@bridge_gpt/mcp-server 0.2.67 → 0.2.68

package/build/executor/worktree.js

@@ -1,3 +1,4 @@
+import { guardedFastForwardPush, isSafePublicationBranch } from "./guarded-fast-forward-push.js";
 /**
  * Executor worktree ensure (BAPI-534, TDD §7, §12).
  *
@@ -30,6 +31,45 @@ export function resolveExecutorBranch(job) {
         return { ok: true, branch: `feature/${ticketKey}` };
     return { ok: false, error: "no branch could be resolved (no expected_branch and no ticket_key)" };
 }
+/** Configure only this branch; inherited routing must already be safe. */
+export async function configureExecutorBranch(worktreePath, branch, deps) {
+    const failure = "executor push routing could not be confirmed";
+    if (!isSafePublicationBranch(branch))
+        return failure;
+    try {
+        const read = async (key) => {
+            const result = await deps.runCommand("git", ["config", "--get-all", key], { cwd: worktreePath });
+            if (result.exitCode === 1)
+                return [];
+            if (result.exitCode !== 0)
+                return null;
+            return result.stdout.trim().split("\n");
+        };
+        const allowed = async (key, values) => {
+            const actual = await read(key);
+            return actual !== null && actual.every(value => values.includes(value));
+        };
+        if (!await allowed("push.default", ["simple", "current", "upstream"]) ||
+            !await allowed("remote.pushDefault", ["origin"]) ||
+            !await allowed(`branch.${branch}.pushRemote`, ["origin"]) ||
+            !await allowed("remote.origin.push", []) ||
+            !await allowed("remote.origin.mirror", ["false"]))
+            return failure;
+        const urls = await read("remote.origin.url");
+        const pushUrls = await read("remote.origin.pushurl");
+        if (!urls || urls.length !== 1 || !pushUrls || pushUrls.length > 1 ||
+            (pushUrls.length === 1 && pushUrls[0] !== urls[0]))
+            return failure;
+        for (const [key, value] of [[`branch.${branch}.remote`, "origin"], [`branch.${branch}.merge`, `refs/heads/${branch}`]]) {
+            if ((await deps.runCommand("git", ["config", "--local", key, value], { cwd: worktreePath })).exitCode !== 0)
+                return failure;
+        }
+        return null;
+    }
+    catch {
+        return failure;
+    }
+}
 /**
  * BAPI-941: emit the per-spawn `claude-review` workflow-drift advisory for an
  * executor worker. Returns `void` and swallows everything — a diagnostic that
@@ -71,6 +111,7 @@ function toWorktreeCoreDeps(deps) {
 /** Build the command-provisioning boundary from the executor deps (BAPI-664). */
 function toCommandProvisioningDeps(deps) {
     return {
+        recordAssets: deps.recordPackagedAssets,
         readFile: deps.readFile,
         writeFile: deps.writeFile,
         mkdir: deps.mkdir,
@@ -89,12 +130,12 @@ function toCommandProvisioningDeps(deps) {
  * preserved unchanged. Errors stay secret-free (no raw filesystem exception, Git
  * output, or command contents).
  */
-async function finalizeExecutorWorktree(worktreePath, branch, expectedHeadSha, deps) {
+async function finalizeExecutorWorktree(worktreePath, branch, expectedHeadSha, deps, publication) {
     const provisioned = await provisionCommandsForWorktree(worktreePath, toCommandProvisioningDeps(deps));
     if (!provisioned.ok) {
-        return { ok: false, error: provisioned.error };
+        return { ok: false, error: provisioned.error, ...(publication ? { publication } : {}) };
     }
-    return { ok: true, worktreePath, branch, expectedHeadSha };
+    return { ok: true, worktreePath, branch, expectedHeadSha, ...(publication ? { publication } : {}) };
 }
 /**
  * BAPI-1300 — finish a RETAINED continuation worktree the same way a created one
@@ -157,6 +198,7 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
     if (!branchResult.ok)
         return { ok: false, error: branchResult.error };
     const branch = branchResult.branch;
+    const postSwitch = policy.preparation ? (worktreePath) => configureExecutorBranch(worktreePath, branch, deps) : undefined;
     // The shared primitive resolves the branch from `key` via a per-key override,
     // so we pin the exact resolved branch through the override map.
     const key = typeof job.ticket_key === "string" && job.ticket_key.trim().length > 0
@@ -188,7 +230,7 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
         const originRef = `origin/${branch}`;
         const fetch = await deps.runCommand("git", ["fetch", "origin", branch], { cwd: deps.cwd });
         if (!commandSucceeded(fetch)) {
-            const reason = (fetch.stderr || fetch.stdout || "").trim();
+            const reason = "";
             return {
                 ok: false,
                 error: `git fetch origin ${branch} failed${reason ? `: ${reason}` : ""}`,
@@ -206,15 +248,49 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
                 error: `failed to resolve '${originRef}' to a commit after fetching branch '${branch}'`,
             };
         }
+        let publication;
+        let safeHead = expectedHeadSha;
+        const preReset = policy.preparation ? async (worktreePath, actualBranch) => {
+            const context = policy.preparation;
+            const refuse = (reason) => ({ ok: false, error: `retained work preserved: ${reason}` });
+            if (!context.mayMutate() || context.branch !== actualBranch)
+                return refuse("preparation unavailable");
+            const head = await resolveCommitSha(deps, worktreePath, "HEAD");
+            const checked = await deps.runCommand("git", ["symbolic-ref", "--quiet", "--short", "HEAD"], { cwd: worktreePath });
+            if (!head || checked.exitCode !== 0 || checked.stdout.trim() !== branch)
+                return refuse("branch or head unknown");
+            if (head === expectedHeadSha)
+                return { ok: true, target: expectedHeadSha };
+            const ancestry = await deps.runCommand("git", ["merge-base", "--is-ancestor", expectedHeadSha, "HEAD"], { cwd: worktreePath });
+            if (ancestry.exitCode === 1) {
+                try {
+                    deps.errorLog?.(`[executor] job ${context.jobId} ${new Date(deps.now()).toISOString()}: branch ${branch}: non-descending retained head ${head.slice(0, 12)}; resetting to ${expectedHeadSha.slice(0, 12)}`);
+                }
+                catch { /* advisory */ }
+                return { ok: true, target: expectedHeadSha };
+            }
+            if (ancestry.exitCode !== 0)
+                return refuse("ancestry unknown");
+            const pushed = await guardedFastForwardPush({ branch, expectedOriginSha: expectedHeadSha,
+                candidateSha: head, worktreePath, runCommand: deps.runCommand, env: deps.env,
+                remainingMs: context.remainingMs, mayMutate: context.mayMutate });
+            if (pushed.status !== "published")
+                return refuse(pushed.reason);
+            publication = { jobId: context.jobId, preparationId: context.preparationId, branch,
+                from_sha: pushed.from_sha, to_sha: pushed.to_sha };
+            context.recordPublication(publication);
+            safeHead = pushed.to_sha;
+            return { ok: true, target: safeHead };
+        } : undefined;
         const row = await createWorktreeForTicket(toWorktreeCoreDeps(deps), key, { [key]: branch }, options.worktrunkBinary, baseStartPoint, guardStaleWorktree, 
         // Hard-reset a reused existing local branch onto the freshly fetched
         // pushed head; a missing local branch is instead cut from `baseStartPoint`
         // (= `origin/<branch>`) inside the primitive, so both land at origin.
-        { freshenFromOrigin: originRef });
+        { freshenFromOrigin: policy.preparation ? expectedHeadSha : originRef, ...(preReset ? { preReset } : {}), ...(postSwitch ? { postSwitch } : {}) });
         if (row.status === "created" && typeof row.path === "string") {
-            return finalizeExecutorWorktree(row.path, branch, expectedHeadSha, deps);
+            return finalizeExecutorWorktree(row.path, branch, safeHead, deps, publication);
         }
-        return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
+        return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'`, ...(publication ? { publication } : {}) };
     }
     // BAPI-586 (fresh dispatch): a fresh implementation-style job must start from
     // the CURRENT remote base — never a stale local `main`, another local base
@@ -258,9 +334,10 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
     // gate lives HERE, not in the shared primitive, which learns no job types.
     const priorHeadSha = eligiblePriorHead(job, policy);
     if (priorHeadSha !== null) {
-        return ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, options, deps);
+        return ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, options, deps, postSwitch);
     }
     const row = await createWorktreeForTicket(toWorktreeCoreDeps(deps), key, { [key]: branch }, options.worktrunkBinary, baseSha, guardStaleWorktree, {
+        ...(postSwitch ? { postSwitch } : {}),
         alignExistingBranchTo: baseSha,
         verifyHeadMatches: baseSha,
         // BAPI-862: the guard is ON for this fresh-dispatch path, and this is the
@@ -306,7 +383,7 @@ function eligiblePriorHead(job, policy) {
  * without cleanup. The result says plainly whether prior uncommitted files could
  * survive.
  */
-async function ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, options, deps) {
+async function ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, options, deps, postSwitch) {
     const entries = await listGitWorktrees(deps.runCommand, deps.cwd);
     const retained = findWorktreeByBranch(entries, branch) !== undefined;
     const coreDeps = toWorktreeCoreDeps(deps);
@@ -315,7 +392,7 @@ async function ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, op
         // Recreation reads origin/<branch>; make sure that ref is current and proven.
         const fetch = await deps.runCommand("git", ["fetch", "origin", branch], { cwd: deps.cwd });
         if (!commandSucceeded(fetch)) {
-            const reason = (fetch.stderr || fetch.stdout || "").trim();
+            const reason = "";
             return {
                 ok: false,
                 error: `cannot resume prior-attempt work on '${branch}': git fetch origin ${branch} failed` +
@@ -330,7 +407,7 @@ async function ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, op
             };
         }
     }
-    const row = await createWorktreeForTicket(coreDeps, key, { [key]: branch }, options.worktrunkBinary, baseSha, true, { allowedPriorHead: policy });
+    const row = await createWorktreeForTicket(coreDeps, key, { [key]: branch }, options.worktrunkBinary, baseSha, true, { allowedPriorHead: policy, ...(postSwitch ? { postSwitch } : {}) });
     if (row.status !== "created" || typeof row.path !== "string") {
         return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
     }

package/build/first-build-advisory.js

@@ -0,0 +1,97 @@
+/** Import-safe read-only installer guidance; never launcher admission. */
+import { resolveAgentSpec } from "./agent-registry.js";
+import { getPreflightPrereqDescriptors, getDoctorOnlyPrereqDescriptors, probePrerequisite, formatGitCompatibilityDiagnostic, START_TICKETS_DOCTOR_COMMAND, } from "./start-tickets-prereqs.js";
+/** One ten-second budget across all tool probes, including unavailable runners. */
+export async function collectFirstBuildAdvisory(options, deps) {
+    const preflight = getPreflightPrereqDescriptors(deps.platform, deps.env);
+    const base = { platform: deps.platform, configuredHosts: options.configuredHosts, required: [], recommended: [] };
+    if (!preflight.ok)
+        return { ...base, status: "unsupported" };
+    if (options.decision.kind !== "spawn")
+        return { ...base, status: "manual" };
+    const agent = resolveAgentSpec(options.decision.agent);
+    if (!agent)
+        return { ...base, status: "manual" };
+    const now = deps.now ?? Date.now;
+    const deadline = now() + 10000;
+    const controller = new AbortController();
+    const allowed = new Set(["uv", agent.command, "ast-grep", "rg", "lizard", "git-compatibility"]);
+    const required = preflight.descriptors.filter((d) => d.id !== "git-work-tree");
+    const recommended = getDoctorOnlyPrereqDescriptors(deps.platform, deps.env, agent).filter((d) => allowed.has(d.id));
+    async function probe(descriptor) {
+        let uncertain = false;
+        const remaining = Math.max(0, deadline - now());
+        const scoped = { ...deps, runCommand: async (file, args, commandOptions) => {
+                const budget = Math.max(0, deadline - now());
+                if (controller.signal.aborted || budget === 0) {
+                    uncertain = true;
+                    throw new Error("probe unavailable");
+                }
+                try {
+                    const result = await deps.runCommand(file, args, {
+                        ...commandOptions, timeoutMs: Math.min(commandOptions?.timeoutMs ?? budget, budget), signal: controller.signal,
+                    });
+                    if (result.unavailable || controller.signal.aborted || now() >= deadline || result.exitCode > 1) {
+                        uncertain = true;
+                        throw new Error("probe unavailable");
+                    }
+                    return result;
+                }
+                catch {
+                    uncertain = true;
+                    throw new Error("probe unavailable");
+                }
+            } };
+        let timer;
+        const unavailable = async () => {
+            const result = await probePrerequisite({ ...scoped, runCommand: async () => { throw new Error("probe unavailable"); } }, descriptor);
+            return { ...result, detail: undefined, availability: "unknown" };
+        };
+        if (remaining === 0 || controller.signal.aborted)
+            return unavailable();
+        try {
+            const result = await Promise.race([
+                probePrerequisite(scoped, descriptor),
+                new Promise((resolve) => { timer = setTimeout(() => { controller.abort(); resolve(null); }, remaining); }),
+            ]);
+            if (!result)
+                return unavailable();
+            return { ...result, detail: undefined, availability: uncertain ? "unknown" : result.found ? "found" : "missing" };
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    const result = { ...base, status: "supported", agent: options.decision.agent, required: [], recommended: [] };
+    try {
+        for (const descriptor of required)
+            result.required.push(await probe(descriptor));
+        for (const descriptor of recommended)
+            result.recommended.push(await probe(descriptor));
+        return result;
+    }
+    finally {
+        controller.abort();
+    }
+}
+export function formatFirstBuildAdvisory(result) {
+    const lines = [`First-build prerequisites (${result.platform}${result.agent ? `; ${result.agent}` : ""})`];
+    if (result.status !== "supported")
+        lines.push(`${result.status}: continue manually in your configured host; launcher readiness was not checked.`);
+    else {
+        for (const [label, tools] of [["Required for launcher", result.required], ["Recommended diagnostics", result.recommended]]) {
+            lines.push(`${label}:`);
+            for (const tool of tools.filter((t) => t.id !== "git-compatibility")) {
+                lines.push(`  ${tool.label}: ${tool.availability}${tool.availability === "missing" ? ` — ${tool.installHint}` : ""}`);
+            }
+        }
+        const git = result.recommended.find((t) => t.id === "git-compatibility");
+        lines.push(git?.gitCompatibility ? formatGitCompatibilityDiagnostic(git.gitCompatibility) : "Git compatibility advisory: unknown");
+        lines.push("Git work-tree context is checked by the launcher at launch time. Recommendations and Git compatibility add no admission gate.");
+    }
+    if (result.configuredHosts.length > 1)
+        lines.push(`Other configured hosts: ${result.configuredHosts.join(", ")}; tool checks above apply only to the selected agent.`);
+    lines.push(`Read-only follow-up: ${START_TICKETS_DOCTOR_COMMAND}${result.agent ? ` --agent ${result.agent}` : ""}`);
+    return lines.join("\n");
+}

package/build/generated-assets-advisory.js

@@ -0,0 +1,14 @@
+import { packagedAssetRemedy } from "./generated-assets-remedy.js";
+export const RECOVERY_ADVISORY_META_KEY = "bridge-api/asset-recovery";
+export function assetRecoveryAdvisory(result, root, host, platform = process.platform) {
+    if (!result.confirmed || !host)
+        return null;
+    const missing = result.findings.filter(f => f.status === "missing");
+    if (!missing.length)
+        return null;
+    const paths = missing.slice(0, 5).map(f => f.destination);
+    const capabilities = [...new Set(missing.flatMap(f => f.workflows))].slice(0, 5);
+    const remedy = packagedAssetRemedy(root, host, undefined, platform);
+    return { host, missingCount: missing.length, paths, capabilities, command: remedy.command,
+        text: `Bridge ${host} workflow files are missing (${missing.length}; ${paths.join(", ")}${missing.length > 5 ? ", …" : ""}). Affected capabilities: ${capabilities.join(", ") || "packaged workflow documentation"}. ${remedy.command}\n${remedy.guidance}` };
+}

package/build/generated-assets-catalog.js

@@ -0,0 +1,66 @@
+import { COMMANDS } from "./commands.generated.js";
+import { AGENTS } from "./agents.generated.js";
+import { DOCS, DOC_METADATA } from "./docs.generated.js";
+import { renderCommandForHost } from "./command-host.js";
+import { codexSkillAssets } from "./codex-skill-adapter.js";
+import { reconstructAgentMarkdown, translateAgentToCopilot, translateCommandToCopilot } from "./agent-utils.js";
+export const WORKFLOW_HOSTS = ["claude", "cursor", "codex", "copilot"];
+/** Destination and rendered bytes have one owner, shared by all consumers. */
+export function buildPackagedAssetCatalog() {
+    const assets = [];
+    const packageProblems = [];
+    const destinations = new Set();
+    const add = (destination, content, kind, hosts, workflows, classification = "entrypoint") => {
+        if (destinations.has(destination) || !validAssetDestination(destination) || !content) {
+            packageProblems.push("invalid-or-conflicting-packaged-asset");
+            return;
+        }
+        destinations.add(destination);
+        assets.push({ id: destination, destination, content, kind, hosts, workflows, classification });
+    };
+    for (const [filename, content] of Object.entries(COMMANDS)) {
+        const workflow = filename.replace(/\.md$/, "");
+        try {
+            add(`.claude/commands/${filename}`, renderCommandForHost(filename, content, "claude-code"), "command", ["claude"], [workflow]);
+            add(`.cursor/commands/${filename}`, renderCommandForHost(filename, content, "cursor"), "command", ["cursor"], [workflow]);
+            const copilot = translateCommandToCopilot(filename, content);
+            add(`.github/prompts/${workflow}.prompt.md`, copilot.prompt, "prompt", ["copilot"], [workflow]);
+            add(`.github/skills/${workflow}/SKILL.md`, copilot.skill, "skill", ["copilot"], [workflow]);
+        }
+        catch {
+            packageProblems.push("command-render-failed");
+        }
+    }
+    try {
+        for (const asset of codexSkillAssets(COMMANDS)) {
+            add(asset.relativePath, asset.content, "skill", ["codex"], [asset.relativePath.split("/")[2]]);
+        }
+    }
+    catch {
+        packageProblems.push("skill-render-failed");
+    }
+    for (const [key, agent] of Object.entries(AGENTS)) {
+        try {
+            add(`.claude/agents/${key}.md`, reconstructAgentMarkdown(agent.frontmatter, agent.body), "agent", ["claude"], [key]);
+            add(`.github/agents/${key}.agent.md`, translateAgentToCopilot(agent.frontmatter, agent.body), "agent", ["copilot"], [key]);
+        }
+        catch {
+            packageProblems.push("agent-render-failed");
+        }
+    }
+    for (const [destination, content] of Object.entries(DOCS)) {
+        const metadata = DOC_METADATA[destination];
+        add(destination, content, "document", WORKFLOW_HOSTS, metadata?.workflows ?? [], metadata?.classification ?? "reference");
+    }
+    if (!Object.keys(COMMANDS).length || !Object.keys(AGENTS).length || !Object.keys(DOCS).length) {
+        packageProblems.push("empty-required-bundle");
+    }
+    return { assets, packageProblems: [...new Set(packageProblems)].slice(0, 20) };
+}
+/** A bounded POSIX-relative destination, valid on every supported platform. */
+export function validAssetDestination(value) {
+    if (typeof value !== "string" || !value || value.length > 512 || /[\x00-\x1f\x7f\\:<>"|?*]/.test(value))
+        return false;
+    return value.split("/").every(s => !!s && s !== "." && s !== ".." && !/[. ]$/.test(s)
+        && !/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/i.test(s));
+}

package/build/generated-assets-context.js

@@ -0,0 +1,46 @@
+import { createHash } from "node:crypto";
+import { validAssetDestination, WORKFLOW_HOSTS } from "./generated-assets-catalog.js";
+/** Secret-free association token; no absolute customer path is persisted. */
+export function assetRootBinding(canonicalRoot) {
+    return createHash("sha256").update(canonicalRoot).digest("hex");
+}
+export function validPackagedAssetInventory(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    if (v.version !== 1 || typeof v.rootBinding !== "string" || !/^[0-9a-f]{64}$/.test(v.rootBinding)
+        || typeof v.packageVersion !== "string" || !/^\d+\.\d+\.\d+(?:[-+][a-zA-Z0-9.-]+)?$/.test(v.packageVersion)
+        || !Array.isArray(v.assets) || v.assets.length > 1000)
+        return false;
+    const seen = new Set();
+    for (const a of v.assets) {
+        if (!a || !validAssetDestination(a.id) || !validAssetDestination(a.destination)
+            || !WORKFLOW_HOSTS.includes(a.host) || seen.has(`${a.host}:${a.id}`))
+            return false;
+        seen.add(`${a.host}:${a.id}`);
+    }
+    return true;
+}
+export function assetContextConfidence(context) {
+    if (!context.initialized || !context.host)
+        return { confirmed: false, reason: "unknown-initialized-host" };
+    if (!context.corroborated)
+        return { confirmed: false, reason: "uncorroborated-project" };
+    if (!validPackagedAssetInventory(context.inventory))
+        return { confirmed: false, reason: "missing-or-invalid-inventory" };
+    if (context.inventory.rootBinding !== assetRootBinding(context.root))
+        return { confirmed: false, reason: "root-binding-mismatch" };
+    if (!context.inventory.assets.some(a => a.host === context.host))
+        return { confirmed: false, reason: "unprovisioned-host" };
+    return { confirmed: true, reason: "root-bound-initialized-workflow" };
+}
+/** Explicit root+host selection authorizes current-catalog provisioning. An
+ * implicit selection must instead be bound to an exact-cwd inventory. */
+export function authorizeAssetRepair(root, hosts, explicitPair, inventory) {
+    if (!hosts.length || hosts.some(h => !WORKFLOW_HOSTS.includes(h)))
+        return false;
+    if (explicitPair)
+        return true;
+    return validPackagedAssetInventory(inventory) && inventory.rootBinding === assetRootBinding(root)
+        && hosts.every(host => inventory.assets.some(a => a.host === host));
+}

package/build/generated-assets-dependencies.js

@@ -0,0 +1,26 @@
+import { buildPackagedAssetCatalog } from "./generated-assets-catalog.js";
+import { inspectPackagedDependency } from "./generated-assets-health.js";
+import { assetFindingRemedy } from "./generated-assets-remedy.js";
+/** Used only by actual local-file consumers. Backend generation tools consume
+ * their bundled instructions, not customer slash-command files; they have no
+ * declared local packaged dependencies. Agent direct reads are covered in the
+ * narrowly scoped canonical command failure branches instead. */
+export async function checkPackagedAssetDependency(root, dependency, fs) {
+    const asset = buildPackagedAssetCatalog().assets.find(a => a.id === dependency.assetId && a.hosts.includes(dependency.host));
+    if (!asset)
+        return { error: "PACKAGED_DEPENDENCY_UNAVAILABLE", status: 409,
+            message: "Required dependency is unavailable in the invoking bundle.", dependency: "[unavailable catalog asset]",
+            operation: dependency.operation, remedy: "Rebuild or reinstall the package; no consumer file can be reconstructed from this bundle." };
+    const finding = await inspectPackagedDependency(root, asset, fs);
+    if (finding.status === "present")
+        return null;
+    return { error: finding.status === "missing" ? "WORKFLOW_ASSET_MISSING" : "WORKFLOW_ASSET_UNUSABLE", status: 409,
+        asset_status: finding.status, reason: finding.reason, message: "The requested operation requires an unavailable local workflow asset.",
+        dependency: asset.destination, operation: dependency.operation, remedy: assetFindingRemedy(finding, root, dependency.host, fs.platform) };
+}
+export function reviewedRewriteFailure(dependency, reason) {
+    return { error: "BAD_REQUEST", status: 400, code: reason === "missing" ? "REVIEWED_FILE_MISSING" : reason === "unsafe" ? "REVIEWED_FILE_UNSAFE" : "REVIEWED_FILE_UNREADABLE",
+        asset_status: reason, dependency, operation: "publish_reviewed_attachment",
+        message: "The agent-reviewed rewrite is unavailable for publication.",
+        remedy: "Recreate the rewrite from eligible source material, review it, and save the reviewed Markdown file before publishing. Canonical retrieval is source material only; it cannot reconstruct a reviewed rewrite. Do not rerun paid generation automatically." };
+}

package/build/generated-assets-doctor.js

@@ -0,0 +1,50 @@
+import { buildPackagedAssetCatalog } from "./generated-assets-catalog.js";
+import { inspectPackagedAssets, inspectPackagedDependency } from "./generated-assets-health.js";
+import { assetRootBinding } from "./generated-assets-context.js";
+import { readMcpInstallState } from "./mcp-install-state.js";
+import { assetFindingRemedy } from "./generated-assets-remedy.js";
+export async function collectPackagedAssetDoctor(deps) {
+    const lines = ["", "Packaged workflow assets (read-only advisory)"];
+    try {
+        const root = await deps.realpath(deps.cwd);
+        const state = await readMcpInstallState(root, deps);
+        const inventory = state.status === "valid" ? state.state.packagedAssets : undefined;
+        const catalog = buildPackagedAssetCatalog();
+        const health = await inspectPackagedAssets({ catalog, context: { root, host: null,
+                initialized: false, corroborated: false, inventory }, fs: deps });
+        lines.push(`Historical loss: indeterminate (${state.status === "valid" ? state.state.packagedAssetsStatus ?? health.reason : state.status}). Standalone doctor has no initialized host identity.`);
+        if (!inventory || inventory.rootBinding !== assetRootBinding(root)) {
+            lines.push(deps.platform === "linux" || (!deps.platform && process.platform === "linux")
+                ? "For explicit provisioning, select both --project-root and --host (claude, cursor, codex, copilot) with repair-assets; directory presence does not establish an installation."
+                : "In-place asset repair is not supported on this platform. Re-run start-tickets for worktrees or the existing Bridge --init/install workflow for project scaffolds; directory presence does not establish an installation.");
+            return lines.join("\n");
+        }
+        lines.push(`Invoking package ${health.invokingVersion}; recorded package ${inventory.packageVersion}.`);
+        const records = inventory.assets.slice(0, 1000);
+        const findings = [];
+        const deadline = Date.now() + 1000;
+        for (const record of records) {
+            if (Date.now() >= deadline) {
+                lines.push("Remaining inspection: indeterminate (time budget).");
+                break;
+            }
+            const asset = catalog.assets.find(a => a.id === record.id && a.destination === record.destination && a.hosts.includes(record.host));
+            if (!asset) {
+                lines.push("Package problem: recorded asset unavailable from invoking bundle.");
+                continue;
+            }
+            // Exact physical checks are observations, not claims about deletion history.
+            const result = await inspectPackagedDependency(root, asset, deps, deadline - Date.now());
+            findings.push(result);
+            if (result.status !== "present" && lines.length < 20) {
+                lines.push(`${record.host}: ${result.status} (${result.reason}) ${asset.destination}`);
+                lines.push(assetFindingRemedy(result, root, record.host, deps.platform));
+            }
+        }
+        lines.push(`Observed readable files: ${findings.filter(f => f.status === "present").length}; absent: ${findings.filter(f => f.status === "missing").length}; other unusable: ${findings.filter(f => f.status !== "present" && f.status !== "missing").length}.`);
+        return lines.join("\n");
+    }
+    catch {
+        return [...lines, "Inspection indeterminate: filesystem metadata or inventory unavailable."].join("\n");
+    }
+}

package/build/generated-assets-health.js

@@ -0,0 +1,65 @@
+import { VERSION } from "./version.generated.js";
+import { assetContextConfidence } from "./generated-assets-context.js";
+import { inspectAssetPath } from "./generated-assets-paths.js";
+export const MAX_ASSET_INSPECTIONS = 1000;
+/** Inspect only historically provisioned applicable assets; newer bundle entries
+ * are reported separately and never diagnosed as consumer loss. */
+export async function inspectPackagedAssets(options) {
+    const { catalog, context, fs } = options;
+    const confidence = assetContextConfidence(context);
+    const result = { ...confidence, findings: [],
+        packageProblems: catalog.packageProblems.slice(0, 20), newlyIntroduced: [], invokingVersion: VERSION,
+        recordedVersion: context.inventory?.packageVersion };
+    if (!confidence.confirmed || !context.inventory)
+        return result;
+    const applicable = catalog.assets.filter(a => a.hosts.includes(context.host));
+    const byId = new Map(applicable.map(a => [a.id, a]));
+    const recorded = context.inventory.assets.filter(a => a.host === context.host);
+    if (recorded.length > MAX_ASSET_INSPECTIONS)
+        return { ...result, confirmed: false, reason: "inspection-limit" };
+    const recordedIds = new Set(recorded.map(a => a.id));
+    result.newlyIntroduced = applicable.filter(a => !recordedIds.has(a.id)).map(a => a.destination).slice(0, MAX_ASSET_INSPECTIONS);
+    const deadline = Date.now() + Math.min(1000, Math.max(1, options.budgetMs ?? 1000));
+    // Bounded serial probing; no unbounded Promise fan-out.
+    for (const record of recorded) {
+        const asset = byId.get(record.id);
+        if (!asset || record.destination !== asset.destination) {
+            result.packageProblems.push("recorded-asset-unavailable-in-bundle");
+            continue;
+        }
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            return { ...result, confirmed: false, reason: "inspection-timeout" };
+        let timer;
+        try {
+            const finding = await Promise.race([
+                inspectPackagedDependency(context.root, asset, fs),
+                new Promise(resolve => { timer = setTimeout(() => resolve(null), remaining); }),
+            ]);
+            if (!finding)
+                return { ...result, confirmed: false, reason: "inspection-timeout" };
+            result.findings.push(finding);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    result.packageProblems = [...new Set(result.packageProblems)].slice(0, 20);
+    return result;
+}
+/** Fresh exact dependency inspection is independent of historical confidence. */
+export async function inspectPackagedDependency(root, asset, fs, budgetMs = 1000) {
+    let timer;
+    try {
+        const finding = await Promise.race([inspectAssetPath(root, asset.destination, fs),
+            new Promise(resolve => {
+                timer = setTimeout(() => resolve({ status: "indeterminate", reason: "metadata-timeout" }), Math.max(1, Math.min(1000, budgetMs)));
+            })]);
+        return { id: asset.id, destination: asset.destination, workflows: asset.workflows, ...finding };
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}

package/build/generated-assets-host.js

@@ -0,0 +1,17 @@
+import { WORKFLOW_HOSTS } from "./generated-assets-catalog.js";
+/** Exact identities with repository-owned handshake evidence. Cursor and
+ * Copilot VS Code remain unknown until an observed handshake is available.
+ * Copilot CLI evidence: learn-tool-gating.ts, CLI 1.0.71 probe (2026-08-26). */
+const IDENTITIES = {
+    "claude-code": "claude", codex: "codex", "github-copilot-developer": "copilot",
+};
+export function isWorkflowHost(value) {
+    return typeof value === "string" && WORKFLOW_HOSTS.includes(value);
+}
+export function resolveWorkflowHost(clientName, marker) {
+    const host = typeof clientName === "string" && Object.hasOwn(IDENTITIES, clientName) ? IDENTITIES[clientName] : null;
+    const marked = marker === "claude_code" ? "claude" : marker;
+    if (marked != null && (!isWorkflowHost(marked) || (host && host !== marked)))
+        return { host: null, reason: "conflicting-or-invalid-identity" };
+    return { host, reason: host ? "initialized-client" : "unknown-client" };
+}

package/build/generated-assets-inventory.js

@@ -0,0 +1,17 @@
+import { readFile, writeFile, mkdir, rename, unlink, realpath } from "node:fs/promises";
+import { assetRootBinding } from "./generated-assets-context.js";
+import { recordPackagedAssetInventory } from "./mcp-install-state.js";
+import { VERSION } from "./version.generated.js";
+/** Production scaffold seam. Repair deliberately never calls this writer. */
+export async function recordProvisionedAssets(root, assets, hosts) {
+    const canonicalRoot = await realpath(root);
+    const result = await recordPackagedAssetInventory(canonicalRoot, {
+        version: 1, packageVersion: VERSION, rootBinding: assetRootBinding(canonicalRoot),
+        assets: assets.flatMap(a => a.hosts.filter(h => hosts.includes(h)).map(host => ({ id: a.id, destination: a.destination, host }))),
+    }, {
+        readFile: p => readFile(p, "utf-8"), writeFile: (p, data) => writeFile(p, data, "utf-8"),
+        mkdir: async (p, options) => { await mkdir(p, options); }, rename, unlink,
+    });
+    if (!result.ok)
+        throw new Error("Packaged-asset inventory could not be safely recorded.");
+}