SlashCommand: ["command"],
+};
+/** An `mcp__` tool whose name is a planner or recipe entry point. */
+const PLANNER_TOOL_NAME = /(?:request_plan_generation|get_pipeline_recipe|plan_ticket|implement_ticket)/i;
+/**
+ * Correction-mode dispatch by tool role. Returns a decision for a file tool, an
+ * invocation tool, a planner tool, or an unknown role, and `undefined` for `Bash`,
+ * which the caller evaluates as a shell command.
+ */
+function evaluateCorrectionToolRole(toolName, input) {
+    if (FILE_TOOLS.has(toolName))
+        return { kind: "allow" };
+    if (toolName === "Bash")
+        return undefined;
+    const fields = INVOCATION_FIELDS[toolName];
+    if (fields !== undefined) {
+        for (const field of fields) {
+            const value = input[field];
+            if (value === undefined)
+                continue;
+            if (typeof value !== "string")
+                return workflowDeny("workflow-launch-skill");
+            const nameField = toolName === "Skill" ? field === "skill" : toolName === "SlashCommand";
+            if (WORKFLOW_SLASH_LAUNCH.test(value) || (nameField && WORKFLOW_NAME_EXACT.test(value.trim().split(/\s+/)[0] ?? ""))) {
+                return workflowDeny("workflow-launch-skill");
+            }
+        }
+        return { kind: "allow" };
+    }
+    if (/^mcp__/i.test(toolName) && PLANNER_TOOL_NAME.test(toolName)) {
+        return workflowDeny("workflow-planner-tool");
+    }
+    // Any other role: only an explicit workflow launch in a string argument denies.
+    const args = Object.values(input).filter((v) => typeof v === "string").join(" ");
+    return WORKFLOW_SLASH_LAUNCH.test(args) ? workflowDeny("workflow-entry") : undefined;
+}
 /**
  * Evaluate a parsed PreToolUse payload.
  *
@@ -878,20 +994,32 @@ function evaluateSimpleCommand(segment, ctx, payloadCwd, depth = 0, stdinFed = f
  * governed here.
  */
 export function evaluateWorkerGuardPayload(payload, ctx) {
+    if (ctx.correctionContextInvalid)
+        return workflowDeny("correction-context-invalid");
     const root = asRecord(payload);
-    if (root === undefined)
-        return { kind: "malformed" };
+    if (root === undefined) {
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    }
     const toolName = root.tool_name ?? root.toolName;
-    if (typeof toolName !== "string")
-        return { kind: "malformed" };
+    if (typeof toolName !== "string") {
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    }
+    const input = asRecord(root.tool_input ?? root.toolInput);
+    if (ctx.correctionEnforced) {
+        if (input === undefined)
+            return workflowDeny("correction-payload-invalid");
+        const decision = evaluateCorrectionToolRole(toolName, input);
+        if (decision !== undefined)
+            return decision;
+    }
     if (toolName !== "Bash")
         return { kind: "allow" };
-    const input = asRecord(root.tool_input ?? root.toolInput);
     if (input === undefined)
         return { kind: "malformed" };
     const command = input.command;
-    if (typeof command !== "string")
-        return { kind: "malformed" };
+    if (typeof command !== "string") {
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    }
     const rawCwd = root.cwd ?? input.cwd;
     const payloadCwd = typeof rawCwd === "string" ? rawCwd : undefined;
     for (const segment of tokenizeShellCommand(command)) {
@@ -908,18 +1036,23 @@ export function evaluateWorkerGuardPayload(payload, ctx) {
  * exception: the binary's job is to emit one bounded line and get out of the way.
  */
 export function evaluateWorkerGuardInput(raw, ctx) {
+    const unreadable = () => {
+        if (ctx.correctionContextInvalid)
+            return workflowDeny("correction-context-invalid");
+        return ctx.correctionEnforced ? workflowDeny("correction-payload-invalid") : { kind: "malformed" };
+    };
     if (typeof raw !== "string")
-        return { kind: "malformed" };
+        return unreadable();
     if (raw.length > WORKER_GUARD_MAX_PAYLOAD_BYTES)
-        return { kind: "malformed" };
+        return unreadable();
     if (raw.trim().length === 0)
-        return { kind: "malformed" };
+        return unreadable();
     let parsed;
     try {
         parsed = JSON.parse(raw);
     }
     catch {
-        return { kind: "malformed" };
+        return unreadable();
     }
     try {
         return evaluateWorkerGuardPayload(parsed, ctx);
@@ -927,7 +1060,7 @@ export function evaluateWorkerGuardInput(raw, ctx) {
     catch {
         // Defensive: an unexpected evaluator failure is a HOOK problem, not a worker
         // problem, so it takes the fail-open path rather than blocking the tool loop.
-        return { kind: "malformed" };
+        return unreadable();
     }
 }
 /** The flag through which provisioning templates the trusted worktree root. */
@@ -968,5 +1101,12 @@ export function resolveWorkerGuardContext(env, cwd, argv = []) {
     const branch = env.BAPI_WORKER_BRANCH;
     if (typeof branch === "string" && branch.trim().length > 0)
         ctx.workerBranch = branch.trim();
+    const flagIndex = argv.indexOf("--correction-intent-version");
+    const flagValue = flagIndex >= 0 ? argv[flagIndex + 1] : undefined;
+    const envValue = env.BAPI_CORRECTION_INTENT_VERSION;
+    ctx.correctionEnforced = flagValue === "1" || envValue === "1";
+    ctx.correctionContextInvalid = flagIndex >= 0 && flagValue !== "1" ||
+        (envValue !== undefined && envValue !== "1") ||
+        (flagIndex >= 0 && envValue !== undefined && envValue !== flagValue);
     return ctx;
 }

package/build/executor/worker-log.js

@@ -1,21 +1,70 @@
 /**
- * Per-job worker log tee primitives (BAPI-535, TDD §8, G5).
+ * Per-attempt worker log tee primitives (BAPI-535, TDD §8, G5; BAPI-1330).
+ *
+ * Every worker's output is teed to a log file that belongs to exactly ONE claimed
+ * attempt: `<worktree>/.conductor/worker-job<id>-attempt<n>-<claim>.log`, where
+ * `<claim>` is an opaque identifier minted fresh for each claim. The file is
+ * created EXCLUSIVELY before the first write, so a retry, a reclaim, or a reused
+ * worktree can never truncate, rotate, or append into an earlier attempt's
+ * transcript — and a reference to one attempt can never resolve to another's
+ * contents.
+ *
+ * BAPI-1330 retired the fixed `.conductor/worker.log` path. Its BAPI-1021
+ * rotation (rename the old file to a timestamped archive, truncate a new one)
+ * left the job-log registry pointing at a MUTABLE path that the next attempt
+ * reused, and a timestamp is not collision protection. There is no active alias
+ * any more: readers go through the registry, which names the stable file.
  *
- * Every worker's output is teed to the fixed path `<worktree>/.conductor/worker.log`
- * in human-readable form so `tail -f` reproduces the v1 tab experience on demand.
  * The tee is PURELY a recorder: it never owns, signals, or kills the worker
- * process — closing/finalizing the log affects the file only. All filesystem
- * access is behind injected boundaries so this is unit-testable with no real I/O.
+ * process, and a logging failure never changes a worker's disposition — it only
+ * marks this attempt's transcript unavailable. All filesystem access is behind
+ * injected boundaries so this is unit-testable with no real I/O.
  */
+import { randomBytes as nodeRandomBytes } from "node:crypto";
 import { pathApiForExecutorPlatform } from "./worktree-inspection.js";
 /** The fixed `.conductor` worker-log directory (relative to the worktree). */
 export const CONDUCTOR_WORKER_LOG_DIR = ".conductor";
-/** The fixed worker-log filename. */
+/**
+ * The RETIRED fixed worker-log filename (BAPI-1330). Nothing writes it any more;
+ * it is kept only so readers can recognize a legacy registry record that names
+ * it and report that record as unavailable instead of following a mutable alias.
+ */
 export const CONDUCTOR_WORKER_LOG_FILE = "worker.log";
-/** Resolve `<worktree>/.conductor/worker.log` with platform-correct separators. */
-export function buildWorkerLogPath(worktreePath, platform = process.platform) {
+/** An opaque per-claim identifier: 32 lower-case hex characters. */
+export const WORKER_LOG_CLAIM_ID_RE = /^[0-9a-f]{32}$/;
+/**
+ * The stable attempt-log filename shape. Groups: job id, attempt, claim id.
+ * Readers validate a registry record against this before returning a pointer.
+ */
+export const WORKER_LOG_ATTEMPT_FILE_RE = /^worker-job([1-9][0-9]*)-attempt([0-9]+)-([0-9a-f]{32})\.log$/;
+/** Mint a fresh opaque claim identifier (16 random bytes, hex). */
+export function createWorkerLogClaimId(randomBytes = nodeRandomBytes) {
+    return randomBytes(16).toString("hex");
+}
+/** True for a well-formed attempt identity. */
+export function isValidWorkerLogAttemptIdentity(identity) {
+    return (Number.isInteger(identity.jobId) &&
+        identity.jobId > 0 &&
+        Number.isInteger(identity.attempt) &&
+        identity.attempt >= 0 &&
+        typeof identity.claimId === "string" &&
+        WORKER_LOG_CLAIM_ID_RE.test(identity.claimId));
+}
+/**
+ * The stable filename for one attempt. Throws on a malformed identity: every
+ * component is validated so nothing can escape `.conductor` or collide with
+ * another attempt's name.
+ */
+export function workerLogAttemptFileName(identity) {
+    if (!isValidWorkerLogAttemptIdentity(identity)) {
+        throw new Error("invalid worker log attempt identity");
+    }
+    return `worker-job${identity.jobId}-attempt${identity.attempt}-${identity.claimId}.log`;
+}
+/** Resolve `<worktree>/.conductor/<attempt file>` with platform-correct separators. */
+export function buildWorkerLogPath(worktreePath, identity, platform = process.platform) {
     const pathApi = pathApiForExecutorPlatform(platform);
-    return pathApi.join(worktreePath, CONDUCTOR_WORKER_LOG_DIR, CONDUCTOR_WORKER_LOG_FILE);
+    return pathApi.join(worktreePath, CONDUCTOR_WORKER_LOG_DIR, workerLogAttemptFileName(identity));
 }
 /**
  * Render one stdout/stderr chunk as human-readable log text. The worker's stream
@@ -26,81 +75,97 @@ export function buildWorkerLogPath(worktreePath, platform = process.platform) {
 export function renderWorkerLogChunk(chunk, _stream = "stdout") {
     return chunk;
 }
-/**
- * True for a Node-`fs`-shaped "does not exist" rejection (`code: "ENOENT"`).
- * The normal, expected outcome of probing a first-ever attempt's log path —
- * never itself a reason to warn.
- */
-function isMissingFileError(err) {
-    return typeof err === "object" && err !== null && err.code === "ENOENT";
+function errorCode(err) {
+    return typeof err === "object" && err !== null ? err.code : undefined;
 }
 /**
- * The bounded, secret-free archive-preservation warning (BAPI-1021, AC-6).
- * Carries ONLY the stable category and the current/archive path identifiers —
- * never the caught exception's message or stack. Emitted at most once per tee
- * creation, whether the existence probe or the rename itself failed.
+ * The bounded, secret-free transcript-unavailable warning (BAPI-1330). Carries
+ * only the job id, attempt number and a closed reason — never a path, an
+ * exception message, or transcript content.
  */
-export function formatWorkerLogArchivePreservationWarning(currentLogPath, archivePath) {
-    return archivePath
-        ? `worker log archive: could not preserve the prior attempt's log ` +
-            `(${currentLogPath} -> ${archivePath}); the new attempt continues.`
-        : `worker log archive: could not confirm whether a prior attempt's log exists ` +
-            `at ${currentLogPath}; the new attempt continues.`;
+export function formatWorkerLogUnavailableWarning(identity, reason) {
+    return (`worker log unavailable for job ${identity.jobId} attempt ${identity.attempt} (${reason}); ` +
+        "the attempt continues without a recorded transcript.");
 }
-/**
- * Create the `.conductor` directory, initialize an empty `worker.log`, and return
- * a tee handle. When an `appendFile` boundary is supplied, chunks are appended
- * incrementally; otherwise a buffered fallback re-writes the accumulated content
- * via `writeFile` so all consumed chunks are preserved in order.
- *
- * BAPI-1021 (AC-6): before writing the new empty log, archives any PRIOR
- * attempt's log under a timestamped filename in the same directory — so a
- * retried job in the same worktree does not silently overwrite what the
- * previous attempt wrote. Best-effort throughout: a missing prior log is the
- * normal first-attempt case (no warning); a probe or rename failure degrades
- * to exactly one bounded warning and tee creation still proceeds.
- */
-export async function createWorkerLogTee(worktreePath, deps) {
-    const platform = deps.platform ?? process.platform;
-    const pathApi = pathApiForExecutorPlatform(platform);
-    const dir = pathApi.join(worktreePath, CONDUCTOR_WORKER_LOG_DIR);
-    const logPath = pathApi.join(dir, CONDUCTOR_WORKER_LOG_FILE);
-    await deps.mkdir(dir, { recursive: true });
-    if (deps.stat && deps.rename) {
+/** Create the attempt file exclusively. Resolves with a reason when it could not. */
+async function allocateAttemptLog(logPath, deps) {
+    try {
+        if (deps.writeFileExclusive) {
+            await deps.writeFileExclusive(logPath, "");
+            return null;
+        }
+        if (!deps.stat)
+            return "allocation_failed";
         try {
             await deps.stat(logPath);
         }
         catch (err) {
-            if (!isMissingFileError(err)) {
-                deps.errorLog?.(formatWorkerLogArchivePreservationWarning(logPath));
-            }
-            // Missing (or unconfirmable) is the normal first-attempt case either
-            // way: fall through to the truncating write below without a rename.
+            if (errorCode(err) !== "ENOENT")
+                return "allocation_failed";
             await deps.writeFile(logPath, "");
-            return createTeeHandle(logPath, deps);
-        }
-        // The current log exists: archive it before truncating.
-        const clock = deps.now ?? Date.now;
-        const timestamp = new Date(clock()).toISOString().replace(/:/g, "-");
-        const archivePath = pathApi.join(dir, `worker.${timestamp}.log`);
-        try {
-            await deps.rename(logPath, archivePath);
-        }
-        catch {
-            deps.errorLog?.(formatWorkerLogArchivePreservationWarning(logPath, archivePath));
+            return null;
         }
+        return "allocation_collision";
+    }
+    catch (err) {
+        return errorCode(err) === "EEXIST" ? "allocation_collision" : "allocation_failed";
     }
-    await deps.writeFile(logPath, "");
-    return createTeeHandle(logPath, deps);
 }
-/** Shared tee-handle construction, used by every `createWorkerLogTee` return path. */
-function createTeeHandle(logPath, deps) {
+/**
+ * Allocate this attempt's log file and return a tee for it.
+ *
+ * The file is created EXCLUSIVELY before any append. An existing file is refused,
+ * never truncated or archived: a collision means some other claim already owns
+ * that name, and its transcript must survive. Allocation failure does NOT throw —
+ * the tee comes back `available: false` (appends become no-ops), one bounded
+ * diagnostic is emitted, and the worker runs exactly as it would have.
+ */
+export async function createWorkerLogTee(worktreePath, deps, identity) {
+    const platform = deps.platform ?? process.platform;
+    const pathApi = pathApiForExecutorPlatform(platform);
+    const dir = pathApi.join(worktreePath, CONDUCTOR_WORKER_LOG_DIR);
+    const logPath = buildWorkerLogPath(worktreePath, identity, platform);
+    let reason;
+    try {
+        await deps.mkdir(dir, { recursive: true });
+        reason = await allocateAttemptLog(logPath, deps);
+    }
+    catch {
+        reason = "allocation_failed";
+    }
+    const handle = createTeeHandle(logPath, identity, deps);
+    if (reason !== null)
+        handle.markUnavailable(reason);
+    return handle;
+}
+/** Shared tee-handle construction. */
+function createTeeHandle(logPath, identity, deps) {
     let buffer = "";
     let closed = false;
+    let unavailableReason;
+    const markUnavailable = (reason) => {
+        if (unavailableReason !== undefined)
+            return;
+        unavailableReason = reason;
+        try {
+            deps.errorLog?.(formatWorkerLogUnavailableWarning(identity, reason));
+        }
+        catch {
+            /* the diagnostic is best-effort too */
+        }
+    };
     return {
         logPath,
+        identity,
+        get available() {
+            return unavailableReason === undefined;
+        },
+        get unavailableReason() {
+            return unavailableReason;
+        },
+        markUnavailable,
         async append(chunk) {
-            if (closed)
+            if (closed || unavailableReason !== undefined)
                 return;
             try {
                 if (deps.appendFile) {
@@ -112,7 +177,9 @@ function createTeeHandle(logPath, deps) {
                 }
             }
             catch {
-                /* the log tee is a visibility nicety — a write failure never fails a job */
+                // A write failure never fails a job; it makes this attempt's transcript
+                // incomplete, which readers must be told rather than left to guess.
+                markUnavailable("append_failed");
             }
         },
         async close() {
@@ -146,7 +213,7 @@ export const MAX_SESSION_SCAN_CHARS = 2_000_000;
  * The DISTINCT `session_id` values present in a worker log (BAPI-793).
  *
  * The incident signature this exists to catch is two Claude sessions writing
- * into one worktree's single `.conductor/worker.log`. Every stream-json record a
+ * into one attempt's worker log. Every stream-json record a
  * worker emits carries its `session_id`, so one healthy job produces MANY
  * records and exactly ONE distinct id — which is why this counts DISTINCT ids
  * rather than occurrences. A count-based check would flag every normal job.
@@ -210,7 +277,7 @@ export function distinctWorkerLogSessionIds(logText) {
  */
 export function formatWorkerLogSessionInvariantWarning(sessionCount) {
     return (`worker log session invariant violated: ${sessionCount} distinct Claude sessions wrote to this ` +
-        "job's .conductor/worker.log, so more than one worker was active in this worktree. The " +
+        "attempt's .conductor worker log, so more than one worker was active in this worktree. The " +
         "worktree lock should have refused the second one — treat this as evidence it was bypassed " +
         "(a pre-existing stale lock, a worktree entered outside the executor, or a manual claude run).");
 }

package/build/executor/worktree-gc.js

@@ -10,6 +10,7 @@
  * never abort the whole sweep. All I/O is injected for offline unit testing.
  */
 import { listGitWorktrees, pathApiForExecutorPlatform, } from "./worktree-inspection.js";
+import { WORKER_LOG_ATTEMPT_FILE_RE } from "./worker-log.js";
 /** Idle cutoff: a worktree must be idle strictly longer than 24h to be eligible. */
 export const EXECUTOR_WORKTREE_GC_IDLE_MS = 24 * 60 * 60 * 1000;
 function conductorMarkerPaths(worktreePath, platform) {
@@ -17,30 +18,53 @@ function conductorMarkerPaths(worktreePath, platform) {
     const dir = pathApi.join(worktreePath, ".conductor");
     return {
         dir,
-        workerLog: pathApi.join(dir, "worker.log"),
         resultJson: pathApi.join(dir, "result.json"),
     };
 }
+/**
+ * The per-attempt worker logs in `.conductor` (BAPI-1330). Only names matching
+ * the stable attempt-log shape count; the retired fixed `worker.log` is never
+ * probed. A listing failure yields none — the other markers still apply.
+ */
+async function attemptLogPaths(dir, deps) {
+    if (!deps.listDir)
+        return [];
+    let names;
+    try {
+        names = await deps.listDir(dir);
+    }
+    catch {
+        return [];
+    }
+    const pathApi = pathApiForExecutorPlatform(deps.platform ?? process.platform);
+    return names.filter((name) => WORKER_LOG_ATTEMPT_FILE_RE.test(name)).map((name) => pathApi.join(dir, name));
+}
 /**
  * Conservatively identify an executor/conductor-managed worktree by the presence
- * of a `.conductor` directory, `.conductor/worker.log`, or `.conductor/result.json`.
+ * of a `.conductor` directory or `.conductor/result.json`.
  */
 export async function isExecutorManagedWorktree(worktreePath, deps) {
     const markers = conductorMarkerPaths(worktreePath, deps.platform ?? process.platform);
-    for (const marker of [markers.workerLog, markers.resultJson, markers.dir]) {
+    for (const marker of [markers.resultJson, markers.dir]) {
         if ((await deps.statMtimeMs(marker)) !== null)
             return true;
     }
     return false;
 }
 /**
- * Compute last activity as the NEWEST mtime among `.conductor/worker.log`,
- * `.conductor/result.json`, and the worktree directory itself. Returns `null`
+ * Compute last activity as the NEWEST mtime among the per-attempt worker logs
+ * in `.conductor` (the newest attempt log wins), `.conductor/result.json`, the
+ * `.conductor` directory, and the worktree directory itself. Returns `null`
  * when none can be stat'd (activity cannot be proven → the caller retains).
  */
 export async function getWorktreeLastActivityMs(worktreePath, deps) {
     const markers = conductorMarkerPaths(worktreePath, deps.platform ?? process.platform);
-    const candidates = [markers.workerLog, markers.resultJson, worktreePath];
+    const candidates = [
+        ...(await attemptLogPaths(markers.dir, deps)),
+        markers.resultJson,
+        markers.dir,
+        worktreePath,
+    ];
     let newest = null;
     for (const candidate of candidates) {
         const mtime = await deps.statMtimeMs(candidate);

package/build/executor/worktree.js

@@ -10,7 +10,8 @@ import { fetchAndResolveBaseSha, probeClaudeReviewWorkflowDrift, resolveReposito
 // BAPI-941: the shared drift diagnostic formatter (a leaf module — no cycle).
 import { formatClaudeReviewWorkflowDriftDiagnostic } from "../claude-review-workflow-drift.js";
 import { commandSucceeded } from "../start-tickets-prereqs.js";
-import { createWorktreeForTicket } from "../worktree-core.js";
+import { createWorktreeForTicket, provePriorHeadLineage } from "../worktree-core.js";
+import { findWorktreeByBranch, listGitWorktrees } from "./worktree-inspection.js";
 import { provisionCommandsForWorktree } from "../command-provisioning.js";
 /**
  * Resolve the branch for a real spawn job: `expected_branch` wins; else
@@ -252,6 +253,13 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
     // is neither), and it never contributes to the fail-CLOSED base-resolution
     // decision above.
     await emitExecutorWorkflowDriftAdvisory(deps, options.baseBranch);
+    // BAPI-1367: a retry of an `implement` job with a server-minted prior head
+    // resumes its own branch instead of being refused as a stale leftover. The
+    // gate lives HERE, not in the shared primitive, which learns no job types.
+    const priorHeadSha = eligiblePriorHead(job, policy);
+    if (priorHeadSha !== null) {
+        return ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, options, deps);
+    }
     const row = await createWorktreeForTicket(toWorktreeCoreDeps(deps), key, { [key]: branch }, options.worktrunkBinary, baseSha, guardStaleWorktree, {
         alignExistingBranchTo: baseSha,
         verifyHeadMatches: baseSha,
@@ -268,3 +276,76 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
     }
     return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
 }
+/**
+ * BAPI-1367: the prior head a worktree policy may act on, or `null`. Requires an
+ * `implement` job on a real retry and a syntactically valid full SHA; anything
+ * else keeps the ordinary fresh-dispatch behavior.
+ */
+function eligiblePriorHead(job, policy) {
+    if (policy.reuseExistingBranch === true)
+        return null;
+    if (job.job_type !== "implement")
+        return null;
+    if (typeof job.attempt_count !== "number" || job.attempt_count <= 1)
+        return null;
+    const head = policy.priorAttemptHeadSha;
+    return typeof head === "string" && FULL_SHA_PATTERN.test(head) ? head : null;
+}
+/**
+ * BAPI-1367: prepare the worktree for a retry that resumes prior-attempt work.
+ *
+ * Non-destructive by construction: no `alignExistingBranchTo`, no
+ * `verifyHeadMatches: baseSha`, no reset-based freshen, no `git clean -fd`. The
+ * shared primitive proves lineage against the resolved base and refuses before
+ * any mutation otherwise.
+ *
+ * When the worktree is missing it is recreated from the pushed branch, so
+ * `origin/<branch>` is fetched first and its lineage is proven here as well as
+ * (when a local branch exists) the local tip's lineage in the primitive —
+ * recreation may only use a remote source that passes. A conflicting ref refuses
+ * without cleanup. The result says plainly whether prior uncommitted files could
+ * survive.
+ */
+async function ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, options, deps) {
+    const entries = await listGitWorktrees(deps.runCommand, deps.cwd);
+    const retained = findWorktreeByBranch(entries, branch) !== undefined;
+    const coreDeps = toWorktreeCoreDeps(deps);
+    const policy = { priorHeadSha, baseRef: baseSha };
+    if (!retained) {
+        // Recreation reads origin/<branch>; make sure that ref is current and proven.
+        const fetch = await deps.runCommand("git", ["fetch", "origin", branch], { cwd: deps.cwd });
+        if (!commandSucceeded(fetch)) {
+            const reason = (fetch.stderr || fetch.stdout || "").trim();
+            return {
+                ok: false,
+                error: `cannot resume prior-attempt work on '${branch}': git fetch origin ${branch} failed` +
+                    `${reason ? `: ${reason}` : ""}`,
+            };
+        }
+        const remote = await provePriorHeadLineage(coreDeps, branch, policy, "origin_branch");
+        if (!remote.ok) {
+            return {
+                ok: false,
+                error: `stale worktree guard: pushed branch 'origin/${branch}' cannot be resumed: ${remote.reason}`,
+            };
+        }
+    }
+    const row = await createWorktreeForTicket(coreDeps, key, { [key]: branch }, options.worktrunkBinary, baseSha, true, { allowedPriorHead: policy });
+    if (row.status !== "created" || typeof row.path !== "string") {
+        return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
+    }
+    const headSha = await resolveCommitSha(deps, row.path, "HEAD");
+    if (headSha === null) {
+        return { ok: false, error: `failed to resolve HEAD of the resumed worktree for '${branch}'` };
+    }
+    return {
+        ok: true,
+        worktreePath: row.path,
+        branch,
+        expectedHeadSha: headSha,
+        priorWork: {
+            kind: retained ? "retained_worktree" : "recreated_from_pushed_branch",
+            priorHeadSha,
+        },
+    };
+}