@bridge_gpt/mcp-server 0.2.69 → 0.2.70

package/build/conductor/worker-database-doctor-inspector.js

@@ -0,0 +1,49 @@
+/**
+ * BAPI-1479 / BAPI-1496 — the production read-only worker-database inspector.
+ *
+ * Moved out of `epic-implementer-cli.ts` so `drive-epic` can reuse it for a
+ * local launch's advisory readiness rows without importing the conductor CLI.
+ * Nothing about it changed in the move: `conductor doctor` still builds it the
+ * same way, through this module.
+ */
+/** Inner budget for the doctor's worker-database inspection (doctor adds its own hard ceiling). */
+const WORKER_DATABASE_DOCTOR_BUDGET_MS = 15_000;
+/**
+ * BAPI-1479 — the production read-only worker-database inspector for doctor.
+ *
+ * The operator checkout is the git top level of `cwd` (falling back to `cwd`
+ * outside a repository), matching the executor, which resolves the repository
+ * `.venv` Alembic from its own working directory. Every module is imported
+ * lazily so a doctor run that never reaches this probe loads none of the
+ * worker-database lifecycle graph. Inspection only: nothing is created,
+ * dropped, swept, or written.
+ */
+export function createWorkerDatabaseDoctorInspector(options) {
+    return async () => {
+        const [{ spawnSync }, os, workerDatabase, containment, registry] = await Promise.all([
+            import("node:child_process"),
+            import("node:os"),
+            import("../executor/worker-database.js"),
+            import("../executor/process-containment.js"),
+            import("../executor/job-log-registry.js"),
+        ]);
+        const topLevel = spawnSync("git", ["rev-parse", "--show-toplevel"], {
+            cwd: options.cwd,
+            encoding: "utf-8",
+            timeout: 5_000,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        const resolvedTop = topLevel.status === 0 && typeof topLevel.stdout === "string" ? topLevel.stdout.trim() : "";
+        const operatorRepositoryRoot = resolvedTop.length > 0 ? resolvedTop : options.cwd;
+        const stateDir = registry.resolveExecutorStateDir({
+            env: options.env,
+            tmpdir: os.tmpdir,
+            platform: process.platform,
+        });
+        return workerDatabase.inspectWorkerDatabaseReadiness({
+            operatorRepositoryRoot,
+            hostDigest: containment.hostIdentityDigest(os.hostname()),
+            budgetMs: WORKER_DATABASE_DOCTOR_BUDGET_MS,
+        }, workerDatabase.createDefaultWorkerDatabaseDeps({ stateDir, env: options.env }));
+    };
+}

package/build/conductor-bin.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import path from"node:path";import{fileURLToPath}from"node:url";var CONDUCTOR_REMOVED_STUB_MESSAGE=`'conductor' was renamed to 'epic-implementer'. Run 'epic-implementer ...' instead.
-`;function runConductorRemovedStubBin(deps={}){let writeStderr=deps.writeStderr??(chunk=>process.stderr.write(chunk)),exit=deps.exit??process.exit.bind(process);writeStderr(CONDUCTOR_REMOVED_STUB_MESSAGE),exit(1)}var invokedDirectly=process.argv[1]!==void 0&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);invokedDirectly&&runConductorRemovedStubBin();export{CONDUCTOR_REMOVED_STUB_MESSAGE,runConductorRemovedStubBin};
+import{realpathSync}from"node:fs";import path from"node:path";import{fileURLToPath}from"node:url";function isBinEntrypoint(callerModuleUrl,argv1=process.argv[1]){if(argv1===void 0)return!1;let callerPath=fileURLToPath(callerModuleUrl);try{return realpathSync(argv1)===realpathSync(callerPath)}catch{return path.resolve(argv1)===callerPath}}var CONDUCTOR_REMOVED_STUB_MESSAGE=`'conductor' was renamed to 'epic-implementer'. Run 'epic-implementer ...' instead.
+`;function runConductorRemovedStubBin(deps={}){let writeStderr=deps.writeStderr??(chunk=>process.stderr.write(chunk)),exit=deps.exit??process.exit.bind(process);writeStderr(CONDUCTOR_REMOVED_STUB_MESSAGE),exit(1)}isBinEntrypoint(import.meta.url)&&runConductorRemovedStubBin();export{CONDUCTOR_REMOVED_STUB_MESSAGE,runConductorRemovedStubBin};

package/build/conductor-claude-hook-bin.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import path from"node:path";import{fileURLToPath}from"node:url";var CONDUCTOR_CLAUDE_HOOK_REMOVED_STUB_MESSAGE=`'conductor-claude-hook' was renamed to 'epic-implementer-claude-hook'. Run 'epic-implementer-claude-hook ...' instead.
-`;function runConductorClaudeHookRemovedStubBin(deps={}){let writeStderr=deps.writeStderr??(chunk=>process.stderr.write(chunk)),exit=deps.exit??process.exit.bind(process);writeStderr(CONDUCTOR_CLAUDE_HOOK_REMOVED_STUB_MESSAGE),exit(1)}var invokedDirectly=process.argv[1]!==void 0&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);invokedDirectly&&runConductorClaudeHookRemovedStubBin();export{CONDUCTOR_CLAUDE_HOOK_REMOVED_STUB_MESSAGE,runConductorClaudeHookRemovedStubBin};
+import{realpathSync}from"node:fs";import path from"node:path";import{fileURLToPath}from"node:url";function isBinEntrypoint(callerModuleUrl,argv1=process.argv[1]){if(argv1===void 0)return!1;let callerPath=fileURLToPath(callerModuleUrl);try{return realpathSync(argv1)===realpathSync(callerPath)}catch{return path.resolve(argv1)===callerPath}}var CONDUCTOR_CLAUDE_HOOK_REMOVED_STUB_MESSAGE=`'conductor-claude-hook' was renamed to 'epic-implementer-claude-hook'. Run 'epic-implementer-claude-hook ...' instead.
+`;function runConductorClaudeHookRemovedStubBin(deps={}){let writeStderr=deps.writeStderr??(chunk=>process.stderr.write(chunk)),exit=deps.exit??process.exit.bind(process);writeStderr(CONDUCTOR_CLAUDE_HOOK_REMOVED_STUB_MESSAGE),exit(1)}isBinEntrypoint(import.meta.url)&&runConductorClaudeHookRemovedStubBin();export{CONDUCTOR_CLAUDE_HOOK_REMOVED_STUB_MESSAGE,runConductorClaudeHookRemovedStubBin};

package/build/conductor-claude-hook-removed-stub-bin.js

@@ -10,8 +10,7 @@
  * delegated hook work: it writes exactly one fixed line to stderr, nothing to
  * stdout, and always exits `1`.
  */
-import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { isBinEntrypoint } from "./bin-entrypoint.js";
 /** The fixed migration-pointer line this stub writes to stderr, and nowhere else. */
 export const CONDUCTOR_CLAUDE_HOOK_REMOVED_STUB_MESSAGE = "'conductor-claude-hook' was renamed to 'epic-implementer-claude-hook'. Run 'epic-implementer-claude-hook ...' instead.\n";
 /** Run the stub: write the fixed line to stderr and exit `1`. Delegates to nothing. */
@@ -24,8 +23,6 @@ export function runConductorClaudeHookRemovedStubBin(deps = {}) {
 // Run for real ONLY when this file is the process's own entry — importing it
 // for its exported runner/deps (e.g. from a unit test) must never spend a real
 // process.exit as a side effect of import.
-const invokedDirectly = process.argv[1] !== undefined &&
-    path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
-if (invokedDirectly) {
+if (isBinEntrypoint(import.meta.url)) {
     runConductorClaudeHookRemovedStubBin();
 }

package/build/conductor-removed-stub-bin.js

@@ -9,8 +9,7 @@
  * writes exactly one fixed line to stderr, nothing to stdout, and always
  * exits `1`.
  */
-import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { isBinEntrypoint } from "./bin-entrypoint.js";
 /** The fixed migration-pointer line this stub writes to stderr, and nowhere else. */
 export const CONDUCTOR_REMOVED_STUB_MESSAGE = "'conductor' was renamed to 'epic-implementer'. Run 'epic-implementer ...' instead.\n";
 /** Run the stub: write the fixed line to stderr and exit `1`. Delegates to nothing. */
@@ -23,8 +22,6 @@ export function runConductorRemovedStubBin(deps = {}) {
 // Run for real ONLY when this file is the process's own entry — importing it
 // for its exported runner/deps (e.g. from a unit test) must never spend a real
 // process.exit as a side effect of import.
-const invokedDirectly = process.argv[1] !== undefined &&
-    path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
-if (invokedDirectly) {
+if (isBinEntrypoint(import.meta.url)) {
     runConductorRemovedStubBin();
 }

package/build/credential-store.js

@@ -174,11 +174,19 @@ function collectEnvValues(env, requiredKeys) {
  * names, and the expected store path — never a secret value. Never creates
  * files.
  *
- * DURABLE-HOST BOUNDARY (BAPI-1137, R-4). The bundle key is supplied by the
- * caller, and the executor's only caller is {@link resolveBapiCredentials} with
- * `bapi:<repo>`. Nothing on the executor path asks this function for a GitHub
- * bundle, and BAPI-1137 introduces no GitHub credential resolver, registration
- * field, CLI argument, or diagnostic value that could begin to.
+ * DURABLE-HOST BOUNDARY (BAPI-1137, R-4; amended by BAPI-1461). The bundle key
+ * is supplied by the caller, and the executor's only caller is
+ * {@link resolveBapiCredentials} with `bapi:<repo>`. Nothing on the executor path
+ * asks this function for a GitHub bundle.
+ *
+ * BAPI-1461 adds ONE GitHub read, and not through this function: the local merge
+ * kind may read a stored `github-merge:` entry through
+ * {@link readGithubMergeCredential}. Only a run-scoped executor that
+ * `drive-epic` starts in the person's own session does that, and only for the
+ * local kind. A durable-host service executor runs with its inherited GitHub
+ * credentials scrubbed and never reads a `github-merge:` entry, so it still
+ * holds no standing GitHub write credential. Bridge credentials keep exactly
+ * the resolution path described above.
  */
 export async function resolveCredentialBundle(bundleKey, requiredKeys, deps) {
     const primaryPath = getPrimaryCredentialStorePath(deps);
@@ -264,6 +272,9 @@ export async function resolveCredentialBundle(bundleKey, requiredKeys, deps) {
  * structural rather than on a scrub of something resolved. (The executor process
  * additionally deletes any GitHub write variable it INHERITED at startup — see
  * `executor/env.ts` — which covers the environment, not this seam.)
+ *
+ * BAPI-1461: the bundle key is the fixed `bapi:<repo>`, so a stored
+ * `github-merge:` entry is never selected here, whatever the repository name.
  */
 export async function resolveBapiCredentials(repoName, deps) {
     const result = await resolveCredentialBundle(`bapi:${repoName}`, ["BAPI_API_KEY"], deps);
@@ -343,6 +354,12 @@ const LOCK_TIMEOUT_MS = 5_000;
 export function getCredentialStoreLockPath(deps) {
     return `${getPrimaryCredentialStorePath(deps)}.lock`;
 }
+/**
+ * BAPI-1449: the one support address every user-facing recovery message names.
+ * Messages read "contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}"; none repeats
+ * the literal.
+ */
+export const BRIDGE_SUPPORT_EMAIL = "info@bridgegpt.ai";
 /**
  * Exclusive creation with bounded fail-closed contention. No writer steals or
  * replaces a held lock; only the successful owner can release it. Abandonment
@@ -351,7 +368,7 @@ export function getCredentialStoreLockPath(deps) {
 async function acquireCredentialStoreLock(deps) {
     const open = deps.open;
     if (!open || !deps.unlink)
-        return { ok: false, error: "Exclusive credential storage is unavailable. Resume from the original folder with installation support." };
+        return { ok: false, error: `Exclusive credential storage is unavailable. Resume from the original folder and contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}; preserve recovery proof.` };
     const lockPath = getCredentialStoreLockPath(deps);
     const isPosix = deps.platform !== "win32";
     const now = deps.now ?? (() => Date.now());
@@ -399,7 +416,7 @@ async function acquireCredentialStoreLock(deps) {
     }
     return {
         ok: false,
-        error: `Timed out waiting for exclusive credential storage at ${lockPath}. Another installer may still be running. Resume from the original folder with installation support; preserve recovery proof.`,
+        error: `Timed out waiting for exclusive credential storage at ${lockPath}. Another installer may still be running. Resume from the original folder and contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}; preserve recovery proof.`,
     };
 }
 /**
@@ -593,7 +610,7 @@ async function loadStoreForMutation(deps) {
     }
     const fallback = await readCredentialStoreJsonIfPresent(getFallbackCredentialStorePath(deps), deps);
     if (fallback.state === "error")
-        return { ok: false, kind: fallback.kind, error: "Recovery storage could not be read. Preserve it and contact installation support." };
+        return { ok: false, kind: fallback.kind, error: `Recovery storage could not be read. Preserve it and contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}.` };
     return { ok: true, base: fallback.state === "present" ? { ...fallback.value } : {} };
 }
 /** Does a real (non-empty) `BAPI_API_KEY` already exist for `bapi:<repo>`? */
@@ -701,7 +718,7 @@ function storedPendingIsSelfServe(store, repoName) {
  * because there the CLI genuinely cannot replay it.
  */
 function pendingConflictError(_target, _primaryPath, _storedIsSelfServe) {
-    return "An earlier installation has saved recovery proof. Resume from its original folder with its original invite or signup flow, or contact installation support. Preserve the saved proof.";
+    return `An earlier installation has saved recovery proof. Resume from its original folder with its original invite or signup flow, or contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}. Preserve the saved proof.`;
 }
 /**
  * Generate (or REUSE) the bootstrap `key_secret` and durably persist it as a
@@ -1184,7 +1201,7 @@ export async function lookupSelfServeBootstrapPendingCredential(params, deps) {
                     };
                 }
                 if (challenge.kind === "expired") {
-                    return { ok: true, state: "challenge-expired", path: primaryPath, target };
+                    return { ok: true, state: "challenge-expired", path: primaryPath, target, snapshot: { ...(entry ?? {}) } };
                 }
                 return { ok: true, state: "none", path: primaryPath, target };
             }
@@ -1590,7 +1607,7 @@ export async function bindEpicLaunchCredential(repoName, targetBaseUrl, deps) {
         return { ok: true, target, action: previous === null ? "bound" : "rebound", path: primaryPath };
     }, (error) => ({ ok: false, target, kind: "lock-error", error }));
 }
-const modernRecoveryError = "Installation recovery is inconsistent or unavailable. Preserve proof and resume with the original folder and invite, or contact installation support.";
+const modernRecoveryError = `Installation recovery is inconsistent or unavailable. Preserve proof and resume with the original folder and invite, or contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}.`;
 function parseModernBootstrapRecord(entry) {
     if (!entry)
         return null;
@@ -1700,14 +1717,167 @@ export async function lookupLegacyBootstrapInvite(fingerprint, deps) {
         }
     }, () => ({ ok: false, error: modernRecoveryError }));
 }
+function buildModernSignupRecord(scope, label, email, keySecret) {
+    return { version: 1, mode: "server_assigned", baseUrl: scope.baseUrl, folder: scope.folder,
+        label: validateBootstrapDisplayName(label), keySecret, signupEmail: email };
+}
 export async function prepareModernBootstrapSignup(scope, label, email, generateKeySecret, deps) {
     return mutateModernBootstrapRecord(scope, deps, record => {
         if (record)
             return record;
-        return { version: 1, mode: "server_assigned", baseUrl: scope.baseUrl, folder: scope.folder,
-            label: validateBootstrapDisplayName(label), keySecret: generateKeySecret(), signupEmail: email };
+        return buildModernSignupRecord(scope, label, email, generateKeySecret());
     });
 }
+/**
+ * BAPI-1449: archive prefix. Deliberately NOT {@link BOOTSTRAP_PENDING_TARGET_PREFIX}:
+ * the legacy invite and self-serve lookups scan that prefix, so an archived record
+ * under it would be picked up again. Archived entries are never read back by
+ * install; they exist so support can recover them by hand. Their `RECORD` strings
+ * and sibling values are preserved verbatim, and nothing prunes them.
+ */
+export const BOOTSTRAP_ARCHIVE_TARGET_PREFIX = "bootstrap-archive:";
+const archiveRefusal = (kind, detail) => ({
+    ok: false, kind,
+    error: `${detail} Your saved signup was not changed; contact Bridge support at ${BRIDGE_SUPPORT_EMAIL} if this persists.`,
+});
+// Presence, not truthiness: an empty-string proof field is still proof.
+function hasProtectedProofField(record) {
+    return ["fingerprint", "replayToken", "canonical"].some(field => Object.prototype.hasOwnProperty.call(record, field));
+}
+function buildArchiveKey(scope, suffix) {
+    const digest = scope.folderReference.startsWith("bootstrap-folder:") ? scope.folderReference.slice("bootstrap-folder:".length) : "";
+    if (!/^[A-Za-z0-9_-]{1,128}$/.test(digest) || !/^[A-Za-z0-9_-]{1,128}$/.test(suffix))
+        return null;
+    return `${BOOTSTRAP_ARCHIVE_TARGET_PREFIX}${digest}:${suffix}`;
+}
+async function commitArchiveReplacement(updated, record, archiveKey, deps) {
+    const path = getPrimaryCredentialStorePath(deps);
+    // Exactly one durable write carries the archive move and the replacement together.
+    const written = await durablyReplaceCredentialStoreJson(path, updated, deps);
+    if (written.ok)
+        return { ok: true, record, archiveKey, path };
+    if (written.kind === "post-rename-uncertain") {
+        // The new bytes may already exist: never claim the old store is untouched, never retry.
+        return { ok: false, kind: written.kind, error: `The credential store replacement could not be confirmed as durable, so the old and new signup state are uncertain. Rerun install from this folder, or contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}. Preserve recovery proof.` };
+    }
+    return archiveRefusal(written.kind, "The signup could not be replaced.");
+}
+/**
+ * Replace an eligible, unresolved modern signup with a fresh one in ONE locked,
+ * durable write that moves the original entry, unchanged, under an archive key.
+ * Fails closed on any change since the caller read the record, on any record that
+ * may hold redeemed proof, and on any ownership or collision problem.
+ */
+export async function archiveAndReplaceModernBootstrapSignup(params, deps) {
+    const { scope, observed } = params;
+    return withCredentialStoreLock(deps, async () => {
+        try {
+            const loaded = await loadStoreForMutation(deps);
+            if (!loaded.ok)
+                return archiveRefusal("invalid-store", "Recovery storage could not be read.");
+            const store = loaded.base;
+            const reference = store[scope.folderReference];
+            if (!reference || reference.FOLDER !== scope.folder || reference.BASE_URL !== scope.baseUrl || reference.LOCATOR !== scope.locator) {
+                return archiveRefusal("invalid-store", "Recovery storage is inconsistent.");
+            }
+            const entry = store[reference.LOCATOR];
+            const current = parseModernBootstrapRecord(entry);
+            if (!entry || !current || current.folder !== scope.folder || current.baseUrl !== scope.baseUrl) {
+                return archiveRefusal("invalid-store", "Recovery storage is inconsistent.");
+            }
+            if (hasProtectedProofField(current) || hasProtectedProofField(observed)) {
+                return archiveRefusal("protected", "This signup holds proof that must be preserved.");
+            }
+            if (JSON.stringify(current) !== JSON.stringify(observed) || current.keySecret !== observed.keySecret ||
+                current.challengeHandle !== observed.challengeHandle) {
+                return archiveRefusal("changed", "The saved signup changed while it was being replaced.");
+            }
+            let archiveKey;
+            let replacement;
+            try {
+                archiveKey = buildArchiveKey(scope, params.generateArchiveSuffix());
+                const keySecret = params.generateKeySecret();
+                if (!/^[A-Za-z0-9_-]{43}$/.test(keySecret))
+                    return archiveRefusal("callback-failed", "A replacement secret could not be generated.");
+                replacement = buildModernSignupRecord(scope, current.label, params.email, keySecret);
+            }
+            catch {
+                return archiveRefusal("callback-failed", "A replacement signup could not be prepared.");
+            }
+            if (archiveKey === null)
+                return archiveRefusal("callback-failed", "An archive location could not be prepared.");
+            if (store[archiveKey])
+                return archiveRefusal("archive-collision", "The archive location is already in use.");
+            const updated = { ...store };
+            delete updated[reference.LOCATOR];
+            delete updated[scope.folderReference];
+            updated[archiveKey] = entry;
+            updated[scope.locator] = { RECORD: JSON.stringify(replacement) };
+            updated[scope.folderReference] = { LOCATOR: scope.locator, FOLDER: scope.folder, BASE_URL: scope.baseUrl };
+            return await commitArchiveReplacement(updated, replacement, archiveKey, deps);
+        }
+        catch {
+            return archiveRefusal("invalid-store", "Recovery storage is inconsistent.");
+        }
+    }, () => archiveRefusal("lock-error", "Exclusive credential storage could not be acquired."));
+}
+/**
+ * Archive an expired basename-keyed legacy signup and install the modern signup
+ * that replaces it, in ONE locked, durable write. Refuses unless the whole legacy
+ * entry is unchanged since the caller read it AND still classifies as expired, and
+ * refuses any entry holding a key secret, fingerprint, replay token, or modern
+ * record. The modern destination and folder reference must be unoccupied.
+ */
+export async function archiveExpiredLegacySignupAndInstallModern(params, deps) {
+    const { scope } = params;
+    const target = getBootstrapPendingTarget(params.repoName);
+    return withCredentialStoreLock(deps, async () => {
+        try {
+            const loaded = await loadStoreForMutation(deps);
+            if (!loaded.ok)
+                return archiveRefusal("invalid-store", "Recovery storage could not be read.");
+            const store = loaded.base;
+            const entry = store[target];
+            if (!entry)
+                return archiveRefusal("changed", "The saved signup changed while it was being replaced.");
+            if ([BOOTSTRAP_PENDING_SECRET_FIELD, BOOTSTRAP_PENDING_FINGERPRINT_FIELD, BOOTSTRAP_PENDING_REPLAY_TOKEN_FIELD, "RECORD"]
+                .some(field => Object.prototype.hasOwnProperty.call(entry, field))) {
+                return archiveRefusal("protected", "This signup holds proof that must be preserved.");
+            }
+            if (JSON.stringify(entry) !== JSON.stringify(params.observed) || classifySignupChallengeRecord(entry, params.now).kind !== "expired") {
+                return archiveRefusal("changed", "The saved signup changed while it was being replaced.");
+            }
+            if (store[scope.locator] || store[scope.folderReference]) {
+                return archiveRefusal("invalid-store", "Recovery storage is inconsistent.");
+            }
+            let archiveKey;
+            let replacement;
+            try {
+                archiveKey = buildArchiveKey(scope, params.generateArchiveSuffix());
+                const keySecret = params.generateKeySecret();
+                if (!/^[A-Za-z0-9_-]{43}$/.test(keySecret))
+                    return archiveRefusal("callback-failed", "A replacement secret could not be generated.");
+                replacement = buildModernSignupRecord(scope, params.label, params.email, keySecret);
+            }
+            catch {
+                return archiveRefusal("callback-failed", "A replacement signup could not be prepared.");
+            }
+            if (archiveKey === null)
+                return archiveRefusal("callback-failed", "An archive location could not be prepared.");
+            if (store[archiveKey])
+                return archiveRefusal("archive-collision", "The archive location is already in use.");
+            const updated = { ...store };
+            delete updated[target];
+            updated[archiveKey] = entry;
+            updated[scope.locator] = { RECORD: JSON.stringify(replacement) };
+            updated[scope.folderReference] = { LOCATOR: scope.locator, FOLDER: scope.folder, BASE_URL: scope.baseUrl };
+            return await commitArchiveReplacement(updated, replacement, archiveKey, deps);
+        }
+        catch {
+            return archiveRefusal("invalid-store", "Recovery storage is inconsistent.");
+        }
+    }, () => archiveRefusal("lock-error", "Exclusive credential storage could not be acquired."));
+}
 export async function transitionModernBootstrapSignup(signupScope, inviteScope, fingerprint, replayToken, challengeHandle, deps) {
     return mutateModernBootstrapRecord(inviteScope, deps, record => {
         if (!record || record.challengeHandle !== challengeHandle)
@@ -1763,3 +1933,176 @@ export async function promoteModernBootstrapCredential(scope, proof, deps, allow
         }
     }, () => ({ ok: false, error: modernRecoveryError }));
 }
+// ---------------------------------------------------------------------------
+// Repository-scoped GitHub merge token (BAPI-1461)
+// ---------------------------------------------------------------------------
+/**
+ * Logical target prefix for a stored GitHub merge token. The full key is
+ * `github-merge:github.com/<owner>/<repo>`.
+ *
+ * Kept apart from `bapi:<repo>` on purpose. {@link resolveBapiCredentials} reads
+ * the fixed `bapi:<repo>` key and nothing else, so it can never return this
+ * entry, and the merge resolver reads only this entry, so it can never return a
+ * Bridge key. A GitHub write credential and a Bridge credential never share an
+ * entry, a reader, or a fallback.
+ *
+ * Only the local merge kind reads this entry, and only in a run-scoped executor
+ * that `drive-epic` starts in the person's own session (see
+ * `conductor/merge-credential.ts`). A durable-host service executor never reads
+ * it, so the new entry gives no standing GitHub write credential to a service.
+ */
+export const GITHUB_MERGE_TARGET_PREFIX = "github-merge:";
+/** The one secret name inside a `github-merge:` entry. */
+export const GITHUB_MERGE_TOKEN_FIELD = "GITHUB_MERGE_TOKEN";
+/** The only provider host a stored merge token is scoped to. */
+export const GITHUB_MERGE_HOST = "github.com";
+const GITHUB_REPOSITORY_SEGMENT_RE = /^[A-Za-z0-9._-]{1,100}$/;
+/** Parse a bare `owner/repo` string into an identity, or null when malformed. */
+function parseOwnerRepo(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const parts = raw.trim().split("/");
+    if (parts.length !== 2)
+        return null;
+    const [owner, repo] = parts;
+    if (!GITHUB_REPOSITORY_SEGMENT_RE.test(owner) || !GITHUB_REPOSITORY_SEGMENT_RE.test(repo))
+        return null;
+    if (owner === "." || owner === ".." || repo === "." || repo === "..")
+        return null;
+    return { host: GITHUB_MERGE_HOST, owner, repo };
+}
+/**
+ * Decide which repository a stored merge token belongs to.
+ *
+ * The server's `provider_repository` is preferred; the local github.com remote
+ * (from `parseGithubRemote()`, already `owner/repo`) is the fallback. When both
+ * are present and disagree the answer is `conflict`, so a caller never reads or
+ * writes another repository's entry. GitHub names are case-insensitive, so the
+ * comparison ignores case; the key keeps the server's spelling.
+ */
+export function resolveGithubMergeRepositoryIdentity(input) {
+    const server = parseOwnerRepo(input.providerRepository);
+    const local = parseOwnerRepo(input.localRemote);
+    if (server && local) {
+        const same = server.owner.toLowerCase() === local.owner.toLowerCase() &&
+            server.repo.toLowerCase() === local.repo.toLowerCase();
+        return same ? { ok: true, identity: server } : { ok: false, reason: "conflict" };
+    }
+    if (server)
+        return { ok: true, identity: server };
+    if (local)
+        return { ok: true, identity: local };
+    return { ok: false, reason: "unresolved" };
+}
+/**
+ * The store key for one repository: `github-merge:github.com/<owner>/<repo>`.
+ * GitHub names are case-insensitive, and writers and readers take the name
+ * from different sources (the server's spelling or the local remote), so the
+ * key is always lowercase.
+ */
+export function getGithubMergeTarget(identity) {
+    return `${GITHUB_MERGE_TARGET_PREFIX}${identity.host}/${identity.owner}/${identity.repo}`.toLowerCase();
+}
+/**
+ * Every key in the store that names this repository, matched case-insensitively,
+ * with the canonical lowercase key first when present. A key spelled with
+ * capitals can only come from an earlier build that kept the source's spelling.
+ */
+function findGithubMergeKeys(store, identity) {
+    const target = getGithubMergeTarget(identity);
+    const keys = Object.keys(store).filter((key) => key.toLowerCase() === target);
+    return keys.sort((a, b) => Number(b === target) - Number(a === target));
+}
+/**
+ * Read the stored merge token for one repository. Strictly read-only: it never
+ * creates, migrates, or locks anything. The primary store wins; the legacy
+ * fallback is read only when the primary does not exist, like every other
+ * reader in this module.
+ */
+export async function readGithubMergeCredential(identity, deps) {
+    try {
+        let state = await readCredentialStoreJsonIfPresent(getPrimaryCredentialStorePath(deps), deps);
+        if (state.state === "missing") {
+            state = await readCredentialStoreJsonIfPresent(getFallbackCredentialStorePath(deps), deps);
+        }
+        if (state.state === "error")
+            return { status: "unavailable" };
+        if (state.state === "missing")
+            return { status: "absent" };
+        for (const key of findGithubMergeKeys(state.value, identity)) {
+            const raw = state.value[key]?.[GITHUB_MERGE_TOKEN_FIELD];
+            const token = typeof raw === "string" ? raw.trim() : "";
+            if (token.length > 0)
+                return { status: "present", token };
+        }
+        return { status: "absent" };
+    }
+    catch {
+        return { status: "unavailable" };
+    }
+}
+/**
+ * Store (or replace) the merge token for one repository, under the shared lock
+ * and through the durable replacement. Every other entry is preserved, and the
+ * old token stays in place until the new file is durably published. Results
+ * name the logical target and a fixed failure kind only — never the token,
+ * the path, or a raw I/O message.
+ */
+export async function upsertGithubMergeCredential(identity, token, deps) {
+    const target = getGithubMergeTarget(identity);
+    const value = (token ?? "").trim();
+    if (value.length === 0)
+        return { ok: false, target, kind: "invalid-input" };
+    const primaryPath = getPrimaryCredentialStorePath(deps);
+    return withCredentialStoreLock(deps, async () => {
+        const loaded = await loadStoreForMutation(deps);
+        if (!loaded.ok)
+            return { ok: false, target, kind: loaded.kind };
+        const keys = findGithubMergeKeys(loaded.base, identity);
+        const previousKey = keys[0];
+        const previous = previousKey === undefined ? undefined : loaded.base[previousKey]?.[GITHUB_MERGE_TOKEN_FIELD];
+        if (previous === value && keys.length === 1 && previousKey === target) {
+            return { ok: true, target, action: "unchanged" };
+        }
+        // Fold any differently-cased copy into the one lowercase key.
+        const next = { ...loaded.base };
+        for (const key of keys)
+            delete next[key];
+        next[target] = {
+            ...(previousKey === undefined ? {} : loaded.base[previousKey]),
+            [GITHUB_MERGE_TOKEN_FIELD]: value,
+        };
+        const written = await durablyReplaceCredentialStoreJson(primaryPath, next, deps);
+        if (!written.ok)
+            return { ok: false, target, kind: written.kind };
+        return {
+            ok: true,
+            target,
+            action: typeof previous === "string" && previous.trim().length > 0 ? "replaced" : "created",
+        };
+    }, () => ({ ok: false, target, kind: "lock-error" }));
+}
+/**
+ * Remove the stored merge token for one repository, under the shared lock.
+ * Removing a missing entry is a successful `absent`. This deletes a local copy
+ * only: it does not revoke the token at GitHub.
+ */
+export async function removeGithubMergeCredential(identity, deps) {
+    const target = getGithubMergeTarget(identity);
+    const primaryPath = getPrimaryCredentialStorePath(deps);
+    return withCredentialStoreLock(deps, async () => {
+        const loaded = await loadStoreForMutation(deps);
+        if (!loaded.ok)
+            return { ok: false, target, kind: loaded.kind };
+        const keys = findGithubMergeKeys(loaded.base, identity);
+        if (keys.length === 0)
+            return { ok: true, target, action: "absent" };
+        const next = { ...loaded.base };
+        for (const key of keys)
+            delete next[key];
+        const written = await durablyReplaceCredentialStoreJson(primaryPath, next, deps);
+        if (!written.ok)
+            return { ok: false, target, kind: written.kind };
+        return { ok: true, target, action: "removed" };
+    }, () => ({ ok: false, target, kind: "lock-error" }));
+}