@loucompanion/forge-bridge 0.1.1-dev.32d4dd5874ee → 0.1.1-dev.615630fb4618

package/dist/session/phase-completion.d.ts

@@ -19,6 +19,7 @@ export interface CompletionToolServerConfig {
     readonly workItemId: string;
     readonly phase: CompletionPhase;
     readonly producedBy?: string;
+    readonly redactionSecrets?: readonly string[];
 }
 export interface CompletionArtifactReference {
     readonly phase: CompletionPhase;
@@ -52,3 +53,4 @@ export declare function parseCompletionMcpArgs(argv: readonly string[]): {
     readonly ok: false;
     readonly error: string;
 };
+export declare function completionRedactionEnv(secrets: readonly string[]): Readonly<Record<string, string>>;

package/dist/session/phase-completion.js

@@ -2,7 +2,9 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { redactSecrets } from "../shared/redaction/redaction.js";
 const toolServerName = "forge";
+const completionRedactionSecretsEnv = "FORGE_COMPLETION_REDACTION_SECRETS";
 const phaseFiles = {
     implementation: {
         jsonFileName: "implementation.completeness.json",
@@ -122,12 +124,13 @@ export async function writeCompletionArtifact(config, toolName, input) {
     const payload = asRecord(input, "completion payload");
     validatePayloadShape(phase, payload);
     validateOptionalWorkItemId(payload, config.workItemId);
-    const producedBy = optionalString(payload, "produced_by")
-        ?? optionalString(payload, "producedBy")
+    const redactedPayload = redactSecrets(payload, config.redactionSecrets ?? []);
+    const producedBy = optionalString(redactedPayload, "produced_by")
+        ?? optionalString(redactedPayload, "producedBy")
         ?? config.producedBy
         ?? "forge-completion-tool";
-    const status = requiredString(payload, "status").trim().toLowerCase();
-    const artifactWithoutHash = normalizeArtifactPayload(payload, {
+    const status = requiredString(redactedPayload, "status").trim().toLowerCase();
+    const artifactWithoutHash = normalizeArtifactPayload(redactedPayload, {
         phase,
         workItemId: config.workItemId,
         producedBy,
@@ -139,7 +142,7 @@ export async function writeCompletionArtifact(config, toolName, input) {
         content_hash: contentHash
     };
     const artifactJson = `${JSON.stringify(artifact, null, 2)}\n`;
-    const report = reportMarkdown(payload, phase, status, producedBy, contentHash);
+    const report = reportMarkdown(redactedPayload, phase, status, producedBy, contentHash);
     const artifactPath = completionArtifactJsonPath(config.worktreePath, config.workItemId, phase);
     const reportPath = completionArtifactReportPath(config.worktreePath, config.workItemId, phase);
     await fs.mkdir(path.dirname(artifactPath), { recursive: true });
@@ -232,10 +235,17 @@ export function parseCompletionMcpArgs(argv) {
             worktreePath: path.resolve(worktreePath),
             workItemId,
             phase,
-            producedBy
+            producedBy,
+            redactionSecrets: parseCompletionRedactionSecrets(process.env[completionRedactionSecretsEnv])
         }
     };
 }
+export function completionRedactionEnv(secrets) {
+    const filtered = secrets.filter((secret) => secret.length > 0);
+    return filtered.length > 0
+        ? { [completionRedactionSecretsEnv]: JSON.stringify(filtered) }
+        : {};
+}
 async function prepareCursorCompletionToolRuntime(worktreePath, runtime) {
     const cursorDir = path.join(worktreePath, ".cursor");
     const configPath = path.join(cursorDir, "mcp.json");
@@ -504,6 +514,21 @@ function parseStrictCompletionPhase(value) {
     }
     return null;
 }
+function parseCompletionRedactionSecrets(raw) {
+    if (!raw?.trim()) {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed)) {
+            return [];
+        }
+        return parsed.filter((value) => typeof value === "string" && value.length > 0);
+    }
+    catch {
+        return [];
+    }
+}
 function phaseFromToolName(toolName) {
     const normalized = toolName.trim().toLowerCase();
     if (normalized === "forge.complete_implementation" || normalized === "complete_implementation") {

package/dist/session/provider-cli/provider-cli.service.d.ts

@@ -11,6 +11,7 @@ export interface ProviderProcessRunRequest {
     readonly command: string;
     readonly args: readonly string[];
     readonly cwd: string;
+    readonly env?: Readonly<Record<string, string>>;
 }
 export interface ProviderProcessRunResult {
     readonly exitCode: number;

package/dist/session/provider-cli/provider-cli.service.js

@@ -7,7 +7,7 @@ import { promisify } from "node:util";
 import { GitClient } from "../../shared/git/git.js";
 import { resolveCursorAgentDirectLaunch } from "../../shared/cursor-agent/cursor-agent.launch.js";
 import { buildSpecBody, selectLaneCommand } from "../../worktree/artifact-injector.js";
-import { codexMcpConfigArgs, completionArtifactJsonPath, completionArtifactReportPath, completionPhaseFromDispatch, completionPromptForPhase, prepareCompletionToolRuntime, readCompletionArtifact } from "../phase-completion.js";
+import { codexMcpConfigArgs, completionPhaseFromDispatch, completionPromptForPhase, completionRedactionEnv, expectedCompletionToolName, prepareCompletionToolRuntime, readCompletionArtifact, writeCompletionArtifact } from "../phase-completion.js";
 const fakeWorkerModel = "server-local-fake-worker";
 const execFileAsync = promisify(execFile);
 export class RoutingProviderCliService {
@@ -77,7 +77,8 @@ export class ProcessBackedProviderCliService {
             result = await this.processRunner.run({
                 command: command.command,
                 args: command.args,
-                cwd: worktree.worktreePath
+                cwd: worktree.worktreePath,
+                env: providerRedactionEnv(dispatch)
             }, {
                 onStdoutLine: async (line) => {
                     const event = outputState.consume(line);
@@ -105,12 +106,13 @@ export class ProcessBackedProviderCliService {
         if (!completionArtifact) {
             throw new Error(`Provider CLI completed but did not call the Forge ${phase} completion tool.`);
         }
+        await emitCompletionArtifactRecorded(context.emit, worktree.worktreePath, completionArtifact);
         if (outputState.finalMessage) {
             await context.emit({
                 role: "assistant",
                 kind: "message",
                 content: outputState.finalMessage,
-                eventType: "implementation_complete"
+                eventType: phaseCompleteEventType(phase)
             });
         }
         else {
@@ -118,7 +120,7 @@ export class ProcessBackedProviderCliService {
                 role: "assistant",
                 kind: "message",
                 content: `${dispatch.execution.provider} CLI completed for ${worktree.branchName}.`,
-                eventType: "implementation_complete"
+                eventType: phaseCompleteEventType(phase)
             });
         }
         return {
@@ -250,41 +252,26 @@ export class DeterministicProviderCliService {
             content: `Created bridge changeset at ${changesetPath}`,
             eventType: "changeset"
         });
-        const verdict = {
-            schema_version: 1,
-            phase: "implementation",
-            status: "pass",
-            summary: "forge-bridge produced a deterministic implementation changeset.",
-            plan: [{ step: "Create deterministic changeset", status: "done" }],
-            changed_files: [{ path: "FORGE_PHASE5_CHANGESET.md", summary: "Recorded deterministic bridge evidence." }],
-            tests_added_or_updated: [{ name: "forge_bridge_run_once", evidence: "The bridge committed FORGE_PHASE5_CHANGESET.md." }],
-            docs_added_or_updated: [{ path: "FORGE_PHASE5_CHANGESET.md", summary: "Deterministic evidence document created for the run." }],
-            acceptance_criteria: [
-                {
-                    criterion: dispatch.workItem.acceptanceCriteria || "Deterministic bridge changeset exists",
-                    evidence: `FORGE_PHASE5_CHANGESET.md was committed with content hash ${sha256(changesetBody)}.`,
-                    status: "satisfied"
-                }
-            ],
-            known_gaps: [],
-            next_phase_context: "Review FORGE_PHASE5_CHANGESET.md and the bridge commit before validation.",
-            produced_by: "forge-bridge",
-            content_hash: sha256(changesetBody)
-        };
-        const verdictJson = JSON.stringify(verdict);
-        const report = `# Implementation report\n\nforge-bridge prepared \`${worktree.branchName}\` and created \`${changesetPath}\`.\n`;
-        const artifactPath = completionArtifactJsonPath(worktree.worktreePath, dispatch.workItem.id, "implementation");
-        const reportPath = completionArtifactReportPath(worktree.worktreePath, dispatch.workItem.id, "implementation");
-        await fs.writeFile(artifactPath, verdictJson + "\n", "utf8");
-        await fs.writeFile(reportPath, report, "utf8");
+        await writeCompletionArtifact({
+            worktreePath: worktree.worktreePath,
+            workItemId: dispatch.workItem.id,
+            phase,
+            producedBy: "forge-bridge",
+            redactionSecrets: exactRedactionSecrets(dispatch)
+        }, expectedCompletionToolName(phase), deterministicCompletionPayload(phase, dispatch, changesetBody));
+        const completionArtifact = await readCompletionArtifact(worktree.worktreePath, dispatch.workItem.id, phase);
+        if (!completionArtifact) {
+            throw new Error(`Deterministic provider did not produce the Forge ${phase} completion artifact.`);
+        }
+        await emitCompletionArtifactRecorded(context.emit, worktree.worktreePath, completionArtifact);
         await context.emit({
             role: "assistant",
             kind: "message",
-            content: "Implementation complete. forge-bridge produced deterministic phase artifacts.",
-            eventType: "implementation_complete"
+            content: `${phase.replace(/_/g, " ")} complete. forge-bridge produced deterministic phase artifacts.`,
+            eventType: phaseCompleteEventType(phase)
         });
         return {
-            summary: `forge-bridge completed ${worktree.branchName}.`,
+            summary: `forge-bridge completed ${worktree.branchName} (${phase}).`,
             spec: {
                 repoPath: worktree.worktreePath,
                 path: specPath,
@@ -292,15 +279,7 @@ export class DeterministicProviderCliService {
                 producedBy: "forge-lane-command",
                 status: "approved"
             },
-            artifact: {
-                repoPath: worktree.worktreePath,
-                path: artifactPath,
-                verdictJson,
-                report,
-                producedBy: "forge-bridge",
-                status: "pass",
-                phase: "implementation"
-            }
+            artifact: completionArtifact
         };
     }
     async runQa(dispatch, emit) {
@@ -334,12 +313,114 @@ export class DeterministicProviderCliService {
         };
     }
 }
+function phaseCompleteEventType(phase) {
+    return phase === "implementation" ? "implementation_complete" : `${phase}_complete`;
+}
+function deterministicCompletionPayload(phase, dispatch, changesetBody) {
+    const changesetHash = sha256(changesetBody);
+    const criterion = dispatch.workItem.acceptanceCriteria || "Deterministic bridge changeset exists";
+    if (phase === "implementation") {
+        return {
+            status: "pass",
+            summary: "forge-bridge produced a deterministic implementation changeset.",
+            plan: [{ step: "Create deterministic changeset", status: "done" }],
+            changed_files: [{ path: "FORGE_PHASE5_CHANGESET.md", summary: "Recorded deterministic bridge evidence." }],
+            tests_added_or_updated: [{ name: "forge_bridge_run_once", evidence: "The bridge committed FORGE_PHASE5_CHANGESET.md." }],
+            docs_added_or_updated: [{ path: "FORGE_PHASE5_CHANGESET.md", summary: "Deterministic evidence document created for the run." }],
+            acceptance_criteria: [
+                {
+                    criterion,
+                    evidence: `FORGE_PHASE5_CHANGESET.md was committed with content hash ${changesetHash}.`,
+                    status: "satisfied"
+                }
+            ],
+            known_gaps: [],
+            next_phase_context: "Review FORGE_PHASE5_CHANGESET.md and the bridge commit before validation."
+        };
+    }
+    if (phase === "self_review") {
+        return {
+            status: "pass",
+            summary: "forge-bridge fake worker completed deterministic self-review.",
+            reviewed_diff: true,
+            findings: [],
+            security_review: {
+                status: "pass",
+                notes: "No secret handling, auth, or destructive behavior changes were introduced by the deterministic changeset."
+            },
+            edge_case_review: {
+                status: "pass",
+                notes: "The deterministic fake-worker changeset is intentionally narrow and repeatable."
+            },
+            design_review: {
+                status: "not_applicable",
+                screenshots: [],
+                notes: "No UI changes."
+            },
+            deterministic_comparison: {
+                status: "pass",
+                command_or_tool: "git diff --stat HEAD~1..HEAD",
+                notes: `Reviewed deterministic changeset with content hash ${changesetHash}.`
+            },
+            fixes_applied: [],
+            remaining_risks: []
+        };
+    }
+    return {
+        status: "pass",
+        summary: "forge-bridge fake worker completed deterministic validation.",
+        commands: [
+            {
+                command: "git status --short && git diff --check",
+                exit_code: 0,
+                status: "pass",
+                summary: "Deterministic validation command completed for the fake-worker changeset."
+            }
+        ],
+        acceptance_criteria: [
+            {
+                criterion,
+                evidence: `FORGE_PHASE5_CHANGESET.md exists with content hash ${changesetHash}.`,
+                status: "satisfied"
+            }
+        ],
+        build_status: "pass",
+        test_status: "pass",
+        lint_status: "not_applicable",
+        design_status: "not_applicable",
+        drift_checks: [
+            {
+                command_or_tool: "git diff --check",
+                status: "pass",
+                summary: "No deterministic drift or whitespace errors were reported for the fake-worker changeset."
+            }
+        ],
+        ready_for_dev_test: true
+    };
+}
+async function emitCompletionArtifactRecorded(emit, worktreePath, artifact) {
+    const relativePath = path.relative(worktreePath, artifact.path) || path.basename(artifact.path);
+    await emit({
+        role: "tool",
+        kind: "tool_result",
+        content: `Forge completion tool recorded ${artifact.phase ?? "unknown"} artifact ${relativePath} (${artifact.status}).`,
+        eventType: "completion_tool_artifact_recorded"
+    });
+}
+function providerRedactionEnv(dispatch) {
+    const env = completionRedactionEnv(exactRedactionSecrets(dispatch));
+    return Object.keys(env).length > 0 ? env : undefined;
+}
+function exactRedactionSecrets(dispatch) {
+    return dispatch.apiKeySecretGrant?.secret ? [dispatch.apiKeySecretGrant.secret] : [];
+}
 export class StreamingProviderProcessRunner {
     async run(request, handlers = {}, signal) {
         const launch = await resolveProviderProcessLaunch(request.command, request.args);
         return await new Promise((resolve, reject) => {
             const child = spawn(launch.command, launch.args, {
                 cwd: request.cwd,
+                env: request.env ? { ...process.env, ...request.env } : undefined,
                 stdio: ["ignore", "pipe", "pipe"],
                 windowsHide: true
             });

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const forgeBridgeVersion = "0.1.1-dev.32d4dd5874ee";
+export declare const forgeBridgeVersion = "0.1.1-dev.615630fb4618";

package/dist/version.js

@@ -1 +1 @@
-export const forgeBridgeVersion = "0.1.1-dev.32d4dd5874ee";
+export const forgeBridgeVersion = "0.1.1-dev.615630fb4618";

package/dist/worktree/artifact-injector.js

@@ -29,10 +29,7 @@ export function selectLaneCommand(artifacts, lane, phase) {
     return artifacts.find((artifact) => normalizedArtifactKind(artifact.kind) === "command" && artifact.slug.trim().toLowerCase() === slug);
 }
 export function resolveCommandSlug(lane, phase) {
-    const normalizedPhase = phase.trim().toLowerCase();
-    if (normalizedPhase === "self_review") {
-        return "self-review-prompt";
-    }
+    const normalizedPhase = phase.trim().toLowerCase().replace(/-/g, "_");
     if (normalizedPhase === "rework") {
         return "rework-prompt";
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loucompanion/forge-bridge",
-  "version": "0.1.1-dev.32d4dd5874ee",
+  "version": "0.1.1-dev.615630fb4618",
   "description": "Forge runner bridge CLI for connecting local developer machines to Forge dispatch.",
   "license": "UNLICENSED",
   "type": "module",