@bridge_gpt/mcp-server 0.2.67 → 0.2.69

package/build/executor/likely-tests.js

@@ -0,0 +1,290 @@
+/**
+ * Local, read-only discovery. Optional .bridge/verification-hints.json is
+ * {version:1,pins:[{paths:["exact/file", "directory/"],tests:["reference"]}]}.
+ * Exact paths match exactly; directory prefixes match at directory boundaries.
+ * Optional .conductor/recently-failed-tests.json is
+ * {version:1,tests:["most-recent-first reference"],truncated:false}.
+ * Child 3 writes recent failures under the worker worktree before each spawn.
+ * References are data only, never commands. Priority: recent failures, ordered
+ * pins, sorted inferred tracked tests; exact deduplication precedes the limit.
+ * Missing/malformed/unreadable/truncated sources degrade advisory coverage.
+ */
+import path from "node:path";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { execFile } from "node:child_process";
+export const RECENTLY_FAILED_TESTS_PATH = ".conductor/recently-failed-tests.json";
+export const RECENTLY_FAILED_TESTS_MAX_COUNT = 20;
+export const TEST_REFERENCE_MAX_LENGTH = 512;
+export const MAX_OUTPUT_REFERENCES = 100;
+export const MAX_SCAN_FILE_BYTES = 256 * 1024;
+export const MAX_SCAN_TOTAL_BYTES = 16 * 1024 * 1024;
+export const MAX_CANDIDATE_FILES = 10_000;
+export const MAX_OPTIONAL_JSON_BYTES = 256 * 1024;
+export const GIT_TIMEOUT_MS = 10_000;
+export const GIT_MAX_STDOUT_BYTES = 4 * 1024 * 1024;
+export const DISCOVERY_NOTES = {
+    invalid_arguments: "Likely-tests discovery unavailable: expected only --base and a full commit SHA.",
+    git_unavailable: "Likely-tests git discovery unavailable; retain available targeted verification.",
+    hints_missing: "Optional verification hints are absent.",
+    data_unavailable: "Optional discovery data is malformed or unreadable.",
+    skipped_entries: "Invalid discovery entries were skipped.",
+    scan_unavailable: "Some test candidates could not be read safely.",
+    truncated: "Likely-tests coverage is truncated by a resource bound.",
+    empty: "No likely tests discovered; retain targeted verification.",
+};
+export function isFullCommitSha(value) { return /^[a-fA-F0-9]{40}$/.test(value); }
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value : undefined;
+}
+export function validTestReference(value) {
+    return typeof value === "string" && value.trim().length > 0 &&
+        value.length <= TEST_REFERENCE_MAX_LENGTH && !/[\x00-\x1f\x7f-\x9f\u2028\u2029]/.test(value);
+}
+function validRepoPath(value, directory = false) {
+    const candidate = directory && value.endsWith("/") ? value.slice(0, -1) : value;
+    return !!candidate && !path.isAbsolute(candidate) && !/[:\\\x00-\x1f\x7f-\x9f\u2028\u2029]/.test(candidate) &&
+        candidate.split("/").every(p => p !== "" && p !== "." && p !== "..");
+}
+function validReference(value) {
+    if (!validTestReference(value))
+        return false;
+    const file = value.split("::")[0];
+    const fileShaped = value.includes("/") || /\.(?:py|[cm]?[jt]sx?)(?:::|$)/.test(value) || value.includes("::");
+    return !fileShaped || validRepoPath(file);
+}
+export function parseRecentlyFailedTests(value) {
+    const doc = object(value);
+    if (!doc || doc.version !== 1 || !Array.isArray(doc.tests) || typeof doc.truncated !== "boolean")
+        return { available: false };
+    const tests = [];
+    let skipped = false;
+    for (const test of doc.tests) {
+        if (!validReference(test)) {
+            skipped = true;
+            continue;
+        }
+        if (tests.length < RECENTLY_FAILED_TESTS_MAX_COUNT)
+            tests.push(test);
+    }
+    return { available: true, value: { version: 1, tests,
+            truncated: doc.truncated || doc.tests.length > RECENTLY_FAILED_TESTS_MAX_COUNT }, skipped };
+}
+function parseHints(value) {
+    const doc = object(value);
+    if (!doc || doc.version !== 1 || !Array.isArray(doc.pins))
+        return undefined;
+    const pins = [];
+    let skipped = false;
+    for (const entry of doc.pins) {
+        const pin = object(entry);
+        if (!pin || !Array.isArray(pin.paths) || !Array.isArray(pin.tests)) {
+            skipped = true;
+            continue;
+        }
+        const paths = pin.paths.filter((p) => typeof p === "string" && validRepoPath(p, true));
+        const tests = pin.tests.filter(validReference);
+        if (paths.length !== pin.paths.length || tests.length !== pin.tests.length)
+            skipped = true;
+        if (paths.length && tests.length)
+            pins.push({ paths, tests });
+        else
+            skipped = true;
+    }
+    return { pins, skipped };
+}
+/** No-follow and fstat protect the final component; lstat every ancestor first.
+ * Reads at most limit+1 bytes even if a file grows between stat and read.
+ */
+async function containedText(root, relative, limit) {
+    if (!validRepoPath(relative))
+        throw new Error("invalid_path");
+    let current = root;
+    for (const part of relative.split("/")) {
+        current = path.join(current, part);
+        const info = await lstat(current);
+        if (info.isSymbolicLink())
+            throw new Error("symlink");
+        if (current !== path.join(root, relative) && !info.isDirectory())
+            throw new Error("ancestor");
+    }
+    const handle = await open(current, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const info = await handle.stat();
+        if (!info.isFile())
+            throw new Error("not_regular");
+        if (info.size > limit)
+            throw new Error("bound");
+        const buffer = Buffer.alloc(limit + 1);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+        if (bytesRead > limit)
+            throw new Error("bound");
+        return buffer.subarray(0, bytesRead).toString("utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function boundedGit(cwd, argv) {
+    return new Promise((resolve, reject) => {
+        execFile("git", argv, { cwd, shell: false, timeout: GIT_TIMEOUT_MS,
+            maxBuffer: GIT_MAX_STDOUT_BYTES, encoding: "utf8" }, (error, stdout) => {
+            if (error)
+                reject(new Error("git_unavailable"));
+            else
+                resolve(stdout);
+        });
+    });
+}
+function nulPaths(output) {
+    if (output && !output.endsWith("\0"))
+        throw new Error("git_unavailable");
+    return output.split("\0").filter(Boolean);
+}
+const ordinal = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function testCandidate(file) {
+    const base = path.posix.basename(file);
+    return /^test_.*\.py$|^.*_test\.py$|\.(?:test|spec)\.[cm]?[jt]sx?$/.test(base);
+}
+/** Discover declared Python source roots without importing any project code. */
+async function pythonRoots(root, read) {
+    const roots = [""];
+    for (const file of ["pyproject.toml", "pytest.ini", "setup.cfg"]) {
+        try {
+            const text = await read(root, file, MAX_SCAN_FILE_BYTES);
+            for (const match of text.matchAll(/(?:pythonpath|package-dir|package_dir)\s*=\s*([^\n]+)/g)) {
+                for (const token of match[1].matchAll(/["']([^"']+)["']|\b([a-zA-Z][\w/-]*)\b/g)) {
+                    const value = token[1] ?? token[2];
+                    if (validRepoPath(value))
+                        roots.push(value + "/");
+                }
+            }
+        }
+        catch { /* absent runner declarations are normal */ }
+    }
+    return [...new Set(roots)];
+}
+export async function resolveLikelyTests(options) {
+    const references = [];
+    const diagnostics = new Set();
+    const add = (items) => {
+        for (const item of items)
+            if (!references.includes(item))
+                references.push(item);
+    };
+    const finish = () => {
+        if (references.length > MAX_OUTPUT_REFERENCES)
+            diagnostics.add("truncated");
+        if (!references.length)
+            diagnostics.add("empty");
+        return { references: references.slice(0, MAX_OUTPUT_REFERENCES), diagnostics: [...diagnostics] };
+    };
+    if (!isFullCommitSha(options.comparisonSha)) {
+        diagnostics.add("invalid_arguments");
+        return finish();
+    }
+    const git = options.git ?? boundedGit;
+    const read = options.readText ?? containedText;
+    let root;
+    try {
+        root = (await git(options.cwd, ["rev-parse", "--show-toplevel"])).trim();
+        if (!path.isAbsolute(root))
+            throw new Error("root");
+    }
+    catch {
+        diagnostics.add("git_unavailable");
+        return finish();
+    }
+    try {
+        const raw = await read(root, RECENTLY_FAILED_TESTS_PATH, MAX_OPTIONAL_JSON_BYTES);
+        const recent = parseRecentlyFailedTests(JSON.parse(raw));
+        if (!recent.available)
+            diagnostics.add("data_unavailable");
+        else {
+            add(recent.value.tests);
+            if (recent.skipped)
+                diagnostics.add("skipped_entries");
+            if (recent.value.truncated)
+                diagnostics.add("truncated");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            diagnostics.add("data_unavailable");
+    }
+    let hints;
+    try {
+        hints = parseHints(JSON.parse(await read(root, ".bridge/verification-hints.json", MAX_OPTIONAL_JSON_BYTES)));
+        if (!hints)
+            diagnostics.add("data_unavailable");
+        else if (hints.skipped)
+            diagnostics.add("skipped_entries");
+    }
+    catch (error) {
+        diagnostics.add(error.code === "ENOENT" ? "hints_missing" : "data_unavailable");
+    }
+    let changed;
+    try {
+        const verified = (await git(root, ["rev-parse", "--verify", `${options.comparisonSha}^{commit}`])).trim();
+        if (!isFullCommitSha(verified))
+            throw new Error("commit");
+        const paths = nulPaths(await git(root, ["diff", "--name-only", "-z", `${options.comparisonSha}..HEAD`]));
+        changed = paths.filter(p => validRepoPath(p));
+        if (changed.length !== paths.length)
+            diagnostics.add("skipped_entries");
+    }
+    catch {
+        diagnostics.add("git_unavailable");
+        return finish();
+    }
+    for (const pin of hints?.pins ?? []) {
+        if (pin.paths.some(p => changed.some(c => p.endsWith("/") ? c.startsWith(p) : c === p)))
+            add(pin.tests);
+    }
+    let tracked;
+    try {
+        const paths = nulPaths(await git(root, ["ls-files", "-z"]));
+        tracked = paths.filter(p => validRepoPath(p));
+        if (tracked.length !== paths.length)
+            diagnostics.add("skipped_entries");
+    }
+    catch {
+        diagnostics.add("git_unavailable");
+        return finish();
+    }
+    const candidates = tracked.filter(testCandidate).sort(ordinal);
+    if (candidates.length > MAX_CANDIDATE_FILES)
+        diagnostics.add("truncated");
+    const roots = await pythonRoots(root, read);
+    const literals = new Set(changed);
+    for (const file of changed) {
+        if (/\.[cm]?[jt]sx?$/.test(file)) {
+            literals.add(path.posix.basename(file));
+            literals.add(path.posix.basename(file).replace(/\.[cm]?[jt]sx?$/, ".js"));
+        }
+        if (file.endsWith(".py"))
+            for (const source of roots) {
+                if (file.startsWith(source))
+                    literals.add(file.slice(source.length, -3).replaceAll("/", ".").replace(/\.__init__$/, ""));
+            }
+    }
+    let scanned = 0;
+    for (const candidate of candidates.slice(0, MAX_CANDIDATE_FILES)) {
+        try {
+            const text = await read(root, candidate, MAX_SCAN_FILE_BYTES);
+            const size = Buffer.byteLength(text);
+            if (scanned + size > MAX_SCAN_TOTAL_BYTES) {
+                diagnostics.add("truncated");
+                break;
+            }
+            scanned += size;
+            if ([...literals].some(literal => literal && text.includes(literal)))
+                add([candidate]);
+        }
+        catch (error) {
+            diagnostics.add(error.message === "bound" ? "truncated" : "scan_unavailable");
+        }
+    }
+    return finish();
+}

package/build/executor/live-worker-registry.js

@@ -43,7 +43,7 @@ export function createLiveWorkerRegistry() {
             return;
         alreadyRequested.add(controller);
         try {
-            controller.requestTermination();
+            controller.requestTermination("executor_shutdown");
         }
         catch {
             // Fail-open, and deliberately silent. A controller that throws is a defect

package/build/executor/observation.js

@@ -1,3 +1,4 @@
+import { createWorkerDiagnosticsState } from "./worker-diagnostics.js";
 /**
  * Collect load-bearing git telemetry from a worktree. Individual git failures
  * degrade the telemetry (fields omitted) rather than throwing — a degraded
@@ -603,7 +604,10 @@ export const MAX_BUFFERED_ADVISORY_LINE_CHARS = 1_048_576;
  * on bad input, so ordinary success never depends on it either.
  */
 export function createObservationState(deps, options) {
+    const diagnostics = createWorkerDiagnosticsState();
     let git = {};
+    let publication;
+    let publicationInvalid = false;
     const advisory = {};
     let exitCode;
     let attemptStartSha;
@@ -681,6 +685,7 @@ export function createObservationState(deps, options) {
         }
     };
     const consumeLine = (line) => {
+        diagnostics.observeLine(line);
         if (options.advisoryParserEnabled)
             consumeAdvisoryLine(line);
         if (terminalCapacityParserEnabled)
@@ -689,8 +694,6 @@ export function createObservationState(deps, options) {
     return {
         recordStdout(chunk) {
             advisory.last_stdout_at = new Date(deps.now()).toISOString();
-            if (!options.advisoryParserEnabled && !terminalCapacityParserEnabled)
-                return;
             if (typeof chunk !== "string" || chunk.length === 0)
                 return;
             // BAPI-828: line assembly replaces the previous per-chunk `split("\n")`.
@@ -753,8 +756,34 @@ export function createObservationState(deps, options) {
         git() {
             return git;
         },
+        allocateAttemptLog(identity, allocated) {
+            diagnostics.allocateLog(identity, allocated);
+        },
+        workerDiagnostics() { return diagnostics.snapshot(); },
+        recordPublication(fact) {
+            if (publicationInvalid)
+                return;
+            const valid = (sha) => /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(sha);
+            if (!valid(fact.from_sha) || !valid(fact.to_sha) || fact.from_sha === fact.to_sha)
+                return;
+            if (!publication) {
+                publication = { ...fact };
+                return;
+            }
+            if (publication.jobId !== fact.jobId || publication.branch !== fact.branch ||
+                publication.to_sha !== fact.from_sha) {
+                publication = undefined;
+                publicationInvalid = true;
+                return;
+            }
+            publication = { ...publication, to_sha: fact.to_sha };
+        },
         snapshot() {
             const residue = { ...git };
+            if (publication) {
+                const observed = { from_sha: publication.from_sha, to_sha: publication.to_sha };
+                residue.published_head = observed;
+            }
             if (advisory.phase_hint)
                 residue.phase_hint = advisory.phase_hint;
             if (advisory.last_stdout_at)

package/build/executor/packaged-recipe.js

@@ -0,0 +1,106 @@
+/**
+ * Packaged-recipe delivery for executor workers (BAPI-1392).
+ *
+ * Command provisioning is fill-only (BAPI-664): a command file the customer
+ * already committed under `.claude/commands/` is a customer asset and is never
+ * refreshed, so a worker that resolves `/implement-ticket` itself would run a
+ * stale committed copy. This module supplies the CURRENT packaged recipe instead,
+ * by expanding it into the worker prompt before the adapter builds the launch.
+ *
+ * DELIVERY PATH: prompt expansion. Both prompt transports (`-p <prompt>` argv and
+ * the held-stdin stream-json first message) carry exactly the prompt the runner
+ * hands the adapter, so one expansion reaches both with no launcher-option
+ * dependence. Nothing is written under the worker worktree and no Git index flag
+ * is touched; the worktree's command files keep the bytes provisioning left.
+ *
+ * WHAT IS RECOGNIZED (and nothing else):
+ *   1. A LEADING invocation — the prompt's first token is `/<name>` — which is how
+ *      the synthesized `/implement-ticket <KEY> --auto` arrives. Its arguments are
+ *      everything after the name, exactly as the slash command would receive them
+ *      (so an appended PR-base instruction stays part of `$ARGUMENTS`). A BAPI-1367
+ *      continuation notice may precede it; the notice's own mention of the command
+ *      is never an invocation.
+ *   2. A NESTED invocation written as ``Run `/<name> <args>` `` — the shape the
+ *      server-built `spec_review` prompt uses for `/review-ticket`. The span is
+ *      replaced by a pointer and the recipe is appended once, below the prompt.
+ * Quoted ticket text, arbitrary slash-prefixed prose and a bare mention are left
+ * alone. A name is recognized only when `<name>.md` is a key of the packaged
+ * catalog, and never when the command is in the job's customized list (those keep
+ * the customer's committed copy). A prompt with no recognized invocation is
+ * returned byte-identical. Delivered recipes are NOT expanded recursively.
+ */
+import { COMMANDS } from "../commands.generated.js";
+/** Marker pair of the BAPI-1367 continuation notice (see `job-runner.ts`). */
+const CONTINUATION_NOTICE_START = "CONTINUATION: this is a retry.";
+const CONTINUATION_NOTICE_END = "The original instructions follow unchanged.\n\n";
+const NAME = "[a-z][a-z0-9-]*";
+const LEADING_RE = new RegExp(`^/(${NAME})(?=\\s|$)`);
+const NESTED_RE = new RegExp("\\bRun `/(" + NAME + ")(?: ([^`\\n]*))?`", "g");
+function isPackaged(name, catalog) {
+    return Object.prototype.hasOwnProperty.call(catalog, `${name}.md`);
+}
+/** Drop a leading `---` frontmatter block, as the slash-command loader does. */
+function stripFrontmatter(text) {
+    const match = /^---\r?\n[\s\S]*?\r?\n---\r?\n?/.exec(text);
+    return match ? text.slice(match[0].length) : text;
+}
+/** `$ARGUMENTS` substitution with a function replacer so `$&`-style bytes survive. */
+function renderRecipe(recipe, args) {
+    return stripFrontmatter(recipe).replace(/\$ARGUMENTS/g, () => args);
+}
+function undeliverable(reason, command) {
+    return {
+        ok: false,
+        reason,
+        command,
+        error: `packaged recipe for /${command} could not be delivered (reason=${reason})`,
+    };
+}
+export function resolvePackagedRecipes(prompt, customizedCommands, catalog = COMMANDS) {
+    const customized = new Set(customizedCommands);
+    const deliverable = (name) => isPackaged(name, catalog) && !customized.has(name);
+    // Offset of the "original instructions" after an optional continuation notice.
+    let offset = 0;
+    if (prompt.startsWith(CONTINUATION_NOTICE_START)) {
+        const end = prompt.indexOf(CONTINUATION_NOTICE_END);
+        if (end >= 0)
+            offset = end + CONTINUATION_NOTICE_END.length;
+    }
+    const head = prompt.slice(0, offset);
+    const body = prompt.slice(offset);
+    // 1. Leading invocation: the whole body becomes the recipe.
+    const leading = LEADING_RE.exec(body);
+    if (leading && deliverable(leading[1])) {
+        const name = leading[1];
+        const args = body.slice(leading[0].length).replace(/^\s+/, "");
+        const recipe = renderRecipe(catalog[`${name}.md`], args);
+        if (recipe.trim().length === 0)
+            return undeliverable("empty_recipe", name);
+        return { ok: true, prompt: `${head}${recipe}`, delivered: [name] };
+    }
+    // 2. Nested invocations: one appended block per command name.
+    const blocks = new Map(); // name -> args
+    for (const m of body.matchAll(NESTED_RE)) {
+        const name = m[1];
+        if (!deliverable(name))
+            continue;
+        const args = m[2] ?? "";
+        const seen = blocks.get(name);
+        if (seen !== undefined && seen !== args)
+            return undeliverable("conflicting_arguments", name);
+        blocks.set(name, args);
+    }
+    if (blocks.size === 0)
+        return { ok: true, prompt, delivered: [] };
+    const rewritten = body.replace(NESTED_RE, (whole, name, args) => blocks.has(name)
+        ? `Run the packaged /${name} recipe given below with arguments \`${args ?? ""}\``
+        : whole);
+    const appended = [];
+    for (const [name, args] of blocks) {
+        const recipe = renderRecipe(catalog[`${name}.md`], args);
+        if (recipe.trim().length === 0)
+            return undeliverable("empty_recipe", name);
+        appended.push(`\n\n=== PACKAGED RECIPE /${name} (arguments: ${args}) ===\n${recipe}\n=== END PACKAGED RECIPE /${name} ===`);
+    }
+    return { ok: true, prompt: `${head}${rewritten}${appended.join("")}`, delivered: [...blocks.keys()] };
+}

package/build/executor/permissions.js

@@ -36,7 +36,7 @@
  * fallback is available for CLIs where settings-deny is not enforced.
  */
 import path from "node:path";
-import { mergeClaudeSettingsWithCommandHook, provisionClaudeSettingsForWorktree, DEFAULT_PRE_TOOL_USE_MATCHER, } from "../claude-settings.js";
+import { mergeClaudeSettingsWithAutoMemoryDisabled, mergeClaudeSettingsWithCommandHook, provisionClaudeSettingsForWorktree, DEFAULT_PRE_TOOL_USE_MATCHER, } from "../claude-settings.js";
 /**
  * The stable executor deny rules. Grammar mirrors the deny-enforcement probe's
  * `Bash(<cmd>:<args-glob>)` / `Read(<path-glob>)` form. Covers: reads under
@@ -117,26 +117,96 @@ export function executorDenyRules(inputs) {
     ];
 }
 /**
- * Branch names that a BRANCH-SHAPED deny glob would match (BAPI-1020).
+ * The push commands a worker uses for its OWN branch (BAPI-1397, F7).
  *
- * Two of the fifteen new rules — `Bash(git push:* main*)` and
- * `Bash(git push:* epic/*)` — deny by branch shape rather than by command. If a
- * worker's OWN branch ever matched one, the static deny would block the push the
- * guard is required to allow, and AC-10 ("it still pushes its own branch") would
- * break at push time with an error naming a rule nobody connected to the branch
- * name. The hook cannot rescue it: a PreToolUse allow does not override a
- * settings-level deny.
- *
- * Today the collision is unreachable — worker branches come from `wt.branch`, the
- * Worktrunk `feature/<KEY>` branch, and `epic/<EPIC>` appears only as a merge base
- * — but nothing wrote that invariant down. This does, and it fails LOUDLY at
- * provisioning time rather than mysteriously at push time.
+ * These are the forms the worker instructions direct (`checkpoint-work.md`:
+ * `git push origin <branch>`; `commit-and-push.md`: `git push -u origin
+ * <branch>`) plus the bare upstream push, and every one is a form the PreToolUse
+ * worker guard allows for the job's own branch (`worker-guard-hook.ts`,
+ * `evaluateGitPush`).
  */
-export function workerBranchCollidesWithDenyGlob(branch) {
+export function workerOwnBranchPushCommands(branch) {
     const trimmed = branch.trim();
     if (trimmed.length === 0)
+        return [];
+    return [`git push origin ${trimmed}`, `git push -u origin ${trimmed}`, "git push"];
+}
+/**
+ * Does a Claude Code `Bash(...)` permission rule match `command`? (BAPI-1397, F7)
+ *
+ * Mirrors the rule grammar of the installed Claude Code (checked against 2.1.287):
+ *
+ *  - content ending in `:*` is a PREFIX rule — `Bash(git push:*)` matches
+ *    `git push` and anything after it;
+ *  - otherwise content with an unescaped `*` is a WILDCARD rule — the whole
+ *    command must match, with each `*` matching any text (a single trailing ` *`
+ *    also matches nothing at all). A `:*` in the MIDDLE is not special here: in
+ *    `Bash(git push:* epic/*)` the `:` is a literal character, so that rule
+ *    never matches `git push origin epic/X`;
+ *  - anything else is an EXACT rule.
+ *
+ * Non-`Bash` rules never match a command.
+ */
+export function claudeBashRuleMatchesCommand(rule, command) {
+    const ruleMatch = /^Bash\((.*)\)$/s.exec(rule.trim());
+    if (!ruleMatch)
         return false;
-    return trimmed === "main" || trimmed.startsWith("main") || trimmed.startsWith("epic/");
+    const content = ruleMatch[1].trim();
+    const cmd = command.trim();
+    const prefix = /^(.+):\*$/s.exec(content);
+    if (prefix) {
+        const head = prefix[1];
+        return cmd === head || cmd.startsWith(`${head} `);
+    }
+    let pattern = "";
+    let literal = "";
+    let stars = 0;
+    for (let i = 0; i < content.length; i += 1) {
+        const ch = content[i];
+        // `\*` is a literal star and `\\` a literal backslash, as in Claude Code.
+        if (ch === "\\" && (content[i + 1] === "*" || content[i + 1] === "\\")) {
+            pattern += `\\${content[i + 1]}`;
+            literal += content[i + 1];
+            i += 1;
+            continue;
+        }
+        if (ch === "*") {
+            pattern += ".*";
+            stars += 1;
+            continue;
+        }
+        pattern += ch.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+        literal += ch;
+    }
+    if (stars === 0)
+        return cmd === literal;
+    if (stars === 1 && pattern.endsWith(" .*"))
+        pattern = `${pattern.slice(0, -3)}( .*)?`;
+    return new RegExp(`^${pattern}$`, "s").test(cmd);
+}
+/**
+ * Would one of `denyRules` block the worker's OWN push? (BAPI-1397, F7)
+ *
+ * Replaces the BAPI-1020 branch-NAME check, which warned for any `main*` or
+ * `epic/` branch. That was wrong in practice: the correction worker's push to
+ * `epic/` succeeded despite the warning, because the provisioned
+ * `Bash(git push:* epic/*)` rule does not match the push command the worker
+ * actually runs. This builds those real push commands and tests them against the
+ * deny rules with Claude Code's own matching grammar, so it warns only when a
+ * rule really matches.
+ */
+export function workerOwnPushDeniedByRules(branch, denyRules) {
+    const commands = workerOwnBranchPushCommands(branch);
+    return denyRules.some((rule) => typeof rule === "string" &&
+        commands.some((command) => claudeBashRuleMatchesCommand(rule, command)));
+}
+/**
+ * Would the executor's OWN deny rules block this branch's push? Kept for callers
+ * of the BAPI-1020 name; it now asks the command-form question of
+ * {@link workerOwnPushDeniedByRules} against {@link executorDenyRules}.
+ */
+export function workerBranchCollidesWithDenyGlob(branch) {
+    return workerOwnPushDeniedByRules(branch, executorDenyRules({ baseBranch: "", worktreePath: "", homedir: "" }));
 }
 function asObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value)
@@ -363,8 +433,22 @@ export async function provisionExecutorDenyLayer(worktreePath, options, deps) {
         worktreePath,
         homedir: deps.homedir(),
     };
+    // BAPI-1397 (F7): the deny list the worktree will actually carry — the executor
+    // rules plus any operator-authored entries already in the file. Captured from
+    // the merge; when the merge never runs (a malformed file is left untouched) the
+    // executor's own rules stand in.
+    let effectiveDeny = executorDenyRules(inputs);
     const result = await provisionClaudeSettingsForWorktree(worktreePath, (existing) => {
         let merged = mergeExecutorDenySettings(existing, inputs);
+        const mergedDeny = merged.permissions?.deny;
+        if (Array.isArray(mergedDeny))
+            effectiveDeny = mergedDeny;
+        // BAPI-1397 (F6) — a worker session must never write the OWNER's Claude
+        // auto-memory. Merged through the same malformed-safe write as the deny
+        // rules, so a malformed settings file is still never clobbered and a
+        // re-provisioned worktree is unchanged. The job runner also sets the
+        // environment form at spawn, so a failed write here does not re-enable it.
+        merged = mergeClaudeSettingsWithAutoMemoryDisabled(merged);
         // BAPI-1020 — the worker guard is registered UNCONDITIONALLY, before and
         // independently of the conditional fallback below. PreToolUse hooks fire in
         // EVERY permission mode, bypass included, which is what makes the guard hold
@@ -380,14 +464,16 @@ export async function provisionExecutorDenyLayer(worktreePath, options, deps) {
     // may already exist from an earlier provisioning, so it runs even when the
     // merge-write was refused or failed.
     const exclude = await provisionWorktreeSettingsExclude(worktreePath, deps);
-    // BAPI-1020 — the branch-shaped-glob collision check. Advisory rather than
-    // blocking, matching this function's established fail-open posture: the worker
-    // can still do most of its job, and killing the spawn would trade a push failure
-    // for a total one. It is loud where it matters — the warning names the condition
-    // at PROVISIONING time, so an operator reads it before the push fails, instead of
-    // decoding a deny rule from a push error twenty minutes later.
+    // BAPI-1020 / BAPI-1397 (F7) — would a deny rule block the worker's own push?
+    // Advisory rather than blocking, matching this function's established
+    // fail-open posture: the worker can still do most of its job, and killing the
+    // spawn would trade a push failure for a total one. It is loud where it
+    // matters — at PROVISIONING time, before the push fails. Since BAPI-1397 it is
+    // decided by matching the worker's REAL push commands against the deny rules
+    // with Claude Code's grammar, not by the branch name's shape: an `epic/` branch
+    // alone no longer warns, because no provisioned rule matches its push.
     const collidingBranch = typeof options.workerBranch === "string" &&
-        workerBranchCollidesWithDenyGlob(options.workerBranch);
+        workerOwnPushDeniedByRules(options.workerBranch, effectiveDeny);
     // `blocking` and `advisory` are kept apart on purpose. A blocking warning
     // flips `ok` (the established contract, which existing callers and tests
     // read); an advisory one rides along on `ok: true` so a degraded-but-
@@ -403,11 +489,12 @@ export async function provisionExecutorDenyLayer(worktreePath, options, deps) {
         advisory.push(exclude.warning);
     if (collidingBranch) {
         // The branch NAME is not echoed: this text travels into worker logs, and the
-        // condition ("matches a branch-shaped deny glob") is the whole diagnostic.
-        advisory.push("the job branch matches a branch-shaped executor deny glob (git push to main/ or " +
-            "epic/); the worker's own push would be denied by settings permissions.deny, " +
-            "which the PreToolUse guard cannot override — re-cut the branch before relying " +
-            "on this worktree");
+        // condition ("a deny rule matches the worker's own push") is the whole
+        // diagnostic.
+        advisory.push("a settings permissions.deny rule matches the worker's own git push command for " +
+            "the job branch; the worker's own push would be denied by settings " +
+            "permissions.deny, which the PreToolUse guard cannot override — remove the rule " +
+            "or re-cut the branch before relying on this worktree");
     }
     if (blocking.length > 0) {
         return { ok: false, warning: [...blocking, ...advisory].join("; ") };

package/build/executor/platform.js

@@ -188,7 +188,7 @@ export function startExecutorSleepAssertion(deps) {
             if (releasing)
                 return;
             releasing = true;
-            controller.requestTermination();
+            controller.requestTermination("executor_abort");
             // Await the child so a caller that releases and then exits does not race the
             // teardown, and so `pmset -g assertions` is observably clean afterwards.
             await settled;