@bridge_gpt/mcp-server 0.2.65 → 0.2.67

package/build/start-tickets.js

@@ -54,6 +54,7 @@
  * unit-testable on Linux CI without spawning real commands or terminals.
  */
 import { execFile } from "child_process";
+import { macosTerminalPermissionGuidance } from "./macos-terminal-permission-guidance.js";
 import { readFile, writeFile, mkdir, mkdtemp, stat, lstat, symlink, unlink, copyFile, readdir, rm, } from "fs/promises";
 import os from "node:os";
 import { createHash } from "node:crypto";
@@ -135,8 +136,8 @@ export function getStartTicketsUsage() {
         "  --host claude-code|cursor|codex|copilot-vscode|windsurf Current host when --agent is omitted; Claude Code, Cursor, and Codex can launch sessions",
         "  Cursor with --auto launches headlessly after a bounded readiness check; without --auto it stays interactive for the review gate.",
         "  --workflow implement|review-and-implement  Command each spawned worktree runs (default: implement). review-and-implement runs review-ticket then, after a per-ticket halt gate, hands off to a fresh implement-ticket session; --auto applies to both phases.",
-        "  --tier cheap|basic|premium  Strict manual model-routing override: bypasses the per-ticket difficulty/tier lookup and applies this tier to every ticket exactly as supplied, with no per-session posture adjustment. Claude/Cursor use registry aliases and repository overrides; Codex uses the authenticated Bridge catalog. It is NOT a raw --model alias and never carries an API key or credential. A malformed value requests premium routing when available. Mutually exclusive with --auto-tier.",
-        "  --auto-tier cheap|basic|premium  Internal/advanced machine-carried raw backend tier for chained automation handoffs (e.g. /review-and-implement): bypasses the per-ticket lookup like --tier, but remains subject to per-session optimization-posture adjustment (may be downshifted under maximize_subscription). Not the strict-override mechanism — use --tier for a human override. Mutually exclusive with --tier.",
+        "  --tier cheap|basic|premium  Strict manual model-routing override: bypasses the per-ticket difficulty/tier lookup and applies this tier to every ticket exactly as supplied, with no per-session posture adjustment. Claude/Cursor use registry aliases and repository overrides; Codex uses the authenticated Bridge catalog. It is NOT a raw --model alias and never carries an API key or credential. A malformed value requests premium routing when available. With --workflow review-and-implement a valid value is also forwarded to the spawned command so the review tab and the fresh implementation session both run on it. Mutually exclusive with --auto-tier.",
+        "  --auto-tier cheap|basic|premium  Internal/advanced machine-carried raw backend tier for chained automation handoffs (e.g. /review-and-implement): bypasses the per-ticket lookup like --tier, but remains subject to per-session optimization-posture adjustment (may be downshifted under maximize_subscription, unless the server reports configured thresholds). Not the strict-override mechanism — use --tier for a human override. Mutually exclusive with --tier.",
         "  --rounds 1|2                Review round count forwarded to the review phase; review-only, valid only with --workflow review-and-implement",
         "  --terminal terminal|iterm   Override the macOS terminal app (default: auto-detect via $TERM_PROGRAM); honored on macOS only",
         "  --dry-run                   Print intended actions; creates no worktrees and opens no tabs, but DOES resolve model routing read-only (may compute+cache a ticket's difficulty) to preview the --model each tab would use",
@@ -618,7 +619,9 @@ resumeMode = false, workflow = "implement", reviewRounds,
 // conductor runs always, and (BAPI-801/BAPI-847) for every plain run whose base
 // resolved, `main` included — and threaded (BAPI-593) into the spawned workflow
 // command.
-baseBranch, bridgeApiBaseUrlOverride) {
+baseBranch, bridgeApiBaseUrlOverride, 
+// BAPI-1365: a recognized operator `--tier`, forwarded to the review prompt.
+manualTier) {
     if (!isSupportedStartTicketsPlatform(deps.platform)) {
         return { ok: false, error: unsupportedPlatformMessage(deps.platform) };
     }
@@ -639,7 +642,7 @@ baseBranch, bridgeApiBaseUrlOverride) {
             // falls back to the basename-derived repo name (the 403 root cause), and
             // (BAPI-586/BAPI-801) the run base so the spawned worker opens its PR
             // against it. The base assignment stays outermost.
-            buildAgentShellCommand: (key, worktreePath, modelAlias, launchArgs) => prependBaseBranchEnvAssignment(prependRepoNameEnvAssignment(buildAgentShellCommand(agent, key, worktreePath, platform, autoApprove, modelAlias, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch, launchArgs, bridgeApiBaseUrl), repoName, platform), prBaseBranch, platform),
+            buildAgentShellCommand: (key, worktreePath, modelAlias, launchArgs) => prependBaseBranchEnvAssignment(prependRepoNameEnvAssignment(buildAgentShellCommand(agent, key, worktreePath, platform, autoApprove, modelAlias, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch, launchArgs, bridgeApiBaseUrl, manualTier), repoName, platform), prBaseBranch, platform),
             spawnTerminalTab: deps.spawnTerminalTab,
         },
     };
@@ -1071,6 +1074,19 @@ export async function refreshBaseBranch(deps, options) {
     // `<baseBranch>` is checked out somewhere: fast-forward it in place. git refuses to
     // force-move a checked-out branch ref, so we must go through merge.
     if (basePath) {
+        // BAPI-1362: a live plane member may be running out of this very checkout.
+        // Fail closed — an unreadable or ambiguous record protects it. When
+        // protected, nothing local is moved: the caller cuts from the fetched
+        // `origin/<base>` SHA through the same fetch-only resolution the
+        // non-mutating path uses.
+        const decision = await evaluateGuardSafely(deps, basePath);
+        if (decision.kind === "protect") {
+            (deps.baseWorktreeGuardWarningLog ?? defaultGuardWarningLog)(formatBaseWorktreeGuardWarning(decision, baseBranch));
+            const resolved = await fetchAndResolveBaseSha(deps, baseBranch);
+            if (!resolved.ok)
+                return { ok: false, error: resolved.error };
+            return { ok: true, protectedBaseSha: resolved.base_sha };
+        }
         const merge = await deps.runCommand("git", ["merge", "--ff-only", originRef], { cwd: basePath });
         if (!commandSucceeded(merge)) {
             return {
@@ -1102,6 +1118,25 @@ export async function refreshBaseBranch(deps, options) {
     }
     return { ok: true };
 }
+function defaultGuardWarningLog(message) {
+    // stderr, never stdout: stdout carries the workflow's normal output.
+    process.stderr.write(`${message}\n`);
+}
+/** Run the guard; any failure of the guard itself is a `protect` (fail closed). */
+async function evaluateGuardSafely(deps, basePath) {
+    try {
+        if (deps.evaluateBaseWorktreeGuard)
+            return await deps.evaluateBaseWorktreeGuard(basePath);
+        return await evaluateBaseWorktreeGuard(basePath, await createBaseWorktreeGuardDeps());
+    }
+    catch {
+        return {
+            kind: "protect",
+            reason: "manifest-unreadable",
+            manifestLocation: ".bridge/plane/plane.json",
+        };
+    }
+}
 /**
  * Compatibility wrapper around {@link refreshBaseBranch} that preserves the
  * historical `refreshMainBranch(deps, { refreshMain })` signature for callers
@@ -1194,6 +1229,7 @@ async function emitClaudeReviewWorkflowDriftAdvisory(deps, baseBranch, overrides
 // import the VALUES here (so internal uses keep working) and re-export the same
 // references so existing importers of `./start-tickets.js` (index.ts,
 // review-tickets.ts) and the pinned start-tickets tests are unaffected.
+import { evaluateBaseWorktreeGuard, createBaseWorktreeGuardDeps, formatBaseWorktreeGuardWarning, } from "./plane/base-worktree-guard.js";
 import { validateBranchName, fetchAndResolveBaseSha, 
 // BAPI-941: both live in the same leaf module so the interactive refresh path
 // and the non-mutating conductor path share one drift implementation.
@@ -1338,8 +1374,9 @@ export async function resumeWorktrees(deps, options) {
  * E1/F3b proved a clean TEXTUAL merge can still hide a SEMANTIC break (branch A
  * adds a helper; branch B adds a contract test over all helpers), which only the
  * FULL suite catches — so this instruction requires the worker to run the full
- * project test suite (the same gate the advisory pre-push hook enforces) and only
- * push/complete on green, escalating otherwise.
+ * project test suite (every unit suite the project defines, the same suites its
+ * pull request CI runs) and only push/complete on green, escalating otherwise.
+ * The wording stays project-neutral because this CLI runs in other repositories.
  *
  * Single line (no newlines, no `;`, no quotes/apostrophes) so it stays safe when
  * single-quoted into a shell command and embedded in terminal-launcher args.
@@ -1350,8 +1387,8 @@ export function buildResumeModeRemediationFinalizeInstruction() {
         "the current base branch and resolve the merge conflicts. A clean textual merge can " +
         "still break behavior, so inspect for semantic conflicts even when there are no textual " +
         "conflict markers. Before you push or mark the ticket complete, run the full test suite " +
-        "for the project (the full unit suite, the same gate enforced by the advisory pre-push " +
-        "hook described in CLAUDE.md under the CI cost model and advisory pre-push hook section) " +
+        "for the project (the full unit suite: every unit test suite the project defines, the " +
+        "same suites its pull request CI runs) " +
         "and do not rely on targeted subsets as your only verification. Push and mark the ticket " +
         "complete only after the full suite is green. If you cannot make the full suite pass, " +
         "report the ticket blocked and escalate rather than pushing a green-looking but broken merge.");
@@ -1384,6 +1421,8 @@ export function buildAgentPrompt(key, opts = {}) {
     // Review-only arguments (`--rounds`, non-default `--base-branch`) must never
     // leak into the legacy `/implement-ticket` prompt.
     if (workflow === "review-and-implement") {
+        if (opts.manualTier !== undefined)
+            command += ` --tier=${opts.manualTier}`;
         if (opts.agentName === "cursor-agent")
             command += " --agent=cursor-agent";
         if (opts.reviewRounds !== undefined) {
@@ -1456,13 +1495,13 @@ export function buildAgentInvocation(agent, prompt, quote, modelAlias, launchArg
     }
 }
 /** POSIX agent shell command: `cd '<path>' && <agent> [--model '<alias>'] '<prompt>'`. */
-export function buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false, workflow = "implement", reviewRounds, baseBranch, launchArgs = [], bridgeApiBaseUrl) {
-    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch, agentName: agent.name }), (p) => `'${shSquoteInner(p)}'`, modelAlias, agent.name === "cursor-agent" && autoApprove ? worktreePath : launchArgs);
+export function buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false, workflow = "implement", reviewRounds, baseBranch, launchArgs = [], bridgeApiBaseUrl, manualTier) {
+    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch, agentName: agent.name, manualTier }), (p) => `'${shSquoteInner(p)}'`, modelAlias, agent.name === "cursor-agent" && autoApprove ? worktreePath : launchArgs);
     return `cd '${shSquoteInner(worktreePath)}' && ${prependBridgeApiBaseUrlEnvAssignment(invocation, bridgeApiBaseUrl, "darwin")}`;
 }
 /** PowerShell agent shell command: `Set-Location -LiteralPath '<path>'; <agent> [--model '<alias>'] '<prompt>'`. */
-export function buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false, workflow = "implement", reviewRounds, baseBranch, launchArgs = [], bridgeApiBaseUrl) {
-    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch, agentName: agent.name }), powershellSquote, modelAlias, agent.name === "cursor-agent" && autoApprove ? worktreePath : launchArgs);
+export function buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false, workflow = "implement", reviewRounds, baseBranch, launchArgs = [], bridgeApiBaseUrl, manualTier) {
+    const invocation = buildAgentInvocation(agent, buildAgentPrompt(key, { autoApprove, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch, agentName: agent.name, manualTier }), powershellSquote, modelAlias, agent.name === "cursor-agent" && autoApprove ? worktreePath : launchArgs);
     return `Set-Location -LiteralPath ${powershellSquote(worktreePath)}; ${prependBridgeApiBaseUrlEnvAssignment(invocation, bridgeApiBaseUrl, "win32")}`;
 }
 /**
@@ -1473,10 +1512,10 @@ export function buildPowerShellAgentShellCommand(agent, key, worktreePath, autoA
  * injected as `--model` at the spawn boundary. `conductorEnabled` appends the
  * BAPI-586 PR-base contract instruction to the prompt (opt-in via `--conductor`).
  */
-export function buildAgentShellCommand(agent, key, worktreePath, platform = "darwin", autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false, workflow = "implement", reviewRounds, baseBranch, launchArgs = [], bridgeApiBaseUrl) {
+export function buildAgentShellCommand(agent, key, worktreePath, platform = "darwin", autoApprove = false, modelAlias, conductorEnabled = false, resumeMode = false, workflow = "implement", reviewRounds, baseBranch, launchArgs = [], bridgeApiBaseUrl, manualTier) {
     if (platform === "win32")
-        return buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch, launchArgs, bridgeApiBaseUrl);
-    return buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch, launchArgs, bridgeApiBaseUrl);
+        return buildPowerShellAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch, launchArgs, bridgeApiBaseUrl, manualTier);
+    return buildPosixAgentShellCommand(agent, key, worktreePath, autoApprove, modelAlias, conductorEnabled, resumeMode, workflow, reviewRounds, baseBranch, launchArgs, bridgeApiBaseUrl, manualTier);
 }
 /**
  * Build the shell command run inside a spawned tab/session for an ARBITRARY
@@ -2104,7 +2143,7 @@ export function buildDryRunResults(keys, overrides) {
  * PowerShell on Windows, `wt` + POSIX on macOS/Linux, and a non-throwing `wt` +
  * POSIX fallback for unsupported platforms.
  */
-export function getDryRunPlatformDetails(agent, platform = process.platform, env = process.env, autoApprove = false, conductorEnabled = false, repoName = null, workflow = "implement", reviewRounds, baseBranch) {
+export function getDryRunPlatformDetails(agent, platform = process.platform, env = process.env, autoApprove = false, conductorEnabled = false, repoName = null, workflow = "implement", reviewRounds, baseBranch, manualTier) {
     return {
         worktrunkBinary: resolveWorktrunkBinary(platform, env),
         // The builder accepts an optional resolved modelAlias; the dry-run caller
@@ -2117,7 +2156,7 @@ export function getDryRunPlatformDetails(agent, platform = process.platform, env
         // buildAgentShellCommand/buildAgentPrompt path as a real spawn. A Codex
         // dry-run has no created worktree to bind, so its preview omits the
         // process-local -C/-c MCP scope that the real spawn resolves later.
-        buildAgentShellCommand: (key, worktreePath, modelAlias, launchArgs) => prependBaseBranchEnvAssignment(prependRepoNameEnvAssignment(buildAgentShellCommand(agent, key, worktreePath, platform, autoApprove, modelAlias, conductorEnabled, false, workflow, reviewRounds, baseBranch, launchArgs, resolveSpawnBridgeApiBaseUrl(env)), repoName, platform), resolvePrBaseBranchEnvValue(conductorEnabled, baseBranch), platform),
+        buildAgentShellCommand: (key, worktreePath, modelAlias, launchArgs) => prependBaseBranchEnvAssignment(prependRepoNameEnvAssignment(buildAgentShellCommand(agent, key, worktreePath, platform, autoApprove, modelAlias, conductorEnabled, false, workflow, reviewRounds, baseBranch, launchArgs, resolveSpawnBridgeApiBaseUrl(env), manualTier), repoName, platform), resolvePrBaseBranchEnvValue(conductorEnabled, baseBranch), platform),
     };
 }
 /**
@@ -2156,8 +2195,8 @@ export function buildDryRunMcpProvisioningLines(worktreePath, platform = process
  * the secret-free MCP provisioning preview. Pure platform formatting only — no
  * preflight, no routing failures.
  */
-export function buildDryRunDetailLines(agent, key, branch, platform = process.platform, env = process.env, baseBranch = "main", autoApprove = false, modelAlias = null, conductorEnabled = false, repoName = null, mcpServerInvocation, workflow = "implement", reviewRounds) {
-    const { worktrunkBinary, buildAgentShellCommand: build } = getDryRunPlatformDetails(agent, platform, env, autoApprove, conductorEnabled, repoName, workflow, reviewRounds, baseBranch);
+export function buildDryRunDetailLines(agent, key, branch, platform = process.platform, env = process.env, baseBranch = "main", autoApprove = false, modelAlias = null, conductorEnabled = false, repoName = null, mcpServerInvocation, workflow = "implement", reviewRounds, manualTier) {
+    const { worktrunkBinary, buildAgentShellCommand: build } = getDryRunPlatformDetails(agent, platform, env, autoApprove, conductorEnabled, repoName, workflow, reviewRounds, baseBranch, manualTier);
     const wtArgs = buildWtSwitchArgs(branch, false, baseBranch);
     const agentInvocation = build(key, "<worktree-path>", modelAlias);
     // BAPI-801/BAPI-847: one concise secondary detail naming the PR base, emitted
@@ -2382,6 +2421,12 @@ export function formatModelRoutingDiagnosticLine(d) {
         case "posture-unavailable":
             return ("model routing: optimization posture was unavailable; Quality routing was retained " +
                 "(reason=optimization-posture-unavailable).");
+        case "review-consumer-unrecognized":
+            return (`model routing: the Bridge API server did not recognize the review consumer${ticketSuffix} ` +
+                "(reason=consumer-unrecognized); the review tab uses the premium fallback. Upgrade the server.");
+        case "review-threshold-legacy":
+            return (`model routing: review thresholds are not configured${ticketSuffix} ` +
+                "(reason=legacy); the review tab uses the premium fallback. Configure review model-tier thresholds.");
         default:
             return `model routing degraded: ${d.message} ${failOpen}`;
     }
@@ -2749,14 +2794,32 @@ export async function fetchCodexModelCatalog(access) {
         return invalid();
     return { ok: true, catalog: { models: models, revision } };
 }
+/**
+ * True only when stored thresholds decided the tier (`configured` or
+ * `anomaly`). The merged resolver maps every `anomaly` tier to `premium` as a
+ * fail-safe, so a threshold-decided tier is final and must never be downshifted.
+ *
+ * A `source: "fallback"` response is never threshold-decided: the server could
+ * not obtain a difficulty and assumed premium, even though it still reports the
+ * stored thresholds' mode. Treating it as decided would give review tabs a
+ * premium fallback and skip the maximize downshift for a guess.
+ */
+export function isThresholdDecidedTierResponse(value) {
+    if (value.source === "fallback")
+        return false;
+    return value.thresholdMode === "configured" || value.thresholdMode === "anomaly";
+}
 /**
  * Fetch the coarse tier for one ticket with a bounded timeout. Never throws to
  * the batch orchestrator: failures/timeouts return a structured warning plus a
  * classified diagnostic that preserves the ticket key in metadata.
  */
-export async function fetchTicketModelTierForStartTickets(access, ticket) {
+export async function fetchTicketModelTierForStartTickets(access, ticket, fetchOptions = {}) {
     try {
-        const url = buildStartTicketsJiraUrl(access.baseUrl, `/tickets/${encodeURIComponent(ticket)}/model-tier`, { repo_name: access.repoName });
+        const params = { repo_name: access.repoName };
+        if (fetchOptions.consumer)
+            params.consumer = fetchOptions.consumer;
+        const url = buildStartTicketsJiraUrl(access.baseUrl, `/tickets/${encodeURIComponent(ticket)}/model-tier`, params);
         const body = await fetchJsonWithTimeout(url, startTicketsGetHeaders(access), TICKET_MODEL_TIER_FETCH_TIMEOUT_MS);
         const obj = (body ?? {});
         const tier = isModelTier(obj.tier) ? obj.tier : null;
@@ -2764,7 +2827,17 @@ export async function fetchTicketModelTierForStartTickets(access, ticket) {
         const source = obj.source === "cached" || obj.source === "computed" || obj.source === "fallback"
             ? obj.source
             : "fallback";
-        return { ok: true, value: { difficulty, tier, source } };
+        const value = { difficulty, tier, source };
+        // BAPI-1343: additive fields are attached only when the server sent them,
+        // so an older server's response parses to exactly the pre-feature shape.
+        if (obj.threshold_mode !== undefined && obj.threshold_mode !== null) {
+            value.thresholdMode =
+                obj.threshold_mode === "configured" || obj.threshold_mode === "anomaly" ? obj.threshold_mode : "legacy";
+        }
+        if (obj.consumer === "review" || obj.consumer === "implementation") {
+            value.consumer = obj.consumer;
+        }
+        return { ok: true, value };
     }
     catch (err) {
         return {
@@ -2779,15 +2852,23 @@ export async function fetchTicketModelTierForStartTickets(access, ticket) {
         };
     }
 }
+/**
+ * Fetch tiers for ticket keys with bounded parallelism (capped at 3). One
+ * ticket's failure never aborts the others; results are keyed by ticket. The
+ * shared bounded fetch behind both `start-tickets` and `/review-tickets`.
+ */
+export async function fetchTicketModelTiersForKeys(access, keys, maxParallel, fetchOptions = {}) {
+    const limit = Math.min(maxParallel, 3);
+    const results = await runWithConcurrency(keys, limit, (key) => fetchTicketModelTierForStartTickets(access, key, fetchOptions).then((res) => [key, res]));
+    return new Map(results);
+}
 /**
  * Fetch tiers for the still-spawnable rows with bounded parallelism (capped at
  * 3). One ticket's failure never aborts the others; results are keyed by ticket.
  */
-export async function fetchTicketModelTiersForRows(access, rows, maxParallel, isEligible = (r) => r.status === "created" && !!r.path) {
+export async function fetchTicketModelTiersForRows(access, rows, maxParallel, isEligible = (r) => r.status === "created" && !!r.path, fetchOptions = {}) {
     const eligible = rows.filter(isEligible);
-    const limit = Math.min(maxParallel, 3);
-    const results = await runWithConcurrency(eligible, limit, (row) => fetchTicketModelTierForStartTickets(access, row.key).then((res) => [row.key, res]));
-    return new Map(results);
+    return fetchTicketModelTiersForKeys(access, eligible.map((row) => row.key), maxParallel, fetchOptions);
 }
 /**
  * Parse a model-list command's stdout into a set of advertised model aliases.
@@ -2874,7 +2955,15 @@ export function applyDefaultModelRoutingMetadata(row, reason, diagnostic) {
         ...(diagnostic ? { modelRoutingDiagnostic: diagnostic } : {}),
     };
 }
-function resolveRoutingAlias(agent, tier, overrides, catalog) {
+/**
+ * Map a coarse tier to the agent's alias: the Codex authenticated catalog for
+ * `codex`, otherwise the agent registry plus per-repo
+ * `difficulty_model_tier_overrides`. Exported (BAPI-1343) so `/review-tickets`
+ * maps review-threshold tiers exactly as `start-tickets` does, without copying
+ * the registry or catalog rules. The result still needs
+ * {@link validateResolvedModelAliasForAgent} before it reaches a shell.
+ */
+export function resolveRoutingAlias(agent, tier, overrides, catalog) {
     return agent.name === "codex"
         ? catalog?.models[tier] ?? null
         : resolveModelAlias(agent, tier, overrides);
@@ -2951,8 +3040,12 @@ const isDryRunRoutingEligible = (r) => r.status === "dry-run";
  * routing (posture `not_evaluated_manual_override`) and for `quality`/`speed`;
  * the exact transition token — including the `cheap` floor — under
  * `maximize_subscription`. Total and exhaustive over {@link ModelTier}.
+ * BAPI-1343: `none` whenever a `threshold` marker is supplied, because a
+ * threshold-decided tier is final and is never downshifted.
  */
-function resolveModelRoutingDecisionAdjustment(posture, baseline) {
+function resolveModelRoutingDecisionAdjustment(posture, baseline, threshold) {
+    if (threshold)
+        return "none";
     if (posture !== "maximize_subscription")
         return "none";
     switch (baseline) {
@@ -2973,7 +3066,65 @@ function resolveModelRoutingDecisionAdjustment(posture, baseline) {
 export function formatModelRoutingDecisionDiagnosticLine(input) {
     return (`[model-routing] source=${input.source} baseline=${input.baseline} ` +
         `posture=${input.posture} adjustment=${input.adjustment} effective=${input.effective} ` +
-        `alias=${input.alias ?? "unresolved"}`);
+        `alias=${input.alias ?? "unresolved"}` +
+        (input.threshold ? ` threshold=${input.threshold}` : "") +
+        (input.phase === "review" ? " phase=review consumer=review" : ""));
+}
+/**
+ * BAPI-1365: classify a successfully fetched review-consumer `/model-tier`
+ * response. `consumer-unrecognized` = the server did not echo `consumer:
+ * "review"` (its tier and marker are not a review decision and are never
+ * interpreted); `legacy` = it echoed review but no stored review thresholds
+ * decided the tier. `undefined` = a usable review decision, OR a
+ * `source: "fallback"` response (the difficulty itself failed; callers keep the
+ * existing lookup-failure handling for that).
+ */
+function reviewTierFallbackCause(value) {
+    if (value.consumer !== "review")
+        return "consumer-unrecognized";
+    if (value.source === "fallback")
+        return undefined;
+    if (!isThresholdDecidedTierResponse(value))
+        return "legacy";
+    return undefined;
+}
+/** BAPI-1365: the secret-free operator warning and diagnostic for a review fallback cause. */
+function reviewTierFallbackNotice(cause, repoName, ticketKey) {
+    const kind = cause === "consumer-unrecognized" ? "review-consumer-unrecognized" : "review-threshold-legacy";
+    const warning = cause === "consumer-unrecognized"
+        ? `model routing: server did not recognize the review consumer for ${ticketKey} (reason=consumer-unrecognized)`
+        : `model routing: review thresholds are not configured for ${ticketKey} (reason=legacy)`;
+    return {
+        warning,
+        diagnostic: makeModelRoutingDiagnostic({
+            kind,
+            repoName,
+            storeTarget: `bapi:${repoName}`,
+            ticketKey,
+            message: warning,
+        }),
+    };
+}
+/**
+ * BAPI-1343 R-6: the threshold marker for a successfully fetched `/model-tier`
+ * response when — and only when — the maximize downshift must be skipped:
+ * posture is `maximize_subscription` AND the response is threshold-decided
+ * (`configured` or `anomaly`). Every other case returns `undefined`, so the
+ * caller keeps today's exact downshift and text.
+ */
+function thresholdSkipMarker(posture, tierResult, reviewWorkflow = false) {
+    if (posture !== "maximize_subscription")
+        return undefined;
+    if (!tierResult || !tierResult.ok)
+        return undefined;
+    // BAPI-1365: a review-consumer lookup counts only when the server echoed the
+    // review consumer; an older server that ignored the parameter answered for
+    // the implementation consumer, which says nothing about the review threshold.
+    if (reviewWorkflow && tierResult.value.consumer !== "review")
+        return undefined;
+    if (!isThresholdDecidedTierResponse(tierResult.value))
+        return undefined;
+    return tierResult.value.thresholdMode;
 }
 /**
  * Best-effort emitter: calls the supplied stderr sink once and swallows any
@@ -3140,6 +3291,12 @@ errorLog = (message) => console.error(message)) {
     // produced it.
     const postureResolution = await resolveOptimizationPostureForStartTickets(access);
     const posture = postureResolution.posture;
+    // BAPI-1365: the spawned tab of a `review-and-implement` launch is a REVIEW
+    // tab, so its tier lookups ask for the review consumer. An ordinary
+    // `implement` launch supplies no options and keeps the endpoint's default
+    // implementation consumer. Derived once and shared by both fetch paths below.
+    const isReviewWorkflow = options.workflow === "review-and-implement";
+    const tierFetchOptions = isReviewWorkflow ? { consumer: "review" } : {};
     // BAPI-1225: one deterministic, best-effort diagnostic line per repository-level
     // resolution, emitted exactly here — outside the per-ticket row loop below, so a
     // multi-ticket invocation still logs it once for this canonical repository. Uses
@@ -3160,36 +3317,70 @@ errorLog = (message) => console.error(message)) {
         // chained automation handoff (e.g. `/review-and-implement`'s `--auto-tier`).
         // Routed through the CURRENT session's posture EXACTLY ONCE — unlike the
         // manual override above, this path IS subject to `downshiftModelTier()`
-        // under `maximize_subscription` — while skipping ONLY the redundant
-        // per-ticket `fetchTicketModelTiersForRows()` lookup. The alias is
-        // resolved+validated ONCE (identical for every row), matching the premium
-        // fallback / injected-tier hoisting pattern above.
-        const effectiveTier = posture === "maximize_subscription" ? downshiftModelTier(autoTier) : autoTier;
-        const adjustment = resolveModelRoutingDecisionAdjustment(posture, autoTier);
-        const lineageSuffix = posture === "maximize_subscription"
-            ? `; auto-tier:${autoTier}->maximize:${effectiveTier}`
-            : "";
-        const alias = resolveRoutingAlias(agent, effectiveTier, overrides, catalog);
-        let resolvedAlias = null;
-        let aliasWarning = null;
-        if (!alias) {
-            aliasWarning = `model routing: no valid alias for tier=${effectiveTier}; using agent default`;
-        }
-        else {
-            const validation = await validateResolvedModelAliasForAgent(deps, agent, alias);
-            if (validation.ok) {
-                resolvedAlias = validation.alias;
+        // under `maximize_subscription` — while never re-deriving the tier from a
+        // per-ticket lookup. The alias is resolved+validated at most ONCE per
+        // distinct effective tier, matching the premium fallback / injected-tier
+        // hoisting pattern above.
+        //
+        // BAPI-1343 R-6: under `maximize_subscription` ONLY, each eligible row's
+        // `/model-tier` is fetched once (the shared bounded fetch; BAPI-1365: with
+        // the workflow's consumer) purely to read `threshold_mode`. A threshold-decided
+        // (`configured`/`anomaly`) response keeps the carried tier — stored
+        // thresholds made it final. A fetch failure, `legacy`, or anything else
+        // downshifts exactly as before. `quality`/`speed` never downshift, so they
+        // make no extra request.
+        const thresholdTierMap = posture === "maximize_subscription"
+            ? await fetchTicketModelTiersForRows(access, eligible, options.maxParallel, isEligible, tierFetchOptions)
+            : null;
+        const aliasByEffectiveTier = new Map();
+        const resolveAutoTierAlias = async (effectiveTier) => {
+            const cached = aliasByEffectiveTier.get(effectiveTier);
+            if (cached)
+                return cached;
+            const alias = resolveRoutingAlias(agent, effectiveTier, overrides, catalog);
+            let resolved;
+            if (!alias) {
+                resolved = {
+                    resolvedAlias: null,
+                    aliasWarning: `model routing: no valid alias for tier=${effectiveTier}; using agent default`,
+                };
             }
             else {
-                aliasWarning = validation.warning;
+                const validation = await validateResolvedModelAliasForAgent(deps, agent, alias);
+                resolved = validation.ok
+                    ? { resolvedAlias: validation.alias, aliasWarning: null }
+                    : { resolvedAlias: null, aliasWarning: validation.warning };
             }
-        }
-        const reason = resolvedAlias
-            ? `auto-tier=${autoTier} model=${resolvedAlias} (posture=${posture})${lineageSuffix}`
-            : `${aliasWarning}${lineageSuffix}`;
-        out = rows.map((row) => {
-            if (!isEligible(row))
-                return row;
+            aliasByEffectiveTier.set(effectiveTier, resolved);
+            return resolved;
+        };
+        const autoOut = [];
+        for (const row of rows) {
+            if (!isEligible(row)) {
+                autoOut.push(row);
+                continue;
+            }
+            const markerResult = thresholdTierMap?.get(row.key);
+            const threshold = thresholdSkipMarker(posture, markerResult, isReviewWorkflow);
+            // BAPI-1365: for a review launch, say WHY a fetched marker did not decide
+            // the tier (never a review-threshold claim). A failed fetch keeps the
+            // existing silent downshift.
+            const markerCause = isReviewWorkflow && markerResult && markerResult.ok
+                ? reviewTierFallbackCause(markerResult.value)
+                : undefined;
+            const effectiveTier = posture === "maximize_subscription" && !threshold
+                ? downshiftModelTier(autoTier)
+                : autoTier;
+            const adjustment = resolveModelRoutingDecisionAdjustment(posture, autoTier, threshold);
+            const lineageSuffix = threshold
+                ? `; threshold:${threshold}`
+                : posture === "maximize_subscription"
+                    ? `; auto-tier:${autoTier}->maximize:${effectiveTier}${markerCause ? `; review-marker:${markerCause}` : ""}`
+                    : "";
+            const { resolvedAlias, aliasWarning } = await resolveAutoTierAlias(effectiveTier);
+            const reason = resolvedAlias
+                ? `auto-tier=${autoTier} model=${resolvedAlias} (posture=${posture})${lineageSuffix}`
+                : `${aliasWarning}${lineageSuffix}`;
             const baseRow = {
                 ...row,
                 difficulty: null,
@@ -3201,14 +3392,17 @@ errorLog = (message) => console.error(message)) {
                     ? { modelRoutingDiagnostic: codexEntitlementDiagnostic(access.repoName) }
                     : {}),
             };
-            return aliasWarning ? appendSummaryRowWarning(baseRow, aliasWarning) : baseRow;
-        });
-        // BAPI-1236: one `automatic_snapshot` diagnostic per eligible row — the
-        // carried baseline, the newly resolved posture, the exact adjustment token,
-        // the calculated effective tier, and the validated alias (or `unresolved`).
-        for (const row of rows) {
-            if (!isEligible(row))
-                continue;
+            let pushedRow = aliasWarning ? appendSummaryRowWarning(baseRow, aliasWarning) : baseRow;
+            if (markerCause) {
+                const notice = reviewTierFallbackNotice(markerCause, access.repoName, row.key);
+                pushedRow = appendSummaryRowWarning(pushedRow, notice.warning);
+                if (!pushedRow.modelRoutingDiagnostic)
+                    pushedRow = { ...pushedRow, modelRoutingDiagnostic: notice.diagnostic };
+            }
+            autoOut.push(pushedRow);
+            // BAPI-1236: one `automatic_snapshot` diagnostic per eligible row — the
+            // carried baseline, the newly resolved posture, the exact adjustment token,
+            // the calculated effective tier, and the validated alias (or `unresolved`).
             emitModelRoutingDecisionDiagnostic(errorLog, {
                 source: "automatic_snapshot",
                 baseline: autoTier,
@@ -3216,12 +3410,15 @@ errorLog = (message) => console.error(message)) {
                 adjustment,
                 effective: effectiveTier,
                 alias: resolvedAlias,
+                ...(threshold ? { threshold } : {}),
+                ...(isReviewWorkflow ? { phase: "review" } : {}),
             });
         }
+        out = autoOut;
     }
     else {
         // Ordinary per-ticket difficulty-lookup path.
-        const tierMap = await fetchTicketModelTiersForRows(access, eligible, options.maxParallel, isEligible);
+        const tierMap = await fetchTicketModelTiersForRows(access, eligible, options.maxParallel, isEligible, tierFetchOptions);
         // Lazily resolve+validate the premium fallback alias at most once for this run
         // (the alias is identical across rows; cursor-agent validation spawns a probe).
         let premiumApplier = null;
@@ -3260,6 +3457,40 @@ errorLog = (message) => console.error(message)) {
                 continue;
             }
             const { difficulty, tier, source } = tierResult.value;
+            // BAPI-1365: a review-launch response is a review-threshold decision only
+            // when the server echoed `consumer: "review"` AND stored thresholds decided
+            // it. Anything else takes the existing premium fallback with a closed
+            // reason — the returned tier and marker are never interpreted.
+            if (isReviewWorkflow) {
+                const cause = reviewTierFallbackCause(tierResult.value);
+                if (cause) {
+                    const notice = reviewTierFallbackNotice(cause, access.repoName, row.key);
+                    if (agent.name === "codex") {
+                        loopOut.push(codexDefaultRows([row], () => true, notice.warning, notice.diagnostic)[0]);
+                        continue;
+                    }
+                    loopOut.push(await applyPremiumFallback(row, notice.warning, notice.diagnostic));
+                    continue;
+                }
+                if (source === "fallback") {
+                    // The server could not obtain a difficulty: its premium tier is a
+                    // guess, not a review decision — keep the lookup-failure handling.
+                    const warning = `model routing: tier lookup failed for ${row.key}; using agent default model`;
+                    const diagnostic = makeModelRoutingDiagnostic({
+                        kind: "tier-fetch-unavailable",
+                        repoName: access.repoName,
+                        storeTarget: `bapi:${access.repoName}`,
+                        ticketKey: row.key,
+                        message: `tier lookup failed for ${row.key}`,
+                    });
+                    if (agent.name === "codex") {
+                        loopOut.push(codexDefaultRows([row], () => true, warning, diagnostic)[0]);
+                        continue;
+                    }
+                    loopOut.push(await applyPremiumFallback(row, warning, diagnostic));
+                    continue;
+                }
+            }
             if (!tier) {
                 // Backend reported no usable difficulty — default to premium/Opus. (The
                 // backend now returns a premium fallback itself, so this is defensive.)
@@ -3298,12 +3529,27 @@ errorLog = (message) => console.error(message)) {
             // alias table. Copilot never reaches this loop at all: it has no
             // `AGENT_REGISTRY` entry and `isRunnableHostTarget()` rejects hosts
             // without a launch agent before an `AgentSpec` is ever resolved.
+            //
+            // BAPI-1343 R-6: the response is already in hand — when it is
+            // threshold-decided (`configured`/`anomaly`), stored thresholds made the
+            // tier final, so the maximize downshift is skipped and the lineage and
+            // diagnostic carry a distinct `threshold` marker instead. The harness-
+            // local premium fallback above is untouched.
             const difficultyTier = tier;
-            const effectiveTier = posture === "maximize_subscription" ? downshiftModelTier(difficultyTier) : difficultyTier;
-            const adjustment = resolveModelRoutingDecisionAdjustment(posture, difficultyTier);
-            const lineageSuffix = posture === "maximize_subscription"
-                ? `; difficulty:${difficultyTier}->maximize:${effectiveTier}`
-                : "";
+            const threshold = thresholdSkipMarker(posture, tierResult, isReviewWorkflow);
+            const effectiveTier = posture === "maximize_subscription" && !threshold
+                ? downshiftModelTier(difficultyTier)
+                : difficultyTier;
+            const adjustment = resolveModelRoutingDecisionAdjustment(posture, difficultyTier, threshold);
+            const lineageSuffix = threshold
+                ? `; threshold:${threshold}`
+                : posture === "maximize_subscription"
+                    ? `; difficulty:${difficultyTier}->maximize:${effectiveTier}`
+                    : "";
+            const thresholdField = {
+                ...(threshold ? { threshold } : {}),
+                ...(isReviewWorkflow ? { phase: "review" } : {}),
+            };
             // BAPI-1236: stamp `difficulty_lookup` rather than copying the backend
             // cache/computation source (`cached`/`computed`/`fallback`) into the
             // summary's own routing-provenance field — that backend source is
@@ -3325,6 +3571,7 @@ errorLog = (message) => console.error(message)) {
                     adjustment,
                     effective: effectiveTier,
                     alias: null,
+                    ...thresholdField,
                 });
                 continue;
             }
@@ -3338,6 +3585,7 @@ errorLog = (message) => console.error(message)) {
                     adjustment,
                     effective: effectiveTier,
                     alias: null,
+                    ...thresholdField,
                 });
                 continue;
             }
@@ -3356,6 +3604,7 @@ errorLog = (message) => console.error(message)) {
                 adjustment,
                 effective: effectiveTier,
                 alias: validation.alias,
+                ...thresholdField,
             });
         }
         out = loopOut;
@@ -3652,7 +3901,7 @@ export async function orchestrateStartTickets(deps, options, overrides = {}) {
     // epic.base_branch override applied above) so the spawned worker gets
     // BAPI_BASE_BRANCH — every conductor worker, and a plain worker whose base
     // is non-default.
-    options.baseBranch, bridgeApiBaseUrl);
+    options.baseBranch, bridgeApiBaseUrl, isModelTier(options.injectedTier) ? options.injectedTier : undefined);
     if (!platformConfig.ok)
         return { ok: false, error: platformConfig.error };
     // BAPI-527: resolve the base start point new worktrees are cut from BEFORE any
@@ -3681,6 +3930,11 @@ export async function orchestrateStartTickets(deps, options, overrides = {}) {
         });
         if (!refresh.ok)
             return { ok: false, error: refresh.error };
+        // BAPI-1362: a live plane member runs from the base worktree, so the local
+        // branch was left where it was; cut from the fetched remote SHA instead.
+        if (refresh.protectedBaseSha !== undefined) {
+            effectiveBaseStartPoint = refresh.protectedBaseSha;
+        }
     }
     // BAPI-941: the `claude-review` workflow-drift advisory, emitted ONCE per
     // worker spawn at the one choke point both dispatch paths pass through, after
@@ -3835,14 +4089,13 @@ export async function orchestrateStartTickets(deps, options, overrides = {}) {
     const rows = await spawnTabsFn(deps, scoped, terminal, platformConfig.config.buildAgentShellCommand);
     return { ok: true, rows };
 }
-/** Platform-specific guidance printed when one or more tabs fail to spawn. */
-function spawnFailureHintForPlatform(platform) {
+/**
+ * Platform-specific guidance printed when one or more tabs fail to spawn.
+ * Exported for the BAPI-1319 byte-identity pin on the darwin sentence.
+ */
+export function spawnFailureHintForPlatform(platform) {
     if (platform === "darwin") {
-        return ("One or more tabs failed to spawn. If osascript reported a permission error, grant the " +
-            "required macOS permissions under System Settings -> Privacy & Security, then re-run: " +
-            "Automation (to let the terminal app be controlled) and, for the Terminal.app path, " +
-            "Accessibility (the new-tab step sends Cmd-T via System Events keystrokes, which Automation " +
-            "alone does not cover).");
+        return "One or more tabs failed to spawn. " + macosTerminalPermissionGuidance();
     }
     if (platform === "win32") {
         return ("One or more tabs failed to spawn. Ensure Windows Terminal (wt.exe) or PowerShell is " +
@@ -3918,7 +4171,7 @@ export async function runStartTicketsCli(argv, overrides = {}) {
             const branch = resolveBranchForTicket(key, options.branchOverrides);
             const routedRow = routedByKey.get(key);
             const modelAlias = routedRow?.modelAlias ?? null;
-            for (const line of buildDryRunDetailLines(agent, key, branch, deps.platform, deps.env, options.baseBranch, options.autoApprove, modelAlias, options.conductorEnabled ?? false, dryRunRepoName, dryRunMcpInvocation, options.workflow, options.reviewRounds)) {
+            for (const line of buildDryRunDetailLines(agent, key, branch, deps.platform, deps.env, options.baseBranch, options.autoApprove, modelAlias, options.conductorEnabled ?? false, dryRunRepoName, dryRunMcpInvocation, options.workflow, options.reviewRounds, isModelTier(options.injectedTier) ? options.injectedTier : undefined)) {
                 log(line);
             }
             log(`DRY-RUN:   model routing: ${formatModelRoutingLine(routedRow ?? { key, branch, status: "dry-run" }, agent, { workflow: options.workflow })}`);