engineering-memory 1.11.8 → 1.11.9

package/dispatcher/sections.mjs

@@ -9,7 +9,7 @@ Call \`session.entry\` before you answer anything in a repository, whatever the
 - Switched off: say nothing about Engineering Memory, offer nothing, hint at nothing, however useful it would be for what was asked. They turned it off; raising it again is what this prevents. Record it back on only when they ask.
 - Bound: continue into the lifecycle.
 
-\`session.entry\` also reports this client's version. When it says an update is available, offer once to run \`npx engineering-memory@latest install\` and tell the user the client restarts afterwards. If they decline, record it with \`session.decline_update\` and never raise that version again. When it says an update is required, there is no choice to offer: say that this client is older than the backend supports, give the command, and do not carry on as though the lifecycle works.
+\`session.entry\` also reports this client's version. When it says an update is available, offer once to run \`npx engineering-memory@latest install\` and tell the user that the running bridge switches to the new release by itself on its next call, so nothing needs restarting; only a bridge older than 1.11.9 needs the client restarted once after that install. If they decline, record it with \`session.decline_update\` and never raise that version again. When it says an update is required, there is no choice to offer: say that this client is older than the backend supports, give the command, and do not carry on as though the lifecycle works.
 
 The user may say at any point that they want a different organization, a different project, Engineering Memory switched off, or switched back on. Recognise what they mean rather than matching words — the request arrives in whatever language and phrasing they happen to use — and act on it. Changing the organization always asks for the project again.
 

package/install/files.mjs

@@ -11,7 +11,13 @@ import {
   rm,
   writeFile,
 } from 'node:fs/promises';
-import { basename, dirname, join } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
+import {
+  launcherPackageJson,
+  launcherSource,
+  normalizeRelativeEntry,
+  releasePointerName,
+} from './launcher.mjs';
 
 export class InstallTransaction {
   constructor() {
@@ -110,6 +116,7 @@ export async function installManagedDirectory(
 ) {
   const artifact = options.artifact ?? 'skill';
   const artifactLabel = artifact === 'skill' ? 'skill' : 'bridge runtime';
+  const accepted = new Set([artifact, ...(options.replaces ?? [])]);
   const sourceHash = await hashDirectory(source);
   const manifestPath = join(destination, '.engineering-memory-install.json');
   if (await exists(destination)) {
@@ -117,7 +124,7 @@ export async function installManagedDirectory(
     if (
       manifest?.product !== 'engineering-memory' ||
       manifest?.schemaVersion !== 1 ||
-      (manifest.artifact ?? 'skill') !== artifact
+      !accepted.has(manifest.artifact ?? 'skill')
     ) {
       throw new Error(
         `Refusing to overwrite an unmanaged ${artifactLabel} directory: ${destination}`,
@@ -151,6 +158,7 @@ export async function installManagedDirectory(
         schemaVersion: 1,
         artifact,
         sourceHash,
+        ...(options.manifest ?? {}),
       },
       null,
       2,
@@ -181,9 +189,22 @@ export async function installManagedDirectory(
 
 export async function installManagedBridgeRuntime(
   source,
-  destination,
+  runtimeRoot,
   transaction,
+  options = {},
 ) {
+  const bridgeEntry = normalizeRelativeEntry(
+    options.bridgeEntry ?? 'dist/src/index.js',
+    'Bridge entry',
+  );
+  const gateEntry = normalizeRelativeEntry(
+    options.gateEntry ?? 'dist/src/git/pre-commit.js',
+    'Git gate entry',
+  );
+  const clientVersion =
+    typeof options.clientVersion === 'string' && options.clientVersion
+      ? options.clientVersion
+      : null;
   const packageJsonPath = join(source, 'package.json');
   const packageLockPath = join(source, 'package-lock.json');
   const nodeModulesPath = join(source, 'node_modules');
@@ -209,10 +230,8 @@ export async function installManagedBridgeRuntime(
     packageJson,
     packageLock,
   );
-  await mkdir(dirname(destination), { recursive: true });
-  const bundle = await mkdtemp(
-    join(dirname(destination), '.bridge-runtime-source-'),
-  );
+  await mkdir(runtimeRoot, { recursive: true });
+  const bundle = await mkdtemp(join(runtimeRoot, '.bridge-runtime-source-'));
   try {
     await copyDirectory(join(source, 'dist'), join(bundle, 'dist'));
     await copyFile(packageJsonPath, join(bundle, 'package.json'));
@@ -230,14 +249,101 @@ export async function installManagedBridgeRuntime(
         join(bundle, ...packageEntry.path.split('/')),
       );
     }
-    return await installManagedDirectory(bundle, destination, transaction, {
+    for (const [entry, label] of [
+      [bridgeEntry, 'Bridge entry'],
+      [gateEntry, 'Git gate entry'],
+    ]) {
+      if (!(await exists(join(bundle, ...entry.split('/'))))) {
+        throw new Error(`${label} is missing from the built bridge: ${entry}`);
+      }
+    }
+    const sourceHash = await hashDirectory(bundle);
+    const releasePath = join(runtimeRoot, 'releases', sourceHash.slice(0, 16));
+    const installedAt = new Date().toISOString();
+    await installManagedDirectory(bundle, releasePath, transaction, {
       artifact: 'bridge-runtime',
+      manifest: { clientVersion, installedAt },
     });
+    const launcherPath = join(runtimeRoot, 'bridge');
+    const launcherStage = await mkdtemp(join(runtimeRoot, '.bridge-launcher-'));
+    try {
+      await writeAtomic(
+        join(launcherStage, 'package.json'),
+        launcherPackageJson,
+      );
+      await writeAtomic(
+        join(launcherStage, ...bridgeEntry.split('/')),
+        launcherSource('bridgeEntry', bridgeEntry),
+      );
+      await writeAtomic(
+        join(launcherStage, ...gateEntry.split('/')),
+        launcherSource('gateEntry', gateEntry),
+      );
+      await installManagedDirectory(launcherStage, launcherPath, transaction, {
+        artifact: 'bridge-launcher',
+        replaces: ['bridge-runtime'],
+      });
+    } finally {
+      await rm(launcherStage, { recursive: true, force: true });
+    }
+    await writeJson(
+      join(runtimeRoot, releasePointerName),
+      {
+        product: 'engineering-memory',
+        schemaVersion: 1,
+        version: clientVersion,
+        sourceHash,
+        path: releasePath,
+        bridgeEntry,
+        gateEntry,
+        installedAt,
+      },
+      transaction,
+    );
+    return { sourceHash, releasePath, launcherPath, bridgeEntry, gateEntry };
   } finally {
     await rm(bundle, { recursive: true, force: true });
   }
 }
 
+export async function pruneReleases(runtimeRoot, options = {}) {
+  const keep = Math.max(1, options.keep ?? 3);
+  const releasesPath = join(runtimeRoot, 'releases');
+  if (!(await exists(releasesPath))) return [];
+  const pointer = await readJson(join(runtimeRoot, releasePointerName));
+  const currentPath =
+    pointer && typeof pointer.path === 'string' ? resolve(pointer.path) : null;
+  const candidates = [];
+  for (const entry of await readdir(releasesPath, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const path = join(releasesPath, entry.name);
+    if (currentPath && resolve(path) === currentPath) continue;
+    const manifest = await readJson(
+      join(path, '.engineering-memory-install.json'),
+    );
+    if (
+      manifest?.product !== 'engineering-memory' ||
+      manifest.artifact !== 'bridge-runtime'
+    ) {
+      continue;
+    }
+    const installedAt = Date.parse(String(manifest.installedAt ?? ''));
+    candidates.push({
+      path,
+      installedAt: Number.isNaN(installedAt)
+        ? (await lstat(path)).mtimeMs
+        : installedAt,
+    });
+  }
+  candidates.sort((left, right) => right.installedAt - left.installedAt);
+  const removed = [];
+  for (const candidate of candidates.slice(keep - 1)) {
+    await rm(candidate.path, { recursive: true, force: true });
+    removed.push(candidate.path);
+  }
+  return removed;
+}
+
 export async function hashDirectory(root, options = {}) {
   const hash = createHash('sha256');
   const excluded = new Set(options.exclude ?? []);

package/install/installer.mjs

@@ -10,6 +10,7 @@ import {
   installManagedBridgeRuntime,
   installManagedDirectory,
   InstallTransaction,
+  pruneReleases,
   readJson,
   readText,
   replaceFile,
@@ -54,7 +55,8 @@ export async function installEngineeringMemory(options = {}) {
     options.gateEntry ??
       join(bridgeRuntimeSource, 'dist', 'src', 'git', 'pre-commit.js'),
   );
-  const runtimePath = join(homeDir, '.engineering-memory', 'runtime', 'bridge');
+  const runtimeRoot = join(homeDir, '.engineering-memory', 'runtime');
+  const runtimePath = join(runtimeRoot, 'bridge');
   const bridgeEntry = stableRuntimeEntry(
     bridgeRuntimeSource,
     runtimePath,
@@ -153,10 +155,15 @@ export async function installEngineeringMemory(options = {}) {
   const transaction = new InstallTransaction();
   let result;
   try {
-    const runtimeHash = await installManagedBridgeRuntime(
+    const runtime = await installManagedBridgeRuntime(
       bridgeRuntimeSource,
-      runtimePath,
+      runtimeRoot,
       transaction,
+      {
+        clientVersion,
+        bridgeEntry: relative(bridgeRuntimeSource, sourceBridgeEntry),
+        gateEntry: relative(bridgeRuntimeSource, sourceGateEntry),
+      },
     );
     const mcp = {
       ...(existingState?.mcp ?? {}),
@@ -183,7 +190,8 @@ export async function installEngineeringMemory(options = {}) {
       skillHash,
       runtime: {
         path: runtimePath,
-        sourceHash: runtimeHash,
+        sourceHash: runtime.sourceHash,
+        release: runtime.releasePath,
         bridgeEntry,
         gateEntry,
       },
@@ -206,6 +214,7 @@ export async function installEngineeringMemory(options = {}) {
       apiUrl,
       clientVersion,
       runtimePath,
+      release: runtime.releasePath,
       bridgeEntry,
       gateEntry,
       hook: hookResult,
@@ -222,6 +231,13 @@ export async function installEngineeringMemory(options = {}) {
     throw error;
   }
   await transaction.commit();
+  try {
+    result.prunedReleases = await pruneReleases(runtimeRoot);
+  } catch (error) {
+    result.prunedReleases = [];
+    result.releasePruneProblem =
+      error instanceof Error ? error.message : String(error);
+  }
   return result;
 }
 

package/install/launcher.mjs

@@ -0,0 +1,95 @@
+export const launcherPackageJson = `${JSON.stringify(
+  {
+    name: 'engineering-memory-bridge-launcher',
+    private: true,
+    type: 'module',
+  },
+  null,
+  2,
+)}\n`;
+
+export const releasePointerName = 'current.json';
+
+export function normalizeRelativeEntry(entry, label) {
+  const normalized = String(entry).replaceAll('\\', '/').replace(/^\.\//, '');
+  const segments = normalized.split('/');
+  if (
+    normalized === '' ||
+    normalized.startsWith('/') ||
+    /^[A-Za-z]:/.test(normalized) ||
+    segments.some(
+      (segment) => segment === '' || segment === '..' || segment === '.',
+    )
+  ) {
+    throw new Error(
+      `${label} must be a relative path inside the release: ${entry}`,
+    );
+  }
+  if (segments[0] !== 'dist') {
+    throw new Error(
+      `${label} must be inside the built dist directory: ${entry}`,
+    );
+  }
+  return normalized;
+}
+
+export function launcherSource(kind, relativeEntry) {
+  if (kind !== 'bridgeEntry' && kind !== 'gateEntry') {
+    throw new Error(`Unknown launcher kind: ${kind}`);
+  }
+  const depth = normalizeRelativeEntry(relativeEntry, 'Launcher entry').split(
+    '/',
+  ).length;
+  const ascend = Array.from({ length: depth }, () => "'..'").join(', ');
+  const label = kind === 'bridgeEntry' ? 'bridge' : 'Git gate';
+  return [
+    '#!/usr/bin/env node',
+    "import { readFile } from 'node:fs/promises';",
+    "import { dirname, isAbsolute, join, resolve } from 'node:path';",
+    "import { fileURLToPath, pathToFileURL } from 'node:url';",
+    '',
+    `const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), ${ascend});`,
+    `const pointerPath = join(runtimeRoot, ${JSON.stringify(releasePointerName)});`,
+    `const installCommand = 'npx engineering-memory@latest install';`,
+    '',
+    'function stop(message) {',
+    "  process.stderr.write(message + '\\n');",
+    '  process.exit(1);',
+    '}',
+    '',
+    'let pointer;',
+    'try {',
+    "  pointer = JSON.parse(await readFile(pointerPath, 'utf8'));",
+    '} catch (error) {',
+    '  stop(',
+    `    'The Engineering Memory ${label} cannot start: ' +`,
+    '      pointerPath +',
+    "      ' is unreadable (' +",
+    '      (error instanceof Error ? error.message : String(error)) +',
+    "      '). Run ' +",
+    '      installCommand +',
+    "      '.',",
+    '  );',
+    '}',
+    'if (',
+    '  !pointer ||',
+    "  pointer.product !== 'engineering-memory' ||",
+    "  typeof pointer.path !== 'string' ||",
+    `  typeof pointer.${kind} !== 'string'`,
+    ') {',
+    '  stop(',
+    `    'The Engineering Memory ${label} cannot start: ' +`,
+    '      pointerPath +',
+    "      ' does not name a release. Run ' +",
+    '      installCommand +',
+    "      '.',",
+    '  );',
+    '}',
+    'const releasePath = isAbsolute(pointer.path)',
+    '  ? pointer.path',
+    '  : resolve(runtimeRoot, pointer.path);',
+    'process.env.ENGINEERING_MEMORY_RUNTIME_CURRENT = pointerPath;',
+    `await import(pathToFileURL(join(releasePath, ...pointer.${kind}.split('/'))).href);`,
+    '',
+  ].join('\n');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.11.8",
+  "version": "1.11.9",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/build.json

@@ -1,3 +1,3 @@
 {
-  "gitHead": "eefcf3aac9c83ba9d0126d05309ca100947317d3"
+  "gitHead": "3b5175e578b3d631932b079b5678afe13dc4f00d"
 }

package/runtime/dist/src/config.js

@@ -10,6 +10,9 @@ export function loadBridgeConfig(env = process.env) {
         apiBaseUrl: (env.ENGINEERING_MEMORY_API_URL ?? 'http://127.0.0.1:3000').replace(/\/$/, ''),
         stateRoot: resolve(env.ENGINEERING_MEMORY_STATE_DIR ?? join(homedir(), '.engineering-memory')),
         clientVersion: env.ENGINEERING_MEMORY_CLIENT_VERSION ?? null,
+        runtimeCurrentPath: env.ENGINEERING_MEMORY_RUNTIME_CURRENT
+            ? resolve(env.ENGINEERING_MEMORY_RUNTIME_CURRENT)
+            : null,
         requestTimeoutMs: positiveInteger(env.ENGINEERING_MEMORY_TIMEOUT_MS, 15_000),
         cacheMaxEntries: positiveInteger(env.ENGINEERING_MEMORY_CACHE_MAX_ENTRIES, 64),
         cacheMaxBytes: positiveInteger(env.ENGINEERING_MEMORY_CACHE_MAX_BYTES, 5 * 1024 * 1024),

package/runtime/dist/src/index.js

@@ -1,88 +1,32 @@
 #!/usr/bin/env node
-import { WorktreePool } from './runtime/worktree-pool.js';
-import { WorktreePolicyCache } from './runtime/worktree-policy.js';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { serveStdio } from '@modelcontextprotocol/server/stdio';
-import { BrowserAuthCoordinator } from './auth/browser-auth.js';
-import { createCredentialStore } from './auth/credential-store.js';
-import { EtagCache } from './cache/etag-cache.js';
-import { apiNamespaceKey, apiStateRoot, endpoints, loadBridgeConfig } from './config.js';
-import { GitInspector } from './git/git-inspector.js';
-import { VerificationGate } from './git/verification-gate.js';
-import { JournalStore } from './journal/journal-store.js';
-import { createEngineeringMemoryServer } from './mcp/server.js';
-import { RepositoryResolver } from './project/repository.js';
-import { ApiClient } from './runtime/api-client.js';
-import { BridgeService } from './runtime/bridge-service.js';
-import { OfflineOutbox } from './runtime/offline-outbox.js';
-import { ActiveContextStore } from './runtime/active-context-store.js';
-import { RepositoryDecisionStore } from './runtime/repository-decision-store.js';
-import { ShadowNoticeStore } from './runtime/shadow-notice-store.js';
-import { UpdateChoiceStore } from './runtime/update-choice-store.js';
-import { PrincipalStateGuard } from './runtime/principal-state.js';
-import { OnboardingStore } from './runtime/onboarding-store.js';
-import { QuestionnaireStore } from './runtime/questionnaire-store.js';
-export function createBridgeService() {
+import { loadBridgeConfig } from './config.js';
+import { createMcpServer } from './mcp/server.js';
+import { createRuntime } from './runtime/runtime-entry.js';
+import { RuntimeHost, readCurrentRelease } from './runtime/runtime-host.js';
+export { createBridgeService } from './runtime/create-bridge-service.js';
+const releaseRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
+export async function createServer() {
     const config = loadBridgeConfig();
-    const apiNamespace = apiNamespaceKey(config.apiBaseUrl);
-    const stateRoot = apiStateRoot(config);
-    const credentials = createCredentialStore({
-        service: config.credentialService,
-        account: `${config.credentialAccount}:${apiNamespace}`,
-        stateRoot,
+    const server = createMcpServer();
+    let version = config.clientVersion;
+    const currentPath = config.runtimeCurrentPath;
+    if (currentPath) {
+        const current = await readCurrentRelease(currentPath);
+        if ('release' in current && current.path === releaseRoot)
+            version = current.release.version ?? version;
+    }
+    const host = new RuntimeHost({
+        server,
+        release: { path: releaseRoot, version, module: { createRuntime } },
+        ...(currentPath ? { currentPath } : {}),
+        log: (message) => process.stderr.write(`${message}\n`),
     });
-    const cache = new EtagCache({
-        stateRoot,
-        maxEntries: config.cacheMaxEntries,
-        maxBytes: config.cacheMaxBytes,
-        maxAgeMs: config.cacheMaxAgeMs,
-    });
-    const client = new ApiClient({
-        baseUrl: config.apiBaseUrl,
-        timeoutMs: config.requestTimeoutMs,
-        credentials,
-        cache,
-        refreshPath: endpoints.authRefresh,
-    });
-    const git = new GitInspector();
-    const outbox = new OfflineOutbox(stateRoot);
-    const activeContexts = new ActiveContextStore(stateRoot);
-    const repositoryDecisions = new RepositoryDecisionStore(stateRoot);
-    const updateChoices = new UpdateChoiceStore(stateRoot);
-    const shadowNotices = new ShadowNoticeStore(stateRoot);
-    const worktreePool = new WorktreePool(stateRoot, {
-        pendingWork: async (entry) => {
-            if (!entry.taskId)
-                return false;
-            const pointer = await activeContexts.loadForTask(entry.repoFingerprint, entry.taskId);
-            return Boolean(pointer?.verificationIntent ||
-                pointer?.closeIntent ||
-                (await outbox.listForTask(entry.taskId)).length);
-        },
-    });
-    const gate = new VerificationGate(stateRoot, git, outbox, undefined, worktreePool);
-    const principalState = new PrincipalStateGuard(stateRoot, credentials, cache, outbox, activeContexts, gate);
-    return new BridgeService({
-        worktreePool,
-        worktreePolicy: new WorktreePolicyCache(stateRoot),
-        client,
-        credentials,
-        browserAuth: new BrowserAuthCoordinator(client, credentials),
-        repositories: new RepositoryResolver(git, config.markerSchemaVersion, stateRoot),
-        journal: new JournalStore(stateRoot),
-        outbox,
-        gate,
-        activeContexts,
-        repositoryDecisions,
-        updateChoices,
-        shadowNotices,
-        questionnaires: new QuestionnaireStore(stateRoot),
-        onboarding: new OnboardingStore(stateRoot),
-        clientVersion: config.clientVersion,
-        principalState,
-    });
-}
-export function createServer() {
-    return createEngineeringMemoryServer(createBridgeService());
+    host.start();
+    host.watch(15_000);
+    return server;
 }
 void serveStdio(createServer);
 //# sourceMappingURL=index.js.map

package/runtime/dist/src/mcp/server.js

@@ -2,17 +2,24 @@ import { registerWorktreeTools } from './worktree-tools.js';
 import { McpServer } from '@modelcontextprotocol/server';
 import { registerOnboardingTools } from './onboarding-tools.js';
 import { registerEngineeringMemoryTools, registerQuestionnaireTools } from './tool-definitions.js';
-export function createEngineeringMemoryServer(service) {
-    const server = new McpServer({
+export const serverInstructions = 'Start with session.entry and follow the returned lifecycle. Do not block independent task work on memory.propose_revision drafting, submission or approval. If the host permits background agents or concurrent calls, dispatch independent proposals and continue useful work; otherwise checkpoint the draft and defer submission until needed. Checkpoint, correction, reconciliation, self-review and scaffold receipts use the durable local outbox; after deliveryStatus pending, continue independent work without polling or resending. Inventory upload, claim-bound evidence submission and test-result reporting may overlap independent analysis using host-permitted concurrent calls. Wait only when the next operation needs the result; required task deliveries must settle before verification. Preserve task/source identity and native user approval; never treat pending work as verified.';
+export function createMcpServer() {
+    return new McpServer({
         name: 'engineering-memory',
         version: '0.1.0',
     }, {
-        instructions: 'Start with session.entry and follow the returned lifecycle. Do not block independent task work on memory.propose_revision drafting, submission or approval. If the host permits background agents or concurrent calls, dispatch independent proposals and continue useful work; otherwise checkpoint the draft and defer submission until needed. Checkpoint, correction, reconciliation, self-review and scaffold receipts use the durable local outbox; after deliveryStatus pending, continue independent work without polling or resending. Inventory upload, claim-bound evidence submission and test-result reporting may overlap independent analysis using host-permitted concurrent calls. Wait only when the next operation needs the result; required task deliveries must settle before verification. Preserve task/source identity and native user approval; never treat pending work as verified.',
+        instructions: serverInstructions,
     });
-    registerEngineeringMemoryTools(server, service);
-    registerQuestionnaireTools(server, service);
-    registerOnboardingTools(server, service);
-    registerWorktreeTools(server, service);
+}
+export function registerAllTools(host, service) {
+    registerEngineeringMemoryTools(host, service);
+    registerQuestionnaireTools(host, service);
+    registerOnboardingTools(host, service);
+    registerWorktreeTools(host, service);
+}
+export function createEngineeringMemoryServer(service) {
+    const server = createMcpServer();
+    registerAllTools(server, service);
     return server;
 }
 //# sourceMappingURL=server.js.map

package/runtime/dist/src/mcp/tool-host.js

@@ -0,0 +1,12 @@
+export function recordingHost(server) {
+    const tools = [];
+    const registerTool = (name, config, callback) => {
+        tools.push({ name, config, callback });
+        return undefined;
+    };
+    return {
+        host: { registerTool: registerTool, server },
+        tools,
+    };
+}
+//# sourceMappingURL=tool-host.js.map

package/runtime/dist/src/runtime/bridge-service.js

@@ -459,7 +459,7 @@ export class BridgeService {
                 const recoveredClose = await this.retryCloseIntent(repository, pointer);
                 return asJsonValue({
                     backend: { close: recoveredClose },
-                    worktree: this.poolAllocations.get(repository.repoRoot) ?? null,
+                    worktree: (await this.ownedAllocation(projectId, repository.repoRoot)) ?? null,
                     pendingQuestionnaires,
                     repository: publicRepository(repository),
                     localJournal: await this.dependencies.journal.load(projectId, taskSlug),
@@ -642,7 +642,7 @@ export class BridgeService {
             return asJsonValue({
                 backend,
                 repository: publicRepository(repository),
-                worktree: this.poolAllocations.get(repository.repoRoot) ?? null,
+                worktree: (await this.ownedAllocation(projectId, repository.repoRoot)) ?? null,
                 localJournal,
                 pendingQuestionnaires,
                 synchronization: {
@@ -741,7 +741,7 @@ export class BridgeService {
                 transitionTaskVersion = refreshed.taskVersion;
             }
             if (decision && this.dependencies.worktreePool) {
-                const allocation = this.poolAllocations.get(repository.repoRoot);
+                const allocation = await this.ownedAllocation(pointer.projectId, repository.repoRoot);
                 if (!allocation || allocation.externalTaskId !== pointer.taskSlug)
                     throw refuse('Choose this task branch and use its allocated repoRoot before transitioning to write.', 'task.branch');
                 await this.dependencies.worktreePool.assertOwnership(pointer.projectId, repository.repoRoot, allocation.generation);
@@ -802,16 +802,14 @@ export class BridgeService {
                     await this.dependencies.repositories.git
                         .branchStore(repository.repoRoot)
                         .bind(preparedPointer.projectId, preparedPointer.taskSlug, preparedPointer.taskId);
+                    const allocation = await this.ownedAllocation(preparedPointer.projectId, repository.repoRoot);
                     await this.dependencies.activeContexts.save({
                         ...preparedPointer,
                         worktreeId: sha256(repository.repoRoot),
                         branch: typeof preparedTask?.branch === 'string' ? preparedTask.branch : decision.branch,
                         mode: 'write',
-                        ...(this.poolAllocations.get(repository.repoRoot)
-                            ? { worktreeGeneration: this.poolAllocations.get(repository.repoRoot).generation }
-                            : {}),
+                        ...(allocation ? { worktreeGeneration: allocation.generation } : {}),
                     });
-                    const allocation = this.poolAllocations.get(repository.repoRoot);
                     if (allocation && this.dependencies.worktreePool) {
                         await this.dependencies.worktreePool.bind(preparedPointer.projectId, repository.repoRoot, allocation.generation, preparedPointer.taskId);
                         allocation.taskId = preparedPointer.taskId;
@@ -2020,6 +2018,25 @@ export class BridgeService {
             nextAction: 'Run every file, terminal, lifecycle and delivery operation from this repoRoot. Use task.heartbeat during long work. Pause before handing the task to another client.',
         });
     }
+    adoptOwned(repoRoot, entry) {
+        const cached = this.poolAllocations.get(repoRoot);
+        if (cached)
+            return cached;
+        const pool = this.dependencies.worktreePool;
+        if (!entry || !pool || !pool.owns(entry))
+            return undefined;
+        this.poolAllocations.set(repoRoot, entry);
+        return entry;
+    }
+    async ownedAllocation(projectId, repoRoot) {
+        const cached = this.poolAllocations.get(repoRoot);
+        if (cached)
+            return cached;
+        const pool = this.dependencies.worktreePool;
+        if (!pool)
+            return undefined;
+        return this.adoptOwned(repoRoot, await pool.forPath(projectId, repoRoot));
+    }
     async assertPoolPointer(repository, pointer) {
         const pool = this.dependencies.worktreePool;
         if (!pool)
@@ -2029,7 +2046,7 @@ export class BridgeService {
             return; // existing unmanaged tasks retain their legacy reservation
         if (entry && entry.externalTaskId !== pointer.taskSlug)
             throw refuse(`This directory is allocated to task ${entry.externalTaskId}. Resume this task from its own worktree, or reconcile the pool to release the directory.`, 'worktree.reconcile');
-        const owned = this.poolAllocations.get(repository.repoRoot);
+        const owned = this.adoptOwned(repository.repoRoot, entry);
         if (!entry || !owned || owned.generation !== pointer.worktreeGeneration)
             throw refuse('Resume this task to acquire its worktree before writing or delivering.', 'session.resume');
         await pool.assertOwnership(pointer.projectId, repository.repoRoot, owned.generation);
@@ -2156,7 +2173,9 @@ export class BridgeService {
                 if (!abandoned || abandoned.abandoned !== true) {
                     throw refuse('The backend did not record the abandonment, so the task is still open.', 'session.resume');
                 }
-                const allocation = this.poolAllocations.get(repository.repoRoot);
+                const allocation = repository.projectId
+                    ? await this.ownedAllocation(repository.projectId, repository.repoRoot)
+                    : this.poolAllocations.get(repository.repoRoot);
                 if (allocation && this.dependencies.worktreePool) {
                     await this.dependencies.worktreePool.pause(allocation.projectId, allocation.repoRoot, allocation.generation);
                     this.poolAllocations.delete(repository.repoRoot);
@@ -3424,7 +3443,9 @@ export class BridgeService {
             taskChanges,
         });
         await this.dependencies.activeContexts.clearCloseIntent(repository.repoFingerprint, String(body.taskId));
-        const allocation = this.poolAllocations.get(repository.repoRoot);
+        const allocation = repository.projectId
+            ? await this.ownedAllocation(repository.projectId, repository.repoRoot)
+            : this.poolAllocations.get(repository.repoRoot);
         if (allocation && this.dependencies.worktreePool)
             await this.dependencies.worktreePool.delivery(allocation.projectId, repository.repoRoot, allocation.generation);
         else
@@ -3510,7 +3531,7 @@ export class BridgeService {
         try {
             const allocation = await this.dependencies.worktreePool?.forTask(taskId);
             if (allocation) {
-                const owned = this.poolAllocations.get(allocation.repoRoot);
+                const owned = this.adoptOwned(allocation.repoRoot, allocation);
                 if (!owned || owned.generation !== allocation.generation)
                     throw refuse('Resume the task in its owned worktree before this operation.', 'session.resume');
                 await this.dependencies.worktreePool.assertOwnership(allocation.projectId, allocation.repoRoot, owned.generation);

package/runtime/dist/src/runtime/create-bridge-service.js

@@ -0,0 +1,82 @@
+import { WorktreePool } from './worktree-pool.js';
+import { WorktreePolicyCache } from './worktree-policy.js';
+import { BrowserAuthCoordinator } from '../auth/browser-auth.js';
+import { createCredentialStore } from '../auth/credential-store.js';
+import { EtagCache } from '../cache/etag-cache.js';
+import { apiNamespaceKey, apiStateRoot, endpoints, loadBridgeConfig } from '../config.js';
+import { GitInspector } from '../git/git-inspector.js';
+import { VerificationGate } from '../git/verification-gate.js';
+import { JournalStore } from '../journal/journal-store.js';
+import { RepositoryResolver } from '../project/repository.js';
+import { ApiClient } from './api-client.js';
+import { BridgeService } from './bridge-service.js';
+import { OfflineOutbox } from './offline-outbox.js';
+import { ActiveContextStore } from './active-context-store.js';
+import { RepositoryDecisionStore } from './repository-decision-store.js';
+import { ShadowNoticeStore } from './shadow-notice-store.js';
+import { UpdateChoiceStore } from './update-choice-store.js';
+import { PrincipalStateGuard } from './principal-state.js';
+import { OnboardingStore } from './onboarding-store.js';
+import { QuestionnaireStore } from './questionnaire-store.js';
+export function createBridgeService(options = {}) {
+    const config = loadBridgeConfig();
+    const apiNamespace = apiNamespaceKey(config.apiBaseUrl);
+    const stateRoot = apiStateRoot(config);
+    const credentials = createCredentialStore({
+        service: config.credentialService,
+        account: `${config.credentialAccount}:${apiNamespace}`,
+        stateRoot,
+    });
+    const cache = new EtagCache({
+        stateRoot,
+        maxEntries: config.cacheMaxEntries,
+        maxBytes: config.cacheMaxBytes,
+        maxAgeMs: config.cacheMaxAgeMs,
+    });
+    const client = new ApiClient({
+        baseUrl: config.apiBaseUrl,
+        timeoutMs: config.requestTimeoutMs,
+        credentials,
+        cache,
+        refreshPath: endpoints.authRefresh,
+    });
+    const git = new GitInspector();
+    const outbox = new OfflineOutbox(stateRoot);
+    const activeContexts = new ActiveContextStore(stateRoot);
+    const repositoryDecisions = new RepositoryDecisionStore(stateRoot);
+    const updateChoices = new UpdateChoiceStore(stateRoot);
+    const shadowNotices = new ShadowNoticeStore(stateRoot);
+    const worktreePool = new WorktreePool(stateRoot, {
+        ...(options.ownerId ? { ownerId: options.ownerId } : {}),
+        pendingWork: async (entry) => {
+            if (!entry.taskId)
+                return false;
+            const pointer = await activeContexts.loadForTask(entry.repoFingerprint, entry.taskId);
+            return Boolean(pointer?.verificationIntent ||
+                pointer?.closeIntent ||
+                (await outbox.listForTask(entry.taskId)).length);
+        },
+    });
+    const gate = new VerificationGate(stateRoot, git, outbox, undefined, worktreePool);
+    const principalState = new PrincipalStateGuard(stateRoot, credentials, cache, outbox, activeContexts, gate);
+    return new BridgeService({
+        worktreePool,
+        worktreePolicy: new WorktreePolicyCache(stateRoot),
+        client,
+        credentials,
+        browserAuth: new BrowserAuthCoordinator(client, credentials),
+        repositories: new RepositoryResolver(git, config.markerSchemaVersion, stateRoot),
+        journal: new JournalStore(stateRoot),
+        outbox,
+        gate,
+        activeContexts,
+        repositoryDecisions,
+        updateChoices,
+        shadowNotices,
+        questionnaires: new QuestionnaireStore(stateRoot),
+        onboarding: new OnboardingStore(stateRoot),
+        clientVersion: options.clientVersion === undefined ? config.clientVersion : options.clientVersion,
+        principalState,
+    });
+}
+//# sourceMappingURL=create-bridge-service.js.map

package/runtime/dist/src/runtime/runtime-entry.js

@@ -0,0 +1,16 @@
+import { registerAllTools } from '../mcp/server.js';
+import { recordingHost } from '../mcp/tool-host.js';
+import { createBridgeService } from './create-bridge-service.js';
+export function collectTools(service, server) {
+    const recording = recordingHost(server);
+    registerAllTools(recording.host, service);
+    return recording.tools;
+}
+export function createRuntime(options) {
+    const service = createBridgeService({
+        ownerId: options.ownerId,
+        clientVersion: options.clientVersion,
+    });
+    return { tools: collectTools(service, options.server) };
+}
+//# sourceMappingURL=runtime-entry.js.map

package/runtime/dist/src/runtime/runtime-host.js

@@ -0,0 +1,265 @@
+import { randomUUID } from 'node:crypto';
+import { readFile, stat } from 'node:fs/promises';
+import { isAbsolute, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { z } from 'zod';
+export const currentReleaseSchema = z.object({
+    product: z.literal('engineering-memory'),
+    schemaVersion: z.literal(1),
+    path: z.string().min(1),
+    version: z.string().min(1).nullable().optional(),
+    sourceHash: z.string().optional(),
+    bridgeEntry: z.string().optional(),
+    gateEntry: z.string().optional(),
+});
+export const runtimeEntryRelativePath = ['dist', 'src', 'runtime', 'runtime-entry.js'];
+const emptyObjectSchema = { type: 'object', properties: {} };
+export async function readCurrentRelease(currentPath) {
+    let raw;
+    try {
+        raw = await readFile(currentPath, 'utf8');
+    }
+    catch (error) {
+        return { problem: `${currentPath} cannot be read: ${describe(error)}` };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { problem: `${currentPath} is not valid JSON` };
+    }
+    const release = currentReleaseSchema.safeParse(parsed);
+    if (!release.success)
+        return { problem: `${currentPath} does not describe a release` };
+    const path = isAbsolute(release.data.path)
+        ? resolve(release.data.path)
+        : resolve(currentPath, '..', release.data.path);
+    return { release: release.data, path };
+}
+export async function importRelease(releasePath) {
+    const entry = join(releasePath, ...runtimeEntryRelativePath);
+    const loaded = (await import(pathToFileURL(entry).href));
+    if (typeof loaded.createRuntime !== 'function')
+        throw new Error(`${entry} does not export createRuntime`);
+    return { createRuntime: loaded.createRuntime };
+}
+export class RuntimeHost {
+    options;
+    ownerId;
+    registered = new Map();
+    specs = new Map();
+    loadedPath;
+    loadedVersion;
+    refreshing;
+    failedPath;
+    seen;
+    timer;
+    started = false;
+    constructor(options) {
+        this.options = options;
+        this.ownerId = options.ownerId ?? randomUUID();
+        this.loadedPath = resolve(options.release.path);
+        this.loadedVersion = options.release.version;
+    }
+    get version() {
+        return this.loadedVersion;
+    }
+    get releasePath() {
+        return this.loadedPath;
+    }
+    start() {
+        if (this.started)
+            return;
+        this.started = true;
+        this.apply(this.instantiate(this.options.release.module, this.options.release.version));
+    }
+    watch(intervalMs) {
+        if (this.timer || !this.options.currentPath)
+            return;
+        this.timer = setInterval(() => {
+            void this.refresh();
+        }, intervalMs);
+        this.timer.unref();
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = undefined;
+    }
+    async refresh() {
+        if (!this.options.currentPath || !this.started)
+            return false;
+        this.refreshing ??= this.reload().finally(() => {
+            this.refreshing = undefined;
+        });
+        return this.refreshing;
+    }
+    async reload() {
+        const currentPath = this.options.currentPath;
+        let marker;
+        try {
+            marker = await stat(currentPath);
+        }
+        catch {
+            return false;
+        }
+        if (this.seen && this.seen.mtimeMs === marker.mtimeMs && this.seen.size === marker.size)
+            return false;
+        this.seen = { mtimeMs: marker.mtimeMs, size: marker.size };
+        const current = await readCurrentRelease(currentPath);
+        if ('problem' in current) {
+            this.log(`Engineering Memory bridge keeps release ${this.describeLoaded()}: ${current.problem}`);
+            return false;
+        }
+        if (current.path === this.loadedPath || current.path === this.failedPath)
+            return false;
+        const version = current.release.version ?? null;
+        try {
+            const module = await (this.options.load ?? importRelease)(current.path);
+            this.apply(this.instantiate(module, version));
+        }
+        catch (error) {
+            this.failedPath = current.path;
+            this.log(`Engineering Memory bridge keeps release ${this.describeLoaded()} because ${current.path} could not be loaded: ${describe(error)}`);
+            return false;
+        }
+        this.loadedPath = current.path;
+        this.loadedVersion = version;
+        this.failedPath = undefined;
+        this.log(`Engineering Memory bridge switched to release ${this.describeLoaded()}`);
+        return true;
+    }
+    instantiate(module, version) {
+        const runtime = module.createRuntime({
+            ownerId: this.ownerId,
+            clientVersion: version,
+            server: this.options.server.server,
+        });
+        if (!runtime || !Array.isArray(runtime.tools))
+            throw new Error('createRuntime did not return a tool list');
+        const names = new Set();
+        for (const spec of runtime.tools) {
+            if (typeof spec.name !== 'string' || !spec.name)
+                throw new Error('createRuntime returned a tool without a name');
+            if (names.has(spec.name))
+                throw new Error(`Tool ${spec.name} is defined twice`);
+            if (typeof spec.callback !== 'function')
+                throw new Error(`Tool ${spec.name} has no callback`);
+            names.add(spec.name);
+        }
+        return runtime;
+    }
+    apply(runtime) {
+        const names = new Set();
+        const register = this.options.server.registerTool.bind(this.options.server);
+        for (const spec of runtime.tools) {
+            names.add(spec.name);
+            this.specs.set(spec.name, spec);
+            const signature = toolSignature(spec.config);
+            const existing = this.registered.get(spec.name);
+            if (!existing) {
+                const tool = register(spec.name, { ...spec.config, inputSchema: this.inputSchemaOf(spec.name) }, this.dispatcher(spec.name));
+                this.registered.set(spec.name, { tool, signature });
+            }
+            else if (existing.signature !== signature) {
+                existing.tool.update({
+                    ...(spec.config.title !== undefined ? { title: spec.config.title } : {}),
+                    ...(spec.config.description !== undefined
+                        ? { description: spec.config.description }
+                        : {}),
+                    ...(spec.config.outputSchema !== undefined
+                        ? { outputSchema: spec.config.outputSchema }
+                        : {}),
+                    ...(spec.config.annotations !== undefined
+                        ? { annotations: spec.config.annotations }
+                        : {}),
+                });
+                existing.signature = signature;
+            }
+        }
+        for (const [name, entry] of [...this.registered]) {
+            if (names.has(name))
+                continue;
+            entry.tool.remove();
+            this.registered.delete(name);
+            this.specs.delete(name);
+        }
+    }
+    inputSchemaOf(name) {
+        const jsonSchema = (io) => (options) => {
+            const schema = this.specs.get(name)?.config.inputSchema;
+            if (!schema)
+                return emptyObjectSchema;
+            return schema['~standard'].jsonSchema[io](options);
+        };
+        const props = {
+            version: 1,
+            vendor: 'engineering-memory',
+            validate: (value) => ({ value }),
+            jsonSchema: { input: jsonSchema('input'), output: jsonSchema('output') },
+        };
+        return { '~standard': props };
+    }
+    dispatcher(name) {
+        return async (args, context) => {
+            await this.refresh();
+            const spec = this.specs.get(name);
+            if (!spec)
+                throw new Error(`Tool ${name} is no longer provided by this bridge release; list the tools again and use the current lifecycle.`);
+            const schema = spec.config.inputSchema;
+            if (!schema)
+                return spec.callback(context);
+            const outcome = await schema['~standard'].validate(args ?? {});
+            if (outcome.issues && outcome.issues.length > 0)
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Input validation error: Invalid arguments for tool ${name}: ${outcome.issues
+                                .map((issue) => formatIssue(issue))
+                                .join(', ')}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            return spec.callback(outcome.value, context);
+        };
+    }
+    describeLoaded() {
+        return this.loadedVersion ?? this.loadedPath;
+    }
+    log(message) {
+        this.options.log?.(message);
+    }
+}
+export function toolSignature(config) {
+    return JSON.stringify({
+        title: config.title ?? null,
+        description: config.description ?? null,
+        annotations: config.annotations ?? null,
+        input: jsonSchemaOf(config.inputSchema),
+        output: jsonSchemaOf(config.outputSchema),
+    });
+}
+function jsonSchemaOf(schema) {
+    if (!schema)
+        return null;
+    try {
+        return schema['~standard'].jsonSchema.input({ target: 'draft-2020-12' });
+    }
+    catch {
+        return randomUUID();
+    }
+}
+function formatIssue(issue) {
+    if (!issue.path?.length)
+        return issue.message;
+    return `${issue.path
+        .map((segment) => String(typeof segment === 'object' && segment !== null ? segment.key : segment))
+        .join('.')}: ${issue.message}`;
+}
+function describe(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=runtime-host.js.map

package/runtime/dist/src/runtime/worktree-pool.js

@@ -239,6 +239,12 @@ export class WorktreePool {
             .flatMap((p) => p.entries)
             .find((e) => e.taskId === taskId && e.phase !== 'released') ?? null));
     }
+    owns(entry) {
+        return (entry.phase !== 'released' &&
+            entry.owner !== null &&
+            entry.owner.id === this.ownerId &&
+            entry.owner.pid === process.pid);
+    }
     async forPath(projectId, repoRoot) {
         return this.transaction(async (registry) => structuredClone(registry.projects[projectId]?.entries.find((e) => key(e.repoRoot) === key(repoRoot)) ??
             null));