engineering-memory 1.11.8 → 1.11.10

package/dispatcher/sections.mjs

@@ -9,7 +9,7 @@ Call \`session.entry\` before you answer anything in a repository, whatever the
 - Switched off: say nothing about Engineering Memory, offer nothing, hint at nothing, however useful it would be for what was asked. They turned it off; raising it again is what this prevents. Record it back on only when they ask.
 - Bound: continue into the lifecycle.
 
-\`session.entry\` also reports this client's version. When it says an update is available, offer once to run \`npx engineering-memory@latest install\` and tell the user the client restarts afterwards. If they decline, record it with \`session.decline_update\` and never raise that version again. When it says an update is required, there is no choice to offer: say that this client is older than the backend supports, give the command, and do not carry on as though the lifecycle works.
+\`session.entry\` also reports this client's version. When it says an update is available, offer once to run \`npx engineering-memory@latest install\` and tell the user that the running bridge switches to the new release by itself on its next call, so nothing needs restarting; only a bridge older than 1.11.9 needs the client restarted once after that install. If they decline, record it with \`session.decline_update\` and never raise that version again. When it says an update is required, there is no choice to offer: say that this client is older than the backend supports, give the command, and do not carry on as though the lifecycle works.
 
 The user may say at any point that they want a different organization, a different project, Engineering Memory switched off, or switched back on. Recognise what they mean rather than matching words — the request arrives in whatever language and phrasing they happen to use — and act on it. Changing the organization always asks for the project again.
 
@@ -19,12 +19,14 @@ Never answer a question about a bound repository from the working tree alone. Wh
 
 After compaction, a new chat, interruption, or handoff, call \`session.resume\` before continuing.
 
-Before a new write/scaffold task, inspect \`worktree.list\` first, then use \`task.branch\` for native base selection and pool allocation. A separate worktree does not necessarily mean a new directory: reuse a safely available slot before creating another. Never invent the next numbered path. Reconcile protected legacy entries through the native recovery flow; clean files alone do not establish that the old agent and delivery have finished. Run all commands from its returned \`repoRoot\`. Renew \`task.heartbeat\` during actual work, use \`task.pause\` on handoff, and resume before writing again. Inactivity never permits force checkout or cleanup. Keep closed worktrees until authorized delivery completes. Ask only unanswered shared branch preferences when \`session.entry\` says the user can manage them; otherwise choose a task-specific base.
+Before a new write/scaffold task, call \`task.branch\` directly: do not ask the user where, from which branch or under which name first, and do not call \`worktree.list\` for it. Its one native form asks where the task works, which branch it starts from and the branch name, and nothing is created until the user answers. The pool reuses a safely available worktree slot before creating another; never pass or invent a worktree path. Reconcile protected legacy entries through the native recovery flow; clean files alone do not establish that the old agent and delivery have finished. Run all commands from its returned \`repoRoot\`. Renew \`task.heartbeat\` during actual work, use \`task.pause\` on handoff, and resume before writing again. Inactivity never permits force checkout or cleanup. Keep closed worktrees until authorized delivery completes. When \`session.entry\` says the user can manage them, unanswered shared branch preferences are asked together in one native form via \`project.set_git_preferences\`; other members choose only their own task base in \`task.branch\`. Answering "Not now" returns \`deferred\` with nothing allocated and a \`reconsider\` call; say so in one line, keep working on anything that does not depend on it, and make that \`reconsider\` call only when the user actually asks to start that task.
 
 Do not edit until the skill lifecycle has completed discovery, its checkpoint, and \`context.prepare_change\`. Do not claim completion until \`task.verify\` succeeds.
 
 Do not block independent task work on \`memory.propose_revision\` drafting, submission or approval. Follow the skill's memory-updates reference: use background agents or concurrent tools when the host permits them, and continue useful work instead of immediately waiting. Without concurrency, checkpoint the pending draft and defer submission until needed. Collect the result only at the operation that depends on it; native approval and required task verification still apply.
 
+A check whose answer decides the next action — delivery preconditions such as the commit hook, the remote and the branch; whether verification or close can pass; what a waiver allows — is run by the agent that takes that action, in its own turn. Hand work to another agent only when you have other real work to do while it runs, and never take the action a delegated check gates before its answer is back. Work another agent checked is neither the user's approval nor task verification. Size delegation to the task — a one- or two-file change needs no multi-agent workflow — and once work is delegated, wait for its real completion signal, never a sleep loop polling its output.
+
 Use the host's native questionnaire for every question to the user, including implementation choices, names, clarification, branch/worktree decisions and delivery. For a required decision, use \`questionnaire.ask\` to open a durable native MCP form and \`questionnaire.resume\` to return to the same unanswered question. Read the skill's questionnaires reference first. Never use request_user_input_async for a required decision: it does not wait for an answer. When the durable form is unavailable, use a blocking native control only where the host permits it: request_user_input in Codex or AskUserQuestion in Claude. Never replace the questionnaire with a chat instruction such as 'type this', 'reply yes', or 'write X if you want Y'. Do not open a survey web page. If the required native control is unavailable or prohibited for that kind of question, follow the host's tool restrictions, explain the limitation, and continue only work already authorized; do not fabricate a survey or silently choose an answer. A timeout, dismissed form, empty response or ended turn is not an answer. Keep the decision pending and resume it; do not start dependent work or report it as resolved. Existing answers remain valid through retries and handoffs.
 
 When a durable MCP form cannot be displayed, read its \`hostFallback\` or call \`questionnaire.resume\` with \`presentation: host_native\` to get the original question without reopening the MCP form. Display the same question, all choices and notices through a blocking native control only if the host permits that control for this decision. After an actual native answer, call \`questionnaire.answer_from_host\` with the unchanged questionnaireId, requestKey and contentHash, the hostTool name and the returned choice/text. This is an agent-reported relay, not MCP transport attestation. Then retry the owning operation; its authority, content and version checks still apply. Never relay prose consent, a default, an asynchronous response or a cancelled/declined/missing answer. Decline alone is not proof that the host cannot display forms. Keep the decision pending if no permitted native control can represent it.
@@ -33,7 +35,9 @@ When the repository is unbound, use the native questionnaire required by the ski
 
 For project creation or adoption, read the skill's project-onboarding reference. Use read-only maturity evidence, then native selection of greenfield, exhaustive adoption or phased rework. A missing folder or Git repository uses preparation:true questionnaires before project.initialize. Recognize later memory-refresh intent semantically and confirm its scope natively; never trigger it from a fixed word list. Adoption and refresh cover architecture, state, services, network, data, screens and cross-module flows, not just page logic.`;
 
+const codexApproval = `Codex's auto-review cannot see an answer given in an Engineering Memory form: to the reviewer it is tool output, and it trusts only the user's own messages, this file and Codex's own approval controls. When a push or pull request needs approval, its justification quotes what the user said and names the exact remote, URL and branch from the delivery destination \`task.close\` returned. When auto-review denies a push, a pull request or any other action the user chose, never open an Engineering Memory form and never ask the user to type or repeat an approval to get past it, and never reword the command to get it through. Quote the denial reason in one sentence and ask for Codex's own approval once — Approve on the denied action, or its \`/approve\` command — and run the identical command once, only after the user has actually given that approval. If this Codex offers no approval for the denial, explain what was denied and why, and wait for the user.`;
+
 export const dispatcherSections = Object.freeze({
-  codex: `${shared}\n\nInvoke the installed skill as \`$engineering-memory\` when an explicit skill invocation is needed.`,
+  codex: `${shared}\n\n${codexApproval}\n\nInvoke the installed skill as \`$engineering-memory\` when an explicit skill invocation is needed.`,
   claude: `${shared}\n\nInvoke the installed skill as \`/engineering-memory\` when an explicit skill invocation is needed.`,
 });

package/install/codex-approval.mjs

@@ -0,0 +1,457 @@
+import { join, resolve } from 'node:path';
+import { readText, replaceFile } from './files.mjs';
+import { mcpServerName } from './mcp-registration.mjs';
+
+export const codexDefaultToolsApprovalMode = 'approve';
+export const codexReviewedToolApprovalMode = 'prompt';
+export const codexReviewedTools = Object.freeze([]);
+
+const serverPath = ['mcp_servers', mcpServerName];
+
+class UnmanagedCodexConfig extends Error {}
+
+export function codexHome(homeDir, environment = process.env) {
+  return environment.CODEX_HOME
+    ? resolve(environment.CODEX_HOME)
+    : join(homeDir, '.codex');
+}
+
+export async function planCodexApproval({
+  codexHome,
+  state,
+  reviewedTools = codexReviewedTools,
+}) {
+  const path = join(codexHome, 'config.toml');
+  const lines = splitLines(await readText(path));
+  const recorded = state ?? {};
+  const intended = {
+    defaultToolsApprovalMode: codexDefaultToolsApprovalMode,
+    tools: Object.fromEntries(
+      reviewedTools.map((tool) => [tool, codexReviewedToolApprovalMode]),
+    ),
+  };
+  const userOverrides = [];
+  const keepUserValue = (key, found, previous, wanted) => {
+    if (found === undefined || found === wanted || found === previous) {
+      return wanted;
+    }
+    userOverrides.push(key);
+    return found;
+  };
+  const server = findSection(lines, serverPath);
+  const toolMode = (tool) =>
+    readKey(lines, findSection(lines, toolPath(tool)), 'approval_mode');
+  const desired = {
+    defaultToolsApprovalMode: keepUserValue(
+      'default_tools_approval_mode',
+      readKey(lines, server, 'default_tools_approval_mode'),
+      recorded.defaultToolsApprovalMode,
+      intended.defaultToolsApprovalMode,
+    ),
+    tools: Object.fromEntries(
+      Object.entries(intended.tools).map(([tool, mode]) => [
+        tool,
+        keepUserValue(
+          `tools.${tomlKey(tool)}.approval_mode`,
+          toolMode(tool),
+          recorded.tools?.[tool],
+          mode,
+        ),
+      ]),
+    ),
+  };
+  const released = Object.entries(recorded.tools ?? {})
+    .filter(
+      ([tool, mode]) => !(tool in intended.tools) && toolMode(tool) === mode,
+    )
+    .map(([tool]) => tool);
+  const preserved = sections(lines)
+    .filter((section) => isToolPath(section.path))
+    .map((section) => lines.slice(section.start, contentEnd(lines, section)));
+  return {
+    path,
+    intended,
+    desired,
+    released,
+    preserved,
+    userOverrides,
+  };
+}
+
+export async function applyCodexApproval(plan, transaction) {
+  try {
+    return await writeCodexApproval(plan, transaction);
+  } catch (error) {
+    if (!(error instanceof UnmanagedCodexConfig)) throw error;
+    return {
+      path: plan.path,
+      skipped: `${error.message} Nothing in it was changed, so Codex keeps reviewing Engineering Memory tools itself; the rest of the installation is complete.`,
+    };
+  }
+}
+
+async function writeCodexApproval(plan, transaction) {
+  const text = await readText(plan.path);
+  let lines = splitLines(text);
+  if (!findSection(lines, serverPath)) {
+    throw new UnmanagedCodexConfig(
+      `${plan.path} has no [mcp_servers.${mcpServerName}] table to hold the approval settings: the server is written as an inline table or dotted keys, or CODEX_HOME names a different Codex home from the one the codex CLI uses. Write the server as that table in the same Codex home, then rerun the installer to let its tools run without Codex review.`,
+    );
+  }
+  for (const block of plan.preserved) {
+    const header = sections(block)[1];
+    if (!findSection(lines, header.path)) lines = appendToServer(lines, block);
+  }
+  for (const tool of plan.released) {
+    lines = removeKey(lines, toolPath(tool), 'approval_mode');
+  }
+  lines = setKey(
+    lines,
+    serverPath,
+    'default_tools_approval_mode',
+    plan.desired.defaultToolsApprovalMode,
+  );
+  for (const [tool, mode] of Object.entries(plan.desired.tools)) {
+    if (!findSection(lines, toolPath(tool))) {
+      const toolsSection = findSection(lines, [...serverPath, 'tools']);
+      const inlineTools = toolsSection
+        ? undefined
+        : findInlineToolsAssignment(lines, findSection(lines, serverPath));
+      const existing = toolsSection
+        ? readToolBodyMode(lines, toolsSection, tool)
+        : inlineTools !== undefined
+          ? readToolFromBlock(inlineTools, tool)
+          : undefined;
+      if (existing !== undefined) {
+        if (existing === mode) continue;
+        throw new UnmanagedCodexConfig(
+          `Codex approval for ${tool} is already set to "${existing}" as a dotted key or inline table inside [mcp_servers.${mcpServerName}.tools]; the installer only manages a dedicated [mcp_servers.${mcpServerName}.tools.${tomlKey(tool)}] table for it. Change or remove that entry yourself, then rerun the installer.`,
+        );
+      }
+      if (inlineTools !== undefined) {
+        throw new UnmanagedCodexConfig(
+          `Codex approval for ${tool} cannot be added: [mcp_servers.${mcpServerName}].tools is already set as an inline table (tools = { ... }), and Codex does not allow extending an inline table with a separate [mcp_servers.${mcpServerName}.tools.${tomlKey(tool)}] table. Add "${tool}" inside that inline table yourself (approval_mode = "${mode}"), or move tools into an explicit [mcp_servers.${mcpServerName}.tools] table, then rerun the installer.`,
+        );
+      }
+      lines = appendToServer(lines, [
+        `[mcp_servers.${mcpServerName}.tools.${tomlKey(tool)}]`,
+      ]);
+    }
+    lines = setKey(lines, toolPath(tool), 'approval_mode', mode);
+  }
+  const updated = lines.join(text.includes('\r\n') ? '\r\n' : '\n');
+  if (updated !== text) await replaceFile(plan.path, updated, transaction);
+  return {
+    path: plan.path,
+    defaultToolsApprovalMode: plan.desired.defaultToolsApprovalMode,
+    reviewedTools: plan.desired.tools,
+    userOverrides: plan.userOverrides,
+  };
+}
+
+function toolPath(tool) {
+  return [...serverPath, 'tools', tool];
+}
+
+function isToolPath(path) {
+  return (
+    path?.length === 4 &&
+    path[0] === serverPath[0] &&
+    path[1] === serverPath[1] &&
+    path[2] === 'tools'
+  );
+}
+
+function tomlKey(key) {
+  return /^[A-Za-z0-9_-]+$/.test(key) ? key : JSON.stringify(key);
+}
+
+function readToolBodyMode(lines, section, tool) {
+  const pattern = keyPattern(tool);
+  const dotted = new RegExp(
+    `^\\s*${pattern}\\.approval_mode\\s*=\\s*(?:"([^"]*)"|'([^']*)')`,
+  );
+  const inline = new RegExp(`^\\s*${pattern}\\s*=\\s*\\{([^}]*)\\}`);
+  for (const line of lines.slice(section.start + 1, section.end)) {
+    const dottedMatch = dotted.exec(line);
+    if (dottedMatch) return dottedMatch[1] ?? dottedMatch[2];
+    const inlineMatch = inline.exec(line);
+    if (inlineMatch) {
+      const valueMatch = /approval_mode\s*=\s*(?:"([^"]*)"|'([^']*)')/.exec(
+        inlineMatch[1],
+      );
+      if (valueMatch) return valueMatch[1] ?? valueMatch[2];
+    }
+  }
+  return undefined;
+}
+
+function findInlineToolsAssignment(lines, section) {
+  if (!section) return undefined;
+  const opens = /^\s*tools\s*=\s*\{/;
+  for (const line of lines.slice(section.start + 1, section.end)) {
+    if (!opens.test(line)) continue;
+    const openIndex = line.indexOf('{');
+    return extractBalancedBraces(line, openIndex) ?? line.slice(openIndex);
+  }
+  return undefined;
+}
+
+function extractBalancedBraces(line, openIndex) {
+  let depth = 0;
+  let index = openIndex;
+  while (index < line.length) {
+    const char = line[index];
+    if (char === '"' || char === "'") {
+      if (line.slice(index, index + 3) === char.repeat(3)) {
+        const delimiter = char.repeat(3);
+        const closeIndex = line.indexOf(delimiter, index + 3);
+        if (closeIndex === -1) return undefined;
+        index = closeIndex + 3;
+        continue;
+      }
+      const quote = char;
+      let k = index + 1;
+      while (k < line.length && line[k] !== quote) {
+        k += quote === '"' && line[k] === '\\' ? 2 : 1;
+      }
+      index = Math.min(k + 1, line.length);
+      continue;
+    }
+    if (char === '{') depth += 1;
+    if (char === '}') {
+      depth -= 1;
+      if (depth === 0) return line.slice(openIndex, index + 1);
+    }
+    index += 1;
+  }
+  return undefined;
+}
+
+function readToolFromBlock(block, tool) {
+  const pattern = keyPattern(tool);
+  const dotted = new RegExp(
+    `${pattern}\\.approval_mode\\s*=\\s*(?:"([^"]*)"|'([^']*)')`,
+  );
+  const inline = new RegExp(`${pattern}\\s*=\\s*\\{([^{}]*)\\}`);
+  const dottedMatch = dotted.exec(block);
+  if (dottedMatch) return dottedMatch[1] ?? dottedMatch[2];
+  const inlineMatch = inline.exec(block);
+  if (inlineMatch) {
+    const valueMatch = /approval_mode\s*=\s*(?:"([^"]*)"|'([^']*)')/.exec(
+      inlineMatch[1],
+    );
+    if (valueMatch) return valueMatch[1] ?? valueMatch[2];
+  }
+  return undefined;
+}
+
+function keyPattern(name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return /^[A-Za-z0-9_-]+$/.test(name)
+    ? `(?:${escaped}|"${escaped}"|'${escaped}')`
+    : `(?:"${escaped}"|'${escaped}')`;
+}
+
+function splitLines(text) {
+  return text === '' ? [] : text.split(/\r?\n/);
+}
+
+function sections(lines) {
+  const found = [{ path: [], start: -1 }];
+  let state = { openString: null, depth: 0 };
+  lines.forEach((line, index) => {
+    if (state.openString === null && state.depth === 0) {
+      const path = headerPath(line);
+      if (path) {
+        found.push({ path, start: index });
+        return;
+      }
+    }
+    state = scanLine(line, state);
+  });
+  return found.map((section, index) => ({
+    ...section,
+    end: found[index + 1]?.start ?? lines.length,
+  }));
+}
+
+function scanLine(line, state) {
+  let openString = state.openString;
+  let depth = state.depth;
+  let index = 0;
+  if (openString) {
+    const closeIndex = line.indexOf(openString, index);
+    if (closeIndex === -1) return { openString, depth };
+    index = closeIndex + openString.length;
+    openString = null;
+  }
+  while (index < line.length) {
+    const char = line[index];
+    if (char === '#') break;
+    if (
+      (char === '"' || char === "'") &&
+      line.slice(index, index + 3) === char.repeat(3)
+    ) {
+      const delimiter = char.repeat(3);
+      const closeIndex = line.indexOf(delimiter, index + 3);
+      if (closeIndex === -1) {
+        openString = delimiter;
+        index = line.length;
+        break;
+      }
+      index = closeIndex + 3;
+      continue;
+    }
+    if (char === '"') {
+      index += 1;
+      while (index < line.length && line[index] !== '"') {
+        index += line[index] === '\\' ? 2 : 1;
+      }
+      index += 1;
+      continue;
+    }
+    if (char === "'") {
+      const closeIndex = line.indexOf("'", index + 1);
+      index = closeIndex === -1 ? line.length : closeIndex + 1;
+      continue;
+    }
+    if (char === '[' || char === '{') {
+      depth += 1;
+      index += 1;
+      continue;
+    }
+    if (char === ']' || char === '}') {
+      depth = Math.max(0, depth - 1);
+      index += 1;
+      continue;
+    }
+    index += 1;
+  }
+  return { openString, depth };
+}
+
+function headerPath(line) {
+  const match = /^\s*\[(?!\[)(.*)\]\s*(?:#.*)?$/.exec(line);
+  if (!match) return null;
+  const path = [];
+  const segment =
+    /\s*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+))\s*(?:\.|$)/y;
+  while (segment.lastIndex < match[1].length) {
+    const found = segment.exec(match[1]);
+    if (!found) return null;
+    try {
+      path.push(
+        found[1] !== undefined
+          ? JSON.parse(`"${found[1]}"`)
+          : (found[2] ?? found[3]),
+      );
+    } catch {
+      return null;
+    }
+  }
+  return path;
+}
+
+function findSection(lines, path) {
+  return sections(lines).find((section) => samePath(section.path, path));
+}
+
+function samePath(left, right) {
+  return (
+    left?.length === right.length &&
+    left.every((part, index) => part === right[index])
+  );
+}
+
+function readKey(lines, section, key) {
+  if (!section) return undefined;
+  const line = lines
+    .slice(section.start + 1, section.end)
+    .find((candidate) => assigns(candidate, key));
+  return line ? assignedValue(line, key) : undefined;
+}
+
+function assigns(line, key) {
+  return new RegExp(`^\\s*${key}\\s*=`).test(line);
+}
+
+function assignedValue(line, key) {
+  const match = new RegExp(`^\\s*${key}\\s*=\\s*(?:"([^"]*)"|'([^']*)')`).exec(
+    line,
+  );
+  return match ? (match[1] ?? match[2]) : undefined;
+}
+
+function replaceAssignedValue(line, key, value) {
+  const match = new RegExp(
+    `^(\\s*${key}\\s*=\\s*)(?:"[^"]*"|'[^']*')(.*)$`,
+  ).exec(line);
+  if (!match) return `${key} = ${JSON.stringify(value)}`;
+  return `${match[1]}${JSON.stringify(value)}${match[2]}`;
+}
+
+function setKey(lines, path, key, value) {
+  const matches = sections(lines).filter((section) =>
+    samePath(section.path, path),
+  );
+  const located = matches
+    .map((section) => ({
+      section,
+      at: lines.findIndex(
+        (candidate, index) =>
+          index > section.start &&
+          index < section.end &&
+          assigns(candidate, key),
+      ),
+    }))
+    .filter((entry) => entry.at >= 0);
+  if (located.length > 1) {
+    throw new UnmanagedCodexConfig(
+      `Refusing to set ${key} in [${path.join('.')}]: it is already set more than once across the tables Codex would load there. Remove the duplicate ${key} lines yourself, then rerun the installer.`,
+    );
+  }
+  if (located.length === 1) {
+    const { at } = located[0];
+    if (assignedValue(lines[at], key) === value) return lines;
+    return lines.with(at, replaceAssignedValue(lines[at], key, value));
+  }
+  const section = matches[0];
+  return lines.toSpliced(
+    section.start + 1,
+    0,
+    `${key} = ${JSON.stringify(value)}`,
+  );
+}
+
+function removeKey(lines, path, key) {
+  const section = findSection(lines, path);
+  if (!section) return lines;
+  const remaining = lines.filter(
+    (line, index) =>
+      !(index > section.start && index < section.end && assigns(line, key)),
+  );
+  const shrunk = findSection(remaining, path);
+  const body = remaining.slice(shrunk.start + 1, shrunk.end);
+  if (body.some((line) => line.trim() && !line.trim().startsWith('#'))) {
+    return remaining;
+  }
+  return remaining.toSpliced(shrunk.start, shrunk.end - shrunk.start);
+}
+
+function appendToServer(lines, block) {
+  const owned = sections(lines).filter(
+    (section) =>
+      section.path?.[0] === serverPath[0] &&
+      section.path?.[1] === serverPath[1],
+  );
+  const at = contentEnd(lines, owned.at(-1));
+  const gap = lines[at]?.trim() ? [''] : [];
+  return lines.toSpliced(at, 0, '', ...block, ...gap);
+}
+
+function contentEnd(lines, section) {
+  let end = section.end;
+  while (end > section.start + 1 && !lines[end - 1].trim()) end -= 1;
+  return end;
+}

package/install/files.mjs

@@ -11,7 +11,13 @@ import {
   rm,
   writeFile,
 } from 'node:fs/promises';
-import { basename, dirname, join } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
+import {
+  launcherPackageJson,
+  launcherSource,
+  normalizeRelativeEntry,
+  releasePointerName,
+} from './launcher.mjs';
 
 export class InstallTransaction {
   constructor() {
@@ -90,8 +96,12 @@ export async function readJson(path) {
 }
 
 export async function replaceFile(path, content, transaction, mode) {
-  const previous = (await exists(path)) ? await readFile(path) : null;
+  await rememberFile(path, transaction, mode);
   await writeAtomic(path, content, mode);
+}
+
+export async function rememberFile(path, transaction, mode) {
+  const previous = (await exists(path)) ? await readFile(path) : null;
   transaction.add(async () => {
     if (previous === null) await rm(path, { force: true });
     else await writeAtomic(path, previous, mode);
@@ -110,6 +120,7 @@ export async function installManagedDirectory(
 ) {
   const artifact = options.artifact ?? 'skill';
   const artifactLabel = artifact === 'skill' ? 'skill' : 'bridge runtime';
+  const accepted = new Set([artifact, ...(options.replaces ?? [])]);
   const sourceHash = await hashDirectory(source);
   const manifestPath = join(destination, '.engineering-memory-install.json');
   if (await exists(destination)) {
@@ -117,7 +128,7 @@ export async function installManagedDirectory(
     if (
       manifest?.product !== 'engineering-memory' ||
       manifest?.schemaVersion !== 1 ||
-      (manifest.artifact ?? 'skill') !== artifact
+      !accepted.has(manifest.artifact ?? 'skill')
     ) {
       throw new Error(
         `Refusing to overwrite an unmanaged ${artifactLabel} directory: ${destination}`,
@@ -151,6 +162,7 @@ export async function installManagedDirectory(
         schemaVersion: 1,
         artifact,
         sourceHash,
+        ...(options.manifest ?? {}),
       },
       null,
       2,
@@ -181,9 +193,22 @@ export async function installManagedDirectory(
 
 export async function installManagedBridgeRuntime(
   source,
-  destination,
+  runtimeRoot,
   transaction,
+  options = {},
 ) {
+  const bridgeEntry = normalizeRelativeEntry(
+    options.bridgeEntry ?? 'dist/src/index.js',
+    'Bridge entry',
+  );
+  const gateEntry = normalizeRelativeEntry(
+    options.gateEntry ?? 'dist/src/git/pre-commit.js',
+    'Git gate entry',
+  );
+  const clientVersion =
+    typeof options.clientVersion === 'string' && options.clientVersion
+      ? options.clientVersion
+      : null;
   const packageJsonPath = join(source, 'package.json');
   const packageLockPath = join(source, 'package-lock.json');
   const nodeModulesPath = join(source, 'node_modules');
@@ -209,10 +234,8 @@ export async function installManagedBridgeRuntime(
     packageJson,
     packageLock,
   );
-  await mkdir(dirname(destination), { recursive: true });
-  const bundle = await mkdtemp(
-    join(dirname(destination), '.bridge-runtime-source-'),
-  );
+  await mkdir(runtimeRoot, { recursive: true });
+  const bundle = await mkdtemp(join(runtimeRoot, '.bridge-runtime-source-'));
   try {
     await copyDirectory(join(source, 'dist'), join(bundle, 'dist'));
     await copyFile(packageJsonPath, join(bundle, 'package.json'));
@@ -230,14 +253,101 @@ export async function installManagedBridgeRuntime(
         join(bundle, ...packageEntry.path.split('/')),
       );
     }
-    return await installManagedDirectory(bundle, destination, transaction, {
+    for (const [entry, label] of [
+      [bridgeEntry, 'Bridge entry'],
+      [gateEntry, 'Git gate entry'],
+    ]) {
+      if (!(await exists(join(bundle, ...entry.split('/'))))) {
+        throw new Error(`${label} is missing from the built bridge: ${entry}`);
+      }
+    }
+    const sourceHash = await hashDirectory(bundle);
+    const releasePath = join(runtimeRoot, 'releases', sourceHash.slice(0, 16));
+    const installedAt = new Date().toISOString();
+    await installManagedDirectory(bundle, releasePath, transaction, {
       artifact: 'bridge-runtime',
+      manifest: { clientVersion, installedAt },
     });
+    const launcherPath = join(runtimeRoot, 'bridge');
+    const launcherStage = await mkdtemp(join(runtimeRoot, '.bridge-launcher-'));
+    try {
+      await writeAtomic(
+        join(launcherStage, 'package.json'),
+        launcherPackageJson,
+      );
+      await writeAtomic(
+        join(launcherStage, ...bridgeEntry.split('/')),
+        launcherSource('bridgeEntry', bridgeEntry),
+      );
+      await writeAtomic(
+        join(launcherStage, ...gateEntry.split('/')),
+        launcherSource('gateEntry', gateEntry),
+      );
+      await installManagedDirectory(launcherStage, launcherPath, transaction, {
+        artifact: 'bridge-launcher',
+        replaces: ['bridge-runtime'],
+      });
+    } finally {
+      await rm(launcherStage, { recursive: true, force: true });
+    }
+    await writeJson(
+      join(runtimeRoot, releasePointerName),
+      {
+        product: 'engineering-memory',
+        schemaVersion: 1,
+        version: clientVersion,
+        sourceHash,
+        path: releasePath,
+        bridgeEntry,
+        gateEntry,
+        installedAt,
+      },
+      transaction,
+    );
+    return { sourceHash, releasePath, launcherPath, bridgeEntry, gateEntry };
   } finally {
     await rm(bundle, { recursive: true, force: true });
   }
 }
 
+export async function pruneReleases(runtimeRoot, options = {}) {
+  const keep = Math.max(1, options.keep ?? 3);
+  const releasesPath = join(runtimeRoot, 'releases');
+  if (!(await exists(releasesPath))) return [];
+  const pointer = await readJson(join(runtimeRoot, releasePointerName));
+  const currentPath =
+    pointer && typeof pointer.path === 'string' ? resolve(pointer.path) : null;
+  const candidates = [];
+  for (const entry of await readdir(releasesPath, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const path = join(releasesPath, entry.name);
+    if (currentPath && resolve(path) === currentPath) continue;
+    const manifest = await readJson(
+      join(path, '.engineering-memory-install.json'),
+    );
+    if (
+      manifest?.product !== 'engineering-memory' ||
+      manifest.artifact !== 'bridge-runtime'
+    ) {
+      continue;
+    }
+    const installedAt = Date.parse(String(manifest.installedAt ?? ''));
+    candidates.push({
+      path,
+      installedAt: Number.isNaN(installedAt)
+        ? (await lstat(path)).mtimeMs
+        : installedAt,
+    });
+  }
+  candidates.sort((left, right) => right.installedAt - left.installedAt);
+  const removed = [];
+  for (const candidate of candidates.slice(keep - 1)) {
+    await rm(candidate.path, { recursive: true, force: true });
+    removed.push(candidate.path);
+  }
+  return removed;
+}
+
 export async function hashDirectory(root, options = {}) {
   const hash = createHash('sha256');
   const excluded = new Set(options.exclude ?? []);