@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/executor/permissions.js

@@ -36,7 +36,7 @@
  * fallback is available for CLIs where settings-deny is not enforced.
  */
 import path from "node:path";
-import { mergeClaudeSettingsWithCommandHook, provisionClaudeSettingsForWorktree, DEFAULT_PRE_TOOL_USE_MATCHER, } from "../claude-settings.js";
+import { mergeClaudeSettingsWithAutoMemoryDisabled, mergeClaudeSettingsWithCommandHook, provisionClaudeSettingsForWorktree, DEFAULT_PRE_TOOL_USE_MATCHER, } from "../claude-settings.js";
 /**
  * The stable executor deny rules. Grammar mirrors the deny-enforcement probe's
  * `Bash(<cmd>:<args-glob>)` / `Read(<path-glob>)` form. Covers: reads under
@@ -117,26 +117,96 @@ export function executorDenyRules(inputs) {
     ];
 }
 /**
- * Branch names that a BRANCH-SHAPED deny glob would match (BAPI-1020).
+ * The push commands a worker uses for its OWN branch (BAPI-1397, F7).
  *
- * Two of the fifteen new rules — `Bash(git push:* main*)` and
- * `Bash(git push:* epic/*)` — deny by branch shape rather than by command. If a
- * worker's OWN branch ever matched one, the static deny would block the push the
- * guard is required to allow, and AC-10 ("it still pushes its own branch") would
- * break at push time with an error naming a rule nobody connected to the branch
- * name. The hook cannot rescue it: a PreToolUse allow does not override a
- * settings-level deny.
- *
- * Today the collision is unreachable — worker branches come from `wt.branch`, the
- * Worktrunk `feature/<KEY>` branch, and `epic/<EPIC>` appears only as a merge base
- * — but nothing wrote that invariant down. This does, and it fails LOUDLY at
- * provisioning time rather than mysteriously at push time.
+ * These are the forms the worker instructions direct (`checkpoint-work.md`:
+ * `git push origin <branch>`; `commit-and-push.md`: `git push -u origin
+ * <branch>`) plus the bare upstream push, and every one is a form the PreToolUse
+ * worker guard allows for the job's own branch (`worker-guard-hook.ts`,
+ * `evaluateGitPush`).
  */
-export function workerBranchCollidesWithDenyGlob(branch) {
+export function workerOwnBranchPushCommands(branch) {
     const trimmed = branch.trim();
     if (trimmed.length === 0)
+        return [];
+    return [`git push origin ${trimmed}`, `git push -u origin ${trimmed}`, "git push"];
+}
+/**
+ * Does a Claude Code `Bash(...)` permission rule match `command`? (BAPI-1397, F7)
+ *
+ * Mirrors the rule grammar of the installed Claude Code (checked against 2.1.287):
+ *
+ *  - content ending in `:*` is a PREFIX rule — `Bash(git push:*)` matches
+ *    `git push` and anything after it;
+ *  - otherwise content with an unescaped `*` is a WILDCARD rule — the whole
+ *    command must match, with each `*` matching any text (a single trailing ` *`
+ *    also matches nothing at all). A `:*` in the MIDDLE is not special here: in
+ *    `Bash(git push:* epic/*)` the `:` is a literal character, so that rule
+ *    never matches `git push origin epic/X`;
+ *  - anything else is an EXACT rule.
+ *
+ * Non-`Bash` rules never match a command.
+ */
+export function claudeBashRuleMatchesCommand(rule, command) {
+    const ruleMatch = /^Bash\((.*)\)$/s.exec(rule.trim());
+    if (!ruleMatch)
         return false;
-    return trimmed === "main" || trimmed.startsWith("main") || trimmed.startsWith("epic/");
+    const content = ruleMatch[1].trim();
+    const cmd = command.trim();
+    const prefix = /^(.+):\*$/s.exec(content);
+    if (prefix) {
+        const head = prefix[1];
+        return cmd === head || cmd.startsWith(`${head} `);
+    }
+    let pattern = "";
+    let literal = "";
+    let stars = 0;
+    for (let i = 0; i < content.length; i += 1) {
+        const ch = content[i];
+        // `\*` is a literal star and `\\` a literal backslash, as in Claude Code.
+        if (ch === "\\" && (content[i + 1] === "*" || content[i + 1] === "\\")) {
+            pattern += `\\${content[i + 1]}`;
+            literal += content[i + 1];
+            i += 1;
+            continue;
+        }
+        if (ch === "*") {
+            pattern += ".*";
+            stars += 1;
+            continue;
+        }
+        pattern += ch.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+        literal += ch;
+    }
+    if (stars === 0)
+        return cmd === literal;
+    if (stars === 1 && pattern.endsWith(" .*"))
+        pattern = `${pattern.slice(0, -3)}( .*)?`;
+    return new RegExp(`^${pattern}$`, "s").test(cmd);
+}
+/**
+ * Would one of `denyRules` block the worker's OWN push? (BAPI-1397, F7)
+ *
+ * Replaces the BAPI-1020 branch-NAME check, which warned for any `main*` or
+ * `epic/` branch. That was wrong in practice: the correction worker's push to
+ * `epic/` succeeded despite the warning, because the provisioned
+ * `Bash(git push:* epic/*)` rule does not match the push command the worker
+ * actually runs. This builds those real push commands and tests them against the
+ * deny rules with Claude Code's own matching grammar, so it warns only when a
+ * rule really matches.
+ */
+export function workerOwnPushDeniedByRules(branch, denyRules) {
+    const commands = workerOwnBranchPushCommands(branch);
+    return denyRules.some((rule) => typeof rule === "string" &&
+        commands.some((command) => claudeBashRuleMatchesCommand(rule, command)));
+}
+/**
+ * Would the executor's OWN deny rules block this branch's push? Kept for callers
+ * of the BAPI-1020 name; it now asks the command-form question of
+ * {@link workerOwnPushDeniedByRules} against {@link executorDenyRules}.
+ */
+export function workerBranchCollidesWithDenyGlob(branch) {
+    return workerOwnPushDeniedByRules(branch, executorDenyRules({ baseBranch: "", worktreePath: "", homedir: "" }));
 }
 function asObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value)
@@ -363,8 +433,22 @@ export async function provisionExecutorDenyLayer(worktreePath, options, deps) {
         worktreePath,
         homedir: deps.homedir(),
     };
+    // BAPI-1397 (F7): the deny list the worktree will actually carry — the executor
+    // rules plus any operator-authored entries already in the file. Captured from
+    // the merge; when the merge never runs (a malformed file is left untouched) the
+    // executor's own rules stand in.
+    let effectiveDeny = executorDenyRules(inputs);
     const result = await provisionClaudeSettingsForWorktree(worktreePath, (existing) => {
         let merged = mergeExecutorDenySettings(existing, inputs);
+        const mergedDeny = merged.permissions?.deny;
+        if (Array.isArray(mergedDeny))
+            effectiveDeny = mergedDeny;
+        // BAPI-1397 (F6) — a worker session must never write the OWNER's Claude
+        // auto-memory. Merged through the same malformed-safe write as the deny
+        // rules, so a malformed settings file is still never clobbered and a
+        // re-provisioned worktree is unchanged. The job runner also sets the
+        // environment form at spawn, so a failed write here does not re-enable it.
+        merged = mergeClaudeSettingsWithAutoMemoryDisabled(merged);
         // BAPI-1020 — the worker guard is registered UNCONDITIONALLY, before and
         // independently of the conditional fallback below. PreToolUse hooks fire in
         // EVERY permission mode, bypass included, which is what makes the guard hold
@@ -380,14 +464,16 @@ export async function provisionExecutorDenyLayer(worktreePath, options, deps) {
     // may already exist from an earlier provisioning, so it runs even when the
     // merge-write was refused or failed.
     const exclude = await provisionWorktreeSettingsExclude(worktreePath, deps);
-    // BAPI-1020 — the branch-shaped-glob collision check. Advisory rather than
-    // blocking, matching this function's established fail-open posture: the worker
-    // can still do most of its job, and killing the spawn would trade a push failure
-    // for a total one. It is loud where it matters — the warning names the condition
-    // at PROVISIONING time, so an operator reads it before the push fails, instead of
-    // decoding a deny rule from a push error twenty minutes later.
+    // BAPI-1020 / BAPI-1397 (F7) — would a deny rule block the worker's own push?
+    // Advisory rather than blocking, matching this function's established
+    // fail-open posture: the worker can still do most of its job, and killing the
+    // spawn would trade a push failure for a total one. It is loud where it
+    // matters — at PROVISIONING time, before the push fails. Since BAPI-1397 it is
+    // decided by matching the worker's REAL push commands against the deny rules
+    // with Claude Code's grammar, not by the branch name's shape: an `epic/` branch
+    // alone no longer warns, because no provisioned rule matches its push.
     const collidingBranch = typeof options.workerBranch === "string" &&
-        workerBranchCollidesWithDenyGlob(options.workerBranch);
+        workerOwnPushDeniedByRules(options.workerBranch, effectiveDeny);
     // `blocking` and `advisory` are kept apart on purpose. A blocking warning
     // flips `ok` (the established contract, which existing callers and tests
     // read); an advisory one rides along on `ok: true` so a degraded-but-
@@ -403,11 +489,12 @@ export async function provisionExecutorDenyLayer(worktreePath, options, deps) {
         advisory.push(exclude.warning);
     if (collidingBranch) {
         // The branch NAME is not echoed: this text travels into worker logs, and the
-        // condition ("matches a branch-shaped deny glob") is the whole diagnostic.
-        advisory.push("the job branch matches a branch-shaped executor deny glob (git push to main/ or " +
-            "epic/); the worker's own push would be denied by settings permissions.deny, " +
-            "which the PreToolUse guard cannot override — re-cut the branch before relying " +
-            "on this worktree");
+        // condition ("a deny rule matches the worker's own push") is the whole
+        // diagnostic.
+        advisory.push("a settings permissions.deny rule matches the worker's own git push command for " +
+            "the job branch; the worker's own push would be denied by settings " +
+            "permissions.deny, which the PreToolUse guard cannot override — remove the rule " +
+            "or re-cut the branch before relying on this worktree");
     }
     if (blocking.length > 0) {
         return { ok: false, warning: [...blocking, ...advisory].join("; ") };

package/build/executor/platform.js

@@ -188,7 +188,7 @@ export function startExecutorSleepAssertion(deps) {
             if (releasing)
                 return;
             releasing = true;
-            controller.requestTermination();
+            controller.requestTermination("executor_abort");
             // Await the child so a caller that releases and then exits does not race the
             // teardown, and so `pmset -g assertions` is observably clean afterwards.
             await settled;

package/build/executor/preflight.js

@@ -2,7 +2,8 @@ import { DEFAULT_PROBE_TIMEOUT_MS } from "../agent-capabilities/types.js";
 import { inspectExecutorAgentAdapter, inspectionForFailedResolution, } from "../agent-launchers/executor-adapter-inspection.js";
 import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter-registry.js";
 import { resolveCompletionEvidenceCapability } from "../agent-launchers/executor-adapter.js";
-import { COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY, runtimeMatchesSupported, } from "./completion-contract.js";
+import { COMPLETION_EVIDENCE_CAPABILITY, REQUIRED_VERIFICATION_CAPABILITY, cliVersionAtLeast, normalizeCliVersion, parseCliVersion, runtimeMatchesSupported, } from "./completion-contract.js";
+import { buildHeadlessAgentEnv } from "./env.js";
 import { resolveExecutorAgentId } from "./agent-identity.js";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -11,7 +12,7 @@ import { spawnSync } from "node:child_process";
 import { defaultResolveBinPath } from "../start-tickets-conductor.js";
 import { CORRECTION_INTENT_CAPABILITY } from "./correction-dispatch.js";
 import { resolveAllExecutorApiAccess, resolveBaseUrl, EXECUTOR_BASE_URL_REQUIRED_MESSAGE, } from "./credentials.js";
-import { FOCUSED_REBASE_CAPABILITY, SCOPE_WAIT_CAPABILITY } from "./types.js";
+import { FOCUSED_REBASE_CAPABILITY, GATE_QUALIFICATION_CAPABILITY, SCOPE_WAIT_CAPABILITY, } from "./types.js";
 /**
  * Environment override for the deny probe's headless timeout (BAPI-722).
  *
@@ -67,7 +68,7 @@ export function resolveDenyProbeTimeoutMs(env = {}) {
  * hang, a control refusal, and a degraded guess all report `layer: "none"` for the
  * posture they happened under, and none of them is cached.
  */
-function isCacheableDenyResult(result) {
+function isVerifiedDenyResult(result) {
     if (result.enforced !== true || result.layer === "none")
         return false;
     const postures = result.postures;
@@ -75,17 +76,38 @@ function isCacheableDenyResult(result) {
         return true;
     return postures.every((p) => p.enforced === true && p.layer !== "none");
 }
+function isCacheableDenyResult(result) {
+    return result.degraded !== true && isVerifiedDenyResult(result);
+}
 /** Create a fresh, empty executor-scoped deny-probe cache. */
 export function createDenyProbeCache() {
     let cached;
+    let failedProbe = false;
+    let retryAt = 0;
+    let failures = 0;
+    const schedule = (nowMs) => {
+        failures += 1;
+        retryAt = nowMs + Math.min(30, 2 ** Math.min(failures - 1, 5)) * 60_000;
+    };
     return {
-        get: () => cached,
-        set: (result) => {
-            if (isCacheableDenyResult(result))
-                cached = result;
+        get: (nowMs = Date.now()) => cached && (isCacheableDenyResult(cached) || nowMs < retryAt) ? cached : undefined,
+        failedProbeDue: (nowMs) => failedProbe && nowMs < retryAt,
+        recordFailedProbe: (nowMs) => { failedProbe = true; schedule(nowMs); },
+        set: (result, nowMs = Date.now()) => {
+            failedProbe = false;
+            cached = result;
+            if (isCacheableDenyResult(result)) {
+                failures = 0;
+                retryAt = 0;
+            }
+            else
+                schedule(nowMs);
         },
         reset: () => {
             cached = undefined;
+            failedProbe = false;
+            failures = 0;
+            retryAt = 0;
         },
     };
 }
@@ -123,20 +145,34 @@ export async function evaluateCompletionEvidenceQualification(adapter, deps) {
     if (probed === null) {
         return { qualified: false, refusal: "runtime identity probe did not run", runtime: null };
     }
-    const declared = capability.value.runtime;
+    const declared = capability.value.predicate;
     const mismatches = [];
-    for (const key of ["adapter", "cli_version", "platform", "event_schema"]) {
-        if (probed[key] !== declared[key]) {
-            mismatches.push(`${key} ${String(probed[key]).slice(0, 40)} != ${declared[key]}`);
-        }
+    if (probed.adapter !== declared.adapter) {
+        mismatches.push(`adapter ${String(probed.adapter).slice(0, 40)} != ${declared.adapter}`);
+    }
+    if (probed.event_schema !== declared.event_schema) {
+        mismatches.push(`event_schema ${String(probed.event_schema).slice(0, 40)} != ${declared.event_schema}`);
     }
     if (mismatches.length > 0) {
         return {
             qualified: false,
-            refusal: bounded(`probed runtime differs from the approved identity: ${mismatches.join("; ")}`),
+            refusal: bounded(`probed runtime differs from the declared predicate: ${mismatches.join("; ")}`),
             runtime: probed,
         };
     }
+    // Fixed reasons below: the probed version and platform are never echoed, because
+    // an unparseable value is arbitrary probe output.
+    const version = parseCliVersion(probed.cli_version);
+    const minimum = parseCliVersion(declared.min_cli_version);
+    if (version === null || minimum === null) {
+        return { qualified: false, refusal: "probed CLI version is not a recognized version", runtime: probed };
+    }
+    if (!cliVersionAtLeast(version, minimum)) {
+        return { qualified: false, refusal: "probed CLI version is older than the minimum", runtime: probed };
+    }
+    if (!declared.platforms.includes(probed.platform)) {
+        return { qualified: false, refusal: "probed platform is not a supported platform", runtime: probed };
+    }
     if (!runtimeMatchesSupported(probed)) {
         return {
             qualified: false,
@@ -144,7 +180,12 @@ export async function evaluateCompletionEvidenceQualification(adapter, deps) {
             runtime: probed,
         };
     }
-    return { qualified: true, refusal: null, runtime: probed };
+    // Normalized (suffix stripped) so the retained identity and the envelope carry one form.
+    const normalized = normalizeCliVersion(probed.cli_version);
+    if (normalized === null) {
+        return { qualified: false, refusal: "probed CLI version is not a recognized version", runtime: probed };
+    }
+    return { qualified: true, refusal: null, runtime: { ...probed, cli_version: normalized } };
 }
 /** Fail-fast report shape for a preflight that refused before probing. */
 function refusedPreflight(fatalFindings, warnings, adapter) {
@@ -160,23 +201,29 @@ function refusedPreflight(fatalFindings, warnings, adapter) {
         adapter,
     };
 }
-const CORRECTION_HOOK_FIXTURE_ID = "correction-entry-nested-v1";
+export const CORRECTION_HOOK_FIXTURE_ID = "correction-entry-nested-v2";
+const spawnCorrectionHook = (args, input, env) => {
+    const result = spawnSync(process.execPath, args, { input, encoding: "utf8", env, timeout: 5000 });
+    return { status: result.status, ...(result.error ? { error: result.error } : {}) };
+};
 /** Exercise the packaged hook process, including a nested-agent entry attempt. */
-export function probeInstalledCorrectionHook(worktreePath, binPath = defaultResolveBinPath("worker-guard-hook-bin.js")) {
+export function probeInstalledCorrectionHook(worktreePath, binPath = defaultResolveBinPath("worker-guard-hook-bin.js"), run = spawnCorrectionHook) {
     const args = [binPath, "--worktree-root", worktreePath,
         "--correction-intent-version", "1"];
     const env = { ...process.env, BAPI_CORRECTION_INTENT_VERSION: "1" };
     const fixtures = [
         { payload: { tool_name: "Skill", tool_input: { skill: "bridge-implement-ticket" } }, status: 2 },
         { payload: { tool_name: "Task", tool_input: { prompt: "/implement-ticket BAPI-1 --auto" } }, status: 2 },
-        { payload: { tool_name: "Read", tool_input: { file_path: "commands/src/implement-ticket.md" } }, status: 2 },
+        { payload: { tool_name: "Read", tool_input: { file_path: "commands/src/implement-ticket.md" } }, status: 0 },
+        {
+            payload: { tool_name: "Bash", tool_input: { command: 'claude -p "/implement-ticket BAPI-1"' } },
+            status: 2,
+        },
         { payload: { tool_name: "mcp__bridge_api__request_plan_generation", tool_input: {} }, status: 2 },
         { payload: { tool_name: "mcp__bridge_api__get_plan", tool_input: { ticket_number: "BAPI-1" } }, status: 0 },
     ];
     return fixtures.every(({ payload, status }) => {
-        const result = spawnSync(process.execPath, args, {
-            input: JSON.stringify(payload), encoding: "utf8", env, timeout: 5000,
-        });
+        const result = run(args, JSON.stringify(payload), env);
         return result.error === undefined && result.status === status;
     });
 }
@@ -386,7 +433,11 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
     let denyEnforced = false;
     try {
         const cache = seams.bypassDenyProbeCache === true ? undefined : seams.denyProbeCache;
-        const cachedDeny = cache?.get();
+        if (cache?.failedProbeDue?.(deps.now?.() ?? Date.now())) {
+            fatalFindings.push("deny-layer enforcement probe failed; refusing to claim");
+            throw new Error("cached deny probe failure");
+        }
+        const cachedDeny = cache?.get(deps.now?.() ?? Date.now());
         let deny;
         if (cachedDeny !== undefined) {
             deny = cachedDeny;
@@ -395,7 +446,7 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
             // An explicitly injected probe still wins, so every existing test seam
             // keeps working unchanged across the extraction.
             deny = await seams.runDenyPreflight({ timeoutMs: resolveDenyProbeTimeoutMs(deps.env) });
-            seams.denyProbeCache?.set(deny);
+            seams.denyProbeCache?.set(deny, deps.now?.() ?? Date.now());
         }
         else {
             // Otherwise the ADAPTER's declared deny hook probes. The verdict is mapped
@@ -411,8 +462,11 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
             if (denyCapability?.supported !== true) {
                 throw new Error("adapter declares no deny-enforcement capability");
             }
+            // The probe gets a worker-shaped environment so a nested-session variable in
+            // the executor's own process cannot change its verdict (BAPI-1386).
             const verdict = await denyCapability.value.probeEnforcement({
                 timeoutMs: resolveDenyProbeTimeoutMs(deps.env),
+                env: buildHeadlessAgentEnv(deps.env),
             });
             deny = {
                 enforced: verdict.enforced,
@@ -423,10 +477,10 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
             };
             // `set` itself refuses anything that is not a genuine success, so a failure
             // cannot become sticky even if this call site were later moved.
-            seams.denyProbeCache?.set(deny);
+            seams.denyProbeCache?.set(deny, deps.now?.() ?? Date.now());
         }
-        denyEnforced = deny.enforced === true;
-        if (!deny.enforced) {
+        denyEnforced = isVerifiedDenyResult(deny);
+        if (!denyEnforced) {
             fatalFindings.push(`deny-layer enforcement not verified (enforced=false, layer=${deny.layer}); refusing to claim`);
         }
         else if (deny.layer === "none") {
@@ -436,7 +490,11 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
         }
     }
     catch {
-        fatalFindings.push("deny-layer enforcement probe failed; refusing to claim");
+        if (!fatalFindings.includes("deny-layer enforcement probe failed; refusing to claim")) {
+            fatalFindings.push("deny-layer enforcement probe failed; refusing to claim");
+            if (!seams.bypassDenyProbeCache)
+                seams.denyProbeCache?.recordFailedProbe?.(deps.now?.() ?? Date.now());
+        }
     }
     // --- Advisory MCP-shadowing inspection (BAPI-727 → BAPI-790 → BAPI-781) --
     // This was a refusal under BAPI-727, because a `bridge-api` entry in the
@@ -486,6 +544,13 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
     if (!completion.qualified && completion.refusal !== null) {
         warnings.push(`completion evidence not advertised: ${completion.refusal}`);
     }
+    // One notice per qualifying collection, built only from validated fields: the
+    // adapter id the predicate matched, the normalized version, and a closed platform id.
+    const notices = [];
+    if (completion.qualified && completion.runtime !== null) {
+        notices.push(`completion evidence advertised: ${completion.runtime.adapter} ` +
+            `${completion.runtime.cli_version} ${completion.runtime.platform}`);
+    }
     let correction = {
         qualified: false, evidence: null,
     };
@@ -504,6 +569,7 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
         ok: fatalFindings.length === 0,
         fatalFindings,
         warnings,
+        notices,
         agentVersion,
         wtVersion,
         diskFreeGb,
@@ -547,6 +613,13 @@ export async function collectExecutorPreflight(options, deps, seams = {}) {
  * once ordinary preflight permits claiming — independently of completion-evidence
  * qualification. The completion tokens keep their exact conditional behavior and
  * order; the focused token is appended after them.
+ *
+ * BAPI-1391 adds two things. `gate_qualification.v1` is appended to
+ * `capabilities` ONLY on a repository-wide executor (see the comment at the
+ * token). And `job_types` is emitted, by conditional spread under the same
+ * "truly absent" rule, ONLY when `options.jobTypes` is set and non-empty; with
+ * it unset every manifest keeps its exact pre-BAPI-1391 shape apart from that
+ * one capability token on repository-wide executors.
  */
 export function buildClaimManifest(report, options, freeSlots) {
     return {
@@ -579,6 +652,19 @@ export function buildClaimManifest(report, options, freeSlots) {
             SCOPE_WAIT_CAPABILITY,
             ...(report.correctionIntentQualified === true ? [CORRECTION_INTENT_CAPABILITY] : []),
             ...(report.correctionIntentQualified === true ? ["ci_evidence.v1"] : []),
+            // BAPI-1391: repository-wide executors only. A `gate_qualification` row is
+            // run-less (no `epic_run_id`), and run-less rows pass the server's
+            // run-scope filter, so a run-scoped executor advertising this token could
+            // pick up repository-level qualification work it was never dedicated to.
+            // Gating the token on `repoWide` keeps that work on the executor whose
+            // operator chose the whole repository.
+            ...(options.repoWide === true ? [GATE_QUALIFICATION_CAPABILITY] : []),
         ],
+        // BAPI-1391: an optional job-type filter, present only when configured. An
+        // older server rejects the key with a 422, so it must never appear by
+        // default.
+        ...(options.jobTypes !== undefined && options.jobTypes.length > 0
+            ? { job_types: [...options.jobTypes] }
+            : {}),
     };
 }

package/build/executor/process-containment.js

@@ -266,6 +266,15 @@ export function buildCleanupVerdict(verdict, survivors, reasons) {
 export function unconfirmedCleanup(reason) {
     return buildCleanupVerdict("unconfirmed", 0, [reason]);
 }
+/**
+ * The verdict when no sweep was attempted because ownership could not be
+ * proven (invalid token, malformed or unreadable ownership record). The extra
+ * `not_run` reason keeps this shape distinct from a completed sweep that merely
+ * could not verify ownership, so it is never treated as continuable.
+ */
+function noSweepCleanup() {
+    return buildCleanupVerdict("unconfirmed", 0, ["ownership_unverifiable", "not_run"]);
+}
 /** Hard cap on distinct processes tracked by one sweep or one descendant tracker. */
 const MAX_TRACKED_PROCESSES = 1024;
 /** Confirmation enumerations after SIGKILL (a killed process can take a moment to leave). */
@@ -302,8 +311,14 @@ export function createDescendantTracker(options) {
                     else
                         childrenOf.set(proc.ppid, [proc]);
                 }
-                // Seeds: the root (when its identity matches) and every tracked member
-                // still live with the SAME start time. A reused pid is not a seed.
+                // Prune first: a member survives only while its exact (pid, startedAt)
+                // is still in this successful listing. Exited descendants must not
+                // exhaust the cap, and a reused pid loses its old identity.
+                for (const [key, member] of members) {
+                    const live = byPid.get(member.pid);
+                    if (!live || live.startedAt !== member.startedAt)
+                        members.delete(key);
+                }
                 const frontier = [];
                 const rootNow = byPid.get(rootPid);
                 if (rootNow) {
@@ -312,12 +327,11 @@ export function createDescendantTracker(options) {
                     if (rootNow.startedAt === rootStartedAt)
                         frontier.push(rootPid);
                 }
-                for (const member of members.values()) {
-                    const live = byPid.get(member.pid);
-                    if (live && live.startedAt === member.startedAt)
-                        frontier.push(member.pid);
-                }
+                for (const member of members.values())
+                    frontier.push(member.pid);
                 const visited = new Set(frontier);
+                let liveCount = members.size;
+                let capHit = false;
                 while (frontier.length > 0) {
                     const parent = frontier.pop();
                     for (const child of childrenOf.get(parent) ?? []) {
@@ -326,8 +340,9 @@ export function createDescendantTracker(options) {
                         visited.add(child.pid);
                         const key = keyOf(child);
                         if (!members.has(key)) {
+                            liveCount += 1;
                             if (members.size >= MAX_TRACKED_PROCESSES) {
-                                overflow = true;
+                                capHit = true;
                                 continue;
                             }
                             members.set(key, { pid: child.pid, startedAt: child.startedAt });
@@ -335,6 +350,15 @@ export function createDescendantTracker(options) {
                         frontier.push(child.pid);
                     }
                 }
+                if (capHit && !overflow) {
+                    overflow = true;
+                    try {
+                        options.onOverflow?.(liveCount);
+                    }
+                    catch {
+                        /* a diagnostic failure never changes tracking or the verdict */
+                    }
+                }
             }
             catch {
                 /* sampling is best-effort; the sweep's own verdict stays authoritative */
@@ -399,7 +423,7 @@ export async function runOwnedProcessSweep(options) {
     const maxRounds = Math.max(quietRounds, options.maxRounds ?? 200);
     const roundDelayMs = Math.max(0, options.roundDelayMs ?? 15);
     if (!isOwnershipToken(token))
-        return unconfirmedCleanup("ownership_unverifiable");
+        return noSweepCleanup();
     const reasons = new Set();
     if (options.trackerOverflowed)
         reasons.add("ownership_unverifiable");
@@ -700,8 +724,8 @@ async function ownerMayBeAlive(inspector, pid) {
  * interrupted before its own sweep finished. The record holds the exact token,
  * so ownership is verified and the full sweep runs. Only the job id and the
  * verdict are logged — never the token. A malformed record cannot prove
- * ownership: it is reported `unconfirmed / ownership_unverifiable` and removed
- * without signalling anything. Never throws.
+ * ownership: it is reported `unconfirmed` with `ownership_unverifiable` and
+ * `not_run` (no sweep ran) and removed without signalling anything. Never throws.
  */
 export async function recoverInterruptedOwnership(options) {
     const { stateDir, inspector, deps, fsDeps, deadlineMs } = options;
@@ -712,7 +736,7 @@ export async function recoverInterruptedOwnership(options) {
         let verdict;
         try {
             if (record === null) {
-                verdict = unconfirmedCleanup("ownership_unverifiable");
+                verdict = noSweepCleanup();
             }
             else if (options.hostDigest !== undefined && record.hostDigest !== options.hostDigest) {
                 continue;