@bridge_gpt/mcp-server 0.2.68 → 0.2.69

package/build/install-bridge.js

@@ -67,9 +67,9 @@ import { collectFirstBuildAdvisory, formatFirstBuildAdvisory } from "./first-bui
  * (BAPI-606) redeems a pre-issued invite; `self-serve` (BAPI-618) mints one from an
  * email. Both then feed the SAME redemption protocol. Selection is pure and
  * deterministic from flags/env, except that a BARE interactive run is asked ONE
- * question (BAPI-626/708): `Welcome to Bridge - do you have a token yet?`, answered
- * `1` (yes) or `2` (no). Answering `2` is the self-serve route, which a first-time
- * user could not otherwise discover. Answering `1` opens a single hidden,
+ * question (BAPI-626/708/1448): `Email (or press Enter if you already have a
+ * token): `. A valid email is the self-serve route, which a first-time user could
+ * not otherwise discover. A blank answer opens a single hidden,
  * CREDENTIAL-AGNOSTIC token prompt and the route is then inferred from the pasted
  * value's SHAPE — the user is never asked to pre-classify their own credential,
  * because the shape checks below do that with no probe request. Either need-key
@@ -155,7 +155,7 @@ import { MCP_HOST_TARGETS, HOST_PLATFORM_ORDER, allHostTargets, agentForPlatform
 import { provisionHostTarget, createDefaultVendorProcessDeps, inspectBridgeApiProfileToken, } from "./mcp-host-config.js";
 import { adaptBridgeEntryForHostTarget, } from "./mcp-host-entry-adapter.js";
 import { MCP_SERVER_NAME, MCP_PACKAGE_NAME, resolveRegistrationKey, } from "./mcp-identity.js";
-import { DUPLICATE_REGISTRATION_GUIDANCE } from "./launcher-config-inspection.js";
+import { DUPLICATE_REGISTRATION_GUIDANCE, discoverClaudeCodeEffectivePin } from "./launcher-config-inspection.js";
 import { codexHome, configureBridgeCodexProfile, inspectBridgeCodexProfile } from "./codex-bridge-profile.js";
 import { recordInstalledConductorCapability, recordInstalledExecutorServiceUnit, recordInstalledProjectArtifact, writeMcpInstallState, } from "./mcp-install-state.js";
 // BAPI-1207: opt-in cross-platform agent notes (AGENTS.md / CLAUDE.md).
@@ -193,7 +193,7 @@ import { resolveStartTicketsRepoName } from "./start-tickets-repo.js";
 import { upsertBapiCredential, getPrimaryCredentialStorePath, prepareBootstrapPendingCredential, repointBootstrapPendingCredential, promoteBootstrapPendingCredential, lookupSelfServeBootstrapPendingCredential, prepareSelfServeBootstrapChallenge as prepareSelfServeBootstrapChallengeCredential, discardBootstrapPendingCredential, getBootstrapPendingTarget, resolveBapiCredentials, } from "./credential-store.js";
 // BAPI-631: the optional GitHub connect offer reuses the standalone command's flow and
 // API primitives verbatim — no duplicated polling, browser, or picker logic here.
-import { fetchGithubConfigurationState } from "./connect-github-api.js";
+import { fetchGithubConfigurationDetails, fetchGithubConfigurationState, } from "./connect-github-api.js";
 import { createDefaultConnectGithubDeps, runGithubConnectionFlow } from "./connect-github.js";
 import { fetchBitbucketConfigurationState } from "./connect-bitbucket-api.js";
 import { createDefaultConnectBitbucketDeps, runBitbucketConnectionFlow } from "./connect-bitbucket.js";
@@ -274,7 +274,7 @@ export const INSTALL_BRIDGE_AGENT_PROMPT = "Run /install-bridge now, with no arg
     "'Needs setup' — and each item in them carries display_name, description, how_to_use, and (in the " +
     "'Needs setup' section only) availability_text. Render each item's display_name, its description, " +
     "and its how_to_use verbatim when that value is a non-empty string; render availability_text " +
-    "verbatim as the setup guidance for a 'Needs setup' item, and show NO availability caveat, " +
+    "verbatim as the setup guidance for a 'Needs setup' item — except when that section carries a non-empty string heading: print it verbatim as the section's sub-heading instead of its name and print NO item's availability_text; with no usable heading, render each availability_text as usual — and show NO availability caveat, " +
     "asterisk, or footnote on an 'Available now' item. An item's `kind` ('tool' or 'workflow') is " +
     "contract metadata only — render both kinds identically, with no label, icon, or separate list, " +
     "and never branch on it. Keep an empty section visible with a short neutral line rather than " +
@@ -303,7 +303,7 @@ export const INSTALL_BRIDGE_AGENT_PROMPT = "Run /install-bridge now, with no arg
     "short, plain-language sentence covering what is happening and why it matters to the person running " +
     "this install, rather than in internal shorthand. Narration you compose yourself must never name an " +
     "internal stage number, this command's contract version, a raw internal MCP tool identifier (like " +
-    "get_install_manifest, apply_install_manifest, or invite_member), or a manifest field key (like " +
+    "get_install_manifest or apply_install_manifest), or a manifest field key (like " +
     "command_contract_version, next_step, or configured) — describe what is actually happening instead. " +
     "This restriction is scoped to narration you author: it does not apply to a user-invocable command " +
     "name you must give the human verbatim (/install-bridge, /learn-repository, connect-github, " +
@@ -317,11 +317,7 @@ export const INSTALL_BRIDGE_AGENT_PROMPT = "Run /install-bridge now, with no arg
     "duplicate. This silence applies ONLY to success and ONLY in the install-spawn context: a Stage 6 " +
     "FAILURE is still reported loudly and in full, and in JOIN MODE or a direct/manual /install-bridge " +
     "invocation Stage 6 reports its success exactly as it does today. " +
-    "The install-spawn skip set is exactly Stage 8 and Stage 9. The command-owned Stage 11 " +
-    "(invite teammates) is NOT in that skip set: it is independently gated and may run only when the " +
-    "caller's role is admin AND customer_type is b2b AND an interactive response is available; " +
-    "otherwise it is skipped silently. If Stage 11 mints a teammate key, show that plaintext key " +
-    "exactly once and never repeat it in any summary, retry, or diagnostic. " +
+    "The install-spawn skip set is exactly Stage 8 and Stage 9. " +
     "Do NOT ask any indexing question, call parse_repository, mention /parse-repository, or claim " +
     "indexing has started or is pending — indexing is decided entirely by the server-side readiness " +
     "funnel with no visibility from this session, so say nothing about it at all. " +
@@ -394,9 +390,8 @@ export function getInstallBridgeUsage(baseUrl = DEFAULT_BAPI_BASE_URL) {
         "the next step the server returned — when it returns one.",
         "If the project is already configured it instead",
         "joins you to it without proposing or applying any changes and just shows the",
-        "concise capability report plus that same conditional next step (a b2b admin is",
-        "additionally offered a teammate-invite",
-        "step). So not every run applies config fields. Indexing is never asked about —",
+        "concise capability report plus that same conditional next step.",
+        "So not every run applies config fields. Indexing is never asked about —",
         "it starts automatically once the repository reaches full parse readiness.",
         "",
         "Your API key is written to a project MCP config only when that file is safe: a",
@@ -406,17 +401,15 @@ export function getInstallBridgeUsage(baseUrl = DEFAULT_BAPI_BASE_URL) {
         "resolves your key from the credential store at runtime. A config file that",
         "cannot be parsed is left untouched, with manual-merge instructions printed.",
         "",
-        "Run it bare — `install` with no flags — in a terminal and it asks",
-        `\`${INSTALL_BRIDGE_KEY_SELECTOR_PROMPT}\` first, with two numbered choices:`,
-        ...INSTALL_BRIDGE_ONBOARDING_CHOICES.map((choice) => `  ${choice}`),
-        "There is NO default — pressing Enter selects nothing; you must type 1 or 2 (one",
-        "blank or invalid answer re-prompts once, then exits with guidance). Answering 1",
-        "prompts for an email and creates a brand-new Bridge workspace for you (the",
-        "self-serve flow). Answering 2 opens a single hidden token prompt: paste whatever",
-        "you were given and its SHAPE picks the route — a bootstrap invite (bapi_inv_…)",
-        "is redeemed to CREATE a new project and mint your first admin key, while a",
-        "Bridge API key connects to the project that already exists. You are",
-        "never asked which kind of token you hold. That question is asked ONLY for a",
+        "Run it bare — `install` with no flags — in a terminal and it asks one question:",
+        `\`${INSTALL_BRIDGE_EMAIL_OR_TOKEN_PROMPT.trim()}\``,
+        "Type your email to create a brand-new Bridge workspace for you (the self-serve",
+        "flow). Press Enter if you already have a token: a single hidden token prompt",
+        "opens, and whatever you paste has its SHAPE pick the route — a bootstrap invite",
+        "(bapi_inv_…) is redeemed to CREATE a new project and mint your first admin key,",
+        "while a Bridge API key connects to the project that already exists. One",
+        "malformed answer re-prompts once, then exits with guidance. You are",
+        "never asked which kind of token you hold. The question is asked ONLY for a",
         "bare interactive run: passing ANY flag, setting BAPI_API_KEY, or running without an interactive",
         "terminal keeps the existing deterministic behavior and no prompt.",
         "",
@@ -532,9 +525,11 @@ export function getInstallBridgeUsage(baseUrl = DEFAULT_BAPI_BASE_URL) {
         "                                --tools claude-code,codex are accepted. On an",
         "                                interactive terminal WITHOUT this flag you get a",
         "                                numbered picker: enter one or more tool numbers,",
-        "                                comma-separated (e.g. 1,3), and press Enter once —",
-        "                                no tool is pre-selected (not even Claude Code) and",
-        "                                you must select at least one. A non-interactive",
+        "                                comma-separated (e.g. 1,3), and press Enter once.",
+        "                                Tools Bridge detects on this machine are pre-ticked:",
+        "                                a bare Enter accepts them, and typed numbers",
+        "                                replace them. With none detected you must select",
+        "                                at least one. A non-interactive",
         "                                (non-TTY) run without",
         "                                --tools writes the legacy automatic set (Claude",
         "                                Code plus any detected Cursor / Copilot VS Code)",
@@ -563,6 +558,8 @@ export function getInstallBridgeUsage(baseUrl = DEFAULT_BAPI_BASE_URL) {
         "                                session — it always wins, and there is NO Claude",
         "                                default. Without it the launch tool is derived",
         "                                from your selection: Claude Code opens `claude`.",
+        "                                With more than one launchable tool selected, the",
+        "                                first one is used and no question is asked.",
         "                                Cursor is NOT auto-opened (its cursor-agent CLI",
         "                                first-run workspace-trust prompt collapses a spawned",
         "                                session); selecting Cursor writes .cursor/mcp.json",
@@ -1147,12 +1144,6 @@ export async function offerBitbucketConnection(repoName, baseUrl, deps, log, ses
             `Bitbucket later with 'npx -y ${MCP_PACKAGE_NAME}@latest connect-bitbucket --repo ${repoName}'.`);
     }
 }
-/**
- * The exact agent-notes consent-prompt prefix, shared with tests so the copy
- * cannot drift. Mirrors {@link INSTALL_BRIDGE_LAUNCH_CONSENT_PROMPT_PREFIX}: the
- * prefix is pinned, the platform tail varies with the selection.
- */
-export const INSTALL_BRIDGE_AGENT_NOTES_PROMPT_PREFIX = "Write guidance so ";
 /**
  * Describe the selected notes platforms for the offer copy: a naturally joined
  * subject and whether it is plural (so a verb can agree). `platformLabels` are
@@ -1175,68 +1166,30 @@ function joinLabelsWithAnd(labels) {
     return `${labels.slice(0, -1).join(", ")}, and ${labels[labels.length - 1]}`;
 }
 /**
- * The default-Yes agent-notes consent prompt (BAPI-1435; payoff-led, platform-named
- * copy per the BAPI-1239 install-issue #4 follow-up). Leads with WHY — teaching
- * the agent how to use Bridge's MCP tools — and NAMES the selected platform(s)
- * rather than the old generic "cross-platform" phrasing.
- */
-export function buildAgentNotesPrompt(platformLabels) {
-    const { subject, plural } = describeAgentNotesPlatforms(platformLabels);
-    return `${INSTALL_BRIDGE_AGENT_NOTES_PROMPT_PREFIX}${subject} know${plural ? "" : "s"} how to use the Bridge MCP? Enter adds guidance for ${subject}. [Y/n]: `;
-}
-/**
- * The offer-context lines printed immediately before the agent-notes prompt
- * (BAPI-1207). Leads with the payoff — teaching the named platform(s) WHEN to
- * reach for Bridge's MCP tools — then states the marker-scoped, non-destructive
- * contract as a secondary line, mirroring the GitHub/Bitbucket offers' "explain
- * before asking" convention.
- */
-export function buildAgentNotesOfferContext(targets, platformLabels) {
-    const { subject, plural } = describeAgentNotesPlatforms(platformLabels);
-    return [
-        "",
-        `Step 4c — optional: Bridge MCP guidance for ${subject}.`,
-        `  Write guidance so ${subject} know${plural ? "" : "s"} when to reach for Bridge's MCP tools`,
-        "  during a task — for project standards, a second opinion, a council, or a ticket review.",
-        `  It writes a Bridge-owned region to ${targets.join(" and ")}; only that marked region is`,
-        "  created or refreshed — any existing content, inside or outside it, is otherwise preserved.",
-    ];
-}
-function agentGuidancePromptConsents(result) {
-    if (result?.kind !== "answer" || typeof result.value !== "string")
-        return false;
-    const value = result.value.trim().toLowerCase();
-    return value === "" || value === "y" || value === "yes";
-}
-/**
- * Offer to create or refresh the cross-platform agent notes, if the selected
- * platforms resolve to at least one writable target (BAPI-1207).
+ * Decide whether to create or refresh the cross-platform agent notes, if the
+ * selected platforms resolve to at least one writable target (BAPI-1207).
  *
- * Entirely best-effort and non-destructive, mirroring
- * {@link offerGithubConnection}: by the time this runs the install itself is
- * already complete and durable, so nothing here may fail the run. This
- * function only resolves the CONSENT decision — the caller performs the
- * actual write via {@link writeAgentNotes}, so a `--dry-run` (which never
- * reaches this call) and the live path share exactly one write path.
+ * BAPI-1448: an interactive run consents by default — the question is gone, with
+ * the product sign-off recorded in the install notes. The write is still bounded to
+ * Bridge's marked region (see {@link writeAgentNotes}) and reported afterwards with
+ * a removal hint. A non-interactive run keeps `headless-skip`: it never writes
+ * guidance on its own.
+ *
+ * Entirely best-effort and non-destructive: by the time this runs the install
+ * itself is already complete and durable, so nothing here may fail the run. This
+ * function only resolves the CONSENT decision — the caller performs the actual
+ * write via {@link writeAgentNotes}, so a `--dry-run` (which never reaches this
+ * call) and the live path share exactly one write path.
  */
-export async function offerAgentGuidanceNotes(deps, log, targets, platformLabels) {
+export function offerAgentGuidanceNotes(deps, targets) {
     if (targets.length === 0)
         return { kind: "not-applicable" };
-    // No prompt surface → no offer. Never assume consent on a non-interactive run.
-    if (!deps.isTTY || !deps.promptGuidanceLine)
+    if (!deps.isTTY)
         return { kind: "headless-skip" };
-    try {
-        for (const line of buildAgentNotesOfferContext(targets, platformLabels))
-            log(line);
-        const answer = await deps.promptGuidanceLine(buildAgentNotesPrompt(platformLabels));
-        return agentGuidancePromptConsents(answer) ? { kind: "consented" } : { kind: "declined" };
-    }
-    catch {
-        // The install is already durable; a failure here is never fatal to it.
-        deps.errorLog("Agent guidance skipped: the prompt could not be read; no guidance files were changed.");
-        return { kind: "prompt-error" };
-    }
+    return { kind: "consented" };
 }
+/** The one-line removal hint printed after guidance was actually written (BAPI-1448). */
+export const INSTALL_BRIDGE_AGENT_NOTES_REMOVAL_HINT = "To remove it, delete the lines from <!-- BEGIN BRIDGE MCP GUIDANCE --> to <!-- END BRIDGE MCP GUIDANCE -->.";
 /**
  * One secret-free summary line for the final install output (BAPI-1207). Never
  * reveals guidance content, file bytes, or a credential — only which files
@@ -1273,6 +1226,47 @@ export function buildAgentNotesSummaryLine(offer, result, writeFailed, unsupport
         parts.push(`failed for ${failed.join(", ")}`);
     return `Agent notes: ${parts.join("; ")}${unsupportedNote}.`;
 }
+const OPTIMIZATION_POSTURE_SUMMARY_LABELS = {
+    quality: "Quality",
+    speed: "Speed",
+    maximize_subscription: "Token Efficiency",
+};
+/**
+ * The aligned "defaults Bridge chose" block printed once, right before the launch
+ * consent question. Pure: it formats what the run already knows and performs no I/O.
+ *
+ * Layout: a header, then two rows of two cells. Both rows are indented two spaces and
+ * the left cells are padded to the longer left cell plus three spaces, so the right
+ * cells line up. The Ticket keys cell is omitted entirely when the server supplied no
+ * valid prefix; the prefix is printed as given and never derived locally.
+ */
+export function buildInstallBridgeDefaultsSummary(input) {
+    const optimization = input.persistedPosture
+        ? OPTIMIZATION_POSTURE_SUMMARY_LABELS[input.persistedPosture]
+        : input.isNewProject
+            ? "Quality"
+            : "unchanged";
+    const guidanceLabel = input.claudeCodeSelected ? "Claude Code guidance" : "Agent guidance";
+    const guidanceValue = input.guidance.written.length > 0
+        ? `added to ${input.guidance.written.join(", ")}`
+        : input.guidance.unchanged.length > 0
+            ? "already up to date"
+            : "not written";
+    const leftTop = `Project name: ${input.displayName}`;
+    const leftBottom = `Optimization: ${optimization}`;
+    const rightTop = input.ticketPrefix
+        ? `Ticket keys: ${input.ticketPrefix}-1, ${input.ticketPrefix}-2, …`
+        : undefined;
+    const rightBottom = `${guidanceLabel}: ${guidanceValue}`;
+    const width = Math.max(leftTop.length, leftBottom.length) + 3;
+    const rowTop = rightTop === undefined ? `  ${leftTop}` : `  ${leftTop.padEnd(width)}${rightTop}`;
+    const rowBottom = `  ${leftBottom.padEnd(width)}${rightBottom}`;
+    return [
+        "Bridge chose these defaults — change them later on the Setup page, or ask your agent:",
+        rowTop,
+        rowBottom,
+    ].join("\n");
+}
 /**
  * Echoed single-line prompt on stderr (used for repo confirmation / value).
  * Exported so `index.ts`'s `--init` can share the exact same prompt mechanics
@@ -1296,56 +1290,6 @@ export function promptLineViaReadline(promptText, input = process.stdin, output
         });
     });
 }
-/** Observe CR/LF before readline, counting split CRLF as one submission. */
-export function promptGuidanceLineViaReadline(promptText, input = process.stdin, output = process.stderr) {
-    return new Promise((resolve) => {
-        const readable = input;
-        if (readable.readableEnded || readable.destroyed) {
-            resolve({ kind: "eof" });
-            return;
-        }
-        let terminators = 0;
-        let previousCR = false;
-        let settled = false;
-        let rl;
-        const observe = (chunk) => {
-            for (const char of chunk.toString()) {
-                if (char === "\r")
-                    terminators++;
-                else if (char === "\n" && !previousCR)
-                    terminators++;
-                previousCR = char === "\r";
-            }
-        };
-        const finish = (result) => {
-            if (settled)
-                return;
-            settled = true;
-            input.removeListener("data", observe);
-            input.removeListener("end", eof);
-            input.removeListener("close", eof);
-            input.removeListener("error", eof);
-            rl?.removeListener("close", eof);
-            rl?.close();
-            resolve(result);
-        };
-        const eof = () => finish({ kind: "eof" });
-        input.prependListener("data", observe);
-        input.once("end", eof);
-        input.once("close", eof);
-        input.once("error", eof);
-        rl = readline.createInterface({ input, output });
-        rl.once("close", eof);
-        if (settled || readable.readableEnded || readable.destroyed) {
-            rl.close();
-            eof();
-            return;
-        }
-        rl.question(promptText, (value) => {
-            finish(terminators > 0 ? { kind: "answer", value } : { kind: "eof" });
-        });
-    });
-}
 /**
  * Default pre-warm spawner (BAPI-451 W3). Spawns array-based (`shell: false`) so
  * no argument is ever shell-interpreted, ignores all child stdio (node-gyp /
@@ -1461,8 +1405,9 @@ export function createDefaultInstallBridgeDeps() {
         randomBytes: (size) => cryptoRandomBytes(size),
         promptSecret: isTTY ? promptSecretViaReadline : undefined,
         promptLine: isTTY ? promptLineViaReadline : undefined,
-        promptGuidanceLine: isTTY ? promptGuidanceLineViaReadline : undefined,
-        promptMultiSelect: isTTY ? promptMultiSelectViaReadline : undefined,
+        promptMultiSelect: isTTY
+            ? (promptText, options, preselected) => promptMultiSelectViaReadline(promptText, options, process.stdin, process.stderr, preselected)
+            : undefined,
         vendor: createDefaultVendorProcessDeps(spawn),
         fetch: productionFetch,
         resolveRepoViaServer: (baseUrl, apiKey) => resolveRepoViaServer(productionFetch, baseUrl, apiKey),
@@ -2148,7 +2093,7 @@ export function buildInstallBridgeMaintenanceHint() {
         "Persistent host registrations remain pinned until an explicit upgrade; the editor may need to reconnect to use the new server.",
     ];
 }
-export async function resolveSignupEmail(options, deps, baseUrl = DEFAULT_BAPI_BASE_URL) {
+export async function resolveSignupEmail(options, deps, baseUrl = DEFAULT_BAPI_BASE_URL, onboarding) {
     // BAPI-757 (R-3 / AC-9): self-serve signup now REQUIRES an interactive terminal,
     // and the check runs FIRST — before `--email` and before `BAPI_SIGNUP_EMAIL` —
     // so an unattended run fails before any request is made, no verification email
@@ -2159,6 +2104,13 @@ export async function resolveSignupEmail(options, deps, baseUrl = DEFAULT_BAPI_B
     if (!deps.isTTY || !deps.promptLine) {
         return { ok: false, error: INSTALL_BRIDGE_SIGNUP_REQUIRES_TTY };
     }
+    // BAPI-1448: an email already answered at the merged entry prompt is consumed the
+    // way `--email` is, with no second question and no second privacy notice.
+    if (onboarding) {
+        if (!onboarding.privacyNoticeShown)
+            deps.log(buildInstallBridgeSignupPrivacyNotice(baseUrl));
+        return { ok: true, value: onboarding.email };
+    }
     deps.log(buildInstallBridgeSignupPrivacyNotice(baseUrl));
     if (typeof options.email === "string" && options.email.trim().length > 0) {
         return { ok: true, value: options.email.trim() };
@@ -2222,49 +2174,24 @@ export function resolveInstallBridgeOnboardingBranch(options, env) {
     return { kind: "have-key" };
 }
 /**
- * The bare-TTY onboarding question (BAPI-708, Part A), replacing the BAPI-667/687
- * three-option chooser.
- *
- * The three-option form asked the user to make a distinction the CODE can already
- * make for itself: whether the string in their clipboard is an invite or an API
- * key. `classifyEnteredCredential` + `isHighEntropyApiKeyShape` decide that from
- * SHAPE alone, with no probe request — so the only thing a first-time user
- * genuinely knows, and the only thing worth asking, is whether they have a token
- * at all. Hence a yes/no question, with the route inferred afterwards.
- *
- * Interaction contract is unchanged from BAPI-667/687 and remains load-bearing:
- * render the heading and the numbered options exactly once, accept ONE strict
- * line, no default (a bare Enter selects nothing), bounded to a single re-prompt
- * after one hint, and EOF resolves as an empty answer so it can never hang.
- */
-export const INSTALL_BRIDGE_KEY_SELECTOR_PROMPT = "Welcome to Bridge - do you have a token yet?";
-/**
- * The question's numbered options, in render order. Index + 1 is the accepted
- * token. BAPI-1171 swapped the order so the self-serve, need-a-token path is
- * option 1 — first-time signup is the common case and now leads.
- *
- * "Token" is deliberately credential-agnostic: an invite and an API key are both
- * tokens as far as this question is concerned, and answering "2" leads to ONE
- * hidden prompt whose value selects the route by shape.
+ * The bare-TTY entry prompt (BAPI-1448). One question replaces the BAPI-708 "do you
+ * have a token yet? 1/2" chooser: a typed email selects self-serve signup, and a
+ * blank answer selects the have-key branch, whose value is read ONLY through the
+ * hidden `Paste your Bridge token (input hidden): ` prompt downstream.
  */
-export const INSTALL_BRIDGE_ONBOARDING_CHOICES = [
-    "1. I need a token",
-    "2. I already have a token",
-];
-/** The single-line answer prompt drawn after the options (no bracketed default). */
-export const INSTALL_BRIDGE_ONBOARDING_CHOICE_PROMPT = "Enter 1 or 2: ";
-/** The one hint line printed after a blank/invalid answer, before the single re-prompt. */
-export const INSTALL_BRIDGE_ONBOARDING_CHOICE_HINT = "Enter 1 or 2.";
+export const INSTALL_BRIDGE_EMAIL_OR_TOKEN_PROMPT = "Email (or press Enter if you already have a token): ";
+/** The one hint line printed after a non-blank malformed answer, before the single re-prompt. */
+export const INSTALL_BRIDGE_EMAIL_OR_TOKEN_HINT = "Enter an email address, or press Enter if you already have a token.";
 /**
  * The one place the "no usable credential" copy lives (BAPI-667, U1-3).
  *
- * Centralized because the chooser failure and {@link resolveApiKey}'s two failure
+ * Centralized because the entry-prompt failure and {@link resolveApiKey}'s two failure
  * branches previously drifted: only one of them mentioned self-serve, and one
  * advised "try the hidden prompt again" — false, because the process has already
  * exited by the time the user reads it. All three now name the SAME three routes.
  */
-export const INSTALL_BRIDGE_ENTRY_ROUTES_ADVICE = "Re-run install: on a bare interactive run answer 1 to request a new token or 2 if you " +
-    "already have one (an invite or an API key — either one is accepted at the hidden prompt). " +
+export const INSTALL_BRIDGE_ENTRY_ROUTES_ADVICE = "Re-run install: on a bare interactive run, type your email to sign up, or press Enter if you " +
+    "already have a token (an invite or an API key — either one is accepted at the hidden prompt). " +
     "Non-interactively, pass --api-key <key> (or set BAPI_API_KEY) for an " +
     "existing project, --invite if you were sent an invite token, or --email <addr> to sign up.";
 /**
@@ -2312,7 +2239,7 @@ export const INSTALL_BRIDGE_ENTRY_ROUTES_ADVICE = "Re-run install: on a bare int
  * key-on-invite exits non-zero) is preserved BY CONSTRUCTION. Do not "unify" the
  * two.
  */
-export async function resolveInstallBridgeOnboardingBranchForRun(options, deps, argv) {
+export async function resolveInstallBridgeOnboardingBranchForRun(options, deps, argv, baseUrl = DEFAULT_BAPI_BASE_URL) {
     const branch = resolveInstallBridgeOnboardingBranch(options, deps.env);
     // An explicit need-key intent is already unambiguous — never re-ask it.
     if (branch.kind === "need-key")
@@ -2324,38 +2251,35 @@ export async function resolveInstallBridgeOnboardingBranchForRun(options, deps,
     }
     const promptLine = deps.promptLine;
     try {
-        // Render the heading + options EXACTLY once; a re-prompt after an invalid
-        // answer re-asks the question without redrawing the list (BAPI-663 contract).
-        deps.log(INSTALL_BRIDGE_KEY_SELECTOR_PROMPT);
-        for (const choice of INSTALL_BRIDGE_ONBOARDING_CHOICES)
-            deps.log(choice);
+        // The answer may be an email, so the privacy notice comes first and prints once.
+        deps.log(buildInstallBridgeSignupPrivacyNotice(baseUrl));
         // Bounded to two reads total: the first answer, then ONE re-prompt after a
         // single hint line. EOF resolves as an empty answer (promptLineViaReadline
-        // resolves "" on close), so it costs one re-prompt and then fails cleanly —
-        // it can never hang or silently select a branch.
+        // resolves "" on close), which selects the have-key branch rather than hanging.
         for (let attempt = 0; attempt < 2; attempt += 1) {
-            const answer = (await promptLine(INSTALL_BRIDGE_ONBOARDING_CHOICE_PROMPT)).trim();
-            // BAPI-708 (A-1): the accepted tokens are exactly 1/2 (no letters, no
-            // aliases), preserving the one-strict-line contract. BAPI-1171 swapped the
-            // order so "1" is the self-serve need-key branch and "2" routes to the
-            // have-key branch's credential-agnostic prompt, whose value is classified by
-            // SHAPE — so a user holding an invite still lands in the redemption protocol
-            // without ever having been asked which kind of token they hold.
-            if (answer === "1") {
+            const answer = String((await promptLine(INSTALL_BRIDGE_EMAIL_OR_TOKEN_PROMPT)) ?? "").trim();
+            // Blank (or EOF): the user has a token; it is read only by the hidden prompt.
+            if (answer.length === 0) {
+                return { ok: true, branch: { kind: "have-key" }, credentialIntent: "inferred" };
+            }
+            // A typed value is accepted ONLY as a signup email. It is never classified as a
+            // credential, logged, or persisted here; a token-shaped value fails the shape
+            // check and gets the hint.
+            if (INSTALL_BRIDGE_SIGNUP_EMAIL_SHAPE.test(answer)) {
                 return {
                     ok: true,
                     branch: { kind: "need-key", method: "self-serve" },
                     credentialIntent: "inferred",
+                    onboardingEmail: answer,
+                    privacyNoticeShown: true,
                 };
             }
-            if (answer === "2")
-                return { ok: true, branch: { kind: "have-key" }, credentialIntent: "inferred" };
             if (attempt === 0)
-                deps.log(INSTALL_BRIDGE_ONBOARDING_CHOICE_HINT);
+                deps.log(INSTALL_BRIDGE_EMAIL_OR_TOKEN_HINT);
         }
         return {
             ok: false,
-            error: `No option was selected. ${INSTALL_BRIDGE_ENTRY_ROUTES_ADVICE}`,
+            error: `No email or token choice was made. ${INSTALL_BRIDGE_ENTRY_ROUTES_ADVICE}`,
         };
     }
     catch {
@@ -2464,22 +2388,31 @@ const SELECTION_TOKEN_PATTERN = /^[1-9][0-9]*$/;
  * Interactive single-shot numbered picker on stderr (TTY only). Renders the
  * heading and each option exactly once, then accepts ONE strict
  * comma-separated line of one-based numbers and resolves immediately — there
- * is no preselected/toggle state and no separate confirmation step (BAPI-663).
+ * is no toggle state and no separate confirmation step (BAPI-663).
+ *
+ * BAPI-1448: when `preselected` names at least one offered option, those rows
+ * render as `[x]` (the rest as `[ ]`) and a blank line accepts the ticked set.
+ * Typed numbers REPLACE the ticked set; they never toggle it. With nothing
+ * pre-ticked the original behaviour is unchanged: a blank line is rejected with
+ * "Select at least one tool."
  *
- * A blank line or a line containing any invalid token (non-numeric, zero,
- * signed, leading-zero, decimal, out-of-range) is rejected atomically — the
- * whole line is discarded, one error line is printed, and the picker
- * re-prompts without re-rendering the option list. A valid line is
- * deduplicated and returned in `options` order regardless of entry order.
+ * A line containing any invalid token (non-numeric, zero, signed,
+ * leading-zero, decimal, out-of-range) is rejected atomically — the whole line
+ * is discarded, one error line is printed, and the picker re-prompts without
+ * re-rendering the option list, so the ticks stay as first shown. A valid line
+ * is deduplicated and returned in `options` order regardless of entry order.
  *
  * Resolves to `[]` on EOF / synchronous close before any line has been
  * committed, so a readline regression can never hang. Returns `[]`
  * immediately, without creating a readline interface, when `options` is
  * empty.
  */
-export function promptMultiSelectViaReadline(promptText, options, input = process.stdin, output = process.stderr) {
+export function promptMultiSelectViaReadline(promptText, options, input = process.stdin, output = process.stderr, preselected = []) {
     if (options.length === 0)
         return Promise.resolve([]);
+    // Canonical option order, restricted to options actually offered.
+    const ticked = options.filter((o) => preselected.includes(o.id)).map((o) => o.id);
+    const hasTicks = ticked.length > 0;
     return new Promise((resolve) => {
         const rl = readline.createInterface({ input, output });
         let settled = false;
@@ -2496,13 +2429,20 @@ export function promptMultiSelectViaReadline(promptText, options, input = proces
         rl.on("close", () => finish([]));
         output.write(`\n${promptText}\n`);
         options.forEach((opt, idx) => {
-            output.write(`  ${idx + 1}. ${opt.label}\n`);
+            const box = hasTicks ? `${ticked.includes(opt.id) ? "[x]" : "[ ]"} ` : "";
+            output.write(`  ${idx + 1}. ${box}${opt.label}\n`);
         });
-        output.write("Enter the number(s) of the tools you use (e.g. 1,3), then Enter.\n");
+        output.write(hasTicks
+            ? "Press Enter to use the ticked tools, or type the numbers you use (e.g. 1,3).\n"
+            : "Enter the number(s) of the tools you use (e.g. 1,3), then Enter.\n");
         const prompt = () => {
             rl.question("> ", (answer) => {
                 const trimmed = answer.trim();
                 if (trimmed.length === 0) {
+                    if (hasTicks) {
+                        finish(ticked);
+                        return;
+                    }
                     output.write("Select at least one tool.\n");
                     prompt();
                     return;
@@ -2553,10 +2493,6 @@ export function optimizationPostureSubscriptionNounPhrase(primaryPlatform) {
     const mapped = primaryPlatform ? OPTIMIZATION_POSTURE_SUBSCRIPTION_NAMES[primaryPlatform] : undefined;
     return mapped ? `${mapped} subscription` : "coding subscription";
 }
-/** Option three's exact wording, platform-aware (BAPI-1221 Step 2). */
-function buildOptimizationPostureOptionThree(primaryPlatform) {
-    return `Get the most out of your ${optimizationPostureSubscriptionNounPhrase(primaryPlatform)}?`;
-}
 /** The neutral single-line correction reprompted for any malformed answer. */
 const OPTIMIZATION_POSTURE_CORRECTION = "Enter a single number from 1 to 3.";
 /**
@@ -2572,20 +2508,21 @@ const OPTIMIZATION_POSTURE_CORRECTION = "Enter a single number from 1 to 3.";
 const OPTIMIZATION_POSTURE_MAX_CORRECTIONS = 20;
 /**
  * Render the one-time posture menu and its input instruction. Exactly three
- * vertically ordered numbered options; option three is platform-aware. Plain,
- * wrap-safe text — no color-only state, icons, or decorative framing.
+ * vertically ordered numbered options; option three names the user's own
+ * subscription. Plain, wrap-safe text (every line within 80 columns) — no
+ * color-only state, icons, or decorative framing.
  */
 function buildOptimizationPostureMenu(primaryPlatform) {
-    return ("How should Bridge optimize its work on this repository?\n" +
-        "  1. Quality — fuller planning and review policy.\n" +
-        "  2. Speed — a combined planning pass and normally one review round.\n" +
-        `  3. ${buildOptimizationPostureOptionThree(primaryPlatform)} — leaner planning/review defaults\n` +
-        "     and lower harness model tiers where supported.\n" +
-        "These are active defaults, subject to explicit policy/model overrides.\n" +
-        `Your ${optimizationPostureSubscriptionNounPhrase(primaryPlatform)} is separate from Bridge credits.\n` +
-        "Enter keeps an existing saved preference; projects without one use Quality.\n" +
-        "You can change this later with /teach-bridge.\n" +
-        `${OPTIMIZATION_POSTURE_CORRECTION} `);
+    return ("How should Bridge balance quality and cost on this project?\n" +
+        "  1. Quality — Bridge plans and reviews each ticket in full depth; slowest and\n" +
+        "     uses the most credits, but catches the most problems.\n" +
+        "  2. Speed — Bridge plans in one pass and reviews once; faster and cheaper, but\n" +
+        "     may miss things on some tickets.\n" +
+        "  3. Token Efficiency — Bridge will use Speed settings and hand simpler tickets\n" +
+        "     to smaller models more often, which stretches your\n" +
+        `     ${optimizationPostureSubscriptionNounPhrase(primaryPlatform)} the furthest.\n` +
+        "Press Enter to keep Quality (or your saved choice).\n" +
+        "Enter 1, 2, or 3: ");
 }
 /**
  * The purpose-built, strict single-select optimization-posture picker
@@ -2675,7 +2612,7 @@ function optimizationPostureConfirmationPhrase(value, primaryPlatform) {
 }
 /** Printed immediately after a successful posture write, on its own line. */
 const OPTIMIZATION_POSTURE_BLOG_URL = "https://bridgegpt.ai/blog/how-we-optimize-your-setup";
-const OPTIMIZATION_POSTURE_REMEDIATION = "Update it later with /teach-bridge or the optimization_posture setting in the web UI.";
+const OPTIMIZATION_POSTURE_REMEDIATION = "Change it later by running /teach-bridge in your agent.";
 /**
  * The generic, secret-free fail-open message shared by every non-success,
  * non-forbidden outcome — an interactive no-answer/prompt-exception (no PUT
@@ -2709,8 +2646,9 @@ function reportOptimizationPostureOutcome(log, result, value, primaryPlatform) {
  * Resolve the selected host platforms with strict precedence (BAPI-635):
  *   1. explicit `--tools` (including an explicit EMPTY selection — never falls
  *      back to detection),
- *   2. interactive multi-select on a TTY (AC-2: no row pre-selected — the picker
- *      starts empty and requires an explicit ≥1 selection),
+ *   2. interactive multi-select on a TTY, pre-ticked with the detected tools
+ *      (BAPI-1448 reverses the BAPI-635 AC-2 empty picker; with nothing detected
+ *      the picker still requires an explicit ≥1 selection),
  *   3. the legacy non-TTY automatic set: Claude Code plus only the currently
  *      detected Copilot VS Code and Cursor automatic targets (never Codex just
  *      because a global directory exists).
@@ -2720,11 +2658,12 @@ export async function resolveSelectedHostPlatforms(deps, options) {
     if (options.tools !== undefined) {
         return options.tools;
     }
-    // 2. Interactive single-shot numbered picker on a TTY. No row is pre-selected
-    // — the picker has no default state and requires an explicit selection.
+    // 2. Interactive single-shot numbered picker on a TTY, seeded with the locally
+    // detected tools (BAPI-1448): Enter accepts them, typed numbers replace them.
     if (deps.isTTY && deps.promptMultiSelect) {
         const optionList = allHostTargets().map((t) => ({ id: t.id, label: t.label }));
-        const chosen = await deps.promptMultiSelect(INSTALL_BRIDGE_TOOL_SELECTOR_PROMPT, optionList);
+        const detected = detectDefaultPlatforms(await buildDetectionContext(deps));
+        const chosen = await deps.promptMultiSelect(INSTALL_BRIDGE_TOOL_SELECTOR_PROMPT, optionList, detected);
         return HOST_PLATFORM_ORDER.filter((id) => chosen.includes(id));
     }
     // 3. Legacy non-TTY automatic set: Claude + detected Cursor / Copilot VS Code.
@@ -2842,42 +2781,6 @@ export function toolLabelForLaunchAgent(agent) {
     const target = allHostTargets().find((t) => t.launchAgent === agent);
     return target?.label ?? UNKNOWN_LAUNCH_TOOL_LABEL;
 }
-/**
- * Interactive numbered chooser for when MORE THAN ONE launchable tool was selected
- * (AC-11). Mirrors the connect-github picker: prints each candidate by its host-tool
- * label, asks for an exact numeric choice with NO default, validates the range, and
- * returns the chosen agent. Returns `null` — never a silent first-candidate default —
- * for every unavailable/invalid path: non-TTY, a missing `promptLine` seam, blank/EOF
- * input, an out-of-range or malformed answer, or a prompt that throws. Single-purpose:
- * it must run only AFTER the multi-select promise has resolved and closed its readline
- * interface so two readers never contend for stdin.
- */
-export async function chooseInstallBridgeLaunchAgent(agents, deps) {
-    if (!deps.isTTY || !deps.promptLine)
-        return null;
-    const promptLine = deps.promptLine;
-    try {
-        deps.log("");
-        deps.log("More than one selected tool can host the configuration session:");
-        agents.forEach((agent, i) => {
-            deps.log(`  ${String(i + 1).padStart(2, " ")}. ${toolLabelForLaunchAgent(agent)}`);
-        });
-        // No default: a stray Enter must not silently pick a tool.
-        const answer = (await promptLine(`Which tool should open? [1-${agents.length}]: `)).trim();
-        const index = Number(answer);
-        if (!/^\d+$/.test(answer) ||
-            !Number.isInteger(index) ||
-            index < 1 ||
-            index > agents.length) {
-            return null;
-        }
-        return agents[index - 1];
-    }
-    catch {
-        // Never surface caught exception text; an unavailable chooser is a no-spawn.
-        return null;
-    }
-}
 /**
  * Shared, copy-pasteable "we didn't open a session for you" guidance so every
  * no-spawn path (no-launchable selection, non-TTY suppression, chooser failure,
@@ -4128,6 +4031,27 @@ export function buildSelfServeMintUrl(baseUrl) {
 export const SIGNUP_VERIFICATION_CODE_LENGTH = 6;
 /** The one prompt label. The E2E harness and the static contract both pin it. */
 export const INSTALL_BRIDGE_CODE_PROMPT = "Email verification code: ";
+/**
+ * The address verification codes are sent from. Mirrors the server's
+ * `DEFAULT_FROM_ADDRESS` in `api/library/email/provider.py`; keep the two in step.
+ */
+export const INSTALL_BRIDGE_VERIFICATION_SENDER = "noreply@bridgegpt-api.com";
+/**
+ * The shared lead-in printed immediately before every self-serve
+ * {@link promptForVerificationCode} call (modern and legacy paths, fresh or resumed):
+ * three unindented lines, then a blank line. It prints neither the prompt nor any
+ * expiry or time-left text.
+ *
+ * BAPI-1449 (verification recovery) builds on this lead-in instead of adding its
+ * own, and may later return the sender from the request endpoint rather than using
+ * {@link INSTALL_BRIDGE_VERIFICATION_SENDER}.
+ */
+export function logVerificationCodeLeadIn(log, email) {
+    log(`We emailed a ${SIGNUP_VERIFICATION_CODE_LENGTH}-digit code to ${maskSignupEmail(email)}.`);
+    log(`It usually arrives within two minutes. It comes from ${INSTALL_BRIDGE_VERIFICATION_SENDER} — check your`);
+    log("spam or junk folder if you don't see it.");
+    log("");
+}
 /** Shown when a stored, unexpired challenge is picked up on a later run. */
 export const INSTALL_BRIDGE_RESUME_VERIFICATION_HEADING = "Resume email verification";
 /**
@@ -4898,8 +4822,8 @@ function buildDeferredLaunchStepPreview() {
 /**
  * The optional agent-notes offer preview line (BAPI-1207). A --dry-run never
  * prompts or writes; when the selection resolves to at least one writable
- * notes target this states plainly that a real interactive run would ask
- * default-No consent before touching it. Empty when the selection resolves to
+ * notes target this states plainly that a real interactive run writes it
+ * without asking. Empty when the selection resolves to
  * no writable target (e.g. Windsurf-only), mirroring how the GitHub offer
  * lines are unconditional but this offer's applicability is not.
  */
@@ -4914,10 +4838,10 @@ function buildAgentNotesPreviewLines(notesTargets, platformLabels) {
         "Step 4c — reached only after the Step 4b VCS connect offer has completed or been",
         "          explicitly deferred (a declined or incomplete connect is announced first,",
         "          with the command to finish it later, and never blocks this step).",
-        `Step 4c — optional: Bridge MCP guidance for ${subject} (SKIPPED in --dry-run): if the`,
-        `          terminal is interactive, offer to write guidance so ${subject} know${plural ? "" : "s"} when to reach`,
-        `          for Bridge's MCP tools, in a Bridge-owned marker region in ${notesTargets.join(" and ")}; defaults`,
-        "          to Yes [Y/n] on submitted Enter; EOF skips. Existing content outside that region is preserved. No notes files are",
+        `Step 4c — Bridge MCP guidance for ${subject} (SKIPPED in --dry-run): if the`,
+        `          terminal is interactive, a real run writes guidance so ${subject} know${plural ? "" : "s"} when to reach`,
+        `          for Bridge's MCP tools, in a Bridge-owned marker region in ${notesTargets.join(" and ")}, without asking,`,
+        "          then prints how to remove it. Existing content outside that region is preserved. No notes files are",
         "          written in --dry-run.",
     ];
 }
@@ -5395,10 +5319,6 @@ export function isMinttyNonInteractiveInstall(platform, env, isTTY) {
 }
 export async function runInstallBridgeCli(argv, overrides = {}) {
     const deps = { ...createDefaultInstallBridgeDeps(), ...overrides };
-    if (Object.prototype.hasOwnProperty.call(overrides, "promptLine") &&
-        !Object.prototype.hasOwnProperty.call(overrides, "promptGuidanceLine")) {
-        deps.promptGuidanceLine = undefined;
-    }
     // When the caller overrode only `fetch` (the common test seam), bind the
     // default resolver to the FINAL merged fetch so server resolution still routes
     // through the override. An explicit `resolveRepoViaServer` override is honored.
@@ -5749,7 +5669,7 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
     // The selection is pure and deterministic for every explicit, env-driven, and
     // non-TTY invocation; only a BARE interactive run is asked which branch it wants
     // (BAPI-626 — otherwise a first-time user can never reach self-serve).
-    const branchResult = await resolveInstallBridgeOnboardingBranchForRun(options, deps, argv);
+    const branchResult = await resolveInstallBridgeOnboardingBranchForRun(options, deps, argv, baseUrl);
     if (!branchResult.ok) {
         errorLog(`Error: ${branchResult.error}`);
         return 1;
@@ -5791,7 +5711,12 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
     // key-authentication ping, so there is no source to attribute.
     let apiKeySource;
     if (selfServeSignupMode) {
-        const emailResult = await resolveSignupEmail(options, deps, baseUrl);
+        const emailResult = await resolveSignupEmail(options, deps, baseUrl, branchResult.onboardingEmail
+            ? {
+                email: branchResult.onboardingEmail,
+                privacyNoticeShown: branchResult.privacyNoticeShown === true,
+            }
+            : undefined);
         if (!emailResult.ok) {
             errorLog(`Error: ${emailResult.error}`);
             return 1;
@@ -6137,10 +6062,10 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         return 0;
     }
     // ---- Finalize the launch agent for spawn-capable decisions ----
-    // choose-one: pick exactly one via the numbered chooser (TTY only); a non-TTY run or
-    // a failed/aborted chooser degrades to the manual continuation (finalAgentName stays
-    // null). This runs AFTER the multi-select readline closed and BEFORE the GitHub /
-    // consent flows, so no two stdin readers ever overlap.
+    // choose-one: on a TTY, take the first launchable agent the user selected and say so
+    // (BAPI-1448 retired the launch-agent chooser; `--agent` still wins
+    // upstream in the pure launch decision). A non-TTY run degrades to the manual
+    // continuation (finalAgentName stays null).
     let finalAgentName = null;
     let finalSpawnCommand = null;
     if (planLaunch.kind === "spawn") {
@@ -6148,8 +6073,9 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         finalSpawnCommand = planLaunch.spawnCommand;
     }
     else if (planLaunch.kind === "choose-one") {
-        const chosen = await chooseInstallBridgeLaunchAgent(planLaunch.agents, deps);
+        const chosen = deps.isTTY ? (planLaunch.agents[0] ?? null) : null;
         if (chosen) {
+            log(`Using ${toolLabelForLaunchAgent(chosen)} for the setup session (the first tool you selected). Pass --agent to choose another.`);
             const spec = resolveAgentSpec(chosen);
             if (!spec) {
                 errorLog(`Error: no launch agent is registered for '${chosen}'.`);
@@ -6159,7 +6085,7 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
             const modelAlias = await resolveValidatedPremiumModelAlias(deps, spec);
             finalSpawnCommand = deps.buildShellCommand(spec, INSTALL_BRIDGE_AGENT_PROMPT, deps.cwd, deps.platform, modelAlias);
         }
-        // chosen === null → non-TTY / unavailable / invalid → manual continuation below.
+        // chosen === null → non-TTY → manual continuation below.
     }
     // planLaunch.kind === "manual" (no-launchable) → finalAgentName stays null.
     // ---- Materialize the Step 5 launch command + kick off the pre-warm — ONLY for a
@@ -6348,7 +6274,6 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                     challengeExpiresAt = liveChallenge.expiresAt;
                     challengeEmail = liveChallenge.email;
                     log(`  ${INSTALL_BRIDGE_RESUME_VERIFICATION_HEADING}`);
-                    log(`  We already emailed a code to ${maskSignupEmail(challengeEmail)}.`);
                 }
                 else {
                     const requested = await requestSelfServeChallenge(deps, baseUrl, signupEmail);
@@ -6408,12 +6333,9 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                             "No workspace has been set up — fix the problem and re-run.");
                         return false;
                     }
-                    log(`  We emailed a code to ${maskSignupEmail(challengeEmail)}.`);
                 }
-                log(`  Enter the ${SIGNUP_VERIFICATION_CODE_LENGTH}-digit code to finish setting up your workspace.`);
-                const remaining = formatChallengeRemaining(challengeExpiresAt, deps.now());
-                if (remaining)
-                    log(`  ${remaining}`);
+                // BAPI-1448: the shared lead-in, fresh or resumed, directly before code entry.
+                logVerificationCodeLeadIn(log, challengeEmail);
                 // Phase 2, second half, and phase 3. One resend is offered on the recovery
                 // path only — never proactively — so the budget is spent on the user's
                 // explicit request rather than by the CLI's own retry logic.
@@ -6820,9 +6742,12 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         // existing value unconditionally — the old value is never read first. A
         // no-answer (or a prompt/stream exception the picker already absorbed)
         // reports the same fail-open remediation without ever attempting a write.
+        let persistedPosture;
         if (optimizationPostureSelection) {
             const postureResult = await persistOptimizationPosture(deps, baseUrl, apiKey, repoName, optimizationPostureSelection);
             reportOptimizationPostureOutcome(log, postureResult, optimizationPostureSelection, selectedPlatforms[0]);
+            if (postureResult.kind === "success")
+                persistedPosture = optimizationPostureSelection;
         }
         else if (optimizationPostureEligible) {
             log(OPTIMIZATION_POSTURE_UNCHANGED_MESSAGE);
@@ -7106,8 +7031,7 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         // selected set. `writeAgentNotes` never touches `writeMcpInstallState` or any
         // other persisted install-state contract — consent is re-evaluated every run.
         const notesPlan = resolveAgentNotesTargets(selectedPlatforms);
-        const notesPlatformLabels = labelsForPlatforms(notesPlan.supportedPlatforms);
-        const notesOffer = await offerAgentGuidanceNotes(deps, log, notesPlan.targets, notesPlatformLabels);
+        const notesOffer = offerAgentGuidanceNotes(deps, notesPlan.targets);
         let notesResult;
         let notesWriteFailed = false;
         if (notesOffer.kind === "consented") {
@@ -7137,10 +7061,20 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         const notesSummaryLine = buildAgentNotesSummaryLine(notesOffer, notesResult, notesWriteFailed, notesPlan.unsupportedPlatforms);
         if (notesSummaryLine)
             log(notesSummaryLine);
+        // The removal hint only when something was actually written (BAPI-1448).
+        const notesWrittenTargets = (notesResult?.files ?? [])
+            .filter((f) => f.status === "written")
+            .map((f) => f.target);
+        if (notesWrittenTargets.length > 0)
+            log(INSTALL_BRIDGE_AGENT_NOTES_REMOVAL_HINT);
+        const notesUnchangedTargets = (notesResult?.files ?? [])
+            .filter((f) => f.status === "skipped")
+            .map((f) => f.target);
         // ---- BAPI-1398: Bridge permission rules for /drive-epic-run (Claude Code) ----
         // After the durable install work and the other offers, before the session
-        // opens. Project rules are written as part of the normal install; the user
-        // settings change asks once and is skipped without a yes or a terminal. Every
+        // opens. Project rules are written as part of the normal install. The user
+        // settings change is NOT part of install (BAPI-1448): it lives in the
+        // `bridge-permissions` subcommand, offered in-session by /drive-epic-run. Every
         // failure here is advisory: a malformed settings file is reported and skipped,
         // and the install still completes.
         if (selectedPlatforms.includes("claude-code")) {
@@ -7149,13 +7083,14 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                     cwd: deps.cwd,
                     homeDir: deps.homedir(),
                     env: deps.env,
-                    promptLine: deps.isTTY ? deps.promptLine : undefined,
                     readFile: deps.readFile,
                     writeFile: (p, data) => deps.writeFile(p, data, { encoding: "utf-8" }),
                     mkdir: (p, o) => deps.mkdir(p, o),
                     log,
                     errorLog,
                     ensureGitignored: (relPath) => ensureGitignoredShared(deps.cwd, relPath, gitignoreDeps),
+                    // BAPI-1446: pin the SessionStart upgrade-notice hook to the effective Claude Code pin.
+                    sessionStartHook: { pinnedVersion: await discoverClaudeCodeEffectivePin({ cwd: deps.cwd, readFile: deps.readFile, targetVersion: VERSION }) },
                 });
             }
             catch {
@@ -7187,6 +7122,27 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         for (const line of buildInstallBridgeMaintenanceHint())
             log(line);
         await showFirstBuildAdvisory(finalAgentName);
+        // ---- BAPI-1448: the defaults summary, once, right before the launch consent ----
+        // Every input is already in memory except the optional ticket prefix, which is one
+        // bounded read of the manifest the GitHub offer already uses. Any failure there just
+        // omits the cell: the summary never blocks or changes the install's outcome.
+        let ticketPrefix;
+        try {
+            const details = await fetchGithubConfigurationDetails({ fetch: deps.fetch, baseUrl, apiKey }, repoName);
+            ticketPrefix = details.ticketPrefix;
+        }
+        catch {
+            ticketPrefix = undefined;
+        }
+        log("");
+        log(buildInstallBridgeDefaultsSummary({
+            displayName: modernAttempt?.displayName ?? repoName,
+            ...(ticketPrefix ? { ticketPrefix } : {}),
+            isNewProject: Boolean(modernAttempt) || bootstrapExchangeSucceeded,
+            ...(persistedPosture ? { persistedPosture } : {}),
+            claudeCodeSelected: selectedPlatforms.includes("claude-code"),
+            guidance: { written: notesWrittenTargets, unchanged: notesUnchangedTargets },
+        }));
         // ---- Step 5 — consent-gate, then spawn the selected tool (or print continuation) ----
         // AC-7: for a spawn-capable path, ask Y/N first (`requestInstallBridgeLaunchConsent`
         // resolves to no-spawn without prompting on a non-TTY run). A decline, a no-launchable
@@ -7326,13 +7282,19 @@ async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupE
     if (label === undefined) {
         if (!deps.isTTY || !deps.promptLine)
             throw new ModernInstallRecoveryError("Modern invite creation requires --display-name in a non-interactive terminal.");
+        // BAPI-1448: a valid folder name is the label, with no question. The prompt
+        // survives only for a folder name the validator rejects.
         let suggestion = "";
         try {
             suggestion = validateBootstrapDisplayName(path.basename(folder));
         }
         catch { /* explicit label required */ }
-        const entered = await deps.promptLine(suggestion ? `Project display name [${suggestion}]: ` : "Project display name: ");
-        label = validateBootstrapDisplayName(entered || suggestion);
+        if (suggestion) {
+            label = suggestion;
+        }
+        else {
+            label = validateBootstrapDisplayName(await deps.promptLine("Project display name: "));
+        }
     }
     if (selfServe) {
         if (!deps.isTTY || !deps.promptLine)
@@ -7364,6 +7326,7 @@ async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupE
                 throw new ModernInstallRecoveryError("The previous signup response is unresolved. Preserve proof and contact installation support before restarting.");
             if (Date.parse(record.challengeExpiresAt) <= deps.now())
                 throw new ModernInstallRecoveryError("The saved verification challenge expired. Preserve proof and contact installation support.");
+            logVerificationCodeLeadIn(deps.log, record.signupEmail ?? signupEmail);
             const code = await promptForVerificationCode(deps, deps.log);
             if (!code)
                 throw new ModernInstallRecoveryError("Verification incomplete. Resume the same signup from this folder.");