@bridge_gpt/mcp-server 0.2.69 → 0.2.70

package/build/executor/worktree.js

@@ -11,8 +11,9 @@ import { fetchAndResolveBaseSha, probeClaudeReviewWorkflowDrift, resolveReposito
 // BAPI-941: the shared drift diagnostic formatter (a leaf module — no cycle).
 import { formatClaudeReviewWorkflowDriftDiagnostic } from "../claude-review-workflow-drift.js";
 import { commandSucceeded } from "../start-tickets-prereqs.js";
-import { createWorktreeForTicket, provePriorHeadLineage } from "../worktree-core.js";
-import { findWorktreeByBranch, listGitWorktrees } from "./worktree-inspection.js";
+import { branchExists, createWorktreeForTicket, isAncestor, provePriorHeadLineage, resolveCommit, } from "../worktree-core.js";
+import { findWorktreeByBranch, listGitWorktrees, parseGitWorktreePorcelain } from "./worktree-inspection.js";
+import { buildExecutorWorktreeLockPath, parseExecutorWorktreeLock } from "./worktree-lock.js";
 import { provisionCommandsForWorktree } from "../command-provisioning.js";
 /**
  * Resolve the branch for a real spawn job: `expected_branch` wins; else
@@ -234,6 +235,7 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
             return {
                 ok: false,
                 error: `git fetch origin ${branch} failed${reason ? `: ${reason}` : ""}`,
+                failureKind: "unavailable",
             };
         }
         // BAPI-731: resolve the freshly fetched remote head to an immutable commit
@@ -290,7 +292,12 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
         if (row.status === "created" && typeof row.path === "string") {
             return finalizeExecutorWorktree(row.path, branch, safeHead, deps, publication);
         }
-        return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'`, ...(publication ? { publication } : {}) };
+        return {
+            ok: false,
+            error: row.error ?? `worktree creation failed for branch '${branch}'`,
+            ...(row.failureKind ? { failureKind: row.failureKind } : {}),
+            ...(publication ? { publication } : {}),
+        };
     }
     // BAPI-586 (fresh dispatch): a fresh implementation-style job must start from
     // the CURRENT remote base — never a stale local `main`, another local base
@@ -332,9 +339,19 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
     // BAPI-1367: a retry of an `implement` job with a server-minted prior head
     // resumes its own branch instead of being refused as a stale leftover. The
     // gate lives HERE, not in the shared primitive, which learns no job types.
-    const priorHeadSha = eligiblePriorHead(job, policy);
-    if (priorHeadSha !== null) {
-        return ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, options, deps, postSwitch);
+    const prior = eligiblePriorHead(job, policy);
+    if (prior !== null) {
+        if (prior.source === "fenced_resume") {
+            // BAPI-1530: a server-authored resume head for a fenced child, on any
+            // attempt. Prepared from authoritative origin with rename-aside only.
+            return ensureFencedResumeWorktree({
+                key, branch, resumeHeadSha: prior.head, baseSha, options, deps,
+                ...(postSwitch ? { postSwitch } : {}),
+                ...(policy.preparation ? { preparation: policy.preparation } : {}),
+                ...(typeof job.id === "number" ? { jobId: job.id } : {}),
+            });
+        }
+        return ensurePriorAttemptWorktree(key, branch, prior.head, baseSha, options, deps, postSwitch);
     }
     const row = await createWorktreeForTicket(toWorktreeCoreDeps(deps), key, { [key]: branch }, options.worktrunkBinary, baseSha, guardStaleWorktree, {
         ...(postSwitch ? { postSwitch } : {}),
@@ -351,22 +368,35 @@ export async function ensureExecutorWorktree(job, options, deps, policy = {}) {
         // the expectation — no extra resolution needed.
         return finalizeExecutorWorktree(row.path, branch, baseSha, deps);
     }
-    return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
+    return {
+        ok: false,
+        error: row.error ?? `worktree creation failed for branch '${branch}'`,
+        ...(row.failureKind ? { failureKind: row.failureKind } : {}),
+    };
 }
 /**
- * BAPI-1367: the prior head a worktree policy may act on, or `null`. Requires an
- * `implement` job on a real retry and a syntactically valid full SHA; anything
- * else keeps the ordinary fresh-dispatch behavior.
+ * The prior head a worktree policy may act on, or `null`. Requires an
+ * `implement` job and a syntactically valid full SHA. BAPI-1367's retry head needs
+ * a real retry (`attempt_count > 1`) and wins when present; BAPI-1530's fenced
+ * resume head is honored on any attempt. Anything else keeps the ordinary
+ * fresh-dispatch behavior.
  */
 function eligiblePriorHead(job, policy) {
     if (policy.reuseExistingBranch === true)
         return null;
     if (job.job_type !== "implement")
         return null;
-    if (typeof job.attempt_count !== "number" || job.attempt_count <= 1)
-        return null;
-    const head = policy.priorAttemptHeadSha;
-    return typeof head === "string" && FULL_SHA_PATTERN.test(head) ? head : null;
+    const retryHead = policy.priorAttemptHeadSha;
+    if (typeof job.attempt_count === "number" &&
+        job.attempt_count > 1 &&
+        typeof retryHead === "string" &&
+        FULL_SHA_PATTERN.test(retryHead)) {
+        return { head: retryHead, source: "retry" };
+    }
+    const resumeHead = policy.fencedImplementResumeHeadSha;
+    return typeof resumeHead === "string" && FULL_SHA_PATTERN.test(resumeHead)
+        ? { head: resumeHead, source: "fenced_resume" }
+        : null;
 }
 /**
  * BAPI-1367: prepare the worktree for a retry that resumes prior-attempt work.
@@ -397,6 +427,7 @@ async function ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, op
                 ok: false,
                 error: `cannot resume prior-attempt work on '${branch}': git fetch origin ${branch} failed` +
                     `${reason ? `: ${reason}` : ""}`,
+                failureKind: "unavailable",
             };
         }
         const remote = await provePriorHeadLineage(coreDeps, branch, policy, "origin_branch");
@@ -404,12 +435,17 @@ async function ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, op
             return {
                 ok: false,
                 error: `stale worktree guard: pushed branch 'origin/${branch}' cannot be resumed: ${remote.reason}`,
+                failureKind: remote.kind,
             };
         }
     }
     const row = await createWorktreeForTicket(coreDeps, key, { [key]: branch }, options.worktrunkBinary, baseSha, true, { allowedPriorHead: policy, ...(postSwitch ? { postSwitch } : {}) });
     if (row.status !== "created" || typeof row.path !== "string") {
-        return { ok: false, error: row.error ?? `worktree creation failed for branch '${branch}'` };
+        return {
+            ok: false,
+            error: row.error ?? `worktree creation failed for branch '${branch}'`,
+            ...(row.failureKind ? { failureKind: row.failureKind } : {}),
+        };
     }
     const headSha = await resolveCommitSha(deps, row.path, "HEAD");
     if (headSha === null) {
@@ -426,3 +462,255 @@ async function ensurePriorAttemptWorktree(key, branch, priorHeadSha, baseSha, op
         },
     };
 }
+/**
+ * Observe `refs/heads/<branch>` on origin. Only a SUCCESSFUL exact-ref query that
+ * lists nothing is `missing`; a failed query, ambiguous or malformed output, a
+ * failed fetch, or a local tracking ref that disagrees with the listing is
+ * `unavailable` and authorizes nothing. Read-only apart from the fetch.
+ */
+async function observeOriginBranch(deps, coreDeps, branch) {
+    try {
+        const listed = await deps.runCommand("git", ["ls-remote", "origin", `refs/heads/${branch}`], {
+            cwd: deps.cwd,
+        });
+        if (!commandSucceeded(listed))
+            return { kind: "unavailable" };
+        const lines = listed.stdout
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter((line) => line.length > 0);
+        if (lines.length === 0)
+            return { kind: "missing" };
+        if (lines.length !== 1)
+            return { kind: "unavailable" };
+        const [sha, ref] = lines[0].split(/\s+/);
+        if (ref !== `refs/heads/${branch}` || !FULL_SHA_PATTERN.test(sha ?? "")) {
+            return { kind: "unavailable" };
+        }
+        const fetch = await deps.runCommand("git", ["fetch", "origin", branch], { cwd: deps.cwd });
+        if (!commandSucceeded(fetch))
+            return { kind: "unavailable" };
+        const tip = await resolveCommit(coreDeps, `refs/remotes/origin/${branch}`);
+        if (tip === null || tip.toLowerCase() !== sha.toLowerCase())
+            return { kind: "unavailable" };
+        return { kind: "present", sha: tip.toLowerCase() };
+    }
+    catch {
+        return { kind: "unavailable" };
+    }
+}
+/** True only while the retained worktree's lock file names THIS preparation's job. */
+async function retainedLockHeldByJob(deps, worktreePath, jobId) {
+    try {
+        const raw = await deps.readFile(buildExecutorWorktreeLockPath(worktreePath, deps.platform));
+        const owner = parseExecutorWorktreeLock(raw);
+        return owner !== null && owner.jobId === jobId;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * BAPI-1530: prepare a worktree for a fenced `implement` dispatch from the
+ * server-authored resume head, on authoritative origin and nothing else.
+ *
+ * Never destructive. The only local mutation is a plain argv `git branch -m` that
+ * renames a local feature branch whose tip differs from the verified origin tip
+ * (or that is a leftover when origin is positively absent) to
+ * `<branch>-stale-<jobId>`; a checked-out retained worktree follows the rename with
+ * its files and index untouched. There is no force rename, reset, clean, detach,
+ * branch deletion, worktree removal, or publication on this path.
+ *
+ * Outcomes are structured so the job runner never reads message text:
+ * `unavailable` (fetch, authentication, timeout, malformed or ambiguous output,
+ * unresolved refs) mutates nothing and never falls back to base;
+ * `lineage_refused` (origin conclusively lacks the stamped head) mutates nothing;
+ * `setup_refused` (expired preparation authority, a retained-worktree lock not
+ * held by this job, or an occupied rename destination) mutates nothing.
+ */
+async function ensureFencedResumeWorktree(args) {
+    const { key, branch, resumeHeadSha, baseSha, options, deps, postSwitch, preparation } = args;
+    const jobId = preparation?.jobId ?? args.jobId;
+    const coreDeps = toWorktreeCoreDeps(deps);
+    const short = (sha) => sha.slice(0, 12);
+    const refuse = (error, failureKind) => ({
+        ok: false,
+        error,
+        failureKind,
+    });
+    const authorityLost = () => preparation !== undefined && !preparation.mayMutate();
+    const authorityMessage = `cannot resume fenced work on '${branch}': the preparation authority is no longer valid; nothing was changed`;
+    if (authorityLost())
+        return refuse(authorityMessage, "setup_refused");
+    const origin = await observeOriginBranch(deps, coreDeps, branch);
+    if (origin.kind === "unavailable") {
+        return refuse(`cannot resume fenced work on '${branch}': origin could not be read (fetch or ref resolution failed); nothing was changed`, "unavailable");
+    }
+    if (origin.kind === "present") {
+        const lineage = await isAncestor(coreDeps, resumeHeadSha, origin.sha);
+        if (lineage === "unknown") {
+            return refuse(`cannot resume fenced work on '${branch}': ancestry of origin ${short(origin.sha)} against ${short(resumeHeadSha)} could not be established; nothing was changed`, "unavailable");
+        }
+        if (lineage === "no") {
+            return refuse(`stale worktree guard: origin/${branch} (${short(origin.sha)}) does not contain the stamped resume head ${short(resumeHeadSha)}; nothing was changed`, "lineage_refused");
+        }
+    }
+    // Local inspection.
+    const localExists = await branchExists(coreDeps, branch);
+    const localTip = localExists ? await resolveCommit(coreDeps, `refs/heads/${branch}`) : null;
+    if (localExists && localTip === null) {
+        return refuse(`cannot resume fenced work on '${branch}': the local branch tip could not be resolved; nothing was changed`, "unavailable");
+    }
+    const listed = await deps.runCommand("git", ["worktree", "list", "--porcelain"], { cwd: deps.cwd });
+    if (!commandSucceeded(listed)) {
+        return refuse(`cannot resume fenced work on '${branch}': worktrees could not be listed; nothing was changed`, "unavailable");
+    }
+    const retainedPath = findWorktreeByBranch(parseGitWorktreePorcelain(listed.stdout), branch);
+    const originSha = origin.kind === "present" ? origin.sha : null;
+    const aligned = localExists && originSha !== null && localTip?.toLowerCase() === originSha;
+    if (localExists && !aligned) {
+        // Rename aside. Everything is revalidated immediately before the mutation.
+        const stale = `${branch}-stale-${jobId ?? "job"}`;
+        if (authorityLost())
+            return refuse(authorityMessage, "setup_refused");
+        if (retainedPath !== undefined && preparation !== undefined) {
+            if (!(await retainedLockHeldByJob(deps, retainedPath, preparation.jobId))) {
+                return refuse(`cannot rename '${branch}' aside: the retained worktree's lock is not held by this job; nothing was changed`, "setup_refused");
+            }
+        }
+        const tipNow = await resolveCommit(coreDeps, `refs/heads/${branch}`);
+        if (tipNow === null || tipNow !== localTip) {
+            return refuse(`cannot rename '${branch}' aside: the local branch moved since it was inspected; nothing was changed`, "setup_refused");
+        }
+        if (originSha !== null) {
+            const originNow = await resolveCommit(coreDeps, `refs/remotes/origin/${branch}`);
+            if (originNow === null || originNow.toLowerCase() !== originSha) {
+                return refuse(`cannot rename '${branch}' aside: the origin tracking ref changed since it was verified; nothing was changed`, "unavailable");
+            }
+        }
+        const destination = await deps.runCommand("git", ["show-ref", "--verify", "--quiet", `refs/heads/${stale}`], { cwd: deps.cwd });
+        if (destination.exitCode === 0) {
+            return refuse(`cannot rename '${branch}' aside: '${stale}' already exists; nothing was changed`, "setup_refused");
+        }
+        if (destination.exitCode !== 1) {
+            return refuse(`cannot rename '${branch}' aside: whether '${stale}' exists could not be established; nothing was changed`, "unavailable");
+        }
+        const renamed = await deps.runCommand("git", ["branch", "-m", branch, stale], { cwd: deps.cwd });
+        if (!commandSucceeded(renamed)) {
+            return refuse(`cannot rename '${branch}' aside to '${stale}'; the branch was left as it was`, "unavailable");
+        }
+        // Reinspect: the stale name must now hold the old tip and the feature name be free.
+        const staleTip = await resolveCommit(coreDeps, `refs/heads/${stale}`);
+        if (staleTip !== localTip || (await branchExists(coreDeps, branch))) {
+            return refuse(`renaming '${branch}' aside to '${stale}' could not be confirmed; refusing to continue`, "unavailable");
+        }
+        try {
+            deps.errorLog?.(`[executor] fenced resume: kept local '${branch}' (${short(localTip)}) as '${stale}'; preparing from ${originSha !== null ? `origin ${short(originSha)}` : "the resolved base"}`);
+        }
+        catch {
+            /* advisory */
+        }
+    }
+    if (authorityLost())
+        return refuse(authorityMessage, "setup_refused");
+    const startPoint = originSha !== null ? `origin/${branch}` : baseSha;
+    const expectedHead = originSha ?? baseSha;
+    const row = await createWorktreeForTicket(coreDeps, key, { [key]: branch }, options.worktrunkBinary, startPoint, false, { ...(postSwitch ? { postSwitch } : {}), verifyHeadMatches: expectedHead });
+    if (row.status !== "created" || typeof row.path !== "string") {
+        return {
+            ok: false,
+            error: row.error ?? `worktree creation failed for branch '${branch}'`,
+            ...(row.failureKind ? { failureKind: row.failureKind } : {}),
+        };
+    }
+    if (originSha === null) {
+        // Origin is positively empty: the local work is preserved aside and this is a
+        // fresh start from the resolved base. No origin-derived lineage is claimed.
+        return finalizeExecutorWorktree(row.path, branch, baseSha, deps);
+    }
+    const headSha = await resolveCommitSha(deps, row.path, "HEAD");
+    if (headSha === null) {
+        return refuse(`failed to resolve HEAD of the resumed worktree for '${branch}'`, "unavailable");
+    }
+    return {
+        ok: true,
+        worktreePath: row.path,
+        branch,
+        expectedHeadSha: headSha,
+        priorWork: {
+            kind: aligned && retainedPath !== undefined ? "retained_worktree" : "recreated_from_pushed_branch",
+            priorHeadSha: resumeHeadSha,
+        },
+    };
+}
+/**
+ * BAPI-1514: move a CLEAN retained continuation worktree forward to the exact
+ * head the server bound the continuation to, by fast-forward only.
+ *
+ * A refreshed ci_fix continuation describes the bound head B, while the retained
+ * worktree may still sit at an older pushed head A. The worktree is advanced
+ * only when every condition holds, checked in this order:
+ *   1. the worktree has no staged, unstaged, or untracked change (`dirty`
+ *      otherwise — nothing is fetched or merged);
+ *   2. `git fetch origin <branch>` succeeds and `origin/<branch>` resolves to
+ *      exactly the bound SHA (`remote_moved` when it resolves to anything else);
+ *   3. HEAD is the bound SHA already (`already_at_head`), or is an ancestor of
+ *      it (`diverged` otherwise);
+ *   4. `git merge --ff-only <bound-sha>` lands HEAD on the bound SHA
+ *      (`advanced`; `failed` otherwise).
+ * Any command that cannot run or cannot be read is `unavailable`.
+ *
+ * Never stashes, resets, rebases, force-checks-out, deletes, or merges anything
+ * but the exact bound SHA. Every argument is a separate argv entry — no shell.
+ */
+export async function fastForwardRetainedWorktreeToBoundHead(worktreePath, branch, boundHeadSha, runCommand) {
+    const bound = boundHeadSha.trim().toLowerCase();
+    if (!FULL_SHA_PATTERN.test(bound) || branch.trim().length === 0)
+        return { kind: "unavailable" };
+    const run = async (args) => {
+        try {
+            const result = await runCommand("git", args, { cwd: worktreePath });
+            return { exitCode: result.exitCode, stdout: result.stdout };
+        }
+        catch {
+            return null;
+        }
+    };
+    const readSha = async (ref) => {
+        const result = await run(["rev-parse", `${ref}^{commit}`]);
+        if (result === null || result.exitCode !== 0)
+            return null;
+        const sha = result.stdout.trim().toLowerCase();
+        return FULL_SHA_PATTERN.test(sha) ? sha : null;
+    };
+    const status = await run(["status", "--porcelain", "--untracked-files=all"]);
+    if (status === null || status.exitCode !== 0)
+        return { kind: "unavailable" };
+    if (status.stdout.trim().length > 0)
+        return { kind: "dirty" };
+    const fetch = await run(["fetch", "origin", branch]);
+    if (fetch === null || fetch.exitCode !== 0)
+        return { kind: "unavailable" };
+    const remoteTip = await readSha(`origin/${branch}`);
+    if (remoteTip === null)
+        return { kind: "unavailable" };
+    if (remoteTip !== bound)
+        return { kind: "remote_moved" };
+    const head = await readSha("HEAD");
+    if (head === null)
+        return { kind: "unavailable" };
+    if (head === bound)
+        return { kind: "already_at_head" };
+    const ancestry = await run(["merge-base", "--is-ancestor", "HEAD", bound]);
+    if (ancestry === null)
+        return { kind: "unavailable" };
+    if (ancestry.exitCode === 1)
+        return { kind: "diverged" };
+    if (ancestry.exitCode !== 0)
+        return { kind: "unavailable" };
+    const merge = await run(["merge", "--ff-only", bound]);
+    if (merge === null || merge.exitCode !== 0)
+        return { kind: "failed" };
+    const after = await readSha("HEAD");
+    return after === bound ? { kind: "advanced" } : { kind: "failed" };
+}

package/build/executor-launch.js

@@ -47,6 +47,7 @@ import { spawn as nodeSpawn } from "node:child_process";
 import { mkdir, open, readFile, stat, unlink } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { LOCAL_MERGE_CREDENTIAL_ENV_KEYS, } from "./conductor/merge-credential.js";
 import { shellQuote } from "./epic-launch-profile.js";
 import { isValidExecutorEpicRunId } from "./executor/claim-scope.js";
 import { ensureGitInfoExcluded } from "./git-ignore-utils.js";
@@ -78,7 +79,10 @@ export const RUN_EXECUTOR_RELAY_SOURCE = [
     'const { spawn } = require("node:child_process");',
     'const fs = require("node:fs");',
     "const [logPath, command, ...args] = process.argv.slice(1);",
-    "const secrets = [process.env.BAPI_API_KEY, process.env.ANTHROPIC_API_KEY, process.env.CLAUDE_CODE_OAUTH_TOKEN]",
+    "const secrets = [process.env.BAPI_API_KEY, process.env.ANTHROPIC_API_KEY, process.env.CLAUDE_CODE_OAUTH_TOKEN,",
+    // BAPI-1461: the merge token a launch hands over, its alias, and the
+    // machine-user key are redacted from the executor log like every other secret.
+    "  process.env.GITHUB_MERGE_TOKEN, process.env.BAPI_LOCAL_MERGE_TOKEN, process.env.BAPI_MACHINE_MERGE_TOKEN]",
     '  .filter((s) => typeof s === "string" && s.length >= 8).sort((a, b) => b.length - a.length);',
     "const longest = secrets.length > 0 ? secrets[0].length : 0;",
     'const redact = (t) => { for (const s of secrets) t = t.split(s).join("[redacted]"); return t; };',
@@ -587,6 +591,12 @@ export async function ensureRunExecutor(args, deps) {
         childEnv.BAPI_API_KEY = access.apiKey;
         childEnv.BAPI_BASE_URL = access.baseUrl;
         childEnv.BAPI_REPO_NAME = repoName;
+        // BAPI-1461: the resolved local credential becomes the executor's canonical
+        // merge key for its life. A reused executor keeps the value it started with
+        // until it restarts, and still finds a newly stored entry at merge time.
+        if (args.mergeCredential?.kind === "local") {
+            childEnv[LOCAL_MERGE_CREDENTIAL_ENV_KEYS.local] = args.mergeCredential.token;
+        }
         const spawnedAtMs = deps.now();
         let child;
         try {

package/build/generated-assets-doctor.js

@@ -1,6 +1,7 @@
 import { buildPackagedAssetCatalog } from "./generated-assets-catalog.js";
 import { inspectPackagedAssets, inspectPackagedDependency } from "./generated-assets-health.js";
 import { assetRootBinding } from "./generated-assets-context.js";
+import { resolveRecordedPackagedAsset } from "./generated-assets-legacy.js";
 import { readMcpInstallState } from "./mcp-install-state.js";
 import { assetFindingRemedy } from "./generated-assets-remedy.js";
 export async function collectPackagedAssetDoctor(deps) {
@@ -23,16 +24,23 @@ export async function collectPackagedAssetDoctor(deps) {
         const records = inventory.assets.slice(0, 1000);
         const findings = [];
         const deadline = Date.now() + 1000;
+        const currentById = new Map(catalog.assets.map(a => [a.id, a]));
+        // BAPI-1470: an old record and a new record for one host name one asset.
+        const inspected = new Set();
         for (const record of records) {
             if (Date.now() >= deadline) {
                 lines.push("Remaining inspection: indeterminate (time budget).");
                 break;
             }
-            const asset = catalog.assets.find(a => a.id === record.id && a.destination === record.destination && a.hosts.includes(record.host));
+            const asset = resolveRecordedPackagedAsset(record, currentById);
             if (!asset) {
                 lines.push("Package problem: recorded asset unavailable from invoking bundle.");
                 continue;
             }
+            const key = `${record.host}:${asset.id}`;
+            if (inspected.has(key))
+                continue;
+            inspected.add(key);
             // Exact physical checks are observations, not claims about deletion history.
             const result = await inspectPackagedDependency(root, asset, deps, deadline - Date.now());
             findings.push(result);

package/build/generated-assets-health.js

@@ -1,5 +1,6 @@
 import { VERSION } from "./version.generated.js";
 import { assetContextConfidence } from "./generated-assets-context.js";
+import { resolveRecordedPackagedAsset } from "./generated-assets-legacy.js";
 import { inspectAssetPath } from "./generated-assets-paths.js";
 export const MAX_ASSET_INSPECTIONS = 1000;
 /** Inspect only historically provisioned applicable assets; newer bundle entries
@@ -17,16 +18,24 @@ export async function inspectPackagedAssets(options) {
     const recorded = context.inventory.assets.filter(a => a.host === context.host);
     if (recorded.length > MAX_ASSET_INSPECTIONS)
         return { ...result, confirmed: false, reason: "inspection-limit" };
-    const recordedIds = new Set(recorded.map(a => a.id));
+    // BAPI-1470: a valid record of a moved procedure stands for its current asset.
+    const resolvedAssets = recorded.map(record => resolveRecordedPackagedAsset(record, byId));
+    const recordedIds = new Set([...recorded.map(a => a.id), ...resolvedAssets.flatMap(a => a ? [a.id] : [])]);
     result.newlyIntroduced = applicable.filter(a => !recordedIds.has(a.id)).map(a => a.destination).slice(0, MAX_ASSET_INSPECTIONS);
     const deadline = Date.now() + Math.min(1000, Math.max(1, options.budgetMs ?? 1000));
     // Bounded serial probing; no unbounded Promise fan-out.
-    for (const record of recorded) {
-        const asset = byId.get(record.id);
-        if (!asset || record.destination !== asset.destination) {
+    const inspected = new Set();
+    for (const [index, record] of recorded.entries()) {
+        const asset = resolvedAssets[index];
+        if (!asset) {
             result.packageProblems.push("recorded-asset-unavailable-in-bundle");
             continue;
         }
+        // An old record and a new record for the same host name one asset: inspect once.
+        const key = `${record.host}:${asset.id}`;
+        if (inspected.has(key))
+            continue;
+        inspected.add(key);
         const remaining = deadline - Date.now();
         if (remaining <= 0)
             return { ...result, confirmed: false, reason: "inspection-timeout" };

package/build/generated-assets-legacy.js

@@ -0,0 +1,39 @@
+import { LEGACY_DOC_DESTINATIONS } from "./docs.generated.js";
+/** Built once: old destination -> current destination. */
+const CURRENT_BY_LEGACY = new Map(Object.entries(LEGACY_DOC_DESTINATIONS).map(([current, legacy]) => [legacy, current]));
+/**
+ * BAPI-1470 procedure-migration compatibility, not a general asset-rename
+ * mechanism. Returns the current destination for one of the six procedure paths
+ * that moved from docs/install/ to .bridge/procedures/, or undefined for any
+ * other path. This is the only lookup of the inverted map.
+ */
+export function currentDestinationForLegacyDoc(destination) {
+    return CURRENT_BY_LEGACY.get(destination);
+}
+/**
+ * Resolve an inventory record to the current catalog asset it stands for.
+ *
+ * - An ordinary record resolves only when its id, destination, and host all match
+ *   a current asset.
+ * - A moved record resolves only when its id and destination are the same string
+ *   and that string is one of the six old paths. The mapped current asset must
+ *   also support the record's host.
+ * - Everything else (unrelated unavailable records, id/destination pairs that
+ *   disagree, unsupported hosts) returns undefined.
+ *
+ * Pure: it inspects no filesystem path, changes no record, and establishes no
+ * root confidence. Callers apply their own root and authorization checks first.
+ */
+export function resolveRecordedPackagedAsset(record, currentAssets) {
+    const direct = currentAssets.get(record.id);
+    if (direct) {
+        return direct.destination === record.destination && direct.hosts.includes(record.host) ? direct : undefined;
+    }
+    if (record.id !== record.destination)
+        return undefined;
+    const currentId = currentDestinationForLegacyDoc(record.id);
+    if (currentId === undefined)
+        return undefined;
+    const moved = currentAssets.get(currentId);
+    return moved && moved.hosts.includes(record.host) ? moved : undefined;
+}

package/build/generated-assets-paths.js

@@ -1,6 +1,17 @@
 import path from "node:path";
 import { validAssetDestination } from "./generated-assets-catalog.js";
+/**
+ * Path semantics for an injected platform. An explicit platform selects its own
+ * path flavor (win32 or POSIX) so a caller's declared platform, not the host
+ * running the code, decides separators; an absent platform uses the host's.
+ */
+export function assetPathApi(platform) {
+    if (platform === undefined)
+        return path;
+    return platform === "win32" ? path.win32 : path.posix;
+}
 export async function validateAssetRoot(raw, home, fs) {
+    const path = assetPathApi(fs.platform);
     if (!raw || raw.length > 4096 || /[\x00-\x1f\x7f]/.test(raw) || raw.split(/[\\/]/).includes(".."))
         return null;
     try {
@@ -29,7 +40,7 @@ export function filesystemErrorCode(error) {
 }
 /** Metadata/access only. No asset-body reads and no filesystem mutation. */
 export async function inspectAssetPath(root, destination, fs) {
-    const api = fs.platform === "win32" ? path.win32 : path;
+    const api = assetPathApi(fs.platform);
     if (root.length > 4096 || !api.isAbsolute(root) || /[\x00-\x1f\x7f]/.test(root) || !validAssetDestination(destination)) {
         return { status: "indeterminate", reason: "unsafe-path" };
     }

package/build/generated-assets-repair.js

@@ -1,5 +1,6 @@
 import { buildPackagedAssetCatalog, validAssetDestination } from "./generated-assets-catalog.js";
 import { authorizeAssetRepair } from "./generated-assets-context.js";
+import { resolveRecordedPackagedAsset } from "./generated-assets-legacy.js";
 import { inspectAssetPath, filesystemErrorCode } from "./generated-assets-paths.js";
 export async function repairPackagedAssets(options) {
     const catalog = options.catalog ?? buildPackagedAssetCatalog();
@@ -14,7 +15,9 @@ export async function repairPackagedAssets(options) {
         return result;
     }
     for (const record of options.inventory?.assets ?? []) {
-        if (options.hosts.includes(record.host) && ![...requested.values()].some(a => a.id === record.id && a.destination === record.destination)) {
+        // BAPI-1470: authorization above is unchanged; a valid record of a moved
+        // procedure resolves to its current asset, and nothing is published at the old path.
+        if (options.hosts.includes(record.host) && !resolveRecordedPackagedAsset(record, requested)) {
             result.packageProblems.push("recorded-asset-unavailable-in-bundle");
         }
     }

package/build/generated-assets-test-support.js

@@ -33,3 +33,15 @@ export function metadataFixture(assets = [asset()]) {
     };
     return { entries, operations, fs };
 }
+/** BAPI-1470: a moved machine-read procedure and its pre-migration inventory record. */
+export const MOVED_NEW = ".bridge/procedures/review-epic-coherence-procedure.md";
+export const MOVED_OLD = "docs/install/review-epic-coherence-procedure.md";
+export const movedProcedure = (hosts = ["claude"]) => ({
+    id: MOVED_NEW, destination: MOVED_NEW, content: "procedure bytes", kind: "document", hosts,
+    workflows: ["review-epic-coherence"], classification: "procedure",
+});
+/** Context whose inventory holds exactly the given historical records for host claude. */
+export const contextWithRecords = (records) => {
+    const base = context([]);
+    return { ...base, inventory: { ...base.inventory, assets: records.map(r => ({ ...r, host: "claude" })) } };
+};

package/build/github-remote.js

@@ -0,0 +1,33 @@
+/**
+ * The github.com remote parser, dependency-free (BAPI-1461).
+ *
+ * Shared by the merge-workflow installer (which re-exports it) and by
+ * merge-credential resolution, which must not load the installer's module graph
+ * just to name a repository.
+ */
+/**
+ * Parse `owner/name` out of a git remote URL, accepting ONLY canonical
+ * github.com forms.
+ *
+ * GitHub Enterprise and every non-GitHub host return `null`. This feature is
+ * GitHub.com-only: quietly "succeeding" against a host where the result cannot
+ * work would open a pull request that can never actuate anything.
+ */
+export function parseGithubRemote(remoteUrl) {
+    if (typeof remoteUrl !== "string")
+        return null;
+    const trimmed = remoteUrl.trim();
+    if (trimmed.length === 0)
+        return null;
+    const patterns = [
+        /^https:\/\/github\.com\/([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/,
+        /^ssh:\/\/git@github\.com\/([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/,
+        /^git@github\.com:([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/,
+    ];
+    for (const pattern of patterns) {
+        const m = pattern.exec(trimmed);
+        if (m)
+            return `${m[1]}/${m[2]}`;
+    }
+    return null;
+}