@bridge_gpt/mcp-server 0.2.68 → 0.2.70

package/build/install-bridge.js

@@ -1,5 +1,5 @@
 import { validateBootstrapDisplayName, validateBootstrapServerIdentity } from "./bootstrap-project-identity.js";
-import { lookupModernBootstrapRecord, mutateModernBootstrapRecord, prepareModernBootstrapInvite, prepareModernBootstrapSignup, transitionModernBootstrapSignup, lookupLegacyBootstrapInvite, checkpointModernBootstrapIdentity, promoteModernBootstrapCredential } from "./credential-store.js";
+import { BRIDGE_SUPPORT_EMAIL, archiveAndReplaceModernBootstrapSignup, archiveExpiredLegacySignupAndInstallModern, lookupModernBootstrapRecord, mutateModernBootstrapRecord, prepareModernBootstrapInvite, prepareModernBootstrapSignup, transitionModernBootstrapSignup, lookupLegacyBootstrapInvite, checkpointModernBootstrapIdentity, promoteModernBootstrapCredential } from "./credential-store.js";
 import { collectFirstBuildAdvisory, formatFirstBuildAdvisory } from "./first-build-advisory.js";
 /**
  * install-bridge — the one-command Bridge API project bootstrap (BAPI-429).
@@ -67,9 +67,9 @@ import { collectFirstBuildAdvisory, formatFirstBuildAdvisory } from "./first-bui
  * (BAPI-606) redeems a pre-issued invite; `self-serve` (BAPI-618) mints one from an
  * email. Both then feed the SAME redemption protocol. Selection is pure and
  * deterministic from flags/env, except that a BARE interactive run is asked ONE
- * question (BAPI-626/708): `Welcome to Bridge - do you have a token yet?`, answered
- * `1` (yes) or `2` (no). Answering `2` is the self-serve route, which a first-time
- * user could not otherwise discover. Answering `1` opens a single hidden,
+ * question (BAPI-626/708/1448): `Email (or press Enter if you already have a
+ * token): `. A valid email is the self-serve route, which a first-time user could
+ * not otherwise discover. A blank answer opens a single hidden,
  * CREDENTIAL-AGNOSTIC token prompt and the route is then inferred from the pasted
  * value's SHAPE — the user is never asked to pre-classify their own credential,
  * because the shape checks below do that with no probe request. Either need-key
@@ -145,6 +145,14 @@ import { spawn } from "child_process";
 import { randomBytes as cryptoRandomBytes, createHash } from "crypto";
 import os from "os";
 import path from "path";
+import { detectClaudeLogin } from "./claude-login.js";
+import { checkGithubSignIn } from "./github-sign-in.js";
+import { readLocalGithubRemote } from "./conductor/stored-merge-credential.js";
+import { probeStoredMergeToken } from "./conductor/stored-merge-token-probe.js";
+import { readGithubMergeCredential, removeGithubMergeCredential, upsertGithubMergeCredential, } from "./credential-store.js";
+import { createBridgeApiUrls } from "./bridge-api-urls.js";
+import { installEpicCiWorkflow } from "./epic-ci-workflow-install.js";
+import { fetchParseStatus, triggerRepositoryParse, } from "./conductor/bridge-api-client.js";
 import readline from "readline";
 import { runInit, InitPreflightError, buildBridgeApiEntry, buildBridgeConfigManifest, mergeBridgeApiProfileToken, resolveInitScaffoldAssets, refreshBridgeApiPackageSpec, currentBridgePackageSpec, classifyTrackedProbeExitCode, decideExistingProjectRoot, formatUndeterminedRootReplacedWarning, } from "./init.js";
 import { hasProjectRootMarker as sharedHasProjectRootMarker } from "./project-root.js";
@@ -155,7 +163,7 @@ import { MCP_HOST_TARGETS, HOST_PLATFORM_ORDER, allHostTargets, agentForPlatform
 import { provisionHostTarget, createDefaultVendorProcessDeps, inspectBridgeApiProfileToken, } from "./mcp-host-config.js";
 import { adaptBridgeEntryForHostTarget, } from "./mcp-host-entry-adapter.js";
 import { MCP_SERVER_NAME, MCP_PACKAGE_NAME, resolveRegistrationKey, } from "./mcp-identity.js";
-import { DUPLICATE_REGISTRATION_GUIDANCE } from "./launcher-config-inspection.js";
+import { DUPLICATE_REGISTRATION_GUIDANCE, discoverClaudeCodeEffectivePin } from "./launcher-config-inspection.js";
 import { codexHome, configureBridgeCodexProfile, inspectBridgeCodexProfile } from "./codex-bridge-profile.js";
 import { recordInstalledConductorCapability, recordInstalledExecutorServiceUnit, recordInstalledProjectArtifact, writeMcpInstallState, } from "./mcp-install-state.js";
 // BAPI-1207: opt-in cross-platform agent notes (AGENTS.md / CLAUDE.md).
@@ -193,7 +201,7 @@ import { resolveStartTicketsRepoName } from "./start-tickets-repo.js";
 import { upsertBapiCredential, getPrimaryCredentialStorePath, prepareBootstrapPendingCredential, repointBootstrapPendingCredential, promoteBootstrapPendingCredential, lookupSelfServeBootstrapPendingCredential, prepareSelfServeBootstrapChallenge as prepareSelfServeBootstrapChallengeCredential, discardBootstrapPendingCredential, getBootstrapPendingTarget, resolveBapiCredentials, } from "./credential-store.js";
 // BAPI-631: the optional GitHub connect offer reuses the standalone command's flow and
 // API primitives verbatim — no duplicated polling, browser, or picker logic here.
-import { fetchGithubConfigurationState } from "./connect-github-api.js";
+import { fetchGithubConfigurationDetails, fetchGithubConfigurationState, } from "./connect-github-api.js";
 import { createDefaultConnectGithubDeps, runGithubConnectionFlow } from "./connect-github.js";
 import { fetchBitbucketConfigurationState } from "./connect-bitbucket-api.js";
 import { createDefaultConnectBitbucketDeps, runBitbucketConnectionFlow } from "./connect-bitbucket.js";
@@ -274,7 +282,7 @@ export const INSTALL_BRIDGE_AGENT_PROMPT = "Run /install-bridge now, with no arg
     "'Needs setup' — and each item in them carries display_name, description, how_to_use, and (in the " +
     "'Needs setup' section only) availability_text. Render each item's display_name, its description, " +
     "and its how_to_use verbatim when that value is a non-empty string; render availability_text " +
-    "verbatim as the setup guidance for a 'Needs setup' item, and show NO availability caveat, " +
+    "verbatim as the setup guidance for a 'Needs setup' item — except when that section carries a non-empty string heading: print it verbatim as the section's sub-heading instead of its name and print NO item's availability_text; with no usable heading, render each availability_text as usual — and show NO availability caveat, " +
     "asterisk, or footnote on an 'Available now' item. An item's `kind` ('tool' or 'workflow') is " +
     "contract metadata only — render both kinds identically, with no label, icon, or separate list, " +
     "and never branch on it. Keep an empty section visible with a short neutral line rather than " +
@@ -303,7 +311,7 @@ export const INSTALL_BRIDGE_AGENT_PROMPT = "Run /install-bridge now, with no arg
     "short, plain-language sentence covering what is happening and why it matters to the person running " +
     "this install, rather than in internal shorthand. Narration you compose yourself must never name an " +
     "internal stage number, this command's contract version, a raw internal MCP tool identifier (like " +
-    "get_install_manifest, apply_install_manifest, or invite_member), or a manifest field key (like " +
+    "get_install_manifest or apply_install_manifest), or a manifest field key (like " +
     "command_contract_version, next_step, or configured) — describe what is actually happening instead. " +
     "This restriction is scoped to narration you author: it does not apply to a user-invocable command " +
     "name you must give the human verbatim (/install-bridge, /learn-repository, connect-github, " +
@@ -317,11 +325,7 @@ export const INSTALL_BRIDGE_AGENT_PROMPT = "Run /install-bridge now, with no arg
     "duplicate. This silence applies ONLY to success and ONLY in the install-spawn context: a Stage 6 " +
     "FAILURE is still reported loudly and in full, and in JOIN MODE or a direct/manual /install-bridge " +
     "invocation Stage 6 reports its success exactly as it does today. " +
-    "The install-spawn skip set is exactly Stage 8 and Stage 9. The command-owned Stage 11 " +
-    "(invite teammates) is NOT in that skip set: it is independently gated and may run only when the " +
-    "caller's role is admin AND customer_type is b2b AND an interactive response is available; " +
-    "otherwise it is skipped silently. If Stage 11 mints a teammate key, show that plaintext key " +
-    "exactly once and never repeat it in any summary, retry, or diagnostic. " +
+    "The install-spawn skip set is exactly Stage 8 and Stage 9. " +
     "Do NOT ask any indexing question, call parse_repository, mention /parse-repository, or claim " +
     "indexing has started or is pending — indexing is decided entirely by the server-side readiness " +
     "funnel with no visibility from this session, so say nothing about it at all. " +
@@ -394,9 +398,8 @@ export function getInstallBridgeUsage(baseUrl = DEFAULT_BAPI_BASE_URL) {
         "the next step the server returned — when it returns one.",
         "If the project is already configured it instead",
         "joins you to it without proposing or applying any changes and just shows the",
-        "concise capability report plus that same conditional next step (a b2b admin is",
-        "additionally offered a teammate-invite",
-        "step). So not every run applies config fields. Indexing is never asked about —",
+        "concise capability report plus that same conditional next step.",
+        "So not every run applies config fields. Indexing is never asked about —",
         "it starts automatically once the repository reaches full parse readiness.",
         "",
         "Your API key is written to a project MCP config only when that file is safe: a",
@@ -406,17 +409,15 @@ export function getInstallBridgeUsage(baseUrl = DEFAULT_BAPI_BASE_URL) {
         "resolves your key from the credential store at runtime. A config file that",
         "cannot be parsed is left untouched, with manual-merge instructions printed.",
         "",
-        "Run it bare — `install` with no flags — in a terminal and it asks",
-        `\`${INSTALL_BRIDGE_KEY_SELECTOR_PROMPT}\` first, with two numbered choices:`,
-        ...INSTALL_BRIDGE_ONBOARDING_CHOICES.map((choice) => `  ${choice}`),
-        "There is NO default — pressing Enter selects nothing; you must type 1 or 2 (one",
-        "blank or invalid answer re-prompts once, then exits with guidance). Answering 1",
-        "prompts for an email and creates a brand-new Bridge workspace for you (the",
-        "self-serve flow). Answering 2 opens a single hidden token prompt: paste whatever",
-        "you were given and its SHAPE picks the route — a bootstrap invite (bapi_inv_…)",
-        "is redeemed to CREATE a new project and mint your first admin key, while a",
-        "Bridge API key connects to the project that already exists. You are",
-        "never asked which kind of token you hold. That question is asked ONLY for a",
+        "Run it bare — `install` with no flags — in a terminal and it asks one question:",
+        `\`${INSTALL_BRIDGE_EMAIL_OR_TOKEN_PROMPT.trim()}\``,
+        "Type your email to create a brand-new Bridge workspace for you (the self-serve",
+        "flow). Press Enter if you already have a token: a single hidden token prompt",
+        "opens, and whatever you paste has its SHAPE pick the route — a bootstrap invite",
+        "(bapi_inv_…) is redeemed to CREATE a new project and mint your first admin key,",
+        "while a Bridge API key connects to the project that already exists. One",
+        "malformed answer re-prompts once, then exits with guidance. You are",
+        "never asked which kind of token you hold. The question is asked ONLY for a",
         "bare interactive run: passing ANY flag, setting BAPI_API_KEY, or running without an interactive",
         "terminal keeps the existing deterministic behavior and no prompt.",
         "",
@@ -532,9 +533,11 @@ export function getInstallBridgeUsage(baseUrl = DEFAULT_BAPI_BASE_URL) {
         "                                --tools claude-code,codex are accepted. On an",
         "                                interactive terminal WITHOUT this flag you get a",
         "                                numbered picker: enter one or more tool numbers,",
-        "                                comma-separated (e.g. 1,3), and press Enter once —",
-        "                                no tool is pre-selected (not even Claude Code) and",
-        "                                you must select at least one. A non-interactive",
+        "                                comma-separated (e.g. 1,3), and press Enter once.",
+        "                                Tools Bridge detects on this machine are pre-ticked:",
+        "                                a bare Enter accepts them, and typed numbers",
+        "                                replace them. With none detected you must select",
+        "                                at least one. A non-interactive",
         "                                (non-TTY) run without",
         "                                --tools writes the legacy automatic set (Claude",
         "                                Code plus any detected Cursor / Copilot VS Code)",
@@ -563,6 +566,8 @@ export function getInstallBridgeUsage(baseUrl = DEFAULT_BAPI_BASE_URL) {
         "                                session — it always wins, and there is NO Claude",
         "                                default. Without it the launch tool is derived",
         "                                from your selection: Claude Code opens `claude`.",
+        "                                With more than one launchable tool selected, the",
+        "                                first one is used and no question is asked.",
         "                                Cursor is NOT auto-opened (its cursor-agent CLI",
         "                                first-run workspace-trust prompt collapses a spawned",
         "                                session); selecting Cursor writes .cursor/mcp.json",
@@ -1147,12 +1152,6 @@ export async function offerBitbucketConnection(repoName, baseUrl, deps, log, ses
             `Bitbucket later with 'npx -y ${MCP_PACKAGE_NAME}@latest connect-bitbucket --repo ${repoName}'.`);
     }
 }
-/**
- * The exact agent-notes consent-prompt prefix, shared with tests so the copy
- * cannot drift. Mirrors {@link INSTALL_BRIDGE_LAUNCH_CONSENT_PROMPT_PREFIX}: the
- * prefix is pinned, the platform tail varies with the selection.
- */
-export const INSTALL_BRIDGE_AGENT_NOTES_PROMPT_PREFIX = "Write guidance so ";
 /**
  * Describe the selected notes platforms for the offer copy: a naturally joined
  * subject and whether it is plural (so a verb can agree). `platformLabels` are
@@ -1175,68 +1174,30 @@ function joinLabelsWithAnd(labels) {
     return `${labels.slice(0, -1).join(", ")}, and ${labels[labels.length - 1]}`;
 }
 /**
- * The default-Yes agent-notes consent prompt (BAPI-1435; payoff-led, platform-named
- * copy per the BAPI-1239 install-issue #4 follow-up). Leads with WHY — teaching
- * the agent how to use Bridge's MCP tools — and NAMES the selected platform(s)
- * rather than the old generic "cross-platform" phrasing.
- */
-export function buildAgentNotesPrompt(platformLabels) {
-    const { subject, plural } = describeAgentNotesPlatforms(platformLabels);
-    return `${INSTALL_BRIDGE_AGENT_NOTES_PROMPT_PREFIX}${subject} know${plural ? "" : "s"} how to use the Bridge MCP? Enter adds guidance for ${subject}. [Y/n]: `;
-}
-/**
- * The offer-context lines printed immediately before the agent-notes prompt
- * (BAPI-1207). Leads with the payoff — teaching the named platform(s) WHEN to
- * reach for Bridge's MCP tools — then states the marker-scoped, non-destructive
- * contract as a secondary line, mirroring the GitHub/Bitbucket offers' "explain
- * before asking" convention.
- */
-export function buildAgentNotesOfferContext(targets, platformLabels) {
-    const { subject, plural } = describeAgentNotesPlatforms(platformLabels);
-    return [
-        "",
-        `Step 4c — optional: Bridge MCP guidance for ${subject}.`,
-        `  Write guidance so ${subject} know${plural ? "" : "s"} when to reach for Bridge's MCP tools`,
-        "  during a task — for project standards, a second opinion, a council, or a ticket review.",
-        `  It writes a Bridge-owned region to ${targets.join(" and ")}; only that marked region is`,
-        "  created or refreshed — any existing content, inside or outside it, is otherwise preserved.",
-    ];
-}
-function agentGuidancePromptConsents(result) {
-    if (result?.kind !== "answer" || typeof result.value !== "string")
-        return false;
-    const value = result.value.trim().toLowerCase();
-    return value === "" || value === "y" || value === "yes";
-}
-/**
- * Offer to create or refresh the cross-platform agent notes, if the selected
- * platforms resolve to at least one writable target (BAPI-1207).
+ * Decide whether to create or refresh the cross-platform agent notes, if the
+ * selected platforms resolve to at least one writable target (BAPI-1207).
+ *
+ * BAPI-1448: an interactive run consents by default — the question is gone, with
+ * the product sign-off recorded in the install notes. The write is still bounded to
+ * Bridge's marked region (see {@link writeAgentNotes}) and reported afterwards with
+ * a removal hint. A non-interactive run keeps `headless-skip`: it never writes
+ * guidance on its own.
  *
- * Entirely best-effort and non-destructive, mirroring
- * {@link offerGithubConnection}: by the time this runs the install itself is
- * already complete and durable, so nothing here may fail the run. This
- * function only resolves the CONSENT decision — the caller performs the
- * actual write via {@link writeAgentNotes}, so a `--dry-run` (which never
- * reaches this call) and the live path share exactly one write path.
+ * Entirely best-effort and non-destructive: by the time this runs the install
+ * itself is already complete and durable, so nothing here may fail the run. This
+ * function only resolves the CONSENT decision — the caller performs the actual
+ * write via {@link writeAgentNotes}, so a `--dry-run` (which never reaches this
+ * call) and the live path share exactly one write path.
  */
-export async function offerAgentGuidanceNotes(deps, log, targets, platformLabels) {
+export function offerAgentGuidanceNotes(deps, targets) {
     if (targets.length === 0)
         return { kind: "not-applicable" };
-    // No prompt surface → no offer. Never assume consent on a non-interactive run.
-    if (!deps.isTTY || !deps.promptGuidanceLine)
+    if (!deps.isTTY)
         return { kind: "headless-skip" };
-    try {
-        for (const line of buildAgentNotesOfferContext(targets, platformLabels))
-            log(line);
-        const answer = await deps.promptGuidanceLine(buildAgentNotesPrompt(platformLabels));
-        return agentGuidancePromptConsents(answer) ? { kind: "consented" } : { kind: "declined" };
-    }
-    catch {
-        // The install is already durable; a failure here is never fatal to it.
-        deps.errorLog("Agent guidance skipped: the prompt could not be read; no guidance files were changed.");
-        return { kind: "prompt-error" };
-    }
+    return { kind: "consented" };
 }
+/** The one-line removal hint printed after guidance was actually written (BAPI-1448). */
+export const INSTALL_BRIDGE_AGENT_NOTES_REMOVAL_HINT = "To remove it, delete the lines from <!-- BEGIN BRIDGE MCP GUIDANCE --> to <!-- END BRIDGE MCP GUIDANCE -->.";
 /**
  * One secret-free summary line for the final install output (BAPI-1207). Never
  * reveals guidance content, file bytes, or a credential — only which files
@@ -1273,6 +1234,47 @@ export function buildAgentNotesSummaryLine(offer, result, writeFailed, unsupport
         parts.push(`failed for ${failed.join(", ")}`);
     return `Agent notes: ${parts.join("; ")}${unsupportedNote}.`;
 }
+const OPTIMIZATION_POSTURE_SUMMARY_LABELS = {
+    quality: "Quality",
+    speed: "Speed",
+    maximize_subscription: "Token Efficiency",
+};
+/**
+ * The aligned "defaults Bridge chose" block printed once, right before the launch
+ * consent question. Pure: it formats what the run already knows and performs no I/O.
+ *
+ * Layout: a header, then two rows of two cells. Both rows are indented two spaces and
+ * the left cells are padded to the longer left cell plus three spaces, so the right
+ * cells line up. The Ticket keys cell is omitted entirely when the server supplied no
+ * valid prefix; the prefix is printed as given and never derived locally.
+ */
+export function buildInstallBridgeDefaultsSummary(input) {
+    const optimization = input.persistedPosture
+        ? OPTIMIZATION_POSTURE_SUMMARY_LABELS[input.persistedPosture]
+        : input.isNewProject
+            ? "Quality"
+            : "unchanged";
+    const guidanceLabel = input.claudeCodeSelected ? "Claude Code guidance" : "Agent guidance";
+    const guidanceValue = input.guidance.written.length > 0
+        ? `added to ${input.guidance.written.join(", ")}`
+        : input.guidance.unchanged.length > 0
+            ? "already up to date"
+            : "not written";
+    const leftTop = `Project name: ${input.displayName}`;
+    const leftBottom = `Optimization: ${optimization}`;
+    const rightTop = input.ticketPrefix
+        ? `Ticket keys: ${input.ticketPrefix}-1, ${input.ticketPrefix}-2, …`
+        : undefined;
+    const rightBottom = `${guidanceLabel}: ${guidanceValue}`;
+    const width = Math.max(leftTop.length, leftBottom.length) + 3;
+    const rowTop = rightTop === undefined ? `  ${leftTop}` : `  ${leftTop.padEnd(width)}${rightTop}`;
+    const rowBottom = `  ${leftBottom.padEnd(width)}${rightBottom}`;
+    return [
+        "Bridge chose these defaults — change them later on the Setup page, or ask your agent:",
+        rowTop,
+        rowBottom,
+    ].join("\n");
+}
 /**
  * Echoed single-line prompt on stderr (used for repo confirmation / value).
  * Exported so `index.ts`'s `--init` can share the exact same prompt mechanics
@@ -1296,56 +1298,6 @@ export function promptLineViaReadline(promptText, input = process.stdin, output
         });
     });
 }
-/** Observe CR/LF before readline, counting split CRLF as one submission. */
-export function promptGuidanceLineViaReadline(promptText, input = process.stdin, output = process.stderr) {
-    return new Promise((resolve) => {
-        const readable = input;
-        if (readable.readableEnded || readable.destroyed) {
-            resolve({ kind: "eof" });
-            return;
-        }
-        let terminators = 0;
-        let previousCR = false;
-        let settled = false;
-        let rl;
-        const observe = (chunk) => {
-            for (const char of chunk.toString()) {
-                if (char === "\r")
-                    terminators++;
-                else if (char === "\n" && !previousCR)
-                    terminators++;
-                previousCR = char === "\r";
-            }
-        };
-        const finish = (result) => {
-            if (settled)
-                return;
-            settled = true;
-            input.removeListener("data", observe);
-            input.removeListener("end", eof);
-            input.removeListener("close", eof);
-            input.removeListener("error", eof);
-            rl?.removeListener("close", eof);
-            rl?.close();
-            resolve(result);
-        };
-        const eof = () => finish({ kind: "eof" });
-        input.prependListener("data", observe);
-        input.once("end", eof);
-        input.once("close", eof);
-        input.once("error", eof);
-        rl = readline.createInterface({ input, output });
-        rl.once("close", eof);
-        if (settled || readable.readableEnded || readable.destroyed) {
-            rl.close();
-            eof();
-            return;
-        }
-        rl.question(promptText, (value) => {
-            finish(terminators > 0 ? { kind: "answer", value } : { kind: "eof" });
-        });
-    });
-}
 /**
  * Default pre-warm spawner (BAPI-451 W3). Spawns array-based (`shell: false`) so
  * no argument is ever shell-interpreted, ignores all child stdio (node-gyp /
@@ -1461,8 +1413,9 @@ export function createDefaultInstallBridgeDeps() {
         randomBytes: (size) => cryptoRandomBytes(size),
         promptSecret: isTTY ? promptSecretViaReadline : undefined,
         promptLine: isTTY ? promptLineViaReadline : undefined,
-        promptGuidanceLine: isTTY ? promptGuidanceLineViaReadline : undefined,
-        promptMultiSelect: isTTY ? promptMultiSelectViaReadline : undefined,
+        promptMultiSelect: isTTY
+            ? (promptText, options, preselected) => promptMultiSelectViaReadline(promptText, options, process.stdin, process.stderr, preselected)
+            : undefined,
         vendor: createDefaultVendorProcessDeps(spawn),
         fetch: productionFetch,
         resolveRepoViaServer: (baseUrl, apiKey) => resolveRepoViaServer(productionFetch, baseUrl, apiKey),
@@ -1522,6 +1475,19 @@ export function createDefaultInstallBridgeDeps() {
             // Read-only service-state probe (BAPI-779). Typed to return a state,
             // never a runner, so the doctor cannot start/enable/reload anything.
             inspectExecutorServiceState: params.inspectExecutorServiceState,
+            // BAPI-1461: only the converging setup passes these; without them the
+            // conductor doctor is built exactly as before.
+            ...(params.skipDenyProbe !== undefined || params.storedMergeCredential !== undefined
+                ? {
+                    conductorDoctorDeps: {
+                        env: params.env,
+                        ...(params.skipDenyProbe === true ? { skipDenyProbe: true } : {}),
+                        ...(params.storedMergeCredential !== undefined
+                            ? { storedMergeCredential: params.storedMergeCredential }
+                            : {}),
+                    },
+                }
+                : {}),
             installDoctorDeps: {
                 env: params.env,
                 cwd: params.cwd,
@@ -1687,6 +1653,54 @@ export function getMergeWorkflowInstallUsage() {
  * `shell: false` — and `gh` additionally receives the non-interactive pins so a
  * prompt can never hang an install. The resulting environment is never printed.
  */
+/**
+ * BAPI-1461 — the production seams for the converging `install conductor`.
+ *
+ * Each one is a thin adapter over an implementation that already exists: the
+ * Claude login reader, one bounded `gh auth status`, the credential store's
+ * typed merge-token functions (locked, durable writes), the shared capability
+ * probe, the stored-test-command client, the CI workflow artifact-set installer
+ * (sharing the merge-workflow installer's git/gh runners), and the parse routes.
+ */
+export function buildConductorSetupDeps(deps, log, errorLog) {
+    const installerDeps = buildMergeWorkflowInstallDeps(deps, log, errorLog);
+    const storeDeps = modernWriteDeps(deps);
+    return {
+        detectClaudeLogin: () => detectClaudeLogin({ homedir: deps.homedir, readFile: deps.readFile }),
+        // An injected installer runner (tests) is used for these reads too, so a
+        // harness never reaches the real `gh` or `git`.
+        checkGithubSignIn: () => deps.mergeWorkflowRunGh
+            ? checkGithubSignIn(async (args) => ({ exitCode: (await deps.mergeWorkflowRunGh(args)).status }))
+            : checkGithubSignIn(),
+        readLocalGithubRemote: () => readLocalGithubRemote(deps.cwd, deps.mergeWorkflowRunGit
+            ? async () => {
+                const r = await deps.mergeWorkflowRunGit(["remote", "get-url", "origin"]);
+                return r.status === 0 ? r.stdout : null;
+            }
+            : undefined),
+        ...(deps.isTTY && deps.promptSecret ? { promptSecret: deps.promptSecret } : {}),
+        readMergeToken: (identity) => readGithubMergeCredential(identity, storeDeps),
+        storeMergeToken: (identity, token) => upsertGithubMergeCredential(identity, token, storeDeps),
+        removeMergeToken: (identity) => removeGithubMergeCredential(identity, storeDeps),
+        probeMergeToken: (args) => probeStoredMergeToken({ ...args, env: deps.env }),
+        testingConfig: (access) => ({
+            repoName: access.repoName,
+            urls: createBridgeApiUrls(access.baseUrl),
+            fetch: deps.fetch,
+            getGetHeaders: async () => ({ "X-API-Key": access.apiKey }),
+            getPostHeaders: async () => ({ "X-API-Key": access.apiKey, "Content-Type": "application/json" }),
+        }),
+        readRepositoryFile: (relPath) => deps.readFile(path.join(deps.cwd, relPath)),
+        installCiWorkflow: (testCommand, options, confirmWrite) => installEpicCiWorkflow(testCommand, { dryRun: options.dryRun }, {
+            ...installerDeps,
+            ...(options.quiet === true ? { log: () => { }, errorLog: () => { } } : {}),
+            confirmWrite,
+        }),
+        runGh: installerDeps.runGh,
+        fetchParseStatus: (access) => fetchParseStatus(access, deps.fetch),
+        triggerParse: (access) => triggerRepositoryParse(access, deps.fetch),
+    };
+}
 export function buildMergeWorkflowInstallDeps(deps, log, errorLog) {
     const toResult = (r) => ({
         status: r.exitCode,
@@ -2148,7 +2162,7 @@ export function buildInstallBridgeMaintenanceHint() {
         "Persistent host registrations remain pinned until an explicit upgrade; the editor may need to reconnect to use the new server.",
     ];
 }
-export async function resolveSignupEmail(options, deps, baseUrl = DEFAULT_BAPI_BASE_URL) {
+export async function resolveSignupEmail(options, deps, baseUrl = DEFAULT_BAPI_BASE_URL, onboarding) {
     // BAPI-757 (R-3 / AC-9): self-serve signup now REQUIRES an interactive terminal,
     // and the check runs FIRST — before `--email` and before `BAPI_SIGNUP_EMAIL` —
     // so an unattended run fails before any request is made, no verification email
@@ -2159,6 +2173,13 @@ export async function resolveSignupEmail(options, deps, baseUrl = DEFAULT_BAPI_B
     if (!deps.isTTY || !deps.promptLine) {
         return { ok: false, error: INSTALL_BRIDGE_SIGNUP_REQUIRES_TTY };
     }
+    // BAPI-1448: an email already answered at the merged entry prompt is consumed the
+    // way `--email` is, with no second question and no second privacy notice.
+    if (onboarding) {
+        if (!onboarding.privacyNoticeShown)
+            deps.log(buildInstallBridgeSignupPrivacyNotice(baseUrl));
+        return { ok: true, value: onboarding.email };
+    }
     deps.log(buildInstallBridgeSignupPrivacyNotice(baseUrl));
     if (typeof options.email === "string" && options.email.trim().length > 0) {
         return { ok: true, value: options.email.trim() };
@@ -2222,49 +2243,24 @@ export function resolveInstallBridgeOnboardingBranch(options, env) {
     return { kind: "have-key" };
 }
 /**
- * The bare-TTY onboarding question (BAPI-708, Part A), replacing the BAPI-667/687
- * three-option chooser.
- *
- * The three-option form asked the user to make a distinction the CODE can already
- * make for itself: whether the string in their clipboard is an invite or an API
- * key. `classifyEnteredCredential` + `isHighEntropyApiKeyShape` decide that from
- * SHAPE alone, with no probe request — so the only thing a first-time user
- * genuinely knows, and the only thing worth asking, is whether they have a token
- * at all. Hence a yes/no question, with the route inferred afterwards.
- *
- * Interaction contract is unchanged from BAPI-667/687 and remains load-bearing:
- * render the heading and the numbered options exactly once, accept ONE strict
- * line, no default (a bare Enter selects nothing), bounded to a single re-prompt
- * after one hint, and EOF resolves as an empty answer so it can never hang.
+ * The bare-TTY entry prompt (BAPI-1448). One question replaces the BAPI-708 "do you
+ * have a token yet? 1/2" chooser: a typed email selects self-serve signup, and a
+ * blank answer selects the have-key branch, whose value is read ONLY through the
+ * hidden `Paste your Bridge token (input hidden): ` prompt downstream.
  */
-export const INSTALL_BRIDGE_KEY_SELECTOR_PROMPT = "Welcome to Bridge - do you have a token yet?";
-/**
- * The question's numbered options, in render order. Index + 1 is the accepted
- * token. BAPI-1171 swapped the order so the self-serve, need-a-token path is
- * option 1 — first-time signup is the common case and now leads.
- *
- * "Token" is deliberately credential-agnostic: an invite and an API key are both
- * tokens as far as this question is concerned, and answering "2" leads to ONE
- * hidden prompt whose value selects the route by shape.
- */
-export const INSTALL_BRIDGE_ONBOARDING_CHOICES = [
-    "1. I need a token",
-    "2. I already have a token",
-];
-/** The single-line answer prompt drawn after the options (no bracketed default). */
-export const INSTALL_BRIDGE_ONBOARDING_CHOICE_PROMPT = "Enter 1 or 2: ";
-/** The one hint line printed after a blank/invalid answer, before the single re-prompt. */
-export const INSTALL_BRIDGE_ONBOARDING_CHOICE_HINT = "Enter 1 or 2.";
+export const INSTALL_BRIDGE_EMAIL_OR_TOKEN_PROMPT = "Email (or press Enter if you already have a token): ";
+/** The one hint line printed after a non-blank malformed answer, before the single re-prompt. */
+export const INSTALL_BRIDGE_EMAIL_OR_TOKEN_HINT = "Enter an email address, or press Enter if you already have a token.";
 /**
  * The one place the "no usable credential" copy lives (BAPI-667, U1-3).
  *
- * Centralized because the chooser failure and {@link resolveApiKey}'s two failure
+ * Centralized because the entry-prompt failure and {@link resolveApiKey}'s two failure
  * branches previously drifted: only one of them mentioned self-serve, and one
  * advised "try the hidden prompt again" — false, because the process has already
  * exited by the time the user reads it. All three now name the SAME three routes.
  */
-export const INSTALL_BRIDGE_ENTRY_ROUTES_ADVICE = "Re-run install: on a bare interactive run answer 1 to request a new token or 2 if you " +
-    "already have one (an invite or an API key — either one is accepted at the hidden prompt). " +
+export const INSTALL_BRIDGE_ENTRY_ROUTES_ADVICE = "Re-run install: on a bare interactive run, type your email to sign up, or press Enter if you " +
+    "already have a token (an invite or an API key — either one is accepted at the hidden prompt). " +
     "Non-interactively, pass --api-key <key> (or set BAPI_API_KEY) for an " +
     "existing project, --invite if you were sent an invite token, or --email <addr> to sign up.";
 /**
@@ -2312,7 +2308,7 @@ export const INSTALL_BRIDGE_ENTRY_ROUTES_ADVICE = "Re-run install: on a bare int
  * key-on-invite exits non-zero) is preserved BY CONSTRUCTION. Do not "unify" the
  * two.
  */
-export async function resolveInstallBridgeOnboardingBranchForRun(options, deps, argv) {
+export async function resolveInstallBridgeOnboardingBranchForRun(options, deps, argv, baseUrl = DEFAULT_BAPI_BASE_URL) {
     const branch = resolveInstallBridgeOnboardingBranch(options, deps.env);
     // An explicit need-key intent is already unambiguous — never re-ask it.
     if (branch.kind === "need-key")
@@ -2324,38 +2320,35 @@ export async function resolveInstallBridgeOnboardingBranchForRun(options, deps,
     }
     const promptLine = deps.promptLine;
     try {
-        // Render the heading + options EXACTLY once; a re-prompt after an invalid
-        // answer re-asks the question without redrawing the list (BAPI-663 contract).
-        deps.log(INSTALL_BRIDGE_KEY_SELECTOR_PROMPT);
-        for (const choice of INSTALL_BRIDGE_ONBOARDING_CHOICES)
-            deps.log(choice);
+        // The answer may be an email, so the privacy notice comes first and prints once.
+        deps.log(buildInstallBridgeSignupPrivacyNotice(baseUrl));
         // Bounded to two reads total: the first answer, then ONE re-prompt after a
         // single hint line. EOF resolves as an empty answer (promptLineViaReadline
-        // resolves "" on close), so it costs one re-prompt and then fails cleanly —
-        // it can never hang or silently select a branch.
+        // resolves "" on close), which selects the have-key branch rather than hanging.
         for (let attempt = 0; attempt < 2; attempt += 1) {
-            const answer = (await promptLine(INSTALL_BRIDGE_ONBOARDING_CHOICE_PROMPT)).trim();
-            // BAPI-708 (A-1): the accepted tokens are exactly 1/2 (no letters, no
-            // aliases), preserving the one-strict-line contract. BAPI-1171 swapped the
-            // order so "1" is the self-serve need-key branch and "2" routes to the
-            // have-key branch's credential-agnostic prompt, whose value is classified by
-            // SHAPE — so a user holding an invite still lands in the redemption protocol
-            // without ever having been asked which kind of token they hold.
-            if (answer === "1") {
+            const answer = String((await promptLine(INSTALL_BRIDGE_EMAIL_OR_TOKEN_PROMPT)) ?? "").trim();
+            // Blank (or EOF): the user has a token; it is read only by the hidden prompt.
+            if (answer.length === 0) {
+                return { ok: true, branch: { kind: "have-key" }, credentialIntent: "inferred" };
+            }
+            // A typed value is accepted ONLY as a signup email. It is never classified as a
+            // credential, logged, or persisted here; a token-shaped value fails the shape
+            // check and gets the hint.
+            if (INSTALL_BRIDGE_SIGNUP_EMAIL_SHAPE.test(answer)) {
                 return {
                     ok: true,
                     branch: { kind: "need-key", method: "self-serve" },
                     credentialIntent: "inferred",
+                    onboardingEmail: answer,
+                    privacyNoticeShown: true,
                 };
             }
-            if (answer === "2")
-                return { ok: true, branch: { kind: "have-key" }, credentialIntent: "inferred" };
             if (attempt === 0)
-                deps.log(INSTALL_BRIDGE_ONBOARDING_CHOICE_HINT);
+                deps.log(INSTALL_BRIDGE_EMAIL_OR_TOKEN_HINT);
         }
         return {
             ok: false,
-            error: `No option was selected. ${INSTALL_BRIDGE_ENTRY_ROUTES_ADVICE}`,
+            error: `No email or token choice was made. ${INSTALL_BRIDGE_ENTRY_ROUTES_ADVICE}`,
         };
     }
     catch {
@@ -2464,22 +2457,31 @@ const SELECTION_TOKEN_PATTERN = /^[1-9][0-9]*$/;
  * Interactive single-shot numbered picker on stderr (TTY only). Renders the
  * heading and each option exactly once, then accepts ONE strict
  * comma-separated line of one-based numbers and resolves immediately — there
- * is no preselected/toggle state and no separate confirmation step (BAPI-663).
+ * is no toggle state and no separate confirmation step (BAPI-663).
+ *
+ * BAPI-1448: when `preselected` names at least one offered option, those rows
+ * render as `[x]` (the rest as `[ ]`) and a blank line accepts the ticked set.
+ * Typed numbers REPLACE the ticked set; they never toggle it. With nothing
+ * pre-ticked the original behaviour is unchanged: a blank line is rejected with
+ * "Select at least one tool."
  *
- * A blank line or a line containing any invalid token (non-numeric, zero,
- * signed, leading-zero, decimal, out-of-range) is rejected atomically — the
- * whole line is discarded, one error line is printed, and the picker
- * re-prompts without re-rendering the option list. A valid line is
- * deduplicated and returned in `options` order regardless of entry order.
+ * A line containing any invalid token (non-numeric, zero, signed,
+ * leading-zero, decimal, out-of-range) is rejected atomically — the whole line
+ * is discarded, one error line is printed, and the picker re-prompts without
+ * re-rendering the option list, so the ticks stay as first shown. A valid line
+ * is deduplicated and returned in `options` order regardless of entry order.
  *
  * Resolves to `[]` on EOF / synchronous close before any line has been
  * committed, so a readline regression can never hang. Returns `[]`
  * immediately, without creating a readline interface, when `options` is
  * empty.
  */
-export function promptMultiSelectViaReadline(promptText, options, input = process.stdin, output = process.stderr) {
+export function promptMultiSelectViaReadline(promptText, options, input = process.stdin, output = process.stderr, preselected = []) {
     if (options.length === 0)
         return Promise.resolve([]);
+    // Canonical option order, restricted to options actually offered.
+    const ticked = options.filter((o) => preselected.includes(o.id)).map((o) => o.id);
+    const hasTicks = ticked.length > 0;
     return new Promise((resolve) => {
         const rl = readline.createInterface({ input, output });
         let settled = false;
@@ -2496,13 +2498,20 @@ export function promptMultiSelectViaReadline(promptText, options, input = proces
         rl.on("close", () => finish([]));
         output.write(`\n${promptText}\n`);
         options.forEach((opt, idx) => {
-            output.write(`  ${idx + 1}. ${opt.label}\n`);
+            const box = hasTicks ? `${ticked.includes(opt.id) ? "[x]" : "[ ]"} ` : "";
+            output.write(`  ${idx + 1}. ${box}${opt.label}\n`);
         });
-        output.write("Enter the number(s) of the tools you use (e.g. 1,3), then Enter.\n");
+        output.write(hasTicks
+            ? "Press Enter to use the ticked tools, or type the numbers you use (e.g. 1,3).\n"
+            : "Enter the number(s) of the tools you use (e.g. 1,3), then Enter.\n");
         const prompt = () => {
             rl.question("> ", (answer) => {
                 const trimmed = answer.trim();
                 if (trimmed.length === 0) {
+                    if (hasTicks) {
+                        finish(ticked);
+                        return;
+                    }
                     output.write("Select at least one tool.\n");
                     prompt();
                     return;
@@ -2553,10 +2562,6 @@ export function optimizationPostureSubscriptionNounPhrase(primaryPlatform) {
     const mapped = primaryPlatform ? OPTIMIZATION_POSTURE_SUBSCRIPTION_NAMES[primaryPlatform] : undefined;
     return mapped ? `${mapped} subscription` : "coding subscription";
 }
-/** Option three's exact wording, platform-aware (BAPI-1221 Step 2). */
-function buildOptimizationPostureOptionThree(primaryPlatform) {
-    return `Get the most out of your ${optimizationPostureSubscriptionNounPhrase(primaryPlatform)}?`;
-}
 /** The neutral single-line correction reprompted for any malformed answer. */
 const OPTIMIZATION_POSTURE_CORRECTION = "Enter a single number from 1 to 3.";
 /**
@@ -2572,20 +2577,21 @@ const OPTIMIZATION_POSTURE_CORRECTION = "Enter a single number from 1 to 3.";
 const OPTIMIZATION_POSTURE_MAX_CORRECTIONS = 20;
 /**
  * Render the one-time posture menu and its input instruction. Exactly three
- * vertically ordered numbered options; option three is platform-aware. Plain,
- * wrap-safe text — no color-only state, icons, or decorative framing.
+ * vertically ordered numbered options; option three names the user's own
+ * subscription. Plain, wrap-safe text (every line within 80 columns) — no
+ * color-only state, icons, or decorative framing.
  */
 function buildOptimizationPostureMenu(primaryPlatform) {
-    return ("How should Bridge optimize its work on this repository?\n" +
-        "  1. Quality — fuller planning and review policy.\n" +
-        "  2. Speed — a combined planning pass and normally one review round.\n" +
-        `  3. ${buildOptimizationPostureOptionThree(primaryPlatform)} — leaner planning/review defaults\n` +
-        "     and lower harness model tiers where supported.\n" +
-        "These are active defaults, subject to explicit policy/model overrides.\n" +
-        `Your ${optimizationPostureSubscriptionNounPhrase(primaryPlatform)} is separate from Bridge credits.\n` +
-        "Enter keeps an existing saved preference; projects without one use Quality.\n" +
-        "You can change this later with /teach-bridge.\n" +
-        `${OPTIMIZATION_POSTURE_CORRECTION} `);
+    return ("How should Bridge balance quality and cost on this project?\n" +
+        "  1. Quality — Bridge plans and reviews each ticket in full depth; slowest and\n" +
+        "     uses the most credits, but catches the most problems.\n" +
+        "  2. Speed — Bridge plans in one pass and reviews once; faster and cheaper, but\n" +
+        "     may miss things on some tickets.\n" +
+        "  3. Token Efficiency — Bridge will use Speed settings and hand simpler tickets\n" +
+        "     to smaller models more often, which stretches your\n" +
+        `     ${optimizationPostureSubscriptionNounPhrase(primaryPlatform)} the furthest.\n` +
+        "Press Enter to keep Quality (or your saved choice).\n" +
+        "Enter 1, 2, or 3: ");
 }
 /**
  * The purpose-built, strict single-select optimization-posture picker
@@ -2675,7 +2681,7 @@ function optimizationPostureConfirmationPhrase(value, primaryPlatform) {
 }
 /** Printed immediately after a successful posture write, on its own line. */
 const OPTIMIZATION_POSTURE_BLOG_URL = "https://bridgegpt.ai/blog/how-we-optimize-your-setup";
-const OPTIMIZATION_POSTURE_REMEDIATION = "Update it later with /teach-bridge or the optimization_posture setting in the web UI.";
+const OPTIMIZATION_POSTURE_REMEDIATION = "Change it later by running /teach-bridge in your agent.";
 /**
  * The generic, secret-free fail-open message shared by every non-success,
  * non-forbidden outcome — an interactive no-answer/prompt-exception (no PUT
@@ -2709,8 +2715,9 @@ function reportOptimizationPostureOutcome(log, result, value, primaryPlatform) {
  * Resolve the selected host platforms with strict precedence (BAPI-635):
  *   1. explicit `--tools` (including an explicit EMPTY selection — never falls
  *      back to detection),
- *   2. interactive multi-select on a TTY (AC-2: no row pre-selected — the picker
- *      starts empty and requires an explicit ≥1 selection),
+ *   2. interactive multi-select on a TTY, pre-ticked with the detected tools
+ *      (BAPI-1448 reverses the BAPI-635 AC-2 empty picker; with nothing detected
+ *      the picker still requires an explicit ≥1 selection),
  *   3. the legacy non-TTY automatic set: Claude Code plus only the currently
  *      detected Copilot VS Code and Cursor automatic targets (never Codex just
  *      because a global directory exists).
@@ -2720,11 +2727,12 @@ export async function resolveSelectedHostPlatforms(deps, options) {
     if (options.tools !== undefined) {
         return options.tools;
     }
-    // 2. Interactive single-shot numbered picker on a TTY. No row is pre-selected
-    // — the picker has no default state and requires an explicit selection.
+    // 2. Interactive single-shot numbered picker on a TTY, seeded with the locally
+    // detected tools (BAPI-1448): Enter accepts them, typed numbers replace them.
     if (deps.isTTY && deps.promptMultiSelect) {
         const optionList = allHostTargets().map((t) => ({ id: t.id, label: t.label }));
-        const chosen = await deps.promptMultiSelect(INSTALL_BRIDGE_TOOL_SELECTOR_PROMPT, optionList);
+        const detected = detectDefaultPlatforms(await buildDetectionContext(deps));
+        const chosen = await deps.promptMultiSelect(INSTALL_BRIDGE_TOOL_SELECTOR_PROMPT, optionList, detected);
         return HOST_PLATFORM_ORDER.filter((id) => chosen.includes(id));
     }
     // 3. Legacy non-TTY automatic set: Claude + detected Cursor / Copilot VS Code.
@@ -2842,42 +2850,6 @@ export function toolLabelForLaunchAgent(agent) {
     const target = allHostTargets().find((t) => t.launchAgent === agent);
     return target?.label ?? UNKNOWN_LAUNCH_TOOL_LABEL;
 }
-/**
- * Interactive numbered chooser for when MORE THAN ONE launchable tool was selected
- * (AC-11). Mirrors the connect-github picker: prints each candidate by its host-tool
- * label, asks for an exact numeric choice with NO default, validates the range, and
- * returns the chosen agent. Returns `null` — never a silent first-candidate default —
- * for every unavailable/invalid path: non-TTY, a missing `promptLine` seam, blank/EOF
- * input, an out-of-range or malformed answer, or a prompt that throws. Single-purpose:
- * it must run only AFTER the multi-select promise has resolved and closed its readline
- * interface so two readers never contend for stdin.
- */
-export async function chooseInstallBridgeLaunchAgent(agents, deps) {
-    if (!deps.isTTY || !deps.promptLine)
-        return null;
-    const promptLine = deps.promptLine;
-    try {
-        deps.log("");
-        deps.log("More than one selected tool can host the configuration session:");
-        agents.forEach((agent, i) => {
-            deps.log(`  ${String(i + 1).padStart(2, " ")}. ${toolLabelForLaunchAgent(agent)}`);
-        });
-        // No default: a stray Enter must not silently pick a tool.
-        const answer = (await promptLine(`Which tool should open? [1-${agents.length}]: `)).trim();
-        const index = Number(answer);
-        if (!/^\d+$/.test(answer) ||
-            !Number.isInteger(index) ||
-            index < 1 ||
-            index > agents.length) {
-            return null;
-        }
-        return agents[index - 1];
-    }
-    catch {
-        // Never surface caught exception text; an unavailable chooser is a no-spawn.
-        return null;
-    }
-}
 /**
  * Shared, copy-pasteable "we didn't open a session for you" guidance so every
  * no-spawn path (no-launchable selection, non-TTY suppression, chooser failure,
@@ -3962,7 +3934,7 @@ export async function exchangeBootstrapInvite(deps, baseUrl, token, repoName, ke
     return {
         ok: false,
         kind: "failed",
-        message: `The bootstrap exchange failed (HTTP ${resp.status}). Preserve proof and rerun the same attempt; verify server compatibility and contact installation support if it persists.`,
+        message: `The bootstrap exchange failed (HTTP ${resp.status}). Preserve proof and rerun the same attempt; verify server compatibility and contact Bridge support at ${BRIDGE_SUPPORT_EMAIL} if it persists.`,
     };
 }
 /** The invite-email prompt (BAPI-1263), shown once after an `email_required` refusal. */
@@ -4128,6 +4100,27 @@ export function buildSelfServeMintUrl(baseUrl) {
 export const SIGNUP_VERIFICATION_CODE_LENGTH = 6;
 /** The one prompt label. The E2E harness and the static contract both pin it. */
 export const INSTALL_BRIDGE_CODE_PROMPT = "Email verification code: ";
+/**
+ * The address verification codes are sent from. Mirrors the server's
+ * `DEFAULT_FROM_ADDRESS` in `api/library/email/provider.py`; keep the two in step.
+ */
+export const INSTALL_BRIDGE_VERIFICATION_SENDER = "noreply@bridgegpt-api.com";
+/**
+ * The shared lead-in printed immediately before every self-serve
+ * {@link promptForVerificationCode} call (modern and legacy paths, fresh or resumed):
+ * three unindented lines, then a blank line. It prints neither the prompt nor any
+ * expiry or time-left text.
+ *
+ * BAPI-1449 (verification recovery) builds on this lead-in instead of adding its
+ * own, and may later return the sender from the request endpoint rather than using
+ * {@link INSTALL_BRIDGE_VERIFICATION_SENDER}.
+ */
+export function logVerificationCodeLeadIn(log, email) {
+    log(`We emailed a ${SIGNUP_VERIFICATION_CODE_LENGTH}-digit code to ${maskSignupEmail(email)}.`);
+    log(`It usually arrives within two minutes. It comes from ${INSTALL_BRIDGE_VERIFICATION_SENDER} — check your`);
+    log("spam or junk folder if you don't see it.");
+    log("");
+}
 /** Shown when a stored, unexpired challenge is picked up on a later run. */
 export const INSTALL_BRIDGE_RESUME_VERIFICATION_HEADING = "Resume email verification";
 /**
@@ -4255,6 +4248,95 @@ export const INSTALL_BRIDGE_SIGNUP_BLOCKED = "Error: Bridge signup is not availa
 export function formatSelfServeUnexpectedStatus(status) {
     return `Error: Bridge signup returned an unexpected response (status ${status}). Try again in a few minutes.`;
 }
+// ===================================================================
+// BAPI-1449 — modern-path verification recovery copy (S1–S7).
+//
+// The wording is settled; only the sender comes from the shared
+// INSTALL_BRIDGE_VERIFICATION_SENDER constant. None of these says WHY a server
+// rejection happened: the word "expired" appears only in S4a, which is chosen from
+// the locally stored expiry and never from a server reply.
+// ===================================================================
+/** The existing end-of-run line for a prompt that gave up or timed out empty. */
+export const INSTALL_BRIDGE_VERIFICATION_INCOMPLETE = "Verification incomplete. Resume the same signup from this folder.";
+/** S1 — the first empty Enter at the modern code prompt. */
+export const INSTALL_BRIDGE_EMPTY_CODE_GUIDANCE = [
+    "No code yet? Type r to send a new one, or check spam for mail from",
+    `${INSTALL_BRIDGE_VERIFICATION_SENDER}.`,
+    "Wrong address? Press Ctrl-C and re-run install with a different email.",
+    "Have a teammate on Bridge? Ask them for an invite and choose",
+    '"I already have a token".',
+].join("\n");
+/** S2 — after a rejected code while resends may remain. */
+export const INSTALL_BRIDGE_REJECTED_RESEND_HINT = "Type r to send a new code, or enter the code again.";
+/** S3 — `r` after the server reported no resends left. */
+export const INSTALL_BRIDGE_NO_MORE_CODES = [
+    "Bridge cannot send more codes for this signup.",
+    "Enter a code from an email you already received.",
+].join("\n");
+/** S4a — the saved challenge is past its locally stored expiry. */
+export const INSTALL_BRIDGE_RECOVERY_REASON_EXPIRED = "The code for this signup has expired.";
+/** S4b — the saved signup has no challenge handle (or expiry). */
+export const INSTALL_BRIDGE_RECOVERY_REASON_NO_CODE = "The last signup in this folder did not finish, so no code is waiting.";
+/** S4c — this run's email differs from the saved signup's email. */
+export const INSTALL_BRIDGE_RECOVERY_REASON_DIFFERENT_EMAIL = "This folder has a signup waiting for a different email address.";
+/** S5 — the rejection cap was reached (state-neutral). */
+export const INSTALL_BRIDGE_RECOVERY_REASON_CAP = "That signup could not be verified. Nothing has been created.";
+/** S6 — the user declined a fresh signup. */
+export const INSTALL_BRIDGE_FRESH_SIGNUP_DECLINED = [
+    "Nothing has been created. Your saved signup is kept.",
+    "Re-run install from this folder when you are ready.",
+].join("\n");
+/** S7 — the user accepted; printed after the old attempt is archived. */
+export const INSTALL_BRIDGE_FRESH_SIGNUP_STARTING = "Starting a new signup. The old attempt was set aside, not deleted.";
+/**
+ * The default-No question after S4a/S4b/S4c/S5. Names only the MASKED address of
+ * THIS run's email; the full address is never printed.
+ */
+export function formatFreshSignupQuestion(thisRunEmail) {
+    return `Start a new signup? We will email a new code to ${maskSignupEmail(thisRunEmail)}. [y/N]: `;
+}
+/** The legacy "could not be requested" line for a rejected email (HTTP 400/422). */
+export const INSTALL_BRIDGE_SELF_SERVE_REQUEST_INVALID = "Error: Self-serve setup could not be requested. Check the email value and try again.";
+/**
+ * Map a failed challenge REQUEST to its user-facing line, with the legacy loop's
+ * category mapping. Carries no response body, email, or exception text.
+ */
+export function formatSelfServeChallengeRequestFailure(failure) {
+    switch (failure.category) {
+        case "rate-limited":
+            return `Error: ${INSTALL_BRIDGE_RESEND_THROTTLED}`;
+        case "unavailable":
+        case "network-error":
+            return INSTALL_BRIDGE_SIGNUP_UNAVAILABLE;
+        case "invalid":
+            return INSTALL_BRIDGE_SELF_SERVE_REQUEST_INVALID;
+        case "blocked":
+            return INSTALL_BRIDGE_SIGNUP_BLOCKED;
+        case "unexpected":
+            return formatSelfServeUnexpectedStatus(failure.status ?? 0);
+        default:
+            return INSTALL_BRIDGE_SIGNUP_UPGRADE_REQUIRED;
+    }
+}
+/**
+ * Map a failed VERIFY (other than the uniform `rejected`) to its user-facing line,
+ * with the legacy loop's mapping. Carries no response body, code, or handle.
+ */
+export function formatSelfServeVerifyFailure(failure) {
+    switch (failure.category) {
+        case "rate-limited":
+            return `Error: ${INSTALL_BRIDGE_VERIFY_THROTTLED}`;
+        case "server-error":
+        case "network-error":
+            return INSTALL_BRIDGE_VERIFY_SERVER_ERROR;
+        case "blocked":
+            return INSTALL_BRIDGE_SIGNUP_BLOCKED;
+        case "unexpected":
+            return formatSelfServeUnexpectedStatus(failure.status ?? 0);
+        default:
+            return INSTALL_BRIDGE_SIGNUP_UPGRADE_REQUIRED;
+    }
+}
 /**
  * Mask an address for display: first character, then the domain.
  *
@@ -4296,23 +4378,10 @@ export function formatChallengeRemaining(expiresAtIso, nowMs) {
     const hours = Math.floor(minutes / 60);
     return `This code is valid for about another ${hours} hours.`;
 }
-/**
- * Prompt for the verification code, validating its shape LOCALLY before any
- * network call.
- *
- * Local validation is a courtesy, not a security control — the server re-validates
- * everything — but it keeps a mistyped code from consuming one of the five attempts
- * that permanently kill a challenge. The user gets the prompt back instead.
- *
- * Pasted input is trimmed: copying a code out of a mail client routinely brings
- * whitespace with it, and refusing that would be an avoidable dead end.
- *
- * The entered value is returned and never echoed, never logged, and never written
- * to disk. `null` means the user gave up (an empty line, or an unreadable prompt).
- */
-export async function promptForVerificationCode(deps, log, maxAttempts = 3) {
+export async function promptForVerificationCode(deps, log, maxAttempts = 3, options = {}) {
+    const allowResend = options.allowResend ?? false;
     if (!deps.promptLine)
-        return null;
+        return { kind: "give-up" };
     for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
         let entered;
         try {
@@ -4321,17 +4390,19 @@ export async function promptForVerificationCode(deps, log, maxAttempts = 3) {
         catch {
             // Secret-free by construction: the caught value is never surfaced or
             // inspected, because a readline failure can carry the partial input.
-            return null;
+            return { kind: "give-up" };
         }
         if (entered.length === 0)
-            return null;
+            return { kind: "empty" };
+        if (allowResend && entered.toLowerCase() === "r")
+            return { kind: "resend" };
         if (new RegExp(`^[0-9]{${SIGNUP_VERIFICATION_CODE_LENGTH}}$`).test(entered)) {
-            return entered;
+            return { kind: "code", code: entered };
         }
         // Describes the SHAPE, never the value the user typed.
         log(`  That does not look like a code — it is ${SIGNUP_VERIFICATION_CODE_LENGTH} digits.`);
     }
-    return null;
+    return { kind: "give-up" };
 }
 /*
  * `mintSelfServeInvite` and `SelfServeMintResult` were REMOVED in BAPI-757.
@@ -4898,8 +4969,8 @@ function buildDeferredLaunchStepPreview() {
 /**
  * The optional agent-notes offer preview line (BAPI-1207). A --dry-run never
  * prompts or writes; when the selection resolves to at least one writable
- * notes target this states plainly that a real interactive run would ask
- * default-No consent before touching it. Empty when the selection resolves to
+ * notes target this states plainly that a real interactive run writes it
+ * without asking. Empty when the selection resolves to
  * no writable target (e.g. Windsurf-only), mirroring how the GitHub offer
  * lines are unconditional but this offer's applicability is not.
  */
@@ -4914,10 +4985,10 @@ function buildAgentNotesPreviewLines(notesTargets, platformLabels) {
         "Step 4c — reached only after the Step 4b VCS connect offer has completed or been",
         "          explicitly deferred (a declined or incomplete connect is announced first,",
         "          with the command to finish it later, and never blocks this step).",
-        `Step 4c — optional: Bridge MCP guidance for ${subject} (SKIPPED in --dry-run): if the`,
-        `          terminal is interactive, offer to write guidance so ${subject} know${plural ? "" : "s"} when to reach`,
-        `          for Bridge's MCP tools, in a Bridge-owned marker region in ${notesTargets.join(" and ")}; defaults`,
-        "          to Yes [Y/n] on submitted Enter; EOF skips. Existing content outside that region is preserved. No notes files are",
+        `Step 4c — Bridge MCP guidance for ${subject} (SKIPPED in --dry-run): if the`,
+        `          terminal is interactive, a real run writes guidance so ${subject} know${plural ? "" : "s"} when to reach`,
+        `          for Bridge's MCP tools, in a Bridge-owned marker region in ${notesTargets.join(" and ")}, without asking,`,
+        "          then prints how to remove it. Existing content outside that region is preserved. No notes files are",
         "          written in --dry-run.",
     ];
 }
@@ -5395,10 +5466,6 @@ export function isMinttyNonInteractiveInstall(platform, env, isTTY) {
 }
 export async function runInstallBridgeCli(argv, overrides = {}) {
     const deps = { ...createDefaultInstallBridgeDeps(), ...overrides };
-    if (Object.prototype.hasOwnProperty.call(overrides, "promptLine") &&
-        !Object.prototype.hasOwnProperty.call(overrides, "promptGuidanceLine")) {
-        deps.promptGuidanceLine = undefined;
-    }
     // When the caller overrode only `fetch` (the common test seam), bind the
     // default resolver to the FINAL merged fetch so server resolution still routes
     // through the override. An explicit `resolveRepoViaServer` override is honored.
@@ -5537,6 +5604,9 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
             // Built from the FINAL merged deps for the same reason (BAPI-775): a test
             // that overrides only `readFile` or only `cwd` must see its override here.
             localProvisioning: buildConductorLocalDeps(deps),
+            // BAPI-1461: the converging setup's seams (sign-ins, the stored merge token,
+            // the stored test command, the CI workflow installer, and indexing).
+            setup: deps.conductorSetup ?? buildConductorSetupDeps(deps, log, errorLog),
             // BAPI-1391: the read-only discovery filesystem over THIS working tree, and
             // the short-lived qualifying executor (the existing executor CLI with a
             // `runExecutor` override limiting it to `gate_qualification` jobs).
@@ -5749,7 +5819,7 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
     // The selection is pure and deterministic for every explicit, env-driven, and
     // non-TTY invocation; only a BARE interactive run is asked which branch it wants
     // (BAPI-626 — otherwise a first-time user can never reach self-serve).
-    const branchResult = await resolveInstallBridgeOnboardingBranchForRun(options, deps, argv);
+    const branchResult = await resolveInstallBridgeOnboardingBranchForRun(options, deps, argv, baseUrl);
     if (!branchResult.ok) {
         errorLog(`Error: ${branchResult.error}`);
         return 1;
@@ -5791,7 +5861,12 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
     // key-authentication ping, so there is no source to attribute.
     let apiKeySource;
     if (selfServeSignupMode) {
-        const emailResult = await resolveSignupEmail(options, deps, baseUrl);
+        const emailResult = await resolveSignupEmail(options, deps, baseUrl, branchResult.onboardingEmail
+            ? {
+                email: branchResult.onboardingEmail,
+                privacyNoticeShown: branchResult.privacyNoticeShown === true,
+            }
+            : undefined);
         if (!emailResult.ok) {
             errorLog(`Error: ${emailResult.error}`);
             return 1;
@@ -5931,6 +6006,9 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         return 1;
     }
     let modernAttempt;
+    // BAPI-1449: an expired basename-keyed signup is offered a fresh modern signup by
+    // the modern path (consent first), instead of ending the run here.
+    let legacyExpired;
     if (options.tools?.length === 0 && !options.agentName) {
         log(buildManualInstallBridgeContinuation("empty-selection", []));
         return 0;
@@ -5956,22 +6034,22 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                 }
                 if (legacy.state === "resumable" || legacy.state === "challenge")
                     options.repo = oldName.value;
-                if (legacy.state === "challenge-expired") {
-                    errorLog("Saved signup expired. Preserve proof and contact installation support.");
-                    return 1;
-                }
+                if (legacy.state === "challenge-expired")
+                    legacyExpired = { repoName: oldName.value, snapshot: legacy.snapshot };
             }
         }
         if (options.repo === undefined) {
             try {
-                modernAttempt = await redeemModernInstallAttempt(deps, options, baseUrl, inviteToken, signupEmail, selfServeSignupMode);
+                modernAttempt = await redeemModernInstallAttempt(deps, options, baseUrl, inviteToken, signupEmail, selfServeSignupMode, legacyExpired);
                 apiKey = modernAttempt.record.keySecret;
                 options.repo = modernAttempt.repoName;
                 bootstrapInviteMode = false;
                 deps.log(`Project '${modernAttempt.displayName}' recovered; completing installation.`);
             }
             catch (error) {
-                errorLog(error instanceof ModernInstallRecoveryError ? error.message : "Installation could not complete. Preserve recovery proof and resume from the same folder and invite/signup; contact installation support if needed.");
+                if (error instanceof ModernInstallStopped)
+                    return 1;
+                errorLog(error instanceof ModernInstallRecoveryError ? error.message : `Installation could not complete. Preserve recovery proof and resume from the same folder and invite/signup; contact Bridge support at ${BRIDGE_SUPPORT_EMAIL} if needed.`);
                 return 1;
             }
         }
@@ -6137,10 +6215,10 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         return 0;
     }
     // ---- Finalize the launch agent for spawn-capable decisions ----
-    // choose-one: pick exactly one via the numbered chooser (TTY only); a non-TTY run or
-    // a failed/aborted chooser degrades to the manual continuation (finalAgentName stays
-    // null). This runs AFTER the multi-select readline closed and BEFORE the GitHub /
-    // consent flows, so no two stdin readers ever overlap.
+    // choose-one: on a TTY, take the first launchable agent the user selected and say so
+    // (BAPI-1448 retired the launch-agent chooser; `--agent` still wins
+    // upstream in the pure launch decision). A non-TTY run degrades to the manual
+    // continuation (finalAgentName stays null).
     let finalAgentName = null;
     let finalSpawnCommand = null;
     if (planLaunch.kind === "spawn") {
@@ -6148,8 +6226,9 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         finalSpawnCommand = planLaunch.spawnCommand;
     }
     else if (planLaunch.kind === "choose-one") {
-        const chosen = await chooseInstallBridgeLaunchAgent(planLaunch.agents, deps);
+        const chosen = deps.isTTY ? (planLaunch.agents[0] ?? null) : null;
         if (chosen) {
+            log(`Using ${toolLabelForLaunchAgent(chosen)} for the setup session (the first tool you selected). Pass --agent to choose another.`);
             const spec = resolveAgentSpec(chosen);
             if (!spec) {
                 errorLog(`Error: no launch agent is registered for '${chosen}'.`);
@@ -6159,7 +6238,7 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
             const modelAlias = await resolveValidatedPremiumModelAlias(deps, spec);
             finalSpawnCommand = deps.buildShellCommand(spec, INSTALL_BRIDGE_AGENT_PROMPT, deps.cwd, deps.platform, modelAlias);
         }
-        // chosen === null → non-TTY / unavailable / invalid → manual continuation below.
+        // chosen === null → non-TTY → manual continuation below.
     }
     // planLaunch.kind === "manual" (no-launchable) → finalAgentName stays null.
     // ---- Materialize the Step 5 launch command + kick off the pre-warm — ONLY for a
@@ -6348,7 +6427,6 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                     challengeExpiresAt = liveChallenge.expiresAt;
                     challengeEmail = liveChallenge.email;
                     log(`  ${INSTALL_BRIDGE_RESUME_VERIFICATION_HEADING}`);
-                    log(`  We already emailed a code to ${maskSignupEmail(challengeEmail)}.`);
                 }
                 else {
                     const requested = await requestSelfServeChallenge(deps, baseUrl, signupEmail);
@@ -6365,7 +6443,7 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                             reportFatal(INSTALL_BRIDGE_SIGNUP_UNAVAILABLE);
                         }
                         else if (requested.category === "invalid") {
-                            reportFatal("Error: Self-serve setup could not be requested. Check the email value and try again.");
+                            reportFatal(INSTALL_BRIDGE_SELF_SERVE_REQUEST_INVALID);
                         }
                         else if (requested.category === "blocked") {
                             // BAPI-1171: the request was refused before signup logic ran — an
@@ -6408,12 +6486,9 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                             "No workspace has been set up — fix the problem and re-run.");
                         return false;
                     }
-                    log(`  We emailed a code to ${maskSignupEmail(challengeEmail)}.`);
                 }
-                log(`  Enter the ${SIGNUP_VERIFICATION_CODE_LENGTH}-digit code to finish setting up your workspace.`);
-                const remaining = formatChallengeRemaining(challengeExpiresAt, deps.now());
-                if (remaining)
-                    log(`  ${remaining}`);
+                // BAPI-1448: the shared lead-in, fresh or resumed, directly before code entry.
+                logVerificationCodeLeadIn(log, challengeEmail);
                 // Phase 2, second half, and phase 3. One resend is offered on the recovery
                 // path only — never proactively — so the budget is spent on the user's
                 // explicit request rather than by the CLI's own retry logic.
@@ -6424,12 +6499,15 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                 // never succeed, with Ctrl-C as the only way out.
                 let rejections = 0;
                 for (;;) {
-                    const code = await promptForVerificationCode(deps, log);
-                    if (code === null) {
+                    // Resend recognition stays off here: on the legacy path `r` is still malformed
+                    // input, and an empty line or give-up ends the run as it always has.
+                    const prompted = await promptForVerificationCode(deps, log);
+                    if (prompted.kind !== "code") {
                         reportFatal("Error: No verification code entered — nothing has been set up. Re-run this command " +
                             "to continue; the code already emailed to you stays valid until it expires.");
                         return false;
                     }
+                    const code = prompted.code;
                     const verified = await verifySelfServeChallenge(deps, baseUrl, challengeHandle, code);
                     if (verified.ok) {
                         inviteToken = verified.token;
@@ -6820,9 +6898,12 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         // existing value unconditionally — the old value is never read first. A
         // no-answer (or a prompt/stream exception the picker already absorbed)
         // reports the same fail-open remediation without ever attempting a write.
+        let persistedPosture;
         if (optimizationPostureSelection) {
             const postureResult = await persistOptimizationPosture(deps, baseUrl, apiKey, repoName, optimizationPostureSelection);
             reportOptimizationPostureOutcome(log, postureResult, optimizationPostureSelection, selectedPlatforms[0]);
+            if (postureResult.kind === "success")
+                persistedPosture = optimizationPostureSelection;
         }
         else if (optimizationPostureEligible) {
             log(OPTIMIZATION_POSTURE_UNCHANGED_MESSAGE);
@@ -7106,8 +7187,7 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         // selected set. `writeAgentNotes` never touches `writeMcpInstallState` or any
         // other persisted install-state contract — consent is re-evaluated every run.
         const notesPlan = resolveAgentNotesTargets(selectedPlatforms);
-        const notesPlatformLabels = labelsForPlatforms(notesPlan.supportedPlatforms);
-        const notesOffer = await offerAgentGuidanceNotes(deps, log, notesPlan.targets, notesPlatformLabels);
+        const notesOffer = offerAgentGuidanceNotes(deps, notesPlan.targets);
         let notesResult;
         let notesWriteFailed = false;
         if (notesOffer.kind === "consented") {
@@ -7137,10 +7217,20 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         const notesSummaryLine = buildAgentNotesSummaryLine(notesOffer, notesResult, notesWriteFailed, notesPlan.unsupportedPlatforms);
         if (notesSummaryLine)
             log(notesSummaryLine);
+        // The removal hint only when something was actually written (BAPI-1448).
+        const notesWrittenTargets = (notesResult?.files ?? [])
+            .filter((f) => f.status === "written")
+            .map((f) => f.target);
+        if (notesWrittenTargets.length > 0)
+            log(INSTALL_BRIDGE_AGENT_NOTES_REMOVAL_HINT);
+        const notesUnchangedTargets = (notesResult?.files ?? [])
+            .filter((f) => f.status === "skipped")
+            .map((f) => f.target);
         // ---- BAPI-1398: Bridge permission rules for /drive-epic-run (Claude Code) ----
         // After the durable install work and the other offers, before the session
-        // opens. Project rules are written as part of the normal install; the user
-        // settings change asks once and is skipped without a yes or a terminal. Every
+        // opens. Project rules are written as part of the normal install. The user
+        // settings change is NOT part of install (BAPI-1448): it lives in the
+        // `bridge-permissions` subcommand, offered in-session by /drive-epic-run. Every
         // failure here is advisory: a malformed settings file is reported and skipped,
         // and the install still completes.
         if (selectedPlatforms.includes("claude-code")) {
@@ -7149,13 +7239,14 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                     cwd: deps.cwd,
                     homeDir: deps.homedir(),
                     env: deps.env,
-                    promptLine: deps.isTTY ? deps.promptLine : undefined,
                     readFile: deps.readFile,
                     writeFile: (p, data) => deps.writeFile(p, data, { encoding: "utf-8" }),
                     mkdir: (p, o) => deps.mkdir(p, o),
                     log,
                     errorLog,
                     ensureGitignored: (relPath) => ensureGitignoredShared(deps.cwd, relPath, gitignoreDeps),
+                    // BAPI-1446: pin the SessionStart upgrade-notice hook to the effective Claude Code pin.
+                    sessionStartHook: { pinnedVersion: await discoverClaudeCodeEffectivePin({ cwd: deps.cwd, readFile: deps.readFile, targetVersion: VERSION }) },
                 });
             }
             catch {
@@ -7187,6 +7278,27 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         for (const line of buildInstallBridgeMaintenanceHint())
             log(line);
         await showFirstBuildAdvisory(finalAgentName);
+        // ---- BAPI-1448: the defaults summary, once, right before the launch consent ----
+        // Every input is already in memory except the optional ticket prefix, which is one
+        // bounded read of the manifest the GitHub offer already uses. Any failure there just
+        // omits the cell: the summary never blocks or changes the install's outcome.
+        let ticketPrefix;
+        try {
+            const details = await fetchGithubConfigurationDetails({ fetch: deps.fetch, baseUrl, apiKey }, repoName);
+            ticketPrefix = details.ticketPrefix;
+        }
+        catch {
+            ticketPrefix = undefined;
+        }
+        log("");
+        log(buildInstallBridgeDefaultsSummary({
+            displayName: modernAttempt?.displayName ?? repoName,
+            ...(ticketPrefix ? { ticketPrefix } : {}),
+            isNewProject: Boolean(modernAttempt) || bootstrapExchangeSucceeded,
+            ...(persistedPosture ? { persistedPosture } : {}),
+            claudeCodeSelected: selectedPlatforms.includes("claude-code"),
+            guidance: { written: notesWrittenTargets, unchanged: notesUnchangedTargets },
+        }));
         // ---- Step 5 — consent-gate, then spawn the selected tool (or print continuation) ----
         // AC-7: for a spawn-capable path, ask Y/N first (`requestInstallBridgeLaunchConsent`
         // resolves to no-spawn without prompting on a non-TTY run). A decline, a no-launchable
@@ -7303,13 +7415,23 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
 }
 class ModernInstallRecoveryError extends Error {
 }
+/** The run already printed its own output (for example S6) and stops with exit 1. */
+class ModernInstallStopped extends Error {
+}
+/**
+ * A record that may hold redeemed proof. Presence, not truthiness: an empty-string
+ * field still counts. Such a record is never offered a fresh signup.
+ */
+function isProtectedModernRecord(record) {
+    return ["fingerprint", "replayToken", "canonical"].some(field => Object.prototype.hasOwnProperty.call(record, field));
+}
 function modernWriteDeps(deps) {
     return { env: deps.env, homedir: deps.homedir, platform: deps.platform, readFile: deps.readFile,
         mkdir: deps.mkdir, writeFile: deps.writeFile, rename: deps.rename, chmod: deps.chmod, unlink: deps.unlink, open: deps.open };
 }
-async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupEmail, selfServe) {
+async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupEmail, selfServe, legacyExpired) {
     if (!deps.realpath)
-        throw new ModernInstallRecoveryError("Canonical folder resolution is unavailable. Contact installation support.");
+        throw new ModernInstallRecoveryError(`Canonical folder resolution is unavailable. Contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}.`);
     const folder = await deps.realpath(deps.cwd);
     const folderDigest = fingerprintBootstrapFields("bridge-bootstrap-folder-v1", [baseUrl, folder]);
     const signupLocator = `bootstrap-pending:signup:${folderDigest}`;
@@ -7321,30 +7443,50 @@ async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupE
     if (!loaded.ok)
         throw new Error(loaded.error);
     let record = loaded.record;
-    const resumed = record !== null;
+    let resumed = record !== null;
     let label = record?.label ?? options.displayName;
-    if (label === undefined) {
+    // BAPI-1449: an expired legacy basename signup asks for consent BEFORE any label
+    // question, so its label is derived only after the user accepts.
+    const deferLabelForLegacy = selfServe && record === null && legacyExpired !== undefined;
+    const deriveLabel = async () => {
         if (!deps.isTTY || !deps.promptLine)
             throw new ModernInstallRecoveryError("Modern invite creation requires --display-name in a non-interactive terminal.");
+        // BAPI-1448: a valid folder name is the label, with no question. The prompt
+        // survives only for a folder name the validator rejects.
         let suggestion = "";
         try {
             suggestion = validateBootstrapDisplayName(path.basename(folder));
         }
         catch { /* explicit label required */ }
-        const entered = await deps.promptLine(suggestion ? `Project display name [${suggestion}]: ` : "Project display name: ");
-        label = validateBootstrapDisplayName(entered || suggestion);
-    }
+        if (suggestion)
+            return suggestion;
+        return validateBootstrapDisplayName(await deps.promptLine("Project display name: "));
+    };
+    if (label === undefined && !deferLabelForLegacy)
+        label = await deriveLabel();
     if (selfServe) {
         if (!deps.isTTY || !deps.promptLine)
             throw new ModernInstallRecoveryError("Self-serve email verification requires an interactive terminal.");
-        if (!record) {
-            const intent = await prepareModernBootstrapSignup(scope, label, signupEmail, () => generateBootstrapKeySecret(deps.randomBytes), writeDeps);
-            if (!intent.ok || !intent.record)
-                throw new Error(intent.ok ? "Signup proof missing." : intent.error);
-            record = intent.record;
+        // At most one fresh signup per invocation, whichever route accepted it.
+        let freshSignupAccepted = false;
+        const generateKeySecret = () => generateBootstrapKeySecret(deps.randomBytes);
+        const generateArchiveSuffix = () => deps.randomBytes(16).toString("hex");
+        // Print the reason, then ask the default-No question. A decline (or EOF, an empty
+        // line, a thrown prompt) prints S6 and stops with the credential store untouched.
+        const askFreshSignup = async (reason) => {
+            deps.log(reason);
+            if (!(await requestCredentialRouteSwitchConfirmation(deps, formatFreshSignupQuestion(signupEmail)))) {
+                deps.log(INSTALL_BRIDGE_FRESH_SIGNUP_DECLINED);
+                throw new ModernInstallStopped();
+            }
+        };
+        // Request a challenge for THIS run's email, then persist its handle and expiry
+        // BEFORE the prompt. The request happens outside the credential-store lock. On
+        // any failure the saved record stays and is never replaced again in this run.
+        const requestAndSaveChallenge = async () => {
             const requested = await requestSelfServeChallenge(deps, baseUrl, signupEmail);
             if (!requested.ok)
-                throw new ModernInstallRecoveryError("Signup handle could not be established. Preserve recovery proof; contact installation support before restarting signup.");
+                throw new ModernInstallRecoveryError(formatSelfServeChallengeRequestFailure(requested));
             const saved = await mutateModernBootstrapRecord(scope, writeDeps, current => {
                 if (!current)
                     throw new ModernInstallRecoveryError("Signup proof missing.");
@@ -7353,24 +7495,161 @@ async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupE
             if (!saved.ok || !saved.record)
                 throw new Error(saved.ok ? "Signup proof missing." : saved.error);
             record = saved.record;
+        };
+        // Archive the observed record, install a fresh signup for this run's email, then
+        // (only after that is durable) print S7 and request the new challenge.
+        const replaceWithFreshSignup = async (observed) => {
+            const replaced = await archiveAndReplaceModernBootstrapSignup({ scope, observed, email: signupEmail, generateKeySecret, generateArchiveSuffix }, writeDeps);
+            if (!replaced.ok)
+                throw new ModernInstallRecoveryError(replaced.error);
+            freshSignupAccepted = true;
+            resumed = false;
+            record = replaced.record;
+            deps.log(INSTALL_BRIDGE_FRESH_SIGNUP_STARTING);
+            await requestAndSaveChallenge();
+        };
+        if (!record) {
+            if (legacyExpired) {
+                // The basename-keyed legacy signup is the "no modern record" case: ask, derive
+                // the label from the folder basename, then archive it and install the modern
+                // signup in one write.
+                await askFreshSignup(INSTALL_BRIDGE_RECOVERY_REASON_EXPIRED);
+                label = options.displayName ?? await deriveLabel();
+                const replaced = await archiveExpiredLegacySignupAndInstallModern({ repoName: legacyExpired.repoName, observed: legacyExpired.snapshot, now: deps.now(), scope, label, email: signupEmail, generateKeySecret, generateArchiveSuffix }, writeDeps);
+                if (!replaced.ok)
+                    throw new ModernInstallRecoveryError(replaced.error);
+                freshSignupAccepted = true;
+                record = replaced.record;
+                deps.log(INSTALL_BRIDGE_FRESH_SIGNUP_STARTING);
+                await requestAndSaveChallenge();
+            }
+            else {
+                const intent = await prepareModernBootstrapSignup(scope, label, signupEmail, generateKeySecret, writeDeps);
+                if (!intent.ok || !intent.record)
+                    throw new Error(intent.ok ? "Signup proof missing." : intent.error);
+                record = intent.record;
+                await requestAndSaveChallenge();
+            }
+        }
+        else if (!isProtectedModernRecord(record)) {
+            // A saved, unresolved signup. Reasons are checked in this order, and the
+            // expiry is read from the stored value only, never from a server reply.
+            // A malformed stored expiry is treated as unexpired.
+            let reason;
+            if (typeof record.signupEmail === "string" && record.signupEmail.trim().toLowerCase() !== signupEmail.trim().toLowerCase()) {
+                reason = INSTALL_BRIDGE_RECOVERY_REASON_DIFFERENT_EMAIL;
+            }
+            else if (!record.challengeHandle || !record.challengeExpiresAt) {
+                reason = INSTALL_BRIDGE_RECOVERY_REASON_NO_CODE;
+            }
+            else if (Date.parse(record.challengeExpiresAt) <= deps.now()) {
+                reason = INSTALL_BRIDGE_RECOVERY_REASON_EXPIRED;
+            }
+            if (reason !== undefined) {
+                await askFreshSignup(reason);
+                await replaceWithFreshSignup(record);
+            }
         }
+        if (!record)
+            throw new ModernInstallRecoveryError("Recovery proof missing.");
         if (record.replayToken && record.fingerprint) {
             token = record.replayToken;
             fingerprint = record.fingerprint;
             scope = makeScope(`bootstrap-pending:invite:${fingerprint}`);
         }
         else {
+            // Only a protected record can reach these two guards unresolved: an unprotected
+            // one was either offered a fresh signup above or already holds a live challenge.
             if (!record.challengeHandle || !record.challengeExpiresAt)
-                throw new ModernInstallRecoveryError("The previous signup response is unresolved. Preserve proof and contact installation support before restarting.");
-            if (Date.parse(record.challengeExpiresAt) <= deps.now())
-                throw new ModernInstallRecoveryError("The saved verification challenge expired. Preserve proof and contact installation support.");
-            const code = await promptForVerificationCode(deps, deps.log);
-            if (!code)
-                throw new ModernInstallRecoveryError("Verification incomplete. Resume the same signup from this folder.");
-            const verified = await verifySelfServeChallenge(deps, baseUrl, record.challengeHandle, code);
-            if (!verified.ok)
-                throw new ModernInstallRecoveryError("Verification did not complete. Preserve proof and resume the same signup.");
-            token = verified.token;
+                throw new ModernInstallRecoveryError(`The previous signup response is unresolved. Preserve proof and contact Bridge support at ${BRIDGE_SUPPORT_EMAIL} before restarting.`);
+            if (isProtectedModernRecord(record) && Date.parse(record.challengeExpiresAt) <= deps.now())
+                throw new ModernInstallRecoveryError(`The saved verification challenge expired. Preserve proof and contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}.`);
+            // One pass per challenge. Everything challenge-local resets only when a new
+            // challenge begins; the loop leaves it on a verified code or by throwing.
+            let verifiedToken;
+            for (;;) {
+                const handle = record.challengeHandle;
+                logVerificationCodeLeadIn(deps.log, record.signupEmail ?? signupEmail);
+                let rejections = 0;
+                let consecutiveEmpty = 0;
+                let emptyGuidanceShown = false;
+                // Unknown until a resend in THIS session reports it, including on a resumed
+                // challenge: the first `r` then makes a real request.
+                let resendsRemaining;
+                let capReached = false;
+                // Count a rejection; true when the shared cap was just reached.
+                const countRejection = () => {
+                    deps.errorLog(INSTALL_BRIDGE_VERIFICATION_REJECTED);
+                    rejections += 1;
+                    capReached = rejections >= INSTALL_BRIDGE_MAX_CODE_REJECTIONS;
+                    return capReached;
+                };
+                while (!capReached && verifiedToken === undefined) {
+                    const prompted = await promptForVerificationCode(deps, deps.log, 3, { allowResend: true });
+                    if (prompted.kind === "give-up")
+                        throw new ModernInstallRecoveryError(INSTALL_BRIDGE_VERIFICATION_INCOMPLETE);
+                    if (prompted.kind === "empty") {
+                        consecutiveEmpty += 1;
+                        if (consecutiveEmpty >= 2)
+                            throw new ModernInstallRecoveryError(INSTALL_BRIDGE_VERIFICATION_INCOMPLETE);
+                        if (!emptyGuidanceShown) {
+                            deps.log(INSTALL_BRIDGE_EMPTY_CODE_GUIDANCE);
+                            emptyGuidanceShown = true;
+                        }
+                        continue;
+                    }
+                    consecutiveEmpty = 0;
+                    if (prompted.kind === "resend") {
+                        if (resendsRemaining === 0) {
+                            deps.log(INSTALL_BRIDGE_NO_MORE_CODES);
+                            continue;
+                        }
+                        // The server enforces the cooldown and the resend budget; there is no
+                        // client timer or cap. The stored expiry is never touched.
+                        const resent = await resendSelfServeChallenge(deps, baseUrl, handle);
+                        if (resent.ok) {
+                            deps.log(`  ${INSTALL_BRIDGE_RESEND_SENT}`);
+                            resendsRemaining = resent.resendsRemaining;
+                        }
+                        else if (resent.category === "cooldown") {
+                            deps.log(`  ${INSTALL_BRIDGE_RESEND_COOLDOWN}`);
+                        }
+                        else if (resent.category === "rejected") {
+                            // The uniform 401 also covers "no resends left", so the challenge may
+                            // still be alive: count it, but do not end the run on its own.
+                            countRejection();
+                        }
+                        else {
+                            deps.log(`  ${INSTALL_BRIDGE_RESEND_THROTTLED}`);
+                        }
+                        continue;
+                    }
+                    const verified = await verifySelfServeChallenge(deps, baseUrl, handle, prompted.code);
+                    if (verified.ok) {
+                        // BAPI-1173: only an EXPLICIT false prints.
+                        if (verified.trialGranted === false)
+                            deps.log(`  ${INSTALL_BRIDGE_TRIAL_ALREADY_USED}`);
+                        verifiedToken = verified.token;
+                        break;
+                    }
+                    if (verified.category === "rejected") {
+                        if (!countRejection() && resendsRemaining !== 0)
+                            deps.log(INSTALL_BRIDGE_REJECTED_RESEND_HINT);
+                        continue;
+                    }
+                    // Every other category ends the run and keeps the saved record.
+                    throw new ModernInstallRecoveryError(formatSelfServeVerifyFailure(verified));
+                }
+                if (verifiedToken !== undefined)
+                    break;
+                // Rejection cap: offer one fresh signup (S5), unless one was already taken.
+                if (freshSignupAccepted) {
+                    throw new ModernInstallRecoveryError(`${INSTALL_BRIDGE_VERIFICATION_GIVING_UP}\n\nRun it again from this same folder.`);
+                }
+                await askFreshSignup(INSTALL_BRIDGE_RECOVERY_REASON_CAP);
+                await replaceWithFreshSignup(record);
+            }
+            token = verifiedToken;
             fingerprint = fingerprintBootstrapInvite(token, baseUrl);
             const inviteScope = makeScope(`bootstrap-pending:invite:${fingerprint}`);
             const transitioned = await transitionModernBootstrapSignup(makeScope(signupLocator), inviteScope, fingerprint, token, record.challengeHandle, writeDeps);
@@ -7406,7 +7685,7 @@ async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupE
     if (!exchange.ok && exchange.message.includes("Creation outcome is unknown"))
         throw new ModernInstallRecoveryError("Creation outcome is unknown. Preserve recovery proof and rerun the same attempt from the original folder and invite/signup.");
     if (!exchange.ok || !exchange.displayName)
-        throw new ModernInstallRecoveryError("Creation or replay did not complete. Preserve proof and rerun from this folder with the same invite/signup; verify server compatibility or contact installation support.");
+        throw new ModernInstallRecoveryError(`Creation or replay did not complete. Preserve proof and rerun from this folder with the same invite/signup; verify server compatibility or contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}.`);
     const checkpoint = await checkpointModernBootstrapIdentity(scope, record, exchange.repoName, exchange.displayName, writeDeps);
     if (!checkpoint.ok || !checkpoint.record)
         throw new Error(checkpoint.ok ? "Checkpoint missing." : checkpoint.error);