@akira-tl/forgerelay 1.3.1 → 1.3.2

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable ForgeRelay changes are documented here.
 
 ## [Unreleased]
 
+## [1.3.2] - 2026-10-08
+
+### Security
+
+- 现在对所有 Activity App 查询校验 Host Turn 的对话归属，阻止知道其他会话 `turnId` 的调用者通过 `activity_snapshot`、`activity_index`、`activity_detail` 或 `activity_output` 读取跨会话操作历史、命令内容及输出。
+- Workspace Relay 网关在转发 Activity 查询前验证会话与远端 Turn 的归属关系；即使远端尚未升级，也不能通过已知的跨会话 Turn 路由读取历史。为本地、Relay 和重启路径补充回归覆盖。
+
+### Fixed
+
+- 修复 Bash 进程的非交互等待轮询可能过早返回或被高频零等待查询绕过的问题；有界等待及带缓存输出的行为由确定性测试覆盖，同时保留交互输入的短等待行为。
+- Workspace Relay 现在为较长的进程等待窗口留出请求截止时间余量，并与本地进程等待共享计算规则，避免在远端等待刚到边界时请求提前超时。
+- Shell 工作流指令在 MCP server instructions 中继续保持可见；重复打开 Workspace 时强化调用 `activity_panel` 建立 Host Turn 的提醒，但不自动创建 Panel，也不改变现有显式面板生命周期。
+
 ## [1.3.1] - 2026-09-18
 
 ### Fixed

package/dist/activity/history/query-service.js

@@ -130,6 +130,12 @@ export class ActivityQueryService {
                 : summary;
         });
     }
+    assertConversationTurn(turnId, conversationScopeId) {
+        const turn = this.turns.get(turnId);
+        if (!turn || turn.conversationScopeId !== conversationScopeId) {
+            throw new Error(`Unknown Host Turn: ${turnId}.`);
+        }
+    }
     requireTurn(turnId) {
         if (!this.turns.get(turnId))
             throw new Error(`Unknown Host Turn: ${turnId}.`);

package/dist/activity/runtime/mcp-query-tools.js

@@ -143,6 +143,7 @@ export function registerActivityQueryTools(server, queries, connectionScopeId, p
         if (!resolvedTurnId) {
             throw new Error("Activity snapshot bootstrap could not resolve the current Host Turn from conversation and workspace metadata.");
         }
+        queries.assertConversationTurn(resolvedTurnId, conversationScopeId);
         const snapshot = queries.state(resolvedTurnId, knownRevision);
         if (logging) {
             logEvent(logging, "debug", "activity_snapshot_call", {
@@ -184,6 +185,7 @@ export function registerActivityQueryTools(server, queries, connectionScopeId, p
         const relayed = await relay?.index(turnId, knownRevision, conversationScopeId);
         if (relayed)
             return relayed;
+        queries.assertConversationTurn(turnId, conversationScopeId);
         const index = queries.index(turnId, knownRevision);
         if (logging) {
             logEvent(logging, "debug", "activity_index_call", {
@@ -222,6 +224,7 @@ export function registerActivityQueryTools(server, queries, connectionScopeId, p
         const relayed = await relay?.detail(turnId, activityId, conversationScopeId);
         if (relayed)
             return relayed;
+        queries.assertConversationTurn(turnId, conversationScopeId);
         const detail = queries.detail(turnId, activityId);
         if (logging) {
             logEvent(logging, "debug", "activity_detail_call", {
@@ -268,6 +271,7 @@ export function registerActivityQueryTools(server, queries, connectionScopeId, p
         const relayed = await relay?.output(turnId, outputId, conversationScopeId, cursor);
         if (relayed)
             return relayed;
+        queries.assertConversationTurn(turnId, conversationScopeId);
         const output = queries.bashOutput(turnId, outputId, cursor);
         if (logging) {
             logEvent(logging, "debug", "activity_output_call", {

package/dist/mcp/process/process-sessions.js

@@ -1,13 +1,8 @@
 import { spawn } from "node:child_process";
 import { releasePtyProcessResources, resolveShellCommandForRuntime, terminateProcessTree, terminatePtyProcessTree } from "./process-platform.js";
 import { resolveCompatibilityCommandShellRuntime, snapshotCommandShellRuntime } from "../../runtime/shell/command-shell-runtime.js";
-const DEFAULT_EXEC_YIELD_MS = 10_000;
-const DEFAULT_INTERACTIVE_YIELD_MS = 250;
-export const DEFAULT_POLL_YIELD_MS = 60_000;
-const MAX_START_YIELD_MS = 300_000;
-const MAX_COMMAND_YIELD_MS = 300_000;
-const MAX_POLL_YIELD_MS = 300_000;
-const MAX_EXECUTION_TIMEOUT_MS = 24 * 60 * 60 * 1_000;
+import { DEFAULT_EXEC_YIELD_MS, DEFAULT_INTERACTIVE_YIELD_MS, MAX_COMMAND_YIELD_MS, MAX_START_YIELD_MS, boundedDuration, executionTimeout, minimumPollYield, waitOnlyYieldMs, } from "./process-wait-policy.js";
+export { DEFAULT_POLL_YIELD_MS } from "./process-wait-policy.js";
 const DEFAULT_MAX_OUTPUT_TOKENS = 10_000;
 const DEFAULT_BUFFER_CHARACTERS = 256_000;
 const DEFAULT_MAX_ACTIVE_PROCESSES = 64;
@@ -18,22 +13,6 @@ const COMPACT_COMPLETION_CHARACTERS = 16 * 1024;
 const COMPACT_COMPLETION_OUTPUT_TOKENS = COMPACT_COMPLETION_CHARACTERS / 4;
 const DEFAULT_COLUMNS = 80;
 const DEFAULT_ROWS = 24;
-function boundedInteger(value, fallback, maximum) {
-    if (value === undefined)
-        return Math.min(fallback, maximum);
-    if (!Number.isFinite(value) || value < 0) {
-        throw new Error("Duration and output limits must be non-negative.");
-    }
-    return Math.min(Math.floor(value), maximum);
-}
-function optionalExecutionTimeout(value) {
-    if (value === undefined)
-        return undefined;
-    if (!Number.isInteger(value) || value < 1 || value > MAX_EXECUTION_TIMEOUT_MS) {
-        throw new Error(`Execution timeout must be an integer between 1 and ${MAX_EXECUTION_TIMEOUT_MS}ms.`);
-    }
-    return value;
-}
 function terminalSize(value, fallback) {
     if (value === undefined)
         return fallback;
@@ -209,6 +188,7 @@ export class ProcessManager {
     maxCompletedProcesses;
     completedProcessTtlMs;
     maxStartYieldMs;
+    minimumPollYieldMs;
     monotonicNow;
     outputAudit;
     commandShellRuntime;
@@ -227,6 +207,7 @@ export class ProcessManager {
             ?? options.completedSessionTtlMs
             ?? COMPLETED_PROCESS_TTL_MS;
         this.maxStartYieldMs = options.maxStartYieldMs ?? MAX_START_YIELD_MS;
+        this.minimumPollYieldMs = minimumPollYield(options.minimumPollYieldMs);
         this.monotonicNow = options.monotonicNow ?? (() => performance.now());
         this.outputAudit = options.outputAudit;
         this.commandShellRuntime = snapshotCommandShellRuntime(options.commandShellRuntime ?? resolveCompatibilityCommandShellRuntime());
@@ -236,7 +217,7 @@ export class ProcessManager {
         if (this.stats().running >= this.maxActiveProcesses) {
             throw new Error(`Active process limit reached (${this.maxActiveProcesses}). Poll, interrupt, or wait for an existing process before starting another.`);
         }
-        const executionTimeoutMs = optionalExecutionTimeout(input.timeoutMs);
+        const executionTimeoutMs = executionTimeout(input.timeoutMs);
         const processEntry = this.createProcess(input);
         this.processes.set(processEntry.id, processEntry);
         try {
@@ -254,7 +235,7 @@ export class ProcessManager {
             throw error;
         }
         this.armExecutionTimeout(processEntry, executionTimeoutMs);
-        const yieldTimeMs = boundedInteger(input.yieldTimeMs, DEFAULT_EXEC_YIELD_MS, this.maxStartYieldMs);
+        const yieldTimeMs = boundedDuration(input.yieldTimeMs, DEFAULT_EXEC_YIELD_MS, this.maxStartYieldMs);
         try {
             await this.waitForExit(processEntry, yieldTimeMs, input.signal);
             input.signal?.throwIfAborted();
@@ -293,12 +274,22 @@ export class ProcessManager {
         const writableChars = chars.replaceAll("\u0003", "");
         if (writableChars && processEntry.running)
             processEntry.process?.write(writableChars);
-        const explicitWaitRequested = input.yieldTimeMs !== undefined;
-        if ((explicitWaitRequested || interactionRequested || !processEntry.buffer.hasOutput()) && processEntry.running) {
-            const fallback = interactionRequested ? DEFAULT_INTERACTIVE_YIELD_MS : DEFAULT_POLL_YIELD_MS;
-            const maximum = interactionRequested ? MAX_COMMAND_YIELD_MS : MAX_POLL_YIELD_MS;
-            const yieldTimeMs = boundedInteger(input.yieldTimeMs, fallback, maximum);
-            await this.waitForExit(processEntry, yieldTimeMs, input.signal);
+        if (processEntry.running) {
+            if (interactionRequested) {
+                const yieldTimeMs = boundedDuration(input.yieldTimeMs, DEFAULT_INTERACTIVE_YIELD_MS, MAX_COMMAND_YIELD_MS);
+                await this.waitForExit(processEntry, yieldTimeMs, input.signal);
+            }
+            else if (input.yieldTimeMs === 0) {
+                if (processEntry.waitOnlyProbeUsed) {
+                    throw new Error(`Immediate wait-only status probe for process ${processEntry.id} was already used. ` +
+                        "Use a positive or omitted yieldTimeMs for subsequent waits.");
+                }
+                processEntry.waitOnlyProbeUsed = true;
+            }
+            else {
+                const yieldTimeMs = waitOnlyYieldMs(input.yieldTimeMs, this.minimumPollYieldMs);
+                await this.waitForExit(processEntry, yieldTimeMs, input.signal);
+            }
         }
         const snapshot = this.consume(processEntry, input.maxOutputTokens);
         if (!processEntry.running)
@@ -433,6 +424,7 @@ export class ProcessManager {
             outputWasTruncated: false,
             background: false,
             discardOnFinish: false,
+            waitOnlyProbeUsed: false,
             exitPromise,
             resolveExit,
         };
@@ -555,7 +547,7 @@ export class ProcessManager {
         this.outputAudit?.finish(processEntry.outputId, input);
     }
     consume(processEntry, maxOutputTokens) {
-        const limit = boundedInteger(maxOutputTokens, DEFAULT_MAX_OUTPUT_TOKENS, 100_000);
+        const limit = boundedDuration(maxOutputTokens, DEFAULT_MAX_OUTPUT_TOKENS, 100_000);
         const maxCharacters = Math.max(256, limit * 4);
         const buffered = processEntry.buffer.drain(maxCharacters);
         if (buffered.truncated)

package/dist/mcp/process/process-wait-policy.js

@@ -0,0 +1,34 @@
+export const DEFAULT_EXEC_YIELD_MS = 10_000;
+export const DEFAULT_INTERACTIVE_YIELD_MS = 250;
+export const DEFAULT_POLL_YIELD_MS = 60_000;
+export const MAX_START_YIELD_MS = 300_000;
+export const MAX_COMMAND_YIELD_MS = 300_000;
+export const MAX_POLL_YIELD_MS = 300_000;
+const MAX_EXECUTION_TIMEOUT_MS = 24 * 60 * 60 * 1_000;
+export function boundedDuration(value, fallback, maximum) {
+    if (value === undefined)
+        return Math.min(fallback, maximum);
+    if (!Number.isFinite(value) || value < 0) {
+        throw new Error("Duration and output limits must be non-negative.");
+    }
+    return Math.min(Math.floor(value), maximum);
+}
+export function executionTimeout(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Number.isInteger(value) || value < 1 || value > MAX_EXECUTION_TIMEOUT_MS) {
+        throw new Error(`Execution timeout must be an integer between 1 and ${MAX_EXECUTION_TIMEOUT_MS}ms.`);
+    }
+    return value;
+}
+export function minimumPollYield(value) {
+    const resolved = value ?? DEFAULT_POLL_YIELD_MS;
+    if (!Number.isInteger(resolved) || resolved < 1 || resolved > MAX_POLL_YIELD_MS) {
+        throw new Error(`Minimum poll yield must be an integer between 1 and ${MAX_POLL_YIELD_MS}ms.`);
+    }
+    return resolved;
+}
+export function waitOnlyYieldMs(requested, minimum = DEFAULT_POLL_YIELD_MS) {
+    const resolvedMinimum = minimumPollYield(minimum);
+    return Math.max(resolvedMinimum, boundedDuration(requested, resolvedMinimum, MAX_POLL_YIELD_MS));
+}

package/dist/mcp/process/tools.js

@@ -41,7 +41,7 @@ function registerBashTool(options) {
             columns: z.number().int().min(1).max(1_000).optional().describe("Initial PTY width for action=run, or resize width for action=process."),
             rows: z.number().int().min(1).max(1_000).optional().describe("Initial PTY height for action=run, or resize height for action=process."),
             workingDirectory: z.string().optional().describe("For action=run, working directory relative to the workspace root. Defaults to the workspace root."),
-            yieldTimeMs: z.number().int().min(0).max(300_000).optional().describe("Maximum feedback wait, not a minimum delay: if the process finishes sooner, the call returns immediately. For long-running commands or wait-only action=process calls, set a long window near the Host request deadline (60000ms when supported) instead of repeated short polling. For action=run, use 0 for immediate background handoff; otherwise defaults to 10000ms. For action=process, wait-only calls default to 60000ms and interaction to 250ms."),
+            yieldTimeMs: z.number().int().min(0).max(300_000).optional().describe("Feedback wait. action=run defaults to 10000ms; 0 hands off immediately. Wait-only action=process defaults to 60000ms; positive shorter values are raised to 60000ms and buffered output does not shorten the wait. Use 0 once per running process for one immediate wait-only status probe; repeated wait-only 0 is rejected. Interactive action=process defaults to 250ms. Process exit returns sooner."),
             timeoutMs: z.number().int().min(1).max(86_400_000).optional().describe("For action=run, total execution timeout from process start. On expiry ForgeRelay terminates the process. Omit for no ForgeRelay execution deadline."),
             maxOutputTokens: z.number().int().positive().max(100_000).optional().describe("Approximate output token budget. Defaults to 10000."),
         },
@@ -232,7 +232,7 @@ function registerCodexProcessTools(options) {
             chars: z.string().optional().describe("Characters to write. Omit or pass an empty string to poll."),
             columns: z.number().int().min(1).max(1_000).optional().describe("Resize a PTY to this width."),
             rows: z.number().int().min(1).max(1_000).optional().describe("Resize a PTY to this height."),
-            yieldTimeMs: z.number().int().min(0).max(300_000).optional().describe("Milliseconds to keep waiting before returning again, max 300000. Polling defaults to 60000; interaction defaults to 250."),
+            yieldTimeMs: z.number().int().min(0).max(300_000).optional().describe("Wait window, max 300000ms. Wait-only polling defaults to 60000ms; positive shorter values are raised to 60000ms and buffered output does not shorten the wait. Use 0 once per running process for one immediate wait-only status probe; repeated wait-only 0 is rejected. Interaction defaults to 250ms; process exit returns sooner."),
             maxOutputTokens: z.number().int().positive().max(100_000).optional().describe("Approximate output token budget. Defaults to 10000."),
         },
         outputSchema: processOutputSchema(),

package/dist/mcp/server/workspace/runtime/workspace-open-presentation.js

@@ -97,6 +97,7 @@ export async function presentLocalWorkspaceOpen(options, input, contextData) {
     const availableAgentsFileOutputs = bootstrapComponents.has("availableAgentsFiles")
         ? cardAvailableAgentsFiles
         : [];
+    const panelTurnReminder = `Before the first non-lifecycle ForgeRelay work tool after this Workspace resolution, call activity_panel(workspaceId=\"${workspace.id}\") exactly once to begin the project Host Turn. This is required even when the Workspace was already open or reused.`;
     const workspaceContextInstruction = "For later open_workspace calls, context=\"auto\" avoids repeating unchanged bootstrap context; use context=\"none\" when only the workspace handle/metadata is needed, or context=\"full\" to force a refresh.";
     const workspaceManagementInstruction = [
         "Use open_workspace(action=\"list\") for lightweight Workspace inventory. Use action=\"inspect\" with one known workspaceId for bounded read-only metadata without opening/resuming it. Explicitly open a Workspace before executing or mutating against it, and ask the user before close_workspace cleanup.",
@@ -106,12 +107,13 @@ export async function presentLocalWorkspaceOpen(options, input, contextData) {
             : undefined,
     ].filter(Boolean).join(" ");
     const cardInstruction = config.skillsEnabled
-        ? `Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches an available skill, load it with read(path=\"skills://<name>\") before proceeding. When a task matches a capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction} ${executionContext.agentInstruction}`
-        : `Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches a capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction} ${executionContext.agentInstruction}`;
+        ? `${panelTurnReminder} Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches an available skill, load it with read(path=\"skills://<name>\") before proceeding. When a task matches a capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction} ${executionContext.agentInstruction}`
+        : `${panelTurnReminder} Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches a capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction} ${executionContext.agentInstruction}`;
     const instruction = workspaceReused
         ? effectiveIncludeBootstrapContext
             ? [
                 `Workspace already exists as ${workspace.id} for this directory.`,
+                panelTurnReminder,
                 "Reuse this workspaceId for subsequent tool calls.",
                 effectiveBootstrapContextComponents.length > 0
                     ? `Project bootstrap context components included in this response: ${effectiveBootstrapContextComponents.join(", ")}. Components not listed are unchanged and are not repeated.`
@@ -122,6 +124,7 @@ export async function presentLocalWorkspaceOpen(options, input, contextData) {
             ].join("\n\n")
             : [
                 `Workspace already open as ${workspace.id}.`,
+                panelTurnReminder,
                 "Reuse this workspaceId for subsequent tool calls. This is the same directory previously opened in this conversation.",
                 "Continue following the project instructions, nested instruction files, skills, capability guides, agent profiles, and diagnostics previously provided for this workspace. They remain active and are not repeated here.",
                 workspaceContextInstruction,
@@ -129,7 +132,7 @@ export async function presentLocalWorkspaceOpen(options, input, contextData) {
                 executionContext.agentInstruction,
             ].join("\n\n")
         : workspace.mode === "worktree"
-            ? `Use this workspaceId for subsequent tool calls. Follow the project instructions, nested instruction files, skills, agent profiles, and diagnostics returned for this isolated worktree. ${workspaceManagementInstruction} ${executionContext.agentInstruction}`
+            ? `${panelTurnReminder} Use this workspaceId for subsequent tool calls. Follow the project instructions, nested instruction files, skills, agent profiles, and diagnostics returned for this isolated worktree. ${workspaceManagementInstruction} ${executionContext.agentInstruction}`
             : cardInstruction;
     const resultContent = [
         {

package/dist/mcp/server-instructions.js

@@ -53,7 +53,7 @@ export function buildToolDescriptions(config) {
         rename: `Rename or move one file or directory inside an open workspace or the OS temp directory without overwriting an existing destination. Source and destination must both remain inside the permitted file roots. Call ${toolNames.openWorkspace} first and pass workspaceId.`,
         delete: `Delete one path or multiple paths inside an open workspace or the OS temp directory. Use path for one target or paths for multiple targets; a bulk Delete preflights all targets before deleting anything. Non-empty directories require recursive=true. An allowed root itself cannot be deleted. Call ${toolNames.openWorkspace} first and pass workspaceId.`,
         applyPatch: `Apply one Codex-style patch inside an open workspace or the OS temp directory. Supports adding, overwriting, updating, deleting, and moving files. Workspace paths must remain relative; absolute paths are accepted only inside the OS temp directory. Call ${toolNames.openWorkspace} first and pass workspaceId.`,
-        shell: `Run or manage a shell process inside an open workspace.${shellSurface} Commands run with the local user's authority; workspace containment does not make shell execution a sandbox. For action=run, yieldTimeMs is the feedback wait (default 10000ms; 0 returns processId) and timeoutMs is the independent execution limit. action=process waits/interacts with processId. For long-running commands or wait-only process calls, set a long yieldTimeMs near the Host deadline (60000ms when supported), not short polling. This wait is a maximum: if the process finishes sooner, the call returns immediately. If still running, reuse processId with another long wait; use short waits only for interaction. Background completions can arrive later. Call ${toolNames.openWorkspace} first with workspaceId. Expose only behind strong authentication.`,
+        shell: `Run or manage a shell process inside an open workspace.${shellSurface} Commands run with the local user's authority; workspace containment does not make shell execution a sandbox. action=run uses yieldTimeMs as feedback wait (default 10000ms; 0 returns processId) and timeoutMs as the execution limit. Wait-only action=process uses at least 60000ms for positive yieldTimeMs, even with buffered output; 0 is one immediate probe per running process and repeats are rejected. Process exit returns sooner; short waits are for interaction. Background completions can arrive later. Call ${toolNames.openWorkspace} first with workspaceId. Expose only behind strong authentication.`,
         shellCommand: "Shell command to run with the local user's authority.",
     };
 }
@@ -70,7 +70,6 @@ function capabilityContractInstructions(config) {
         ? ""
         : ` If ${toolNames.openWorkspace} reports stale workspaces, let the user choose resume or ${toolNames.closeWorkspace}; never auto-close.`;
     const workspaceLifecycle = `Default to the user's existing checkout. Reuse workspaceId from ${toolNames.openWorkspace}; change it only when asked.${staleWorkspacePolicy} Only open mode=\"worktree\" when the user explicitly asks for isolated or parallel Git work. ${toolNames.closeWorkspace} preserves Workspace identity. Managed close finalizes backing and needs commitMessage. Composite close preserves members; delete removes only Composite state. Active worktree delete still finalizes safely; checkout files are never deleted.`;
-    const activityPanel = `Project-work order: ${toolNames.openWorkspace} if needed → activity_panel(workspaceId) once → work tools. activity_panel is the single ForgeRelay UI render tool: Workspace above Activity. A new workspaceId creates a new card. Never call activity_panel before needed ${toolNames.openWorkspace}.`;
     const agents = `Follow instructions returned by ${toolNames.openWorkspace}. Read an availableAgentsFiles path before working under it.`;
     const capabilityGuides = `For optional capabilities from ${toolNames.openWorkspace}, use ${toolNames.capability}; if unfamiliar, describe first and read its advertised capability guide with ${toolNames.read}.`;
     const skills = config.skillsEnabled
@@ -78,7 +77,7 @@ function capabilityContractInstructions(config) {
         : "";
     const shellMutationPolicy = buildShellMutationPolicy();
     const hooks = "When a ForgeRelay tool result reports Hook results, tell the user which meaningful hooks ran and whether they passed or blocked the operation. Do not claim the requested operation succeeded when a blocking hook prevented it.";
-    return joinInstructions(workspaceLifecycle, activityPanel, agents, capabilityGuides, skills, shellMutationPolicy, hooks);
+    return joinInstructions(workspaceLifecycle, agents, capabilityGuides, skills, shellMutationPolicy, hooks);
 }
 function selectedWorkflowInstructions(config) {
     if (config.workflowInstructions === false)
@@ -89,10 +88,10 @@ function selectedWorkflowInstructions(config) {
 }
 function defaultWorkflowInstructions(config) {
     if (config.toolMode === "codex") {
-        return `Use ${toolNames.read} for direct file reads, ${toolNames.rename} and ${toolNames.delete} for direct path moves or removals, apply_patch for content modifications, exec_command for inspection, tests, builds, and other commands, and ${toolNames.writeStdin} to poll or interact with running processes.`;
+        return `Use ${toolNames.read} for direct file reads, ${toolNames.rename} and ${toolNames.delete} for direct path moves or removals, apply_patch for content modifications, exec_command for inspection, tests, builds, and other commands, and ${toolNames.writeStdin} to poll or interact with running processes. Wait-only polling uses at least 60000ms for positive yieldTimeMs even with buffered output; 0 is one immediate probe per running process and repeats are rejected. Short waits are for interaction.`;
     }
     const inspection = `Use ${toolNames.shell} with command-line tools such as grep, rg, find, ls, and tree for search and directory inspection.`;
-    return joinInstructions(inspection, `Prefer ${toolNames.edit} for targeted content modifications, ${toolNames.write} only for new files or complete rewrites, ${toolNames.rename} for path moves, ${toolNames.delete} for removals, and ${toolNames.shell} for tests, builds, Git/package scripts, generators, formatters, and shell-suited commands. For long ${toolNames.shell} commands or wait-only calls, set yieldTimeMs near Host deadline (60000ms when supported); do not poll every few seconds. Completion returns immediately if sooner; if still running, reuse processId with a long wait. Short waits are only for interaction.`);
+    return joinInstructions(inspection, `Prefer ${toolNames.edit} for targeted content modifications, ${toolNames.write} only for new files or complete rewrites, ${toolNames.rename} for path moves, ${toolNames.delete} for removals, and ${toolNames.shell} for tests, builds, Git/package scripts, generators, formatters, and shell-suited commands. Wait-only polling uses at least 60000ms for positive yieldTimeMs even with buffered output; 0 is one immediate probe per running process and repeats are rejected. Process exit returns sooner; short waits are for interaction.`);
 }
 function joinInstructions(...parts) {
     return parts

package/dist/workspaces/relay/transport/remote-call-timeout.js

@@ -0,0 +1,42 @@
+import { DEFAULT_REQUEST_TIMEOUT_MSEC } from "@modelcontextprotocol/client";
+import { DEFAULT_EXEC_YIELD_MS, DEFAULT_INTERACTIVE_YIELD_MS, DEFAULT_POLL_YIELD_MS, } from "../../../mcp/process/process-wait-policy.js";
+const REMOTE_WAIT_HEADROOM_MS = 5_000;
+export function remoteToolCallTimeoutMs(name, args) {
+    const waitMs = remoteToolWaitMs(name, args);
+    if (waitMs === undefined || waitMs < DEFAULT_REQUEST_TIMEOUT_MSEC)
+        return undefined;
+    return waitMs + REMOTE_WAIT_HEADROOM_MS;
+}
+function remoteToolWaitMs(name, args) {
+    const requested = numberField(args.yieldTimeMs);
+    if (name === "bash") {
+        const action = typeof args.action === "string" ? args.action : "run";
+        if (action === "output")
+            return undefined;
+        if (action === "run")
+            return requested ?? DEFAULT_EXEC_YIELD_MS;
+        if (action !== "process")
+            return undefined;
+        return processControlWaitMs(requested, typeof args.input === "string" && args.input.length > 0 ||
+            args.interrupt === true ||
+            args.columns !== undefined ||
+            args.rows !== undefined);
+    }
+    if (name === "exec_command")
+        return requested ?? DEFAULT_EXEC_YIELD_MS;
+    if (name !== "write_stdin" || args.outputId !== undefined)
+        return undefined;
+    return processControlWaitMs(requested, typeof args.chars === "string" && args.chars.length > 0 ||
+        args.columns !== undefined ||
+        args.rows !== undefined);
+}
+function processControlWaitMs(requested, interactionRequested) {
+    if (interactionRequested)
+        return requested ?? DEFAULT_INTERACTIVE_YIELD_MS;
+    if (requested === 0)
+        return 0;
+    return Math.max(DEFAULT_POLL_YIELD_MS, requested ?? DEFAULT_POLL_YIELD_MS);
+}
+function numberField(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}

package/dist/workspaces/relay/workspace-relay.js

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import { CompatibilityCallToolResultSchema } from "@modelcontextprotocol/core";
 import { isRemoteMcpUnauthorized, refreshRemoteAuthentication, } from "./auth/remote-auth.js";
 import { RemoteMcpConnectionPool } from "./transport/remote-mcp-connection-pool.js";
+import { remoteToolCallTimeoutMs } from "./transport/remote-call-timeout.js";
 import { withFileLock } from "../../runtime/state/lock/file-lock.js";
 import { withRemoteServiceEndpoint } from "./transport/remote-transport.js";
 import { loadForgeRelayFiles, writeForgeRelayRemote, } from "../../runtime/config/user-config.js";
@@ -227,15 +228,22 @@ export class RemoteWorkspaceRelay {
             throw new Error(`Remote activity_panel failed: ${toolResultText(result)}`);
         }
         const turnId = stringField(result.structuredContent, "turnId", "Remote activity_panel response");
-        this.turnRoutes.set(turnId, gatewayWorkspaceId);
+        this.turnRoutes.set(turnId, { workspaceId: gatewayWorkspaceId, conversationScopeId });
         return result;
     }
     async activitySnapshot(input, conversationScopeId) {
+        const turnRoute = input.turnId ? this.turnRoutes.get(input.turnId) : undefined;
+        if (input.turnId && !turnRoute)
+            return undefined;
+        if (turnRoute && turnRoute.conversationScopeId !== conversationScopeId) {
+            throw new Error(`Unknown Host Turn: ${input.turnId}.`);
+        }
         const gatewayWorkspaceId = input.workspaceId && this.has(input.workspaceId)
             ? input.workspaceId
-            : input.turnId
-                ? this.turnRoutes.get(input.turnId)
-                : undefined;
+            : turnRoute?.workspaceId;
+        if (turnRoute && turnRoute.workspaceId !== gatewayWorkspaceId) {
+            throw new Error(`Unknown Host Turn: ${input.turnId}.`);
+        }
         if (!gatewayWorkspaceId)
             return undefined;
         const route = this.requireRoute(gatewayWorkspaceId);
@@ -248,7 +256,10 @@ export class RemoteWorkspaceRelay {
             }, conversationScopeId);
             const remapped = remapToolResultWorkspaceId(result, route.remoteWorkspaceId, gatewayWorkspaceId);
             const turnId = stringField(remapped.structuredContent, "turnId", "Remote activity_snapshot response");
-            this.turnRoutes.set(turnId, gatewayWorkspaceId);
+            if (input.turnId && turnId !== input.turnId) {
+                throw new Error(`Unknown Host Turn: ${input.turnId}.`);
+            }
+            this.turnRoutes.set(turnId, { workspaceId: gatewayWorkspaceId, conversationScopeId });
             return remapped;
         }
         catch (error) {
@@ -265,9 +276,13 @@ export class RemoteWorkspaceRelay {
         return this.callTurnTool(turnId, "activity_output", { turnId, outputId, ...(cursor !== undefined ? { cursor } : {}) }, conversationScopeId);
     }
     async callTurnTool(turnId, name, args, conversationScopeId) {
-        const gatewayWorkspaceId = this.turnRoutes.get(turnId);
-        if (!gatewayWorkspaceId)
+        const turnRoute = this.turnRoutes.get(turnId);
+        if (!turnRoute)
             return undefined;
+        if (turnRoute.conversationScopeId !== conversationScopeId) {
+            throw new Error(`Unknown Host Turn: ${turnId}.`);
+        }
+        const gatewayWorkspaceId = turnRoute.workspaceId;
         const route = this.requireRoute(gatewayWorkspaceId);
         const resolved = this.remoteByInstance(route.remoteInstanceId);
         try {
@@ -313,8 +328,8 @@ export class RemoteWorkspaceRelay {
             this.routes.delete(gatewayWorkspaceId);
             await this.deletePersistedRoute(gatewayWorkspaceId);
         }
-        for (const [turnId, routedWorkspaceId] of this.turnRoutes) {
-            if (routedWorkspaceId === gatewayWorkspaceId)
+        for (const [turnId, turnRoute] of this.turnRoutes) {
+            if (turnRoute.workspaceId === gatewayWorkspaceId)
                 this.turnRoutes.delete(turnId);
         }
         const actionText = action === "delete" ? "Deleted" : "Closed";
@@ -469,13 +484,14 @@ export class RemoteWorkspaceRelay {
             }
         }
         const invoke = async (active) => {
+            const requestTimeoutMs = remoteToolCallTimeoutMs(name, args);
             const parsed = CompatibilityCallToolResultSchema.parse(await active.client.callTool({
                 name,
                 arguments: args,
                 ...(conversationScopeId
                     ? { _meta: { "openai/session": conversationScopeId } }
                     : {}),
-            }));
+            }, requestTimeoutMs === undefined ? undefined : { timeout: requestTimeoutMs }));
             if (!Array.isArray(parsed.content)) {
                 throw new Error("Remote ForgeRelay returned a modern-only tool result on the legacy Relay protocol path.");
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akira-tl/forgerelay",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "Local development control plane for MCP coding agents.",
   "type": "module",
   "homepage": "https://github.com/Akira-TL/forgerelay#readme",

package/scripts/debug/accept/bootstrap.mjs

@@ -59,7 +59,7 @@ export async function runBootstrapAcceptance({ server, packageJson, ownerToken,
   assert.match(serverInstructions, /Shell commands may modify ordinary project files/);
   assert.match(serverInstructions, /\/etc\/sudoers/);
   assert.match(serverInstructions, /configuration files through shell only when the user's request explicitly calls for that configuration change/);
-  assert.match(serverInstructions, /Project-work order: open_workspace if needed → activity_panel\(workspaceId\) once → work tools/);
+  assert.doesNotMatch(serverInstructions, /activity_panel/);
   assert.ok(serverInstructions.length < 3_000, `server instructions should stay compact, got ${serverInstructions.length} characters`);
   assert.doesNotMatch(serverInstructions, /fast-forwards the original target branch/);
   assert.doesNotMatch(serverInstructions, /Do not create or modify files with bash/);