@bridge_gpt/mcp-server 0.2.67 → 0.2.69

package/build/repair-assets.js

@@ -0,0 +1,93 @@
+import { access, lstat, realpath, readFile } from "node:fs/promises";
+import { constants } from "node:fs";
+import os from "node:os";
+import { WORKFLOW_HOSTS, buildPackagedAssetCatalog } from "./generated-assets-catalog.js";
+import { authorizeAssetRepair, assetRootBinding } from "./generated-assets-context.js";
+import { validateAssetRoot } from "./generated-assets-paths.js";
+import { readMcpInstallState } from "./mcp-install-state.js";
+import { repairPackagedAssets } from "./generated-assets-repair.js";
+import { createConfinedAssetPublisher } from "./generated-assets-publisher.js";
+import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
+import { VERSION } from "./version.generated.js";
+export const REPAIR_ASSETS_HELP = `Usage: repair-assets [--project-root <directory>] [--host <claude|cursor|codex|copilot>]
+Fill missing packaged workflow files only; preserve existing customized files.
+Explicit --project-root plus --host authorizes provisioning without inventory.
+Implicit selection requires root-bound inventory at exact cwd; subdirectories must
+select --project-root. Never infer installed hosts from folders or selectedPlatforms.
+Reports restored/preserved/unreadable/failed files; incomplete repair exits 1.
+Linux procfs supports confined exclusive publication. Other platforms refuse writes
+when a confined adapter is unavailable. Existing readable files remain preserved.
+Excludes custom pipelines/instructions, registrations, credentials, generated outputs,
+onboarding, API setup, and Windsurf. Refresh/reconnect after repair, then run doctor.
+Unpinned npx -y ${MCP_PACKAGE_NAME} repair-assets intentionally selects the latest
+package; use @${VERSION} to repair from this running version.\n`;
+export async function runRepairAssetsCli(argv, options = {}) {
+    const log = options.log ?? (text => process.stdout.write(`${text}\n`));
+    const error = options.error ?? (text => process.stderr.write(`${text}\n`));
+    if (argv.length === 1 && (argv[0] === "--help" || argv[0] === "-h")) {
+        log(REPAIR_ASSETS_HELP);
+        return 0;
+    }
+    let requestedRoot;
+    const hosts = [];
+    for (let i = 0; i < argv.length; i++) {
+        const flag = argv[i];
+        const value = argv[++i];
+        if (!value || value.startsWith("--")) {
+            error("repair-assets: missing option value; use --help.");
+            return 1;
+        }
+        if (flag === "--project-root" && !requestedRoot)
+            requestedRoot = value;
+        else if (flag === "--host" && WORKFLOW_HOSTS.includes(value))
+            hosts.push(value);
+        else {
+            error("repair-assets: unknown, duplicate, or invalid option; use --help.");
+            return 1;
+        }
+    }
+    const fs = options.fs ?? { lstat, realpath, readFile: (p) => readFile(p, "utf-8"), access: (p) => access(p, constants.R_OK) };
+    const root = await validateAssetRoot(requestedRoot ?? options.cwd ?? process.cwd(), options.home ?? os.homedir(), fs);
+    if (!root) {
+        error("repair-assets: select an existing canonical project directory, excluding home and filesystem roots.");
+        return 1;
+    }
+    const state = await readMcpInstallState(root, fs);
+    const inventory = state.status === "valid" ? state.state.packagedAssets : undefined;
+    const explicitPair = requestedRoot !== undefined && hosts.length > 0;
+    const selected = [...new Set(hosts.length ? hosts : inventory?.assets.map(a => a.host) ?? [])];
+    if (!authorizeAssetRepair(root, selected, explicitPair, inventory)) {
+        error("repair-assets: installation context is uncertain. Supply both --project-root and --host for explicit provisioning.");
+        return 1;
+    }
+    log(`Selected project root: ${root}`);
+    log(`Invoking package: ${VERSION}; ${explicitPair ? "explicit fill-only provisioning" : "inventory-authorized repair"}.`);
+    const boundInventory = inventory?.rootBinding === assetRootBinding(root) ? inventory : undefined;
+    if (boundInventory)
+        log(`Recorded package: ${boundInventory.packageVersion}; invoking bundle may differ.`);
+    const catalog = buildPackagedAssetCatalog();
+    if (boundInventory) {
+        const historical = new Set(boundInventory.assets.map(a => a.id));
+        const introduced = catalog.assets.filter(a => a.hosts.some(h => selected.includes(h)) && !historical.has(a.id));
+        log(`Newly introduced catalog assets: ${introduced.length} (provisioning, not historical loss).`);
+    }
+    try {
+        const result = await (options.repair ?? repairPackagedAssets)({ root, hosts: selected, explicitPair, inventory: boundInventory, fs,
+            catalog, publisher: options.publisher ?? createConfinedAssetPublisher(options.platform) });
+        for (const status of ["restored", "preserved", "unreadable", "failed"]) {
+            const items = result.findings.filter(f => f.status === status);
+            log(`${status}: ${items.length}${items.length ? ` (${items.slice(0, 5).map(f => `${f.destination}: ${f.reason}`).join(", ")}${items.length > 5 ? ", …" : ""})` : ""}`);
+        }
+        if (result.packageProblems.length)
+            error(`Package problems: ${result.packageProblems.join(", ")}`);
+        if (result.cleanupFailures.length)
+            error("Some owned temporary files could not be removed. Inspect .bridge-repair-*.tmp in the reported asset parents; do not remove other files.");
+        if (!result.complete)
+            error("repair-assets: requested availability restoration is incomplete. Resolve reported permission/path/platform problems before retrying.");
+        return result.complete ? 0 : 1;
+    }
+    catch {
+        error("repair-assets: repair failed; no unsafe fallback was attempted.");
+        return 1;
+    }
+}

package/build/run-unit-tests-launcher.js

@@ -16,7 +16,8 @@
  * compiled module; the logic lives here (under src/, built by tsc) so it can
  * be unit-tested with node:test like every other module in this package.
  */
-import { readdirSync } from "fs";
+import { readdirSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync, renameSync, rmSync, existsSync } from "fs";
+import { tmpdir } from "os";
 import { spawnSync } from "child_process";
 import path from "path";
 const DEFAULT_BUILD_DIR = "build";
@@ -76,6 +77,7 @@ export const MODULE_MOCK_MANIFEST = [
     "build/connect-github.test.js",
     "build/council-submission.test.js",
     "build/council-wait-recovery.test.js",
+    "build/generated-assets-publisher.test.js",
     "build/index-artifacts.test.js",
     "build/index-council-filenames.test.js",
     "build/index-generate-decision-page.integration.test.js",
@@ -314,27 +316,31 @@ export function selectTestGroup(mode, discovered) {
  */
 export function partitionTestBatches(files, options = {}) {
     const { execPath = process.execPath, nodeOptions = [], maxLength = MAX_COMMAND_LENGTH } = options;
-    const prefixLength = [execPath, ...nodeOptions].join(" ").length;
+    const size = (batch, index) => {
+        const args = options.argumentBuilder?.(batch, index) ?? [...nodeOptions, ...batch];
+        // Quoted serialization conservatively includes spaces/backslashes/quotes on
+        // Windows; legacy callers without an argument builder keep their old budget.
+        return options.argumentBuilder
+            ? [execPath, ...args].map((arg) => JSON.stringify(arg)).join(" ").length
+            : [execPath, ...args].join(" ").length;
+    };
     const batches = [];
     let current = [];
-    let currentLength = prefixLength;
     for (const file of files) {
-        const addition = 1 + file.length; // separating space + path
-        if (prefixLength + addition > maxLength) {
-            throw new Error(`run-unit-tests: "${file}" alone exceeds the command-length budget ` +
-                `(${prefixLength + addition} > ${maxLength} chars) — cannot batch it safely`);
+        if (size([file], batches.length) > maxLength) {
+            throw new Error(`run-unit-tests: single file alone exceeds the command-length budget`);
         }
-        if (current.length > 0 && currentLength + addition > maxLength) {
+        if (current.length && size([...current, file], batches.length) > maxLength) {
             batches.push(current);
             current = [];
-            currentLength = prefixLength;
+            if (size([file], batches.length) > maxLength) {
+                throw new Error(`run-unit-tests: single file alone exceeds the command-length budget`);
+            }
         }
         current.push(file);
-        currentLength += addition;
     }
-    if (current.length > 0) {
+    if (current.length)
         batches.push(current);
-    }
     return batches;
 }
 /** Discovers, selects, batches, and spawns the requested test group; returns an aggregate exit code. */
@@ -355,30 +361,7 @@ export function runSelectedGroup(mode, options) {
     const batchable = selected.filter((file) => !quarantineSet.has(file));
     const quarantined = selected.filter((file) => quarantineSet.has(file));
     const extraFlags = mode === "module-mocks" ? ["--experimental-test-module-mocks"] : [];
-    const nodeOptions = [...extraFlags, "--test"];
-    const batches = partitionTestBatches(batchable, { execPath, nodeOptions });
-    log(`run-unit-tests: group="${mode}" files=${selected.length} batches=${batches.length}` +
-        (quarantined.length > 0 ? ` quarantined=${quarantined.length}` : ""));
-    let aggregateExit = 0;
-    const spawn = (args) => {
-        const result = spawnFn(execPath, args, {
-            cwd: root,
-            stdio: "inherit",
-            shell: false,
-        });
-        if ((result.status ?? 1) !== 0) {
-            aggregateExit = 1;
-        }
-    };
-    batches.forEach((batch, index) => {
-        log(`run-unit-tests: batch ${index + 1}/${batches.length} (${batch.length} file(s))`);
-        spawn([...nodeOptions, ...batch]);
-    });
-    quarantined.forEach((file, index) => {
-        log(`run-unit-tests: quarantined ${index + 1}/${quarantined.length} ${file} (single-file, --test-force-exit)`);
-        spawn([...nodeOptions, "--test-force-exit", file]);
-    });
-    return aggregateExit;
+    return runWithReports(mode, options, batchable, quarantined, [...extraFlags, "--test"], log);
 }
 /**
  * Returns the integration lane's file list: every compiled `*.test.js` under
@@ -420,20 +403,118 @@ export function runIntegrationLane(options) {
         throw new Error("run-integration-tests: discovered zero integration tests — refusing to run " +
             "(did you forget 'npm run build'?)");
     }
-    const nodeOptions = ["--test"];
-    const batches = partitionTestBatches(selected, { execPath, nodeOptions });
-    log(`run-integration-tests: files=${selected.length} batches=${batches.length}`);
+    return runWithReports("integration", options, selected, [], ["--test"], log);
+}
+/** Shared reporter argument builder: sizing and execution cannot diverge. */
+export function reporterArguments(nodeOptions, files, destination, forceExit = false) {
+    return [...nodeOptions, ...(forceExit ? ["--test-force-exit"] : []),
+        "--test-reporter=spec", "--test-reporter-destination=stdout",
+        "--test-reporter=junit", `--test-reporter-destination=${destination}`, ...files];
+}
+function runWithReports(group, options, ordinary, quarantined, nodeOptions, log) {
+    const { root, execPath = process.execPath, spawnFn = spawnSync } = options;
+    const retained = options.reportOutputDirectory !== undefined;
+    let directory;
     let aggregateExit = 0;
-    batches.forEach((batch, index) => {
-        log(`run-integration-tests: batch ${index + 1}/${batches.length} (${batch.length} file(s))`);
-        const result = spawnFn(execPath, [...nodeOptions, ...batch], {
-            cwd: root,
-            stdio: "inherit",
-            shell: false,
-        });
-        if ((result.status ?? 1) !== 0) {
-            aggregateExit = 1;
+    try {
+        if (retained) {
+            if (!options.reportOutputDirectory?.trim())
+                throw new Error("empty report directory");
+            directory = path.resolve(options.reportOutputDirectory);
+            // Exclusive allocation refuses stale reports and concurrent invocations.
+            mkdirSync(directory, { recursive: false });
         }
-    });
+        else {
+            directory = mkdtempSync(path.join(tmpdir(), "bridge-junit-"));
+        }
+        const outputDirectory = directory;
+        const reportName = (index) => `report-${index}.xml`;
+        const args = (files, index, forceExit = false) => reporterArguments(nodeOptions, files, path.join(outputDirectory, reportName(index)), forceExit);
+        // Source mapping comes from the build's actual rootDir/outDir, including
+        // authored scripts (which do not pass through tsc).
+        const config = JSON.parse(readFileSync(new URL("../tsconfig.json", import.meta.url), "utf8"));
+        const { rootDir, outDir } = config.compilerOptions;
+        if (rootDir !== "src" || outDir !== "build")
+            throw new Error("unsupported build source mapping");
+        const sourceFor = (file) => {
+            const posix = file.replaceAll("\\", "/");
+            if (posix.startsWith(`${outDir}/`) && posix.endsWith(".js")) {
+                return `mcp_server/${rootDir}/${posix.slice(outDir.length + 1, -3)}.ts`;
+            }
+            if (posix.startsWith("scripts/") && posix.endsWith(".js"))
+                return `mcp_server/${posix}`;
+            throw new Error("unmapped test source");
+        };
+        // Node 24.16 discovery confirmed explicit testcase file attribution.
+        // Older local/scheduled runtimes use one source per invocation, so the
+        // inventory provides an unambiguous fallback without adding concurrency.
+        const [major, minor] = process.versions.node.split(".").map(Number);
+        const explicitAttribution = major > 24 || (major === 24 && minor >= 16);
+        const batches = explicitAttribution
+            ? partitionTestBatches(ordinary, { execPath, nodeOptions, argumentBuilder: args })
+            : ordinary.map((file, index) => {
+                partitionTestBatches([file], { execPath, argumentBuilder: (files) => args(files, index) });
+                return [file];
+            });
+        const plans = [];
+        const addPlan = (files, forceExit) => {
+            const index = plans.length;
+            partitionTestBatches(files, { execPath, argumentBuilder: (values) => args(values, index, forceExit) });
+            const sources = Object.fromEntries(files.map((file) => [`mcp_server/${file}`, sourceFor(file)]));
+            // integrationSuite declares skipped suites inside the shared harness;
+            // Node attributes those cases to the wrapper, rather than its caller.
+            // Map that real declaration source using the same verified build config.
+            // Older runtimes still need exactly one entry for invocation attribution.
+            const harness = `${outDir}/integration/harness.js`;
+            if (group === "integration" && explicitAttribution &&
+                existsSync(path.join(root, harness)) &&
+                existsSync(path.join(root, rootDir, "integration/harness.ts"))) {
+                sources[`mcp_server/${harness}`] = sourceFor(harness);
+            }
+            plans.push({ report: reportName(index), files, forceExit, state: "planned", status: null,
+                sources });
+        };
+        batches.forEach((batch) => addPlan(batch, false));
+        quarantined.forEach((file) => addPlan([file], true));
+        const inventory = { version: 1, lane: group === "integration" ? "integration" : "unit", group,
+            nodeVersion: process.version, attribution: explicitAttribution ? "reporter-file" : "single-source", spawns: plans };
+        const publish = () => {
+            const temporary = path.join(outputDirectory, "inventory.json.tmp");
+            writeFileSync(temporary, JSON.stringify(inventory, null, 2));
+            renameSync(temporary, path.join(outputDirectory, "inventory.json"));
+        };
+        publish(); // Complete expected inventory is durable before the first spawn.
+        log(`run-unit-tests: group="${group}" files=${ordinary.length + quarantined.length} batches=${plans.length}`);
+        for (const [index, plan] of plans.entries()) {
+            plan.state = "started";
+            publish();
+            try {
+                const result = spawnFn(execPath, args(plan.files, index, plan.forceExit), { cwd: root, stdio: "inherit", shell: false });
+                plan.status = result.status;
+                plan.state = result.status === null || !existsSync(path.join(outputDirectory, plan.report)) ? "failed" : "completed";
+            }
+            catch {
+                plan.state = "failed";
+            }
+            if (plan.state !== "completed" || plan.status !== 0)
+                aggregateExit = 1;
+            publish();
+        }
+    }
+    catch {
+        // No exception/environment dump reaches CI logs or exported evidence.
+        log("run-unit-tests: report allocation, inventory publication, or execution failed");
+        aggregateExit = 1;
+    }
+    finally {
+        if (!retained && directory) {
+            try {
+                rmSync(directory, { recursive: true, force: true });
+            }
+            catch {
+                aggregateExit = 1;
+            }
+        }
+    }
     return aggregateExit;
 }

package/build/secret-redaction.js

@@ -0,0 +1,33 @@
+/** Shared leaf scrubber for durable untrusted text. */
+const REDACTED = "[REDACTED]";
+/**
+ * Patterns for values that must never reach durable state or a log line.
+ *
+ * Each rewrites only the secret itself and keeps the surrounding key or scheme, so a
+ * redacted record still shows *that* a credential was involved — useful for audit,
+ * and materially different from dropping the field.
+ */
+const SECRET_PATTERNS = [
+    // Bearer / token schemes in an Authorization header or bare.
+    [/\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{8,}/gi, `$1 ${REDACTED}`],
+    // authorization: <anything>
+    [/\b(authorization)\s*[:=]\s*\S+/gi, `$1: ${REDACTED}`],
+    // Well-known provider key shapes.
+    [/\b(sk|pk|rk)-[A-Za-z0-9_-]{16,}/g, REDACTED],
+    [/\bgh[pousr]_[A-Za-z0-9]{16,}/g, REDACTED],
+    // key/secret/password/token assignments in prose, env, JSON, or CLI form.
+    [
+        /\b([A-Za-z0-9_-]*(?:api[_-]?key|secret|password|passwd|token|credential)[A-Za-z0-9_-]*)\s*[:=]\s*("[^"]*"|'[^']*'|\S+)/gi,
+        `$1=${REDACTED}`,
+    ],
+    // Credentials embedded in a URL.
+    [/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]+:[^/\s@]+@/gi, `$1${REDACTED}@`],
+];
+/** Redact secret-bearing substrings while leaving safe technical text intact. */
+export function redactSecrets(value) {
+    let output = value;
+    for (const [pattern, replacement] of SECRET_PATTERNS) {
+        output = output.replace(pattern, replacement);
+    }
+    return output;
+}

package/build/session-upgrade-notice.js

@@ -0,0 +1,86 @@
+/**
+ * The single "should this session be told about an upgrade?" decision (BAPI-1446).
+ *
+ * Every notice surface asks here: the startup instructions, the first completed
+ * tool result, the Claude SessionStart hook, the `ping` advice, and the
+ * `start-tickets` reminder. One synchronous, non-throwing function holds every
+ * eligibility and silence rule, so the surfaces cannot drift apart.
+ *
+ * Nothing in this module touches the network or starts asynchronous work. The
+ * only I/O is the synchronous read of the local update cache.
+ */
+import { parseDefaultOnEnvFlag } from "./env-flags.js";
+import { isNewerVersion, isPlainReleaseVersion, readCachedLatestVersion, readFakeLatestOverride, } from "./update-check.js";
+import { formatSessionUpgradeNotice } from "./upgrade-advice.js";
+/** The kill switch for every update check and notice. Default on. */
+export const UPDATE_CHECK_ENABLED_ENV = "BAPI_MCP_UPDATE_CHECK_ENABLED";
+/** Worker markers: either one means no person is watching the session. */
+export const UNATTENDED_MARKER_ENVS = [
+    "BAPI_WORKER_BRANCH",
+    "BAPI_EPIC_IMPLEMENTER_WORKER_ID",
+];
+const SILENT = { show: false };
+/** True when either worker marker holds a non-empty string. */
+export function isUnattendedSession(env) {
+    return UNATTENDED_MARKER_ENVS.some((name) => {
+        const value = env[name];
+        return typeof value === "string" && value.trim().length > 0;
+    });
+}
+/**
+ * Decide whether to show the upgrade notice. Never throws and never starts
+ * asynchronous work.
+ *
+ * Silence comes first: a disabled kill switch, an unattended session, or an
+ * invalid current version returns `{ show: false }` before any latest-version
+ * source is read.
+ *
+ * Latest-version sources, in order:
+ *   1. a valid `BAPI_MCP_UPDATE_CHECK_FAKE_LATEST` override;
+ *   2. a reliable, known authoritative latest from a settled live check, which
+ *      stays authoritative even when it says "current" and an older cache
+ *      would suggest an update;
+ *   3. the local cache, when the authoritative source is absent, still in
+ *      flight, or failed.
+ *
+ * The cache ignores its own age on purpose. It is a lower bound: it can
+ * under-claim an update but never claims one that does not exist. Unknown,
+ * equal, older, or invalid versions are silent.
+ */
+export function getNoticeDecision(env, currentVersion, authoritativeLatest) {
+    try {
+        if (!parseDefaultOnEnvFlag(env[UPDATE_CHECK_ENABLED_ENV]))
+            return SILENT;
+        if (isUnattendedSession(env))
+            return SILENT;
+        if (!isPlainReleaseVersion(currentVersion))
+            return SILENT;
+        let latest = readFakeLatestOverride(env);
+        if (latest === null &&
+            authoritativeLatest &&
+            authoritativeLatest.known === true &&
+            isPlainReleaseVersion(authoritativeLatest.latest)) {
+            latest = authoritativeLatest.latest;
+        }
+        if (latest === null)
+            latest = readCachedLatestVersion(env);
+        if (!isPlainReleaseVersion(latest))
+            return SILENT;
+        if (!isNewerVersion(currentVersion, latest))
+            return SILENT;
+        return { show: true, current: currentVersion, latest };
+    }
+    catch {
+        return SILENT;
+    }
+}
+/**
+ * Append the session notice to the server's startup instructions when eligible.
+ * The base string is returned unchanged when the decision is silent.
+ */
+export function composeServerInstructions(baseInstructions, env, currentVersion) {
+    const decision = getNoticeDecision(env, currentVersion);
+    if (!decision.show)
+        return baseInstructions;
+    return `${baseInstructions} ${formatSessionUpgradeNotice(decision.current, decision.latest)}`;
+}

package/build/setup-epic.js

@@ -170,6 +170,7 @@ export const SETUP_EPIC_REVIEW_POLICY_SOURCES = [
     "verdict_protocol",
     "native_review_decision",
     "none",
+    "repository_policy",
 ];
 export function createDefaultSetupEpicDeps() {
     return {
@@ -260,6 +261,10 @@ export function getSetupEpicUsage() {
         "  --review-policy <src>  PER-RUN review policy source, one of:",
         `                         ${SETUP_EPIC_REVIEW_POLICY_SOURCES.join(", ")}.`,
         "                         Composed into policy_json.review_policy on create.",
+        "                         Omitted, setup-epic sends no review policy: the server",
+        "                         stamps repository_policy at first approval for a new",
+        "                         feature-branch run with no repository default. AI review",
+        "                         is an explicit opt-in (--review-policy verdict_protocol).",
         "                         This flag sets the policy for THIS run only and never",
         "                         changes a repository default. To persist one, pass",
         "                         --review-policy to `install-bridge conductor`, which",
@@ -1263,6 +1268,72 @@ export function policyDeclaresNotifyWebhook(policy) {
     const url = notify.webhook_url;
     return typeof url === "string" && url.trim() !== "";
 }
+/**
+ * BAPI-1397 (F1) — does this policy set `notify.local_sink` together with a
+ * `notify.webhook_url`?
+ *
+ * Mirrors the server's `NotifyPolicy._reject_local_sink_and_webhook_together`
+ * exactly, and nothing more: `local_sink: true` with a PRESENT, non-null
+ * `webhook_url` conflicts; `local_sink: true` with the URL absent or `null` is
+ * fine; `local_sink: false` (or absent) never conflicts. Every other policy rule
+ * stays the server's to judge. Checked locally so a policy the server would
+ * reject is refused before any plane starts or any request is sent.
+ */
+export function policyNotifyDestinationsConflict(policy) {
+    if (policy === undefined || policy === null)
+        return false;
+    const notify = policy.notify;
+    if (typeof notify !== "object" || notify === null || Array.isArray(notify))
+        return false;
+    const block = notify;
+    return block.local_sink === true && block.webhook_url !== undefined && block.webhook_url !== null;
+}
+/**
+ * Name the selected policy for a launch line or a refusal: its resolved path and
+ * source, or — for a stored or default policy that has no file — a deliberate
+ * no-file label. Only the path is named; the file's content never is.
+ */
+export function describeSelectedPolicy(policyPath, source) {
+    return policyPath !== undefined
+        ? `'${policyPath}' (${source} policy file)`
+        : `the ${source} run policy (no policy file)`;
+}
+/**
+ * The refusal for a policy whose notify destinations conflict. Names the file and
+ * the two keys only — never the webhook URL or any other policy content.
+ */
+export function notifyDestinationsConflictMessage(policyPath, source) {
+    return (`The run policy ${describeSelectedPolicy(policyPath, source)} sets notify.local_sink ` +
+        "together with notify.webhook_url. The server permits only one delivery destination, so " +
+        "it would reject this policy. Remove notify.local_sink or notify.webhook_url and re-run. " +
+        "No plane was started and no request was sent.");
+}
+/** Group-read and other-read permission bits. */
+const GROUP_OR_OTHER_READ_BITS = 0o044;
+/**
+ * BAPI-1397 (F1) — warn when a policy file that carries a `notify.webhook_url` is
+ * readable by other users. A warning only, never a refusal: the launch continues.
+ *
+ * Returns the warning text, or `null` when there is nothing to say — including
+ * when the file's mode cannot be read (a failed `stat` is silently skipped). The
+ * text names the path only; it never carries the URL, the policy body, or any
+ * filesystem error text.
+ */
+export async function worldReadableWebhookPolicyWarning(policyPath, policy, stat) {
+    if (!policyDeclaresNotifyWebhook(policy))
+        return null;
+    let mode;
+    try {
+        mode = (await stat(policyPath)).mode;
+    }
+    catch {
+        return null;
+    }
+    if (typeof mode !== "number" || (mode & GROUP_OR_OTHER_READ_BITS) === 0)
+        return null;
+    return (`[warn] Policy file '${policyPath}' holds a notify webhook URL and other users on this ` +
+        `machine can read it. Restrict it with: chmod 600 '${policyPath}'`);
+}
 export function evaluateSetupEpicUnattendedPrerequisites(readiness, requestedPolicy) {
     const unattended = readiness?.unattended ?? null;
     if (unattended === null) {
@@ -1974,6 +2045,21 @@ async function executeSetupEpic(argv, overrides, runIdSink, handoff) {
         return 1;
     }
     const localHash = hashPlan(plan);
+    // --- Notify destination conflict, explicit file (BAPI-1397, F1) ----------
+    // An explicit `--policy-file` is always the selected policy, so a conflict the
+    // server would reject is refused HERE — before credentials are resolved and
+    // before any request. A file that cannot be read or parsed is left to the
+    // policy read below, which reports it in its own words, unchanged.
+    const pinnedLaunchPolicy = handoff ? getPinnedEpicLaunchPolicy(handoff.selection) : undefined;
+    if (opts.policyFile !== undefined) {
+        const earlyPolicy = pinnedLaunchPolicy !== undefined
+            ? { ok: true, policy: pinnedLaunchPolicy }
+            : await readSetupEpicPolicyFile(opts.policyFile, deps.readFile);
+        if (earlyPolicy.ok && policyNotifyDestinationsConflict(earlyPolicy.policy)) {
+            deps.errorLog(notifyDestinationsConflictMessage(opts.policyFile, "explicit"));
+            return 1;
+        }
+    }
     // Resolve the selected target and live-run identity before choosing a policy.
     // The offline local-only path keeps its no-network contract.
     let access;
@@ -2092,8 +2178,12 @@ async function executeSetupEpic(argv, overrides, runIdSink, handoff) {
     const selectedPolicyPath = opts.policyFile ?? (existingRunId === null ? selectedProfilePolicyPath : undefined);
     const selectedPolicySource = existingRunId !== null
         ? "stored" : opts.policyFile !== undefined ? "explicit" : selectedProfilePolicyPath !== undefined ? "profile" : "default";
+    // BAPI-1397 (F1): the source NAMED next to a policy path in operator output. An
+    // explicit file is always "explicit" here, even when the effective-policy facts
+    // above report a reused run's policy as "stored".
+    const policyLabelSource = opts.policyFile !== undefined ? "explicit" : selectedPolicySource;
     if (selectedPolicyPath !== undefined) {
-        const pinned = handoff ? getPinnedEpicLaunchPolicy(handoff.selection) : undefined;
+        const pinned = pinnedLaunchPolicy;
         if (pinned !== undefined) {
             filePolicy = pinned;
         }
@@ -2105,6 +2195,17 @@ async function executeSetupEpic(argv, overrides, runIdSink, handoff) {
             }
             filePolicy = policyRead.policy;
         }
+        // BAPI-1397 (F1): the same server rule, for a profile-selected file. Still
+        // before any write or plane bring-up; the refusal names the resolved file.
+        if (policyNotifyDestinationsConflict(filePolicy)) {
+            deps.errorLog(notifyDestinationsConflictMessage(selectedPolicyPath, policyLabelSource));
+            return 1;
+        }
+        // BAPI-1397 (F1): a webhook URL in a file other users can read is a warning,
+        // never a refusal. Only the path is named.
+        const readableWarning = await worldReadableWebhookPolicyWarning(selectedPolicyPath, filePolicy, deps.stat);
+        if (readableWarning !== null)
+            deps.errorLog(readableWarning);
     }
     const policyDeclaresBranch = filePolicy !== undefined &&
         ["base_branch", "baseBranch"].some((key) => key in filePolicy && filePolicy[key] !== undefined && filePolicy[key] !== null);
@@ -2270,7 +2371,10 @@ async function executeSetupEpic(argv, overrides, runIdSink, handoff) {
                 "human-gated) — pass --attended to opt out"
             : "";
         const shape = inherited === "" ? "complete run policy" : "run policy";
-        say(`Policy:     ${opts.policyFile} (${shape}, applied at creation${inherited})`);
+        // BAPI-1397 (F1): the RESOLVED path and source — `opts.policyFile` is
+        // undefined for a profile-selected or composed policy.
+        say(`Policy:     ${describeSelectedPolicy(selectedPolicyPath, policyLabelSource)} ` +
+            `(${shape}, applied at creation${inherited})`);
     }
     if (effectiveFeatureBranch !== undefined && featureBranch === undefined) {
         say(`Feature:    ${effectiveFeatureBranch} (from the policy file; cut on origin with local ` +
@@ -2858,7 +2962,8 @@ async function executeSetupEpic(argv, overrides, runIdSink, handoff) {
                 // Re-sanitizing here would only destroy the field name that makes the
                 // server's field-named 422 actionable. The property is pinned by the
                 // regression test below rather than left to this comment.
-                deps.errorLog(`The run policy from '${opts.policyFile}' was rejected by the server.\n` +
+                deps.errorLog(`The run policy ${describeSelectedPolicy(selectedPolicyPath, policyLabelSource)} ` +
+                    `was rejected by the server.\n` +
                     `${errorDetail(err)}\n` +
                     `No run was created and no automation-start charge occurred. Fix the ` +
                     `named field in the policy file and re-run.`);