@akira-tl/forgerelay 0.8.10 → 0.9.0

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable ForgeRelay changes are documented here.
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-09-04
+
+### Added
+
+- Added bounded read-only managed-worktree recovery diagnostics to `open_workspace` inventory and inspection, distinguishing healthy, recoverable, and manual-intervention states across missing backing/source/branches, stale Git worktree registration, and branch mismatches. Relayed inspection carries the sanitized diagnostic facts from the Execution ForgeRelay without mutating Git state.
+
+### Changed
+
+- Aligned current roadmap and product documentation with already-shipped first-class Subagent delegation, Hook-backed managed-worktree close verification, and explicitly authorized live managed TypeScript/Pyright installation. The 0.9 line is now defined as recovery diagnostics/repair, Workspace checkpoints/restore, and owner-facing retention maintenance.
+- Added managed-worktree recovery/inventory tests to the regular release test suite so the diagnostic contract is exercised on every cloud platform.
+
+### Fixed
+
+- Canonicalized managed-worktree registration paths through their real filesystem location, preventing macOS `/var/...` and `/private/var/...` aliases (and equivalent symlink aliases) from being misreported as missing Git worktree registration.
+
 ## [0.8.10] - 2026-09-03
 
 ### Added

package/README.md

@@ -165,10 +165,13 @@ symbols, workspace symbols, and diagnostics. Results use ForgeRelay-owned normal
 locations, ranges, symbols, hover content, and diagnostic shapes rather than raw LSP
 wire unions.
 
-Language servers remain external dependencies. ForgeRelay can discover
-`typescript-language-server`, `pyright-langserver`, `rust-analyzer`, `gopls`, and
-`clangd` when they already exist on `PATH`, or use structured project/global
-configuration, but it never installs a server automatically. See
+Language servers are never installed automatically or without user authorization.
+ForgeRelay can discover configured or `PATH`-available servers, and `forgerelay init`
+can optionally enable Agent-managed installation of TypeScript/JavaScript and Pyright
+inside ForgeRelay's private config directory. That permission is disabled by default;
+a successful managed install becomes available to the same running ForgeRelay process
+on the next semantic request without a restart. `rust-analyzer`, `gopls`, and `clangd`
+remain external toolchain/system installations. See
 [Configuration Reference](docs/configuration.md#lsp-code-intelligence) and
 [`examples/language-servers.json`](examples/language-servers.json).
 
@@ -297,13 +300,13 @@ forgerelay doctor
 
 ## Where ForgeRelay is going
 
-With LSP code intelligence established in the 0.4 line, the next additions remain
-focused on making the local execution layer more useful, not on turning ForgeRelay
-into another all-in-one agent framework:
+With persistent Workspace lifecycle, first-class Subagent delegation, managed-LSP
+support, and worktree-close verification already shipped, the 0.9 line focuses on
+Workspace recovery and history without expanding the canonical Core tool surface:
 
-1. first-class MCP subagent delegation;
-2. stronger worktree verification and recovery;
-3. checkpoint/rewind and retention improvements.
+1. read-only managed-worktree recovery diagnostics, followed by safe repair/cleanup;
+2. persistent Workspace checkpoints and concurrency-safe restore;
+3. owner-facing retention inspection and explicitly authorized maintenance.
 
 ForgeRelay does not plan to add its own shell sandbox, long-term memory system,
 or plugin marketplace. Conversation, planning, web access, and other host-native

package/dist/mcp/server/core/schemas.js

@@ -94,6 +94,26 @@ export const workspaceSubagentProviderOutputSchema = z.object({
 export const workspaceAvailableAgentsFileOutputSchema = z.object({
     path: z.string(),
 });
+export const managedWorktreeRecoveryOutputSchema = z.object({
+    classification: z.enum(["healthy", "recoverable", "manual-intervention"]),
+    conditions: z.array(z.enum([
+        "backing-missing",
+        "managed-branch-missing",
+        "git-registration-stale",
+        "git-registration-missing",
+        "git-registration-unavailable",
+        "branch-mismatch",
+        "source-missing",
+        "source-unavailable",
+        "target-branch-missing",
+    ])),
+    backing: z.enum(["present", "missing"]),
+    source: z.enum(["available", "missing", "unavailable"]),
+    gitRegistration: z.enum(["registered", "stale", "missing", "unavailable"]),
+    managedBranch: z.enum(["present", "missing", "unknown"]),
+    targetBranch: z.enum(["present", "missing", "unknown"]),
+    backingBranch: z.enum(["matching", "mismatched", "unavailable"]),
+});
 export const workspaceInventoryEntryOutputSchema = z.object({
     label: z.string(),
     workspaceId: z.string(),
@@ -109,6 +129,7 @@ export const workspaceInventoryEntryOutputSchema = z.object({
     lastUsedAt: z.string(),
     idleMs: z.number().nonnegative(),
     rootValid: z.boolean(),
+    recovery: managedWorktreeRecoveryOutputSchema.optional(),
     current: z.boolean(),
 });
 export const workspaceInventorySummaryOutputSchema = z.object({
@@ -167,6 +188,7 @@ export const workspaceInspectionOutputSchema = z.union([
         lastUsedAt: z.string(),
         idleMs: z.number().nonnegative(),
         rootValid: z.boolean(),
+        recovery: managedWorktreeRecoveryOutputSchema.optional(),
         taskSummary: workspaceTaskInspectionSummaryOutputSchema.optional(),
     }),
     z.object({
@@ -186,6 +208,7 @@ export const workspaceInspectionOutputSchema = z.union([
         lastUsedAt: z.string().optional(),
         idleMs: z.number().nonnegative().optional(),
         rootValid: z.boolean().optional(),
+        recovery: managedWorktreeRecoveryOutputSchema.optional(),
         taskSummary: workspaceTaskInspectionSummaryOutputSchema.optional(),
         relay: z.string(),
         executionLocation: z.string(),

package/dist/workspaces/git/worktree-recovery.js

@@ -0,0 +1,189 @@
+import { realpath, stat } from "node:fs/promises";
+import { platform } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { assertAllowedPath } from "../../mcp/filesystem/roots.js";
+import { git } from "./git.js";
+export async function inspectManagedWorktreeRecovery(session, config) {
+    if (session.status !== "active" ||
+        session.mode !== "worktree" ||
+        !session.managed)
+        return undefined;
+    const backing = await directoryState(session.root, [config.worktreeRoot]);
+    const source = await sourceState(session.sourceRoot, config.allowedRoots);
+    const conditions = [];
+    if (source === "missing")
+        conditions.push("source-missing");
+    else if (source === "unavailable")
+        conditions.push("source-unavailable");
+    if (backing === "missing")
+        conditions.push("backing-missing");
+    if (source !== "available" || !session.sourceRoot) {
+        return {
+            classification: "manual-intervention",
+            conditions,
+            backing,
+            source,
+            gitRegistration: "unavailable",
+            managedBranch: "unknown",
+            targetBranch: "unknown",
+            backingBranch: "unavailable",
+        };
+    }
+    const sourceRoot = assertAllowedPath(session.sourceRoot, config.allowedRoots);
+    const [managedBranch, targetBranch, registration] = await Promise.all([
+        branchState(sourceRoot, session.branch),
+        branchState(sourceRoot, session.targetBranch),
+        registrationState(sourceRoot, session.root),
+    ]);
+    if (managedBranch === "missing")
+        conditions.push("managed-branch-missing");
+    if (targetBranch === "missing")
+        conditions.push("target-branch-missing");
+    if (registration === "stale")
+        conditions.push("git-registration-stale");
+    else if (registration === "missing")
+        conditions.push("git-registration-missing");
+    else if (registration === "unavailable")
+        conditions.push("git-registration-unavailable");
+    const backingBranch = backing === "present"
+        ? await backingBranchState(session.root, session.branch)
+        : "unavailable";
+    if (backingBranch === "mismatched")
+        conditions.push("branch-mismatch");
+    const recoverable = backing === "missing" &&
+        managedBranch === "present" &&
+        targetBranch === "present" &&
+        (registration === "stale" || registration === "missing") &&
+        conditions.every((condition) => condition === "backing-missing" ||
+            condition === "git-registration-stale" ||
+            condition === "git-registration-missing");
+    return {
+        classification: conditions.length === 0
+            ? "healthy"
+            : recoverable
+                ? "recoverable"
+                : "manual-intervention",
+        conditions,
+        backing,
+        source,
+        gitRegistration: registration,
+        managedBranch,
+        targetBranch,
+        backingBranch,
+    };
+}
+async function directoryState(path, allowedRoots) {
+    const allowedPath = assertAllowedPath(path, allowedRoots);
+    try {
+        return (await stat(allowedPath)).isDirectory() ? "present" : "missing";
+    }
+    catch (error) {
+        if (isMissingPath(error))
+            return "missing";
+        throw error;
+    }
+}
+async function sourceState(sourceRoot, allowedRoots) {
+    if (!sourceRoot)
+        return "unavailable";
+    let sourcePath;
+    try {
+        sourcePath = assertAllowedPath(sourceRoot, allowedRoots);
+    }
+    catch {
+        return "unavailable";
+    }
+    try {
+        if (!(await stat(sourcePath)).isDirectory())
+            return "missing";
+    }
+    catch (error) {
+        return isMissingPath(error) ? "missing" : "unavailable";
+    }
+    try {
+        const gitRoot = (await git(sourcePath, ["rev-parse", "--show-toplevel"])).stdout.trim();
+        const [canonicalGitRoot, canonicalSource] = await Promise.all([realpath(gitRoot), realpath(sourcePath)]);
+        return pathKey(canonicalGitRoot) === pathKey(canonicalSource) ? "available" : "unavailable";
+    }
+    catch {
+        return "unavailable";
+    }
+}
+async function branchState(sourceRoot, branch) {
+    if (!branch)
+        return "missing";
+    try {
+        await git(sourceRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
+        return "present";
+    }
+    catch {
+        return "missing";
+    }
+}
+async function registrationState(sourceRoot, worktreePath) {
+    let registrations;
+    try {
+        registrations = parseWorktreeRegistrations((await git(sourceRoot, ["worktree", "list", "--porcelain"])).stdout);
+    }
+    catch {
+        return "unavailable";
+    }
+    const worktreeKey = await registrationPathKey(worktreePath);
+    for (const registration of registrations) {
+        if (await registrationPathKey(registration.path) !== worktreeKey)
+            continue;
+        return registration.prunable ? "stale" : "registered";
+    }
+    return "missing";
+}
+async function backingBranchState(worktreeRoot, expectedBranch) {
+    if (!expectedBranch)
+        return "mismatched";
+    try {
+        const actual = (await git(worktreeRoot, ["symbolic-ref", "--quiet", "--short", "HEAD"])).stdout.trim();
+        return actual === expectedBranch ? "matching" : "mismatched";
+    }
+    catch {
+        return "mismatched";
+    }
+}
+function parseWorktreeRegistrations(output) {
+    return output
+        .trim()
+        .split(/\n\n+/)
+        .map((block) => {
+        const lines = block.split("\n");
+        const path = lines.find((line) => line.startsWith("worktree "))?.slice("worktree ".length);
+        if (!path)
+            return undefined;
+        return {
+            path,
+            prunable: lines.some((line) => line.startsWith("prunable ")),
+        };
+    })
+        .filter((entry) => entry !== undefined);
+}
+async function registrationPathKey(path) {
+    const resolved = resolve(path);
+    try {
+        return pathKey(await realpath(resolved));
+    }
+    catch (error) {
+        if (!isMissingPath(error))
+            return pathKey(resolved);
+        try {
+            return pathKey(join(await realpath(dirname(resolved)), basename(resolved)));
+        }
+        catch {
+            return pathKey(resolved);
+        }
+    }
+}
+function pathKey(path) {
+    const resolved = resolve(path);
+    return platform() === "win32" ? resolved.toLowerCase() : resolved;
+}
+function isMissingPath(error) {
+    return error instanceof Error && "code" in error &&
+        (error.code === "ENOENT" || error.code === "ENOTDIR");
+}

package/dist/workspaces/inventory.js

@@ -1,6 +1,7 @@
 import { basename, resolve } from "node:path";
 import { assertAllowedPath } from "../mcp/filesystem/roots.js";
 import { canonicalPath } from "./paths.js";
+import { inspectManagedWorktreeRecovery } from "./git/worktree-recovery.js";
 const WORKSPACE_STALE_REMINDER_MS = 2 * 24 * 60 * 60 * 1_000;
 /** Build bounded read-only projections over persistent Workspace sessions. */
 export class WorkspaceInventoryService {
@@ -84,11 +85,12 @@ export class WorkspaceInventoryService {
     }
     async inventoryEntryForSession(session, now, current) {
         const rootValid = await this.sessions.validSessionRoot(session) !== undefined;
+        const recovery = await inspectManagedWorktreeRecovery(session, this.config);
         const lastUsedAt = Date.parse(session.lastUsedAt);
         const idleMs = Number.isFinite(lastUsedAt) ? Math.max(0, now - lastUsedAt) : 0;
         const state = session.status !== "active"
             ? "closed"
-            : !rootValid
+            : !rootValid || (recovery !== undefined && recovery.classification !== "healthy")
                 ? "invalid"
                 : idleMs >= WORKSPACE_STALE_REMINDER_MS
                     ? "stale"
@@ -109,6 +111,7 @@ export class WorkspaceInventoryService {
             lastUsedAt: session.lastUsedAt,
             idleMs,
             rootValid,
+            ...(recovery ? { recovery } : {}),
             current,
         };
     }

package/dist/workspaces/relay/result-support.js

@@ -25,6 +25,42 @@ export function copyNumberField(source, target, field) {
     if (typeof value === "number" && Number.isFinite(value) && value >= 0)
         target[field] = value;
 }
+export function safeManagedWorktreeRecovery(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const recovery = value;
+    const classifications = new Set(["healthy", "recoverable", "manual-intervention"]);
+    const conditions = new Set([
+        "backing-missing",
+        "managed-branch-missing",
+        "git-registration-stale",
+        "git-registration-missing",
+        "git-registration-unavailable",
+        "branch-mismatch",
+        "source-missing",
+        "source-unavailable",
+        "target-branch-missing",
+    ]);
+    if (typeof recovery.classification !== "string" || !classifications.has(recovery.classification) ||
+        !Array.isArray(recovery.conditions) || recovery.conditions.some((condition) => typeof condition !== "string" || !conditions.has(condition)) ||
+        (recovery.backing !== "present" && recovery.backing !== "missing") ||
+        (recovery.source !== "available" && recovery.source !== "missing" && recovery.source !== "unavailable") ||
+        (recovery.gitRegistration !== "registered" && recovery.gitRegistration !== "stale" && recovery.gitRegistration !== "missing" && recovery.gitRegistration !== "unavailable") ||
+        (recovery.managedBranch !== "present" && recovery.managedBranch !== "missing" && recovery.managedBranch !== "unknown") ||
+        (recovery.targetBranch !== "present" && recovery.targetBranch !== "missing" && recovery.targetBranch !== "unknown") ||
+        (recovery.backingBranch !== "matching" && recovery.backingBranch !== "mismatched" && recovery.backingBranch !== "unavailable"))
+        return undefined;
+    return {
+        classification: recovery.classification,
+        conditions: [...recovery.conditions],
+        backing: recovery.backing,
+        source: recovery.source,
+        gitRegistration: recovery.gitRegistration,
+        managedBranch: recovery.managedBranch,
+        targetBranch: recovery.targetBranch,
+        backingBranch: recovery.backingBranch,
+    };
+}
 export function safeTaskSummary(value) {
     if (!value || typeof value !== "object")
         return undefined;

package/dist/workspaces/relay/workspace-relay.js

@@ -7,7 +7,7 @@ import { RemoteMcpConnectionPool } from "./transport/remote-mcp-connection-pool.
 import { withFileLock } from "../../runtime/state/lock/file-lock.js";
 import { withRemoteServiceEndpoint } from "./transport/remote-transport.js";
 import { loadForgeRelayFiles, writeForgeRelayRemote, } from "../../runtime/config/user-config.js";
-import { assertRemoteToolSucceeded, stringField, copyStringField, copyBooleanField, copyNumberField, safeTaskSummary, toolResultText, remapToolResultWorkspaceId, replaceExactWorkspaceId, sanitizedRemoteError, errorMessage } from "./result-support.js";
+import { assertRemoteToolSucceeded, copyBooleanField, copyNumberField, copyStringField, errorMessage, remapToolResultWorkspaceId, replaceExactWorkspaceId, safeManagedWorktreeRecovery, safeTaskSummary, sanitizedRemoteError, stringField, toolResultText, } from "./result-support.js";
 export class RemoteWorkspaceRelay {
     routes = new Map();
     turnRoutes = new Map();
@@ -77,6 +77,9 @@ export class RemoteWorkspaceRelay {
         copyStringField(remoteInspection, projection, "lastUsedAt");
         copyNumberField(remoteInspection, projection, "idleMs");
         copyBooleanField(remoteInspection, projection, "rootValid");
+        const recovery = safeManagedWorktreeRecovery(remoteInspection.recovery);
+        if (recovery)
+            projection.recovery = recovery;
         const taskSummary = safeTaskSummary(remoteInspection.taskSummary);
         if (taskSummary)
             projection.taskSummary = taskSummary;

package/docs/configuration.md

@@ -338,23 +338,30 @@ inventory is paginated (50 records by default, at most 100) and can filter by Wo
 ID, persisted status, derived state, mode, canonical root/source root, or stale-only
 state. Reading inventory does not refresh `lastUsedAt`. Persisted `status="active"`
 means the record has not been explicitly closed; the derived `state` distinguishes
-`active`, `stale`, `invalid`, and `closed`. A missing checkout or externally removed
-managed-worktree root can therefore remain diagnostically `status="active"` while
-appearing as `state="invalid"`. Canonical identity means ordinary same-target opens no
-longer accumulate duplicate inventory rows; `action="list"` remains the formal
-on-demand inventory path.
+`active`, `stale`, `invalid`, and `closed`. Active managed-worktree entries also expose
+a bounded `recovery` projection: ForgeRelay observes backing/source availability, the
+recorded managed and target branches, Git worktree registration, and the backing's
+current branch, then classifies the result as `healthy`, `recoverable`, or
+`manual-intervention`. A missing checkout or externally damaged managed worktree can
+therefore remain diagnostically `status="active"` while appearing as `state="invalid"`.
+This projection is observation only: inventory never runs `git worktree prune`, creates
+or removes worktrees/branches, or otherwise repairs Git state. Canonical identity means
+ordinary same-target opens no longer accumulate duplicate inventory rows;
+`action="list"` remains the formal on-demand inventory path.
 
 `open_workspace(action="inspect", workspaceId="...")` is the bounded read-only detail
 path for one known Workspace. It uses an explicit allowlist and never opens/resumes the
 target, changes conversation bindings or bootstrap-delivery records, refreshes
 `lastUsedAt`, or grants file/process/Git/Capability authority. Safe projections include
-ordinary/worktree lifecycle metadata, Composite member availability summaries, Relay
-alias/execution-location presentation metadata, and an already-existing Task List
-summary. Inspection never returns AGENTS/CLAUDE contents, Skills, Capability-guide
-paths or contents, Subagent bodies/sessions, files, Git diffs, process/Activity output,
-Hook/review artifacts, credentials, network/SSH routes, or Task bodies. Relay inspection
-reports only that the Gateway route is known; it does not probe or claim the remote
-Workspace lifecycle state.
+ordinary/worktree lifecycle metadata, managed-worktree recovery observations,
+Composite member availability summaries, Relay alias/execution-location presentation
+metadata, and an already-existing Task List summary. Inspection never returns
+AGENTS/CLAUDE contents, Skills, Capability-guide paths or contents, Subagent
+bodies/sessions, files, Git diffs, process/Activity output, Hook/review artifacts,
+credentials, network/SSH routes, or Task bodies. For Relay Workspaces the Gateway asks
+the Execution ForgeRelay for this same bounded inspection and forwards sanitized
+lifecycle/recovery facts under the Gateway Workspace identity; the Gateway does not
+inspect or mutate the remote Git repository itself.
 
 For checkout-backed Workspaces, `close_workspace` defaults to `action="close"`:
 it marks the persistent Workspace closed, removes current conversation bindings, and

package/docs/roadmap.md

@@ -38,7 +38,7 @@ ForgeRelay does not plan to add:
 - a plugin marketplace/runtime;
 - a second conversation/session runtime;
 - host-owned commands such as plan mode, context inspection, or model selection;
-- automatic installation and management of language servers.
+- automatic or unapproved language-server installation. Agent-managed TypeScript/JavaScript and Pyright installs require explicit user opt-in and remain disabled by default; Rust Analyzer, `gopls`, and `clangd` stay external toolchain/system dependencies.
 
 Shell execution remains a trusted local-user capability. Workspace filesystem
 containment must not be described as a shell sandbox.
@@ -197,11 +197,12 @@ capability
 
 ## 0.4 — LSP code intelligence v1
 
-LSP is moderate implementation complexity if ForgeRelay does not become a
-language-server installer.
-
-The first version should launch only language servers already available on the
-user's machine or explicitly configured by the user/project.
+LSP v1 was designed around language servers already available on the user's machine
+or explicitly configured by the user/project. ForgeRelay later added a narrow managed
+installation path for TypeScript/JavaScript and Pyright: it is disabled by default,
+requires explicit user authorization during setup, installs only into ForgeRelay's
+private config directory, and refreshes live without a server restart. This does not
+turn arbitrary language-server installation into an implicit Agent capability.
 
 During 0.4 development, MCP App UI hardening can land alongside the LSP work when
 it does not distort the code-intelligence scope. In particular, evaluate a more
@@ -245,9 +246,10 @@ and verify publication before work begins on the next boundary:
 The shipping 0.4 LSP v1 contract keeps the canonical nine Core MCP tools unchanged
 and exposes semantic operations only through `code.intelligence`. Deterministic
 fake-LSP coverage remains the primary cross-platform protocol/lifecycle gate, while
-`npm run lsp:interop` exercises `typescript-language-server`, Pyright,
-`rust-analyzer`, `gopls`, and `clangd` only when those external executables are
-already present and otherwise reports explicit skips without installing them.
+`npm run lsp:interop` exercises detected servers only when executables are already
+present and never downloads them. The later managed TypeScript/Pyright installation
+path is a separate explicitly authorized runtime capability and does not change that
+interop-test contract.
 
 ## 0.5 — Durable Activity and batch execution
 
@@ -315,32 +317,40 @@ milestone: the next stage remains blocked until the previous version's tag-trigg
 release workflow has completed successfully. Runtime acceptance uses only the
 reserved 7677/7678 debug instances and never touches the normal 7676 installation.
 
-## Later: first-class subagent MCP
-
-ForgeRelay already owns provider adapters and resumable local agent sessions. A
-future release may remove the current `bash -> forgerelay agents ...` indirection
-for MCP hosts.
-
-First-class subagent operations should reuse the Capability Gateway rather than
-add another top-level MCP tool. The parent agent should continue choosing from
-available provider/profile metadata while ForgeRelay owns provider-backed worker
-lifecycle state. This remains provider-backed delegation, not an attempt to
-emulate a Host-native subagent implementation.
-
-## Worktree and history refinements
-
-These can land alongside the main release lines when the underlying interfaces
-are ready:
-
-- `.worktreeinclude`-style explicit copying of selected gitignored files;
-- hook-backed worktree close verification;
-- stale managed-worktree recovery and cleanup;
-- checkpoint/list/restore primitives based on the existing Git snapshot engine;
-- retention/GC for stale workspace sessions, conversation bindings, and review
-  refs.
-
-Checkpoint restore must protect concurrent/external user edits rather than
-blindly overwriting a working tree.
+## 0.9 — Workspace Recovery & History
+
+0.9 builds on persistent Workspace identity, first-class `subagent.session`, and the
+existing Hook-backed managed-worktree finalize lifecycle. It does not add another Core
+MCP tool. Each stage is release-gated: the following stage begins only after the prior
+version's tag-triggered Linux/macOS/Windows verification and publication succeed.
+
+- **0.9.0** — add bounded read-only managed-worktree recovery observations to
+  `open_workspace(action="list"|"inspect")`, distinguishing healthy, recoverable,
+  and manual-intervention states without repairing or pruning Git state; align current
+  Roadmap/product documentation with already-shipped Subagent, worktree verification,
+  and explicitly authorized managed-LSP behavior;
+- **0.9.1** — add Workspace-scoped safe managed-worktree repair and cleanup through
+  the Capability Gateway. Recovery must preserve surviving managed-branch work and
+  refuse ambiguous ownership rather than guessing;
+- **0.9.2** — add persistent Workspace checkpoints with explicit create/list/inspect/
+  delete lifecycle, stored outside normal project history and surviving Workspace
+  close/reopen;
+- **0.9.3** — add checkpoint restore with optimistic-concurrency preflight so external
+  or user edits made after inspection cannot be silently overwritten. Restore changes
+  working-tree content without moving branch HEAD or using `git reset --hard`;
+- **0.9.4** — add owner-facing retention inspection and explicitly authorized prune
+  through the CLI. Audit retention remains unlimited by default, persistent Workspace
+  identity/Tasks are not ordinary GC targets, and destructive global maintenance is
+  not exposed as an ordinary Agent MCP Capability.
+
+Workspace Relay continues to treat the Execution ForgeRelay as the owner of Git,
+recovery, checkpoint, and retention facts; the Gateway only routes and presents bounded
+results. Development acceptance remains on isolated 7677/7678 instances and never uses
+the normal 7676 installation.
+
+Later refinements may add `.worktreeinclude`-style explicit copying of selected
+Git-ignored files. Native PowerShell/`cmd.exe` shell execution is also a separate
+compatibility decision rather than part of the 0.9 recovery/history line.
 
 ## Workspace Task Lists
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akira-tl/forgerelay",
-  "version": "0.8.10",
+  "version": "0.9.0",
   "description": "Local development control plane for MCP coding agents.",
   "type": "module",
   "homepage": "https://github.com/Akira-TL/forgerelay#readme",
@@ -52,7 +52,7 @@
     "release:push-ready": "node scripts/release/push-ready.mjs",
     "postinstall": "node scripts/fix-node-pty-permissions.mjs",
     "start": "node dist/cli.js serve",
-    "test": "node --test scripts/debug/runtime.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/runtime/config/config.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/runtime/managed-language-servers.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/mcp/server/operations/mutation-diagnostics.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/cli.test.ts",
+    "test": "node --test scripts/debug/runtime.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/runtime/config/config.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/runtime/managed-language-servers.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/mcp/server/operations/mutation-diagnostics.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/git/worktree-recovery.test.ts && tsx src/mcp/server/workspace/workspace-inventory.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/cli.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "release:check": "node scripts/release-version.mjs check",
     "release:tag-check": "node scripts/release-version.mjs tag",