@bridge_gpt/mcp-server 0.2.69 → 0.2.70

package/build/install-bridge.js

@@ -1,5 +1,5 @@
 import { validateBootstrapDisplayName, validateBootstrapServerIdentity } from "./bootstrap-project-identity.js";
-import { lookupModernBootstrapRecord, mutateModernBootstrapRecord, prepareModernBootstrapInvite, prepareModernBootstrapSignup, transitionModernBootstrapSignup, lookupLegacyBootstrapInvite, checkpointModernBootstrapIdentity, promoteModernBootstrapCredential } from "./credential-store.js";
+import { BRIDGE_SUPPORT_EMAIL, archiveAndReplaceModernBootstrapSignup, archiveExpiredLegacySignupAndInstallModern, lookupModernBootstrapRecord, mutateModernBootstrapRecord, prepareModernBootstrapInvite, prepareModernBootstrapSignup, transitionModernBootstrapSignup, lookupLegacyBootstrapInvite, checkpointModernBootstrapIdentity, promoteModernBootstrapCredential } from "./credential-store.js";
 import { collectFirstBuildAdvisory, formatFirstBuildAdvisory } from "./first-build-advisory.js";
 /**
  * install-bridge — the one-command Bridge API project bootstrap (BAPI-429).
@@ -145,6 +145,14 @@ import { spawn } from "child_process";
 import { randomBytes as cryptoRandomBytes, createHash } from "crypto";
 import os from "os";
 import path from "path";
+import { detectClaudeLogin } from "./claude-login.js";
+import { checkGithubSignIn } from "./github-sign-in.js";
+import { readLocalGithubRemote } from "./conductor/stored-merge-credential.js";
+import { probeStoredMergeToken } from "./conductor/stored-merge-token-probe.js";
+import { readGithubMergeCredential, removeGithubMergeCredential, upsertGithubMergeCredential, } from "./credential-store.js";
+import { createBridgeApiUrls } from "./bridge-api-urls.js";
+import { installEpicCiWorkflow } from "./epic-ci-workflow-install.js";
+import { fetchParseStatus, triggerRepositoryParse, } from "./conductor/bridge-api-client.js";
 import readline from "readline";
 import { runInit, InitPreflightError, buildBridgeApiEntry, buildBridgeConfigManifest, mergeBridgeApiProfileToken, resolveInitScaffoldAssets, refreshBridgeApiPackageSpec, currentBridgePackageSpec, classifyTrackedProbeExitCode, decideExistingProjectRoot, formatUndeterminedRootReplacedWarning, } from "./init.js";
 import { hasProjectRootMarker as sharedHasProjectRootMarker } from "./project-root.js";
@@ -1467,6 +1475,19 @@ export function createDefaultInstallBridgeDeps() {
             // Read-only service-state probe (BAPI-779). Typed to return a state,
             // never a runner, so the doctor cannot start/enable/reload anything.
             inspectExecutorServiceState: params.inspectExecutorServiceState,
+            // BAPI-1461: only the converging setup passes these; without them the
+            // conductor doctor is built exactly as before.
+            ...(params.skipDenyProbe !== undefined || params.storedMergeCredential !== undefined
+                ? {
+                    conductorDoctorDeps: {
+                        env: params.env,
+                        ...(params.skipDenyProbe === true ? { skipDenyProbe: true } : {}),
+                        ...(params.storedMergeCredential !== undefined
+                            ? { storedMergeCredential: params.storedMergeCredential }
+                            : {}),
+                    },
+                }
+                : {}),
             installDoctorDeps: {
                 env: params.env,
                 cwd: params.cwd,
@@ -1632,6 +1653,54 @@ export function getMergeWorkflowInstallUsage() {
  * `shell: false` — and `gh` additionally receives the non-interactive pins so a
  * prompt can never hang an install. The resulting environment is never printed.
  */
+/**
+ * BAPI-1461 — the production seams for the converging `install conductor`.
+ *
+ * Each one is a thin adapter over an implementation that already exists: the
+ * Claude login reader, one bounded `gh auth status`, the credential store's
+ * typed merge-token functions (locked, durable writes), the shared capability
+ * probe, the stored-test-command client, the CI workflow artifact-set installer
+ * (sharing the merge-workflow installer's git/gh runners), and the parse routes.
+ */
+export function buildConductorSetupDeps(deps, log, errorLog) {
+    const installerDeps = buildMergeWorkflowInstallDeps(deps, log, errorLog);
+    const storeDeps = modernWriteDeps(deps);
+    return {
+        detectClaudeLogin: () => detectClaudeLogin({ homedir: deps.homedir, readFile: deps.readFile }),
+        // An injected installer runner (tests) is used for these reads too, so a
+        // harness never reaches the real `gh` or `git`.
+        checkGithubSignIn: () => deps.mergeWorkflowRunGh
+            ? checkGithubSignIn(async (args) => ({ exitCode: (await deps.mergeWorkflowRunGh(args)).status }))
+            : checkGithubSignIn(),
+        readLocalGithubRemote: () => readLocalGithubRemote(deps.cwd, deps.mergeWorkflowRunGit
+            ? async () => {
+                const r = await deps.mergeWorkflowRunGit(["remote", "get-url", "origin"]);
+                return r.status === 0 ? r.stdout : null;
+            }
+            : undefined),
+        ...(deps.isTTY && deps.promptSecret ? { promptSecret: deps.promptSecret } : {}),
+        readMergeToken: (identity) => readGithubMergeCredential(identity, storeDeps),
+        storeMergeToken: (identity, token) => upsertGithubMergeCredential(identity, token, storeDeps),
+        removeMergeToken: (identity) => removeGithubMergeCredential(identity, storeDeps),
+        probeMergeToken: (args) => probeStoredMergeToken({ ...args, env: deps.env }),
+        testingConfig: (access) => ({
+            repoName: access.repoName,
+            urls: createBridgeApiUrls(access.baseUrl),
+            fetch: deps.fetch,
+            getGetHeaders: async () => ({ "X-API-Key": access.apiKey }),
+            getPostHeaders: async () => ({ "X-API-Key": access.apiKey, "Content-Type": "application/json" }),
+        }),
+        readRepositoryFile: (relPath) => deps.readFile(path.join(deps.cwd, relPath)),
+        installCiWorkflow: (testCommand, options, confirmWrite) => installEpicCiWorkflow(testCommand, { dryRun: options.dryRun }, {
+            ...installerDeps,
+            ...(options.quiet === true ? { log: () => { }, errorLog: () => { } } : {}),
+            confirmWrite,
+        }),
+        runGh: installerDeps.runGh,
+        fetchParseStatus: (access) => fetchParseStatus(access, deps.fetch),
+        triggerParse: (access) => triggerRepositoryParse(access, deps.fetch),
+    };
+}
 export function buildMergeWorkflowInstallDeps(deps, log, errorLog) {
     const toResult = (r) => ({
         status: r.exitCode,
@@ -3865,7 +3934,7 @@ export async function exchangeBootstrapInvite(deps, baseUrl, token, repoName, ke
     return {
         ok: false,
         kind: "failed",
-        message: `The bootstrap exchange failed (HTTP ${resp.status}). Preserve proof and rerun the same attempt; verify server compatibility and contact installation support if it persists.`,
+        message: `The bootstrap exchange failed (HTTP ${resp.status}). Preserve proof and rerun the same attempt; verify server compatibility and contact Bridge support at ${BRIDGE_SUPPORT_EMAIL} if it persists.`,
     };
 }
 /** The invite-email prompt (BAPI-1263), shown once after an `email_required` refusal. */
@@ -4179,6 +4248,95 @@ export const INSTALL_BRIDGE_SIGNUP_BLOCKED = "Error: Bridge signup is not availa
 export function formatSelfServeUnexpectedStatus(status) {
     return `Error: Bridge signup returned an unexpected response (status ${status}). Try again in a few minutes.`;
 }
+// ===================================================================
+// BAPI-1449 — modern-path verification recovery copy (S1–S7).
+//
+// The wording is settled; only the sender comes from the shared
+// INSTALL_BRIDGE_VERIFICATION_SENDER constant. None of these says WHY a server
+// rejection happened: the word "expired" appears only in S4a, which is chosen from
+// the locally stored expiry and never from a server reply.
+// ===================================================================
+/** The existing end-of-run line for a prompt that gave up or timed out empty. */
+export const INSTALL_BRIDGE_VERIFICATION_INCOMPLETE = "Verification incomplete. Resume the same signup from this folder.";
+/** S1 — the first empty Enter at the modern code prompt. */
+export const INSTALL_BRIDGE_EMPTY_CODE_GUIDANCE = [
+    "No code yet? Type r to send a new one, or check spam for mail from",
+    `${INSTALL_BRIDGE_VERIFICATION_SENDER}.`,
+    "Wrong address? Press Ctrl-C and re-run install with a different email.",
+    "Have a teammate on Bridge? Ask them for an invite and choose",
+    '"I already have a token".',
+].join("\n");
+/** S2 — after a rejected code while resends may remain. */
+export const INSTALL_BRIDGE_REJECTED_RESEND_HINT = "Type r to send a new code, or enter the code again.";
+/** S3 — `r` after the server reported no resends left. */
+export const INSTALL_BRIDGE_NO_MORE_CODES = [
+    "Bridge cannot send more codes for this signup.",
+    "Enter a code from an email you already received.",
+].join("\n");
+/** S4a — the saved challenge is past its locally stored expiry. */
+export const INSTALL_BRIDGE_RECOVERY_REASON_EXPIRED = "The code for this signup has expired.";
+/** S4b — the saved signup has no challenge handle (or expiry). */
+export const INSTALL_BRIDGE_RECOVERY_REASON_NO_CODE = "The last signup in this folder did not finish, so no code is waiting.";
+/** S4c — this run's email differs from the saved signup's email. */
+export const INSTALL_BRIDGE_RECOVERY_REASON_DIFFERENT_EMAIL = "This folder has a signup waiting for a different email address.";
+/** S5 — the rejection cap was reached (state-neutral). */
+export const INSTALL_BRIDGE_RECOVERY_REASON_CAP = "That signup could not be verified. Nothing has been created.";
+/** S6 — the user declined a fresh signup. */
+export const INSTALL_BRIDGE_FRESH_SIGNUP_DECLINED = [
+    "Nothing has been created. Your saved signup is kept.",
+    "Re-run install from this folder when you are ready.",
+].join("\n");
+/** S7 — the user accepted; printed after the old attempt is archived. */
+export const INSTALL_BRIDGE_FRESH_SIGNUP_STARTING = "Starting a new signup. The old attempt was set aside, not deleted.";
+/**
+ * The default-No question after S4a/S4b/S4c/S5. Names only the MASKED address of
+ * THIS run's email; the full address is never printed.
+ */
+export function formatFreshSignupQuestion(thisRunEmail) {
+    return `Start a new signup? We will email a new code to ${maskSignupEmail(thisRunEmail)}. [y/N]: `;
+}
+/** The legacy "could not be requested" line for a rejected email (HTTP 400/422). */
+export const INSTALL_BRIDGE_SELF_SERVE_REQUEST_INVALID = "Error: Self-serve setup could not be requested. Check the email value and try again.";
+/**
+ * Map a failed challenge REQUEST to its user-facing line, with the legacy loop's
+ * category mapping. Carries no response body, email, or exception text.
+ */
+export function formatSelfServeChallengeRequestFailure(failure) {
+    switch (failure.category) {
+        case "rate-limited":
+            return `Error: ${INSTALL_BRIDGE_RESEND_THROTTLED}`;
+        case "unavailable":
+        case "network-error":
+            return INSTALL_BRIDGE_SIGNUP_UNAVAILABLE;
+        case "invalid":
+            return INSTALL_BRIDGE_SELF_SERVE_REQUEST_INVALID;
+        case "blocked":
+            return INSTALL_BRIDGE_SIGNUP_BLOCKED;
+        case "unexpected":
+            return formatSelfServeUnexpectedStatus(failure.status ?? 0);
+        default:
+            return INSTALL_BRIDGE_SIGNUP_UPGRADE_REQUIRED;
+    }
+}
+/**
+ * Map a failed VERIFY (other than the uniform `rejected`) to its user-facing line,
+ * with the legacy loop's mapping. Carries no response body, code, or handle.
+ */
+export function formatSelfServeVerifyFailure(failure) {
+    switch (failure.category) {
+        case "rate-limited":
+            return `Error: ${INSTALL_BRIDGE_VERIFY_THROTTLED}`;
+        case "server-error":
+        case "network-error":
+            return INSTALL_BRIDGE_VERIFY_SERVER_ERROR;
+        case "blocked":
+            return INSTALL_BRIDGE_SIGNUP_BLOCKED;
+        case "unexpected":
+            return formatSelfServeUnexpectedStatus(failure.status ?? 0);
+        default:
+            return INSTALL_BRIDGE_SIGNUP_UPGRADE_REQUIRED;
+    }
+}
 /**
  * Mask an address for display: first character, then the domain.
  *
@@ -4220,23 +4378,10 @@ export function formatChallengeRemaining(expiresAtIso, nowMs) {
     const hours = Math.floor(minutes / 60);
     return `This code is valid for about another ${hours} hours.`;
 }
-/**
- * Prompt for the verification code, validating its shape LOCALLY before any
- * network call.
- *
- * Local validation is a courtesy, not a security control — the server re-validates
- * everything — but it keeps a mistyped code from consuming one of the five attempts
- * that permanently kill a challenge. The user gets the prompt back instead.
- *
- * Pasted input is trimmed: copying a code out of a mail client routinely brings
- * whitespace with it, and refusing that would be an avoidable dead end.
- *
- * The entered value is returned and never echoed, never logged, and never written
- * to disk. `null` means the user gave up (an empty line, or an unreadable prompt).
- */
-export async function promptForVerificationCode(deps, log, maxAttempts = 3) {
+export async function promptForVerificationCode(deps, log, maxAttempts = 3, options = {}) {
+    const allowResend = options.allowResend ?? false;
     if (!deps.promptLine)
-        return null;
+        return { kind: "give-up" };
     for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
         let entered;
         try {
@@ -4245,17 +4390,19 @@ export async function promptForVerificationCode(deps, log, maxAttempts = 3) {
         catch {
             // Secret-free by construction: the caught value is never surfaced or
             // inspected, because a readline failure can carry the partial input.
-            return null;
+            return { kind: "give-up" };
         }
         if (entered.length === 0)
-            return null;
+            return { kind: "empty" };
+        if (allowResend && entered.toLowerCase() === "r")
+            return { kind: "resend" };
         if (new RegExp(`^[0-9]{${SIGNUP_VERIFICATION_CODE_LENGTH}}$`).test(entered)) {
-            return entered;
+            return { kind: "code", code: entered };
         }
         // Describes the SHAPE, never the value the user typed.
         log(`  That does not look like a code — it is ${SIGNUP_VERIFICATION_CODE_LENGTH} digits.`);
     }
-    return null;
+    return { kind: "give-up" };
 }
 /*
  * `mintSelfServeInvite` and `SelfServeMintResult` were REMOVED in BAPI-757.
@@ -5457,6 +5604,9 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
             // Built from the FINAL merged deps for the same reason (BAPI-775): a test
             // that overrides only `readFile` or only `cwd` must see its override here.
             localProvisioning: buildConductorLocalDeps(deps),
+            // BAPI-1461: the converging setup's seams (sign-ins, the stored merge token,
+            // the stored test command, the CI workflow installer, and indexing).
+            setup: deps.conductorSetup ?? buildConductorSetupDeps(deps, log, errorLog),
             // BAPI-1391: the read-only discovery filesystem over THIS working tree, and
             // the short-lived qualifying executor (the existing executor CLI with a
             // `runExecutor` override limiting it to `gate_qualification` jobs).
@@ -5856,6 +6006,9 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
         return 1;
     }
     let modernAttempt;
+    // BAPI-1449: an expired basename-keyed signup is offered a fresh modern signup by
+    // the modern path (consent first), instead of ending the run here.
+    let legacyExpired;
     if (options.tools?.length === 0 && !options.agentName) {
         log(buildManualInstallBridgeContinuation("empty-selection", []));
         return 0;
@@ -5881,22 +6034,22 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                 }
                 if (legacy.state === "resumable" || legacy.state === "challenge")
                     options.repo = oldName.value;
-                if (legacy.state === "challenge-expired") {
-                    errorLog("Saved signup expired. Preserve proof and contact installation support.");
-                    return 1;
-                }
+                if (legacy.state === "challenge-expired")
+                    legacyExpired = { repoName: oldName.value, snapshot: legacy.snapshot };
             }
         }
         if (options.repo === undefined) {
             try {
-                modernAttempt = await redeemModernInstallAttempt(deps, options, baseUrl, inviteToken, signupEmail, selfServeSignupMode);
+                modernAttempt = await redeemModernInstallAttempt(deps, options, baseUrl, inviteToken, signupEmail, selfServeSignupMode, legacyExpired);
                 apiKey = modernAttempt.record.keySecret;
                 options.repo = modernAttempt.repoName;
                 bootstrapInviteMode = false;
                 deps.log(`Project '${modernAttempt.displayName}' recovered; completing installation.`);
             }
             catch (error) {
-                errorLog(error instanceof ModernInstallRecoveryError ? error.message : "Installation could not complete. Preserve recovery proof and resume from the same folder and invite/signup; contact installation support if needed.");
+                if (error instanceof ModernInstallStopped)
+                    return 1;
+                errorLog(error instanceof ModernInstallRecoveryError ? error.message : `Installation could not complete. Preserve recovery proof and resume from the same folder and invite/signup; contact Bridge support at ${BRIDGE_SUPPORT_EMAIL} if needed.`);
                 return 1;
             }
         }
@@ -6290,7 +6443,7 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                             reportFatal(INSTALL_BRIDGE_SIGNUP_UNAVAILABLE);
                         }
                         else if (requested.category === "invalid") {
-                            reportFatal("Error: Self-serve setup could not be requested. Check the email value and try again.");
+                            reportFatal(INSTALL_BRIDGE_SELF_SERVE_REQUEST_INVALID);
                         }
                         else if (requested.category === "blocked") {
                             // BAPI-1171: the request was refused before signup logic ran — an
@@ -6346,12 +6499,15 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
                 // never succeed, with Ctrl-C as the only way out.
                 let rejections = 0;
                 for (;;) {
-                    const code = await promptForVerificationCode(deps, log);
-                    if (code === null) {
+                    // Resend recognition stays off here: on the legacy path `r` is still malformed
+                    // input, and an empty line or give-up ends the run as it always has.
+                    const prompted = await promptForVerificationCode(deps, log);
+                    if (prompted.kind !== "code") {
                         reportFatal("Error: No verification code entered — nothing has been set up. Re-run this command " +
                             "to continue; the code already emailed to you stays valid until it expires.");
                         return false;
                     }
+                    const code = prompted.code;
                     const verified = await verifySelfServeChallenge(deps, baseUrl, challengeHandle, code);
                     if (verified.ok) {
                         inviteToken = verified.token;
@@ -7259,13 +7415,23 @@ export async function runInstallBridgeCli(argv, overrides = {}) {
 }
 class ModernInstallRecoveryError extends Error {
 }
+/** The run already printed its own output (for example S6) and stops with exit 1. */
+class ModernInstallStopped extends Error {
+}
+/**
+ * A record that may hold redeemed proof. Presence, not truthiness: an empty-string
+ * field still counts. Such a record is never offered a fresh signup.
+ */
+function isProtectedModernRecord(record) {
+    return ["fingerprint", "replayToken", "canonical"].some(field => Object.prototype.hasOwnProperty.call(record, field));
+}
 function modernWriteDeps(deps) {
     return { env: deps.env, homedir: deps.homedir, platform: deps.platform, readFile: deps.readFile,
         mkdir: deps.mkdir, writeFile: deps.writeFile, rename: deps.rename, chmod: deps.chmod, unlink: deps.unlink, open: deps.open };
 }
-async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupEmail, selfServe) {
+async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupEmail, selfServe, legacyExpired) {
     if (!deps.realpath)
-        throw new ModernInstallRecoveryError("Canonical folder resolution is unavailable. Contact installation support.");
+        throw new ModernInstallRecoveryError(`Canonical folder resolution is unavailable. Contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}.`);
     const folder = await deps.realpath(deps.cwd);
     const folderDigest = fingerprintBootstrapFields("bridge-bootstrap-folder-v1", [baseUrl, folder]);
     const signupLocator = `bootstrap-pending:signup:${folderDigest}`;
@@ -7277,9 +7443,12 @@ async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupE
     if (!loaded.ok)
         throw new Error(loaded.error);
     let record = loaded.record;
-    const resumed = record !== null;
+    let resumed = record !== null;
     let label = record?.label ?? options.displayName;
-    if (label === undefined) {
+    // BAPI-1449: an expired legacy basename signup asks for consent BEFORE any label
+    // question, so its label is derived only after the user accepts.
+    const deferLabelForLegacy = selfServe && record === null && legacyExpired !== undefined;
+    const deriveLabel = async () => {
         if (!deps.isTTY || !deps.promptLine)
             throw new ModernInstallRecoveryError("Modern invite creation requires --display-name in a non-interactive terminal.");
         // BAPI-1448: a valid folder name is the label, with no question. The prompt
@@ -7289,24 +7458,35 @@ async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupE
             suggestion = validateBootstrapDisplayName(path.basename(folder));
         }
         catch { /* explicit label required */ }
-        if (suggestion) {
-            label = suggestion;
-        }
-        else {
-            label = validateBootstrapDisplayName(await deps.promptLine("Project display name: "));
-        }
-    }
+        if (suggestion)
+            return suggestion;
+        return validateBootstrapDisplayName(await deps.promptLine("Project display name: "));
+    };
+    if (label === undefined && !deferLabelForLegacy)
+        label = await deriveLabel();
     if (selfServe) {
         if (!deps.isTTY || !deps.promptLine)
             throw new ModernInstallRecoveryError("Self-serve email verification requires an interactive terminal.");
-        if (!record) {
-            const intent = await prepareModernBootstrapSignup(scope, label, signupEmail, () => generateBootstrapKeySecret(deps.randomBytes), writeDeps);
-            if (!intent.ok || !intent.record)
-                throw new Error(intent.ok ? "Signup proof missing." : intent.error);
-            record = intent.record;
+        // At most one fresh signup per invocation, whichever route accepted it.
+        let freshSignupAccepted = false;
+        const generateKeySecret = () => generateBootstrapKeySecret(deps.randomBytes);
+        const generateArchiveSuffix = () => deps.randomBytes(16).toString("hex");
+        // Print the reason, then ask the default-No question. A decline (or EOF, an empty
+        // line, a thrown prompt) prints S6 and stops with the credential store untouched.
+        const askFreshSignup = async (reason) => {
+            deps.log(reason);
+            if (!(await requestCredentialRouteSwitchConfirmation(deps, formatFreshSignupQuestion(signupEmail)))) {
+                deps.log(INSTALL_BRIDGE_FRESH_SIGNUP_DECLINED);
+                throw new ModernInstallStopped();
+            }
+        };
+        // Request a challenge for THIS run's email, then persist its handle and expiry
+        // BEFORE the prompt. The request happens outside the credential-store lock. On
+        // any failure the saved record stays and is never replaced again in this run.
+        const requestAndSaveChallenge = async () => {
             const requested = await requestSelfServeChallenge(deps, baseUrl, signupEmail);
             if (!requested.ok)
-                throw new ModernInstallRecoveryError("Signup handle could not be established. Preserve recovery proof; contact installation support before restarting signup.");
+                throw new ModernInstallRecoveryError(formatSelfServeChallengeRequestFailure(requested));
             const saved = await mutateModernBootstrapRecord(scope, writeDeps, current => {
                 if (!current)
                     throw new ModernInstallRecoveryError("Signup proof missing.");
@@ -7315,25 +7495,161 @@ async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupE
             if (!saved.ok || !saved.record)
                 throw new Error(saved.ok ? "Signup proof missing." : saved.error);
             record = saved.record;
+        };
+        // Archive the observed record, install a fresh signup for this run's email, then
+        // (only after that is durable) print S7 and request the new challenge.
+        const replaceWithFreshSignup = async (observed) => {
+            const replaced = await archiveAndReplaceModernBootstrapSignup({ scope, observed, email: signupEmail, generateKeySecret, generateArchiveSuffix }, writeDeps);
+            if (!replaced.ok)
+                throw new ModernInstallRecoveryError(replaced.error);
+            freshSignupAccepted = true;
+            resumed = false;
+            record = replaced.record;
+            deps.log(INSTALL_BRIDGE_FRESH_SIGNUP_STARTING);
+            await requestAndSaveChallenge();
+        };
+        if (!record) {
+            if (legacyExpired) {
+                // The basename-keyed legacy signup is the "no modern record" case: ask, derive
+                // the label from the folder basename, then archive it and install the modern
+                // signup in one write.
+                await askFreshSignup(INSTALL_BRIDGE_RECOVERY_REASON_EXPIRED);
+                label = options.displayName ?? await deriveLabel();
+                const replaced = await archiveExpiredLegacySignupAndInstallModern({ repoName: legacyExpired.repoName, observed: legacyExpired.snapshot, now: deps.now(), scope, label, email: signupEmail, generateKeySecret, generateArchiveSuffix }, writeDeps);
+                if (!replaced.ok)
+                    throw new ModernInstallRecoveryError(replaced.error);
+                freshSignupAccepted = true;
+                record = replaced.record;
+                deps.log(INSTALL_BRIDGE_FRESH_SIGNUP_STARTING);
+                await requestAndSaveChallenge();
+            }
+            else {
+                const intent = await prepareModernBootstrapSignup(scope, label, signupEmail, generateKeySecret, writeDeps);
+                if (!intent.ok || !intent.record)
+                    throw new Error(intent.ok ? "Signup proof missing." : intent.error);
+                record = intent.record;
+                await requestAndSaveChallenge();
+            }
         }
+        else if (!isProtectedModernRecord(record)) {
+            // A saved, unresolved signup. Reasons are checked in this order, and the
+            // expiry is read from the stored value only, never from a server reply.
+            // A malformed stored expiry is treated as unexpired.
+            let reason;
+            if (typeof record.signupEmail === "string" && record.signupEmail.trim().toLowerCase() !== signupEmail.trim().toLowerCase()) {
+                reason = INSTALL_BRIDGE_RECOVERY_REASON_DIFFERENT_EMAIL;
+            }
+            else if (!record.challengeHandle || !record.challengeExpiresAt) {
+                reason = INSTALL_BRIDGE_RECOVERY_REASON_NO_CODE;
+            }
+            else if (Date.parse(record.challengeExpiresAt) <= deps.now()) {
+                reason = INSTALL_BRIDGE_RECOVERY_REASON_EXPIRED;
+            }
+            if (reason !== undefined) {
+                await askFreshSignup(reason);
+                await replaceWithFreshSignup(record);
+            }
+        }
+        if (!record)
+            throw new ModernInstallRecoveryError("Recovery proof missing.");
         if (record.replayToken && record.fingerprint) {
             token = record.replayToken;
             fingerprint = record.fingerprint;
             scope = makeScope(`bootstrap-pending:invite:${fingerprint}`);
         }
         else {
+            // Only a protected record can reach these two guards unresolved: an unprotected
+            // one was either offered a fresh signup above or already holds a live challenge.
             if (!record.challengeHandle || !record.challengeExpiresAt)
-                throw new ModernInstallRecoveryError("The previous signup response is unresolved. Preserve proof and contact installation support before restarting.");
-            if (Date.parse(record.challengeExpiresAt) <= deps.now())
-                throw new ModernInstallRecoveryError("The saved verification challenge expired. Preserve proof and contact installation support.");
-            logVerificationCodeLeadIn(deps.log, record.signupEmail ?? signupEmail);
-            const code = await promptForVerificationCode(deps, deps.log);
-            if (!code)
-                throw new ModernInstallRecoveryError("Verification incomplete. Resume the same signup from this folder.");
-            const verified = await verifySelfServeChallenge(deps, baseUrl, record.challengeHandle, code);
-            if (!verified.ok)
-                throw new ModernInstallRecoveryError("Verification did not complete. Preserve proof and resume the same signup.");
-            token = verified.token;
+                throw new ModernInstallRecoveryError(`The previous signup response is unresolved. Preserve proof and contact Bridge support at ${BRIDGE_SUPPORT_EMAIL} before restarting.`);
+            if (isProtectedModernRecord(record) && Date.parse(record.challengeExpiresAt) <= deps.now())
+                throw new ModernInstallRecoveryError(`The saved verification challenge expired. Preserve proof and contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}.`);
+            // One pass per challenge. Everything challenge-local resets only when a new
+            // challenge begins; the loop leaves it on a verified code or by throwing.
+            let verifiedToken;
+            for (;;) {
+                const handle = record.challengeHandle;
+                logVerificationCodeLeadIn(deps.log, record.signupEmail ?? signupEmail);
+                let rejections = 0;
+                let consecutiveEmpty = 0;
+                let emptyGuidanceShown = false;
+                // Unknown until a resend in THIS session reports it, including on a resumed
+                // challenge: the first `r` then makes a real request.
+                let resendsRemaining;
+                let capReached = false;
+                // Count a rejection; true when the shared cap was just reached.
+                const countRejection = () => {
+                    deps.errorLog(INSTALL_BRIDGE_VERIFICATION_REJECTED);
+                    rejections += 1;
+                    capReached = rejections >= INSTALL_BRIDGE_MAX_CODE_REJECTIONS;
+                    return capReached;
+                };
+                while (!capReached && verifiedToken === undefined) {
+                    const prompted = await promptForVerificationCode(deps, deps.log, 3, { allowResend: true });
+                    if (prompted.kind === "give-up")
+                        throw new ModernInstallRecoveryError(INSTALL_BRIDGE_VERIFICATION_INCOMPLETE);
+                    if (prompted.kind === "empty") {
+                        consecutiveEmpty += 1;
+                        if (consecutiveEmpty >= 2)
+                            throw new ModernInstallRecoveryError(INSTALL_BRIDGE_VERIFICATION_INCOMPLETE);
+                        if (!emptyGuidanceShown) {
+                            deps.log(INSTALL_BRIDGE_EMPTY_CODE_GUIDANCE);
+                            emptyGuidanceShown = true;
+                        }
+                        continue;
+                    }
+                    consecutiveEmpty = 0;
+                    if (prompted.kind === "resend") {
+                        if (resendsRemaining === 0) {
+                            deps.log(INSTALL_BRIDGE_NO_MORE_CODES);
+                            continue;
+                        }
+                        // The server enforces the cooldown and the resend budget; there is no
+                        // client timer or cap. The stored expiry is never touched.
+                        const resent = await resendSelfServeChallenge(deps, baseUrl, handle);
+                        if (resent.ok) {
+                            deps.log(`  ${INSTALL_BRIDGE_RESEND_SENT}`);
+                            resendsRemaining = resent.resendsRemaining;
+                        }
+                        else if (resent.category === "cooldown") {
+                            deps.log(`  ${INSTALL_BRIDGE_RESEND_COOLDOWN}`);
+                        }
+                        else if (resent.category === "rejected") {
+                            // The uniform 401 also covers "no resends left", so the challenge may
+                            // still be alive: count it, but do not end the run on its own.
+                            countRejection();
+                        }
+                        else {
+                            deps.log(`  ${INSTALL_BRIDGE_RESEND_THROTTLED}`);
+                        }
+                        continue;
+                    }
+                    const verified = await verifySelfServeChallenge(deps, baseUrl, handle, prompted.code);
+                    if (verified.ok) {
+                        // BAPI-1173: only an EXPLICIT false prints.
+                        if (verified.trialGranted === false)
+                            deps.log(`  ${INSTALL_BRIDGE_TRIAL_ALREADY_USED}`);
+                        verifiedToken = verified.token;
+                        break;
+                    }
+                    if (verified.category === "rejected") {
+                        if (!countRejection() && resendsRemaining !== 0)
+                            deps.log(INSTALL_BRIDGE_REJECTED_RESEND_HINT);
+                        continue;
+                    }
+                    // Every other category ends the run and keeps the saved record.
+                    throw new ModernInstallRecoveryError(formatSelfServeVerifyFailure(verified));
+                }
+                if (verifiedToken !== undefined)
+                    break;
+                // Rejection cap: offer one fresh signup (S5), unless one was already taken.
+                if (freshSignupAccepted) {
+                    throw new ModernInstallRecoveryError(`${INSTALL_BRIDGE_VERIFICATION_GIVING_UP}\n\nRun it again from this same folder.`);
+                }
+                await askFreshSignup(INSTALL_BRIDGE_RECOVERY_REASON_CAP);
+                await replaceWithFreshSignup(record);
+            }
+            token = verifiedToken;
             fingerprint = fingerprintBootstrapInvite(token, baseUrl);
             const inviteScope = makeScope(`bootstrap-pending:invite:${fingerprint}`);
             const transitioned = await transitionModernBootstrapSignup(makeScope(signupLocator), inviteScope, fingerprint, token, record.challengeHandle, writeDeps);
@@ -7369,7 +7685,7 @@ async function redeemModernInstallAttempt(deps, options, baseUrl, token, signupE
     if (!exchange.ok && exchange.message.includes("Creation outcome is unknown"))
         throw new ModernInstallRecoveryError("Creation outcome is unknown. Preserve recovery proof and rerun the same attempt from the original folder and invite/signup.");
     if (!exchange.ok || !exchange.displayName)
-        throw new ModernInstallRecoveryError("Creation or replay did not complete. Preserve proof and rerun from this folder with the same invite/signup; verify server compatibility or contact installation support.");
+        throw new ModernInstallRecoveryError(`Creation or replay did not complete. Preserve proof and rerun from this folder with the same invite/signup; verify server compatibility or contact Bridge support at ${BRIDGE_SUPPORT_EMAIL}.`);
     const checkpoint = await checkpointModernBootstrapIdentity(scope, record, exchange.repoName, exchange.displayName, writeDeps);
     if (!checkpoint.ok || !checkpoint.record)
         throw new Error(checkpoint.ok ? "Checkpoint missing." : checkpoint.error);

package/build/mcp-install-state.js

@@ -17,6 +17,7 @@
  * unit-testable with in-memory fakes.
  */
 import { validPackagedAssetInventory } from "./generated-assets-context.js";
+import { currentDestinationForLegacyDoc } from "./generated-assets-legacy.js";
 import { executorIdFromLaunchdFilename, executorIdFromSystemdFilename, } from "./executor/service-unit.js";
 import { HOST_PLATFORM_ORDER, isHostPlatformId, } from "./mcp-host-targets.js";
 /** Current on-disk schema version. */
@@ -503,12 +504,17 @@ export async function recordPackagedAssetInventory(cwd, inventory, deps) {
         return { ok: false, error: "Existing installation state cannot be safely preserved." };
     const state = prior.status === "valid" ? prior.state : undefined;
     const records = new Map();
+    // BAPI-1470: a record whose id or destination is one of the six moved procedure
+    // paths is dropped from both sides, so future inventories name only current ones.
+    const isMovedRecord = (a) => currentDestinationForLegacyDoc(a.id) !== undefined || currentDestinationForLegacyDoc(a.destination) !== undefined;
     if (state?.packagedAssets?.rootBinding === inventory.rootBinding) {
         for (const a of state.packagedAssets.assets)
-            records.set(`${a.host}:${a.id}`, a);
+            if (!isMovedRecord(a))
+                records.set(`${a.host}:${a.id}`, a);
     }
     for (const a of inventory.assets)
-        records.set(`${a.host}:${a.id}`, a);
+        if (!isMovedRecord(a))
+            records.set(`${a.host}:${a.id}`, a);
     return writeMcpInstallState(cwd, { selectedPlatforms: state?.selectedPlatforms ?? [],
         projectConfigPaths: state?.projectConfigPaths ?? [], packagedAssets: { ...inventory, assets: [...records.values()] } }, deps);
 }

package/build/merge-pull-request.js

@@ -689,6 +689,12 @@ const LOCAL_GH_HINTS = {
     machine_merge_credential_invalid: `The configured ${LOCAL_MERGE_CREDENTIAL_ENV_KEYS.machine_token} was rejected by GitHub. Rotate it and relaunch this MCP server.`,
     local_merge_credential_unpermitted: `The configured ${LOCAL_MERGE_CREDENTIAL_ENV_KEYS.local} authenticates but cannot write to this repository. Grant it merge permission.`,
     machine_merge_credential_unpermitted: `The configured ${LOCAL_MERGE_CREDENTIAL_ENV_KEYS.machine_token} authenticates but cannot write to this repository. Grant the machine user merge permission.`,
+    // BAPI-1452: GitHub gave no usable answer about the credential's access. Not
+    // proof of a missing permission, but a merge still refuses without evidence.
+    local_merge_probe_unavailable: `Could not confirm that ${LOCAL_MERGE_CREDENTIAL_ENV_KEYS.local} can push to this repository and read its pull requests ` +
+        "(GitHub returned no usable answer). Retry shortly; if it persists, check the token's repository access and GitHub's status.",
+    machine_merge_probe_unavailable: `Could not confirm that ${LOCAL_MERGE_CREDENTIAL_ENV_KEYS.machine_token} can push to this repository and read its pull requests ` +
+        "(GitHub returned no usable answer). Retry shortly; if it persists, check the machine user's repository access and GitHub's status.",
 };
 /**
  * Read the repository's LEGACY merge execution mode.