@deftai/directive-core 0.105.0 → 0.107.0

package/dist/swarm/finalize-cohort-cli.js

@@ -1,67 +1,181 @@
 #!/usr/bin/env node
 import { fileURLToPath } from "node:url";
+import { EXIT_CONFIG_ERROR, EXIT_OK } from "./constants.js";
 import { finalizeCohort } from "./finalize-cohort.js";
+export const FINALIZE_COHORT_USAGE = `Usage: task swarm:finalize-cohort -- [--pr <n>[,<n>...]] [--stories <ids|paths>] [options]
+
+After cohort PRs merge, sweep story briefs active/ -> completed/ and open the lifecycle PR.
+
+Options:
+  --pr <n>[,<n>...]            Merged PR numbers (closing issues map to active stories)
+  --stories <ids|paths>        Explicit story tokens (repeatable)
+  --repo OWNER/REPO            GitHub repo (or $GH_REPO)
+  --project-root <path>        Project root (default: cwd)
+  --base-branch <name>         Sweep/PR base (default: resolved delivery branch)
+  --delivery-branch <name>     Delivery-branch override when policy is untyped
+  --label <name>               Feature-branch label
+  --dry-run                    Print plan; no git mutation
+  --no-commit                  Sweep without committing / opening a PR
+  --no-open-pr                 Commit without opening a PR
+  --json                       Machine-readable result
+  -h, --help                   Show this help
+`;
+function equalsValue(arg, flag) {
+    return arg.slice(flag.length + 1);
+}
+function parsePrList(raw, flag, prNumbers, reject) {
+    if (raw.trim().length === 0) {
+        reject(flag);
+        return;
+    }
+    for (const piece of raw.split(",")) {
+        const trimmed = piece.trim();
+        if (trimmed.length === 0) {
+            reject(flag);
+            return;
+        }
+        if (!/^\d+$/.test(trimmed)) {
+            reject(flag);
+            return;
+        }
+        prNumbers.push(Number.parseInt(trimmed, 10));
+    }
+}
 export function parseFinalizeCohortArgv(argv) {
     const prNumbers = [];
     const storyTokens = [];
     let repo = null;
     let projectRoot = ".";
-    let baseBranch = "master";
+    let baseBranch;
     let deliveryBranch = null;
     let label = null;
     let dryRun = false;
     let noCommit = false;
     let noOpenPr = false;
     let emitJson = false;
+    let help = false;
+    let error = null;
+    const reject = (arg) => {
+        error ??= `unrecognized argument: ${arg}`;
+    };
+    const takeValue = (flag, nextValue) => {
+        if (nextValue === undefined || nextValue.startsWith("-")) {
+            reject(flag);
+            return null;
+        }
+        return nextValue;
+    };
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i];
         const next = argv[i + 1];
-        if (arg === "--pr" && next !== undefined) {
-            for (const piece of next.split(",")) {
-                const trimmed = piece.trim();
-                if (/^\d+$/.test(trimmed)) {
-                    prNumbers.push(Number.parseInt(trimmed, 10));
-                }
+        if (arg === "--help" || arg === "-h") {
+            help = true;
+        }
+        else if (arg === "--pr") {
+            const value = takeValue(arg, next);
+            if (value !== null) {
+                parsePrList(value, arg, prNumbers, reject);
+                i += 1;
             }
-            i += 1;
         }
         else if (arg?.startsWith("--pr=")) {
-            for (const piece of arg.slice("--pr=".length).split(",")) {
-                const trimmed = piece.trim();
-                if (/^\d+$/.test(trimmed)) {
-                    prNumbers.push(Number.parseInt(trimmed, 10));
-                }
+            parsePrList(equalsValue(arg, "--pr"), arg, prNumbers, reject);
+        }
+        else if (arg === "--stories") {
+            const value = takeValue(arg, next);
+            if (value !== null) {
+                storyTokens.push(value);
+                i += 1;
             }
         }
-        else if (arg === "--stories" && next !== undefined) {
-            storyTokens.push(next);
-            i += 1;
+        else if (arg?.startsWith("--stories=")) {
+            const value = equalsValue(arg, "--stories");
+            if (value.length === 0) {
+                reject(arg);
+            }
+            else {
+                storyTokens.push(value);
+            }
         }
-        else if (arg === "--repo" && next !== undefined) {
-            repo = next;
-            i += 1;
+        else if (arg === "--repo") {
+            const value = takeValue(arg, next);
+            if (value !== null) {
+                repo = value;
+                i += 1;
+            }
         }
         else if (arg?.startsWith("--repo=")) {
-            repo = arg.slice("--repo=".length);
+            const value = equalsValue(arg, "--repo");
+            if (value.length === 0) {
+                reject(arg);
+            }
+            else {
+                repo = value;
+            }
+        }
+        else if (arg === "--project-root") {
+            const value = takeValue(arg, next);
+            if (value !== null) {
+                projectRoot = value;
+                i += 1;
+            }
         }
-        else if (arg === "--project-root" && next !== undefined) {
-            projectRoot = next;
-            i += 1;
+        else if (arg?.startsWith("--project-root=")) {
+            const value = equalsValue(arg, "--project-root");
+            if (value.length === 0) {
+                reject(arg);
+            }
+            else {
+                projectRoot = value;
+            }
         }
-        else if (arg === "--base-branch" && next !== undefined) {
-            baseBranch = next;
-            i += 1;
+        else if (arg === "--base-branch") {
+            const value = takeValue(arg, next);
+            if (value !== null) {
+                baseBranch = value;
+                i += 1;
+            }
         }
-        else if (arg === "--delivery-branch" && next !== undefined) {
-            deliveryBranch = next;
-            i += 1;
+        else if (arg?.startsWith("--base-branch=")) {
+            const value = equalsValue(arg, "--base-branch");
+            if (value.length === 0) {
+                reject(arg);
+            }
+            else {
+                baseBranch = value;
+            }
+        }
+        else if (arg === "--delivery-branch") {
+            const value = takeValue(arg, next);
+            if (value !== null) {
+                deliveryBranch = value;
+                i += 1;
+            }
         }
         else if (arg?.startsWith("--delivery-branch=")) {
-            deliveryBranch = arg.slice("--delivery-branch=".length);
+            const value = equalsValue(arg, "--delivery-branch");
+            if (value.length === 0) {
+                reject(arg);
+            }
+            else {
+                deliveryBranch = value;
+            }
+        }
+        else if (arg === "--label") {
+            const value = takeValue(arg, next);
+            if (value !== null) {
+                label = value;
+                i += 1;
+            }
         }
-        else if (arg === "--label" && next !== undefined) {
-            label = next;
-            i += 1;
+        else if (arg?.startsWith("--label=")) {
+            const value = equalsValue(arg, "--label");
+            if (value.length === 0) {
+                reject(arg);
+            }
+            else {
+                label = value;
+            }
         }
         else if (arg === "--dry-run") {
             dryRun = true;
@@ -78,23 +192,37 @@ export function parseFinalizeCohortArgv(argv) {
         else if (arg !== undefined && !arg.startsWith("-")) {
             storyTokens.push(arg);
         }
+        else if (arg !== undefined) {
+            reject(arg);
+        }
     }
     return {
         prNumbers,
         storyTokens,
         repo,
         projectRoot,
-        baseBranch,
+        ...(baseBranch !== undefined ? { baseBranch } : {}),
         deliveryBranch,
         label,
         dryRun,
         noCommit,
         noOpenPr,
         emitJson,
+        help,
+        error,
     };
 }
 export function finalizeCohortMain(argv = process.argv.slice(2)) {
-    const result = finalizeCohort(parseFinalizeCohortArgv(argv));
+    const parsed = parseFinalizeCohortArgv(argv);
+    if (parsed.help) {
+        process.stdout.write(FINALIZE_COHORT_USAGE);
+        return EXIT_OK;
+    }
+    if (parsed.error !== null) {
+        process.stderr.write(`${parsed.error}\n`);
+        return EXIT_CONFIG_ERROR;
+    }
+    const result = finalizeCohort(parsed);
     if (result.stdout.length > 0) {
         process.stdout.write(result.stdout);
     }
@@ -103,7 +231,9 @@ export function finalizeCohortMain(argv = process.argv.slice(2)) {
     }
     return result.exitCode;
 }
+/* v8 ignore start -- entry guard */
 if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
     process.exit(finalizeCohortMain());
 }
+/* v8 ignore stop */
 //# sourceMappingURL=finalize-cohort-cli.js.map

package/dist/swarm/finalize-cohort.d.ts

@@ -13,6 +13,7 @@ export interface FinalizeCohortResult {
     readonly branch: string | null;
     readonly pr_url: string | null;
     readonly delivery_branch: string | null;
+    readonly sweep_base: string;
     readonly delivery_errors: readonly string[];
     readonly errors: readonly string[];
     readonly warnings: readonly string[];

package/dist/swarm/finalize-cohort.js

@@ -327,8 +327,6 @@ export function finalizeCohort(args) {
     const prNumbers = [...(args.prNumbers ?? [])].sort((a, b) => a - b);
     const storyTokens = splitCsv(args.storyTokens ?? []);
     const repo = args.repo ?? process.env.GH_REPO ?? null;
-    // baseBranch is for the lifecycle sweep PR only — not delivery proof (#3041).
-    const baseBranch = args.baseBranch ?? "master";
     const dryRun = args.dryRun ?? false;
     const noCommit = args.noCommit ?? false;
     const noOpenPr = args.noOpenPr ?? false;
@@ -351,6 +349,12 @@ export function finalizeCohort(args) {
     const deliveryBranch = policyDelivery.source === "typed"
         ? policyDelivery.branch
         : (cliDelivery ?? policyDelivery.branch);
+    // Sweep/PR base is distinct from delivery proof (#3041). Default via the resolved
+    // delivery branch — never a hardcoded "master". --base-branch remains the override.
+    const explicitSweepBase = args.baseBranch !== undefined && args.baseBranch !== null && args.baseBranch.trim().length > 0
+        ? args.baseBranch.trim()
+        : null;
+    const baseBranch = explicitSweepBase ?? deliveryBranch;
     if (!existsSync(projectRoot)) {
         return buildResponse({
             projectRoot,
@@ -364,6 +368,7 @@ export function finalizeCohort(args) {
             branch: null,
             prUrl: null,
             deliveryBranch,
+            sweepBase: baseBranch,
             deliveryErrors: [],
             errors: [`project root does not exist: ${projectRoot}`],
             warnings: [],
@@ -385,6 +390,7 @@ export function finalizeCohort(args) {
             branch: null,
             prUrl: null,
             deliveryBranch,
+            sweepBase: baseBranch,
             deliveryErrors: [],
             errors: [`no xbrief/ directory under project root: ${projectRoot}`],
             warnings: [],
@@ -546,6 +552,7 @@ export function finalizeCohort(args) {
             branch: null,
             prUrl: null,
             deliveryBranch,
+            sweepBase: baseBranch,
             deliveryErrors,
             errors,
             warnings,
@@ -572,6 +579,7 @@ export function finalizeCohort(args) {
             branch: null,
             prUrl: null,
             deliveryBranch,
+            sweepBase: baseBranch,
             deliveryErrors,
             errors,
             warnings,
@@ -673,6 +681,7 @@ export function finalizeCohort(args) {
             branch: null,
             prUrl: null,
             deliveryBranch,
+            sweepBase: baseBranch,
             deliveryErrors,
             errors,
             warnings,
@@ -712,6 +721,7 @@ export function finalizeCohort(args) {
         branch,
         prUrl,
         deliveryBranch,
+        sweepBase: baseBranch,
         deliveryErrors,
         errors,
         warnings,
@@ -733,6 +743,7 @@ function buildResponse(input) {
         branch: input.branch,
         pr_url: input.prUrl,
         delivery_branch: input.deliveryBranch,
+        sweep_base: input.sweepBase,
         delivery_errors: input.deliveryErrors,
         errors: input.errors,
         warnings: input.warnings,
@@ -754,6 +765,7 @@ function buildResponse(input) {
     if (input.deliveryBranch !== null) {
         lines.push(`  Delivery branch: ${input.deliveryBranch}`);
     }
+    lines.push(`  Sweep base: ${input.sweepBase}`);
     if (input.prNumbers.length > 0) {
         lines.push(`  PRs: ${input.prNumbers.map((n) => `#${n}`).join(", ")}`);
     }

package/dist/swarm/launch.d.ts

@@ -1,3 +1,4 @@
+import { type ExpectedGithubWorkerPrincipal, type GhRunner, GITHUB_AUTH_MODE_HOST_GH, GITHUB_AUTH_MODE_INJECTED_TOKEN } from "../intake/github-auth-modes.js";
 import { EXIT_CONFIG_ERROR, EXIT_GATE_FAILED, EXIT_OK } from "./constants.js";
 import { type WorktreeRecord } from "./worktrees.js";
 export interface ResolvedStory {
@@ -21,6 +22,70 @@ export type RuntimeAuthProbeFn = () => [string, string];
 export declare const defaultPreflightGate: PreflightGateFn;
 export declare const defaultReadinessGate: ReadinessGateFn;
 export declare const defaultRuntimeAuthProbe: RuntimeAuthProbeFn;
+export type WorkerCredentialDispatchPath = "grok-build" | "local-hybrid";
+/**
+ * Dispatch-envelope half of the runtime / GitHub auth-mode contract (#1557 / #1351).
+ * Policy labels only — never a token value.
+ */
+export declare function formatDispatchAuthEnvelope(fields: {
+    runtimeMode: string;
+    githubAuthMode: string;
+    expectedGithubLogin?: string | null;
+}): string;
+export interface WorkerCredentialInjectionRequest {
+    environ?: NodeJS.ProcessEnv;
+    githubAuthMode: string;
+    runtimeMode?: string | null;
+    dispatchPath?: WorkerCredentialDispatchPath;
+    expectedPrincipal?: ExpectedGithubWorkerPrincipal | null;
+    repo?: string;
+    runGh?: GhRunner;
+    cwd?: string;
+}
+export type WorkerCredentialInjectionResult = {
+    ok: true;
+    injected: true;
+    githubAuthMode: typeof GITHUB_AUTH_MODE_INJECTED_TOKEN;
+    runtimeMode: string | null;
+    expectedLogin: string;
+    spawnEnv: {
+        GH_TOKEN: string;
+        GITHUB_TOKEN: string;
+        GH_ENTERPRISE_TOKEN: string;
+        DEFT_EXPECTED_GITHUB_LOGIN: string;
+    };
+    envelopeSection: string;
+} | {
+    ok: true;
+    injected: false;
+    githubAuthMode: typeof GITHUB_AUTH_MODE_HOST_GH;
+    runtimeMode: string | null;
+    expectedLogin: string | null;
+    spawnEnv: Record<string, never>;
+    envelopeSection: string;
+} | {
+    ok: false;
+    blocked: true;
+    githubAuthMode: string;
+    runtimeMode: string | null;
+    missingCredential: string;
+    remedy: string;
+    detail: string;
+    failureKind: string | null;
+    envelopeSection: string;
+};
+/**
+ * Validate a held user-bearing worker credential and prepare spawn-time injection (#1351).
+ *
+ * Comparison is opt-in on the validator. This path always stamps
+ * `DEFT_EXPECTED_GITHUB_LOGIN` after a successful user-principal check so the
+ * worker envelope does not inherit "any user token is approved."
+ *
+ * Installation credentials fail closed via the existing validator (#3693).
+ * Token values belong only in the returned `spawnEnv` — never in prompts,
+ * transcripts, or manifest entries.
+ */
+export declare function prepareWorkerCredentialInjection(request: WorkerCredentialInjectionRequest): WorkerCredentialInjectionResult;
 /**
  * True when a brief in `xbrief/completed/` (or the legacy `vbrief/completed/`)
  * references the given issue number in its `references[]` / `Traces`. Used by
@@ -74,6 +139,7 @@ export declare function buildManifest(resolved: readonly ResolvedStory[], option
     modelSource?: string | null;
     runtimeMode?: string | null;
     githubAuthMode?: string | null;
+    expectedGithubLogin?: string | null;
     occupancySessionId?: string | null;
 }): Record<string, unknown>[];
 export declare function orderCohort(resolved: readonly ResolvedStory[], _projectRoot: string): ResolvedStory[];
@@ -103,6 +169,9 @@ export interface LaunchArgs {
      * Defaults to `process.env` when unset.
      */
     environ?: NodeJS.ProcessEnv;
+    /** Optional gh runner for identity-bound credential injection (#1351). */
+    runGh?: GhRunner;
+    expectedPrincipal?: ExpectedGithubWorkerPrincipal | null;
 }
 export declare function swarmLaunch(args: LaunchArgs): {
     exitCode: number;

package/dist/swarm/launch.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { containedWrite } from "../fs/contained-write.js";
-import { inferGithubAuthMode } from "../intake/github-auth-modes.js";
+import { ENV_EXPECTED_GITHUB_LOGIN, FAILURE_INSTALLATION_IDENTITY_UNVERIFIABLE, FAILURE_MISSING_INJECTED_TOKEN, findInjectedToken, GITHUB_AUTH_MODE_HOST_GH, GITHUB_AUTH_MODE_INJECTED_TOKEN, inferGithubAuthMode, validateGithubAuthForWorker, } from "../intake/github-auth-modes.js";
 import { getPlatformCapabilities } from "../intake/platform-capabilities.js";
 import { hasArtifactSuffix, resolveLifecycleFolder, stripArtifactSuffix, } from "../layout/resolve.js";
 import { evaluate as preflightEvaluate } from "../preflight/evaluate.js";
@@ -25,6 +25,164 @@ export const defaultRuntimeAuthProbe = () => {
     const report = getPlatformCapabilities();
     return [report.runtimeMode, inferGithubAuthMode(report)];
 };
+const CREDENTIAL_VALUE_PATTERN = /^(ghp_|gho_|ghu_|ghs_|github_pat_)/i;
+const INJECTION_MISSING_CREDENTIAL = "GH_TOKEN (or GITHUB_TOKEN / GH_ENTERPRISE_TOKEN)";
+const INJECTION_DISPATCHER_REMEDY = "Dispatcher-side remedy: load an approved user-bearing worker credential into the dispatcher environment, then call prepareWorkerCredentialInjection before spawn. Do not fall back to the host gh token or continue under the maintainer identity. Installation credentials are not injectable; see #3693.";
+const HELD_WORKER_TOKEN_VARS = [
+    "GH_TOKEN",
+    "GITHUB_TOKEN",
+    "GH_ENTERPRISE_TOKEN",
+    "GITHUB_ENTERPRISE_TOKEN",
+];
+function looksLikeCredentialValue(value) {
+    return CREDENTIAL_VALUE_PATTERN.test(value.trim());
+}
+function assertNoCredentialValue(value, label) {
+    if (looksLikeCredentialValue(value)) {
+        throw new Error(`${label} must not contain a credential value`);
+    }
+}
+function sanitizeEnvelopeField(value, label) {
+    const cleaned = value.replace(/\r?\n/g, " ").trim();
+    assertNoCredentialValue(cleaned, label);
+    return cleaned;
+}
+/**
+ * Bind validation to the selected token. Stamp it into every gh token slot and
+ * drop GH_CONFIG_DIR so a host/enterprise config cannot authenticate as someone
+ * else. GH_HOST stays: it selects the API host, not the secret.
+ */
+function isolateHeldWorkerToken(environ, token) {
+    const isolated = { ...environ };
+    for (const name of HELD_WORKER_TOKEN_VARS) {
+        isolated[name] = token;
+    }
+    delete isolated.GH_CONFIG_DIR;
+    return isolated;
+}
+function boundWorkerSpawnEnv(token, expectedLogin) {
+    return {
+        GH_TOKEN: token,
+        GITHUB_TOKEN: token,
+        GH_ENTERPRISE_TOKEN: token,
+        [ENV_EXPECTED_GITHUB_LOGIN]: expectedLogin,
+    };
+}
+/**
+ * Dispatch-envelope half of the runtime / GitHub auth-mode contract (#1557 / #1351).
+ * Policy labels only — never a token value.
+ */
+export function formatDispatchAuthEnvelope(fields) {
+    const runtimeMode = sanitizeEnvelopeField(fields.runtimeMode, "runtime_mode");
+    const githubAuthMode = sanitizeEnvelopeField(fields.githubAuthMode, "github_auth_mode");
+    const lines = [
+        "## Runtime and GitHub auth mode",
+        "",
+        `- runtime_mode: ${runtimeMode}`,
+        `- github_auth_mode: ${githubAuthMode}`,
+    ];
+    if (fields.expectedGithubLogin !== undefined && fields.expectedGithubLogin !== null) {
+        const login = sanitizeEnvelopeField(fields.expectedGithubLogin, "expected_github_login");
+        if (login.length > 0) {
+            lines.push(`- expected_github_login: ${login}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+function blockedInjection(fields) {
+    const detail = fields.detail.startsWith("BLOCKED") ? fields.detail : `BLOCKED: ${fields.detail}`;
+    return {
+        ok: false,
+        blocked: true,
+        githubAuthMode: fields.githubAuthMode,
+        runtimeMode: fields.runtimeMode,
+        missingCredential: fields.missingCredential ?? INJECTION_MISSING_CREDENTIAL,
+        remedy: INJECTION_DISPATCHER_REMEDY,
+        detail,
+        failureKind: fields.failureKind,
+        envelopeSection: formatDispatchAuthEnvelope({
+            runtimeMode: fields.runtimeMode ?? "unknown",
+            githubAuthMode: fields.githubAuthMode,
+        }),
+    };
+}
+/**
+ * Validate a held user-bearing worker credential and prepare spawn-time injection (#1351).
+ *
+ * Comparison is opt-in on the validator. This path always stamps
+ * `DEFT_EXPECTED_GITHUB_LOGIN` after a successful user-principal check so the
+ * worker envelope does not inherit "any user token is approved."
+ *
+ * Installation credentials fail closed via the existing validator (#3693).
+ * Token values belong only in the returned `spawnEnv` — never in prompts,
+ * transcripts, or manifest entries.
+ */
+export function prepareWorkerCredentialInjection(request) {
+    const environ = request.environ ?? process.env;
+    const runtimeMode = request.runtimeMode ?? null;
+    const token = findInjectedToken(environ);
+    const grokBuild = request.dispatchPath === "grok-build";
+    const effectiveMode = grokBuild || token !== null ? GITHUB_AUTH_MODE_INJECTED_TOKEN : request.githubAuthMode;
+    if (effectiveMode === GITHUB_AUTH_MODE_HOST_GH && token === null) {
+        return {
+            ok: true,
+            injected: false,
+            githubAuthMode: GITHUB_AUTH_MODE_HOST_GH,
+            runtimeMode,
+            expectedLogin: null,
+            spawnEnv: {},
+            envelopeSection: formatDispatchAuthEnvelope({
+                runtimeMode: runtimeMode ?? "local-unsandboxed",
+                githubAuthMode: GITHUB_AUTH_MODE_HOST_GH,
+            }),
+        };
+    }
+    if (token === null) {
+        return blockedInjection({
+            githubAuthMode: GITHUB_AUTH_MODE_INJECTED_TOKEN,
+            runtimeMode,
+            failureKind: FAILURE_MISSING_INJECTED_TOKEN,
+            missingCredential: INJECTION_MISSING_CREDENTIAL,
+            detail: "missing worker credential GH_TOKEN (or GITHUB_TOKEN / GH_ENTERPRISE_TOKEN) for a write-requiring injected-token dispatch",
+        });
+    }
+    const isolatedEnviron = isolateHeldWorkerToken(environ, token);
+    const validated = validateGithubAuthForWorker(GITHUB_AUTH_MODE_INJECTED_TOKEN, {
+        environ: isolatedEnviron,
+        runtimeReport: { runtimeMode: runtimeMode ?? "cloud-headless" },
+        repo: request.repo,
+        runGh: request.runGh,
+        expectedPrincipal: request.expectedPrincipal,
+        cwd: request.cwd,
+    });
+    if (!validated.ok || validated.login === null || validated.login.trim().length === 0) {
+        const installation = validated.failureKind === FAILURE_INSTALLATION_IDENTITY_UNVERIFIABLE;
+        return blockedInjection({
+            githubAuthMode: GITHUB_AUTH_MODE_INJECTED_TOKEN,
+            runtimeMode,
+            failureKind: validated.failureKind,
+            detail: installation
+                ? `${validated.detail} Installation credentials are not injectable (#3693).`
+                : validated.detail,
+        });
+    }
+    const expectedLogin = validated.login.trim();
+    assertNoCredentialValue(expectedLogin, "expected_github_login");
+    const spawnEnv = boundWorkerSpawnEnv(token, expectedLogin);
+    return {
+        ok: true,
+        injected: true,
+        githubAuthMode: GITHUB_AUTH_MODE_INJECTED_TOKEN,
+        runtimeMode,
+        expectedLogin,
+        spawnEnv,
+        envelopeSection: formatDispatchAuthEnvelope({
+            runtimeMode: runtimeMode ?? "cloud-headless",
+            githubAuthMode: GITHUB_AUTH_MODE_INJECTED_TOKEN,
+            expectedGithubLogin: expectedLogin,
+        }),
+    };
+}
 function loadJson(path) {
     try {
         const data = JSON.parse(readFileSync(path, "utf8"));
@@ -498,6 +656,10 @@ export function buildManifest(resolved, options) {
         if (options.githubAuthMode !== undefined && options.githubAuthMode !== null) {
             entry.github_auth_mode = options.githubAuthMode;
         }
+        if (options.expectedGithubLogin !== undefined && options.expectedGithubLogin !== null) {
+            assertNoCredentialValue(options.expectedGithubLogin, "expected_github_login");
+            entry.expected_github_login = options.expectedGithubLogin;
+        }
         manifest.push(entry);
     }
     return manifest;
@@ -692,6 +854,33 @@ export function swarmLaunch(args) {
             stderr: `${occupancy.message}\n`,
         };
     }
+    const launchEnviron = args.environ ?? process.env;
+    let expectedGithubLogin = null;
+    // Only the injected-token launch path auto-validates (and fail-closes on a
+    // missing token). An ambient GH_TOKEN on a host-gh probe is often the
+    // maintainer workaround, not a worker credential; local-hybrid injection is
+    // the explicit prepareWorkerCredentialInjection call.
+    if (githubAuthMode === GITHUB_AUTH_MODE_INJECTED_TOKEN) {
+        const injection = prepareWorkerCredentialInjection({
+            environ: launchEnviron,
+            githubAuthMode,
+            runtimeMode,
+            dispatchPath: "grok-build",
+            runGh: args.runGh,
+            expectedPrincipal: args.expectedPrincipal,
+            cwd: projectRoot,
+        });
+        if (!injection.ok) {
+            return {
+                exitCode: EXIT_GATE_FAILED,
+                stdout: "",
+                stderr: `${injection.detail}\n${injection.remedy}\n`,
+            };
+        }
+        if (injection.injected) {
+            expectedGithubLogin = injection.expectedLogin;
+        }
+    }
     const manifest = buildManifest(ordered, {
         projectRoot,
         group: args.group ?? null,
@@ -708,6 +897,7 @@ export function swarmLaunch(args) {
         modelSource,
         runtimeMode,
         githubAuthMode,
+        expectedGithubLogin,
         occupancySessionId: occupancy.sessionId,
     });
     const rendered = `${JSON.stringify(manifest, null, 2)}\n`;

package/dist/swarm/routing-set-cli.js

@@ -22,6 +22,8 @@ export function routingSetMain(argv = process.argv.slice(2), environ = process.e
     let harnessDefault = false;
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i];
+        if (arg === "--")
+            continue;
         if (arg === "--project-root" && argv[i + 1] !== undefined) {
             projectRoot = argv[i + 1] ?? ".";
             i += 1;