@loucompanion/forge-bridge 0.1.1-dev.9acab970e5d1 → 0.1.1-dev.ac656b52f9c6

package/dist/bridge/bridge.service.d.ts

@@ -15,6 +15,7 @@ export declare class ForgeBridgeService implements BridgeService {
     run(signal?: AbortSignal): Promise<void>;
     stop(): Promise<void>;
     private handleDispatch;
+    private parseDispatchOrReport;
     private handleCancel;
     private abortActiveSessions;
     private normalizeDispatch;

package/dist/bridge/bridge.service.js

@@ -1,4 +1,5 @@
 import { HubConnectionBuilder, LogLevel } from "@microsoft/signalr";
+import fs from "node:fs";
 import path from "node:path";
 import { defaultForgeBridgeConfig } from "../config.js";
 import { redactSecrets, redactText } from "../shared/redaction/redaction.js";
@@ -48,8 +49,14 @@ export class ForgeBridgeService {
             while (!this.stopped && !signal?.aborted) {
                 try {
                     await this.connectOnce();
+                    if (attempt > 0) {
+                        logBridgeStatus("Connected to Forge. Waiting for dispatches...");
+                    }
                     attempt = 0;
                     await this.waitForClose(signal);
+                    if (!this.stopped && !signal?.aborted) {
+                        logBridgeStatus("Connection closed. Reconnecting...");
+                    }
                 }
                 catch (error) {
                     if (this.stopped || signal?.aborted) {
@@ -57,6 +64,7 @@ export class ForgeBridgeService {
                     }
                     const backoff = this.config.reconnectBackoffMs[Math.min(attempt, this.config.reconnectBackoffMs.length - 1)] ?? 5000;
                     attempt += 1;
+                    logBridgeStatus(`Connect attempt ${attempt} failed: ${errorMessage(error)}. Retrying in ${formatDelay(backoff)}...`);
                     await delay(backoff, signal);
                 }
             }
@@ -73,10 +81,14 @@ export class ForgeBridgeService {
         this.abortActiveSessions("bridge stopping");
         await this.stopConnection();
     }
-    async handleDispatch(dispatch) {
+    async handleDispatch(rawDispatch) {
+        const dispatch = this.parseDispatchOrReport(rawDispatch);
+        if (!dispatch) {
+            return;
+        }
         const leaseId = dispatch.lease.id;
         const fencingToken = dispatch.lease.fencingToken;
-        const redactionSecrets = exactSecrets(dispatch);
+        const redactionSecrets = exactSecrets(dispatch, this.config);
         if (this.activeSessions.has(leaseId)) {
             await this.sendResult(leaseId, fencingToken, failureResult("Dispatch is already active on this bridge.")).catch(() => undefined);
             return;
@@ -115,6 +127,27 @@ export class ForgeBridgeService {
             this.activeSessions.delete(leaseId);
         }
     }
+    parseDispatchOrReport(rawDispatch) {
+        try {
+            return parseRunOnceDispatchPacket(rawDispatch);
+        }
+        catch (error) {
+            const identifiers = readDispatchIdentifiers(rawDispatch);
+            if (!identifiers) {
+                return null;
+            }
+            const summary = invalidDispatchSummary(error);
+            void this.sendResult(identifiers.leaseId, identifiers.fencingToken, failureResult(summary, [
+                {
+                    role: "runner",
+                    kind: "error",
+                    content: summary,
+                    eventType: "invalid_dispatch"
+                }
+            ])).catch(() => undefined);
+            return null;
+        }
+    }
     async handleCancel(request) {
         const active = this.activeSessions.get(request.leaseId);
         if (!active || active.fencingToken !== request.fencingToken) {
@@ -129,7 +162,7 @@ export class ForgeBridgeService {
         this.activeSessions.clear();
     }
     normalizeDispatch(dispatch) {
-        const mapping = findRepoMapping(dispatch, this.config.repoMappings);
+        const mapping = findRepoMapping(dispatch, repoMappingsFor(this.config));
         const localPath = mapping?.localPath?.trim();
         const repoRoot = localPath ? path.dirname(path.resolve(localPath)) : this.config.defaultRepoRoot;
         const qaLaunchTarget = normalizeQaAppLaunchTarget(mapping?.qaAppLaunchTarget) ?? dispatch.qaBrowser?.launchTarget ?? null;
@@ -197,13 +230,14 @@ export class ForgeBridgeService {
             cliProviders: this.config.cliProviders,
             providerStatuses: this.config.providerStatuses,
             projectLabels: this.config.projectLabels,
-            repoMappings: this.config.repoMappings,
+            repoMappings: repoMappingsFor(this.config),
             os: this.config.os,
             sandboxProfiles: this.config.sandboxProfiles,
             supportsApiSecretGrant: this.config.supportsApiSecretGrant,
             supportsManagedWorktrees: this.config.supportsManagedWorktrees,
             supportsManagedForgeArtifacts: this.config.supportsManagedForgeArtifacts,
-            supportsRunnerAuthoredPhaseArtifacts: this.config.supportsRunnerAuthoredPhaseArtifacts
+            supportsRunnerAuthoredPhaseArtifacts: this.config.supportsRunnerAuthoredPhaseArtifacts,
+            supportsDraftRunOnce: this.config.supportsDraftRunOnce
         };
     }
     async invokeAck(methodName, payload) {
@@ -275,14 +309,7 @@ export class SignalRBridgeConnection {
     }
     onDispatch(handler) {
         this.connection.on("Dispatch", (raw) => {
-            let dispatch;
-            try {
-                dispatch = parseRunOnceDispatchPacket(raw);
-            }
-            catch {
-                return;
-            }
-            void handler(dispatch).catch(() => undefined);
+            void handler(raw).catch(() => undefined);
         });
     }
     onCancel(handler) {
@@ -309,11 +336,12 @@ export function defaultBridgeServiceConfig(overrides = {}) {
         projectLabels: splitCsv(process.env.FORGE_PROJECT_LABELS ?? ""),
         repoMappings: [],
         os: process.platform,
-        sandboxProfiles: ["default"],
+        sandboxProfiles: overrides.sandboxProfiles,
         supportsApiSecretGrant: true,
         supportsManagedWorktrees: true,
         supportsManagedForgeArtifacts: true,
         supportsRunnerAuthoredPhaseArtifacts: true,
+        supportsDraftRunOnce: true,
         version: process.env.FORGE_BRIDGE_VERSION ?? forgeBridgeVersion,
         protocolVersion: 1,
         minServerVersion: null,
@@ -323,6 +351,7 @@ export function defaultBridgeServiceConfig(overrides = {}) {
     };
     return {
         ...config,
+        sandboxProfiles: config.sandboxProfiles ?? defaultSandboxProfiles(config.cliProviders),
         heartbeatIntervalMs: positiveFiniteNumber(config.heartbeatIntervalMs, 30_000)
     };
 }
@@ -341,6 +370,14 @@ function positiveFiniteNumber(value, fallback) {
 function providerStatusesFor(providers) {
     return Object.fromEntries(providers.map((provider) => [provider, { signedIn: true, version: "", models: configuredModelsFor(provider) }]));
 }
+function defaultSandboxProfiles(providers, platform = process.platform) {
+    if (!providers.some((provider) => provider.toLowerCase() === "codex")) {
+        return ["none"];
+    }
+    return platform === "win32"
+        ? ["danger-full-access"]
+        : ["provider-workspace-write"];
+}
 function configuredModelsFor(provider) {
     const envName = `FORGE_${provider.replace(/[^a-zA-Z0-9]/g, "_").toUpperCase()}_MODELS`;
     return splitCsv(process.env[envName] ?? "");
@@ -351,6 +388,62 @@ function splitCsv(value) {
         .map((entry) => entry.trim())
         .filter((entry) => entry.length > 0);
 }
+function repoMappingsFor(config) {
+    const explicit = [...config.repoMappings];
+    const discovered = discoverRepoRootMappings(config.defaultRepoRoot);
+    if (explicit.length === 0) {
+        return discovered;
+    }
+    const explicitKeys = new Set(explicit.flatMap(mappingKeys));
+    return [
+        ...explicit,
+        ...discovered.filter((mapping) => !mappingKeys(mapping).some((key) => explicitKeys.has(key)))
+    ];
+}
+function discoverRepoRootMappings(defaultRepoRoot) {
+    const root = defaultRepoRoot.trim();
+    if (!root) {
+        return [];
+    }
+    const resolvedRoot = path.resolve(root);
+    const mappings = [];
+    if (isGitCheckout(resolvedRoot)) {
+        mappings.push({ name: path.basename(resolvedRoot), localPath: resolvedRoot });
+    }
+    let entries;
+    try {
+        entries = fs.readdirSync(resolvedRoot, { withFileTypes: true });
+    }
+    catch {
+        return mappings;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory()) {
+            continue;
+        }
+        const localPath = path.join(resolvedRoot, entry.name);
+        if (isGitCheckout(localPath)) {
+            mappings.push({ name: entry.name, localPath });
+        }
+    }
+    return mappings.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function isGitCheckout(localPath) {
+    try {
+        return fs.existsSync(path.join(localPath, ".git"));
+    }
+    catch {
+        return false;
+    }
+}
+function mappingKeys(mapping) {
+    return [
+        mapping.repoId ? `id:${mapping.repoId.toLowerCase()}` : null,
+        mapping.name ? `name:${mapping.name.trim().toLowerCase()}` : null,
+        mapping.remoteUrl ? `remote:${mapping.remoteUrl.trim().toLowerCase()}` : null,
+        mapping.localPath ? `path:${path.resolve(mapping.localPath).toLowerCase()}` : null
+    ].filter((key) => Boolean(key));
+}
 function findRepoMapping(dispatch, mappings) {
     return mappings.find((mapping) => {
         if (!mapping.localPath?.trim()) {
@@ -385,13 +478,46 @@ function cleanString(value) {
 function equalsIgnoreCase(left, right) {
     return !!left?.trim() && !!right?.trim() && left.trim().toLowerCase() === right.trim().toLowerCase();
 }
+function readDispatchIdentifiers(rawDispatch) {
+    if (!rawDispatch || typeof rawDispatch !== "object" || Array.isArray(rawDispatch)) {
+        return null;
+    }
+    const packet = rawDispatch;
+    const rawLease = packet.lease ?? packet.Lease;
+    if (!rawLease || typeof rawLease !== "object" || Array.isArray(rawLease)) {
+        return null;
+    }
+    const lease = rawLease;
+    const leaseId = readString(lease, "id", "Id");
+    const fencingToken = readString(lease, "fencingToken", "FencingToken");
+    return leaseId && fencingToken ? { leaseId, fencingToken } : null;
+}
+function readString(source, camelKey, pascalKey) {
+    const value = source[camelKey] ?? source[pascalKey];
+    return typeof value === "string" && value.trim() ? value : null;
+}
+function invalidDispatchSummary(error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return `Invalid bridge dispatch packet: ${detail}`;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function formatDelay(ms) {
+    if (ms >= 1000 && ms % 1000 === 0) {
+        return `${ms / 1000}s`;
+    }
+    return `${ms}ms`;
+}
+function logBridgeStatus(message) {
+    process.stderr.write(`[${new Date().toISOString()}] ${message}\n`);
+}
 function delay(ms, signal) {
     if (signal?.aborted) {
         return Promise.resolve();
     }
     return new Promise((resolve) => {
         const timeout = setTimeout(resolve, ms);
-        timeout.unref?.();
         signal?.addEventListener("abort", () => {
             clearTimeout(timeout);
             resolve();
@@ -407,6 +533,9 @@ function abortPromise(signal) {
     }
     return new Promise((resolve) => signal.addEventListener("abort", () => resolve(), { once: true }));
 }
-function exactSecrets(dispatch) {
-    return dispatch.apiKeySecretGrant?.secret ? [dispatch.apiKeySecretGrant.secret] : [];
+function exactSecrets(dispatch, config) {
+    return [
+        dispatch.apiKeySecretGrant?.secret,
+        config.deviceToken
+    ].filter((secret) => typeof secret === "string" && secret.length > 0);
 }

package/dist/bridge/bridge.types.d.ts

@@ -1,4 +1,4 @@
-import type { RunOnceDispatchPacket, RunOnceResultPacket, RunnerDispatchEvent } from "../session/session.types.js";
+import type { RunOnceResultPacket, RunnerDispatchEvent } from "../session/session.types.js";
 export interface BridgeServiceConfig {
     readonly serverUrl: string;
     readonly runnerId: string;
@@ -16,6 +16,7 @@ export interface BridgeServiceConfig {
     readonly supportsManagedWorktrees: boolean;
     readonly supportsManagedForgeArtifacts: boolean;
     readonly supportsRunnerAuthoredPhaseArtifacts: boolean;
+    readonly supportsDraftRunOnce: boolean;
     readonly version: string;
     readonly protocolVersion: number;
     readonly minServerVersion?: string | null;
@@ -55,6 +56,7 @@ export interface BridgeCapabilities {
     readonly supportsManagedWorktrees?: boolean | null;
     readonly supportsManagedForgeArtifacts?: boolean | null;
     readonly supportsRunnerAuthoredPhaseArtifacts?: boolean | null;
+    readonly supportsDraftRunOnce?: boolean | null;
 }
 export interface BridgeHelloRequest {
     readonly version: string;
@@ -88,5 +90,5 @@ export interface BridgeCancelRequest {
     readonly fencingToken: string;
     readonly reason?: string | null;
 }
-export type BridgeDispatchHandler = (dispatch: RunOnceDispatchPacket) => Promise<void>;
+export type BridgeDispatchHandler = (dispatch: unknown) => Promise<void>;
 export type BridgeCancelHandler = (request: BridgeCancelRequest) => Promise<void>;

package/dist/cli/cli.service.js

@@ -7,6 +7,7 @@ import { promisify } from "node:util";
 import { resolveCursorAgentDirectLaunch } from "../shared/cursor-agent/cursor-agent.launch.js";
 import { redactSecrets, redactText } from "../shared/redaction/redaction.js";
 import { defaultBridgeServiceConfig, ForgeBridgeService } from "../bridge/bridge.service.js";
+import { forgeBridgeVersion } from "../version.js";
 import { addRepoMapping, applyLocalConfigDefaults, providerStatusesFor, readLocalConfigSync, removeRepoMapping, resolveLocalConfigPath, writeLocalConfig } from "./local-config.js";
 import { BridgeSessionService } from "../session/session.service.js";
 import { parseCompletionMcpArgs, runCompletionMcpServer } from "../session/phase-completion.js";
@@ -23,6 +24,22 @@ export class ForgeBridgeCliService {
         this.pairRunner = pairRunner;
     }
     async run(argv, io = { stdout: process.stdout, stderr: process.stderr }) {
+        if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
+            io.stdout.write(helpText());
+            return 0;
+        }
+        if (argv[0] === "help") {
+            io.stdout.write(argv[1] ? commandHelpText(argv[1]) : helpText());
+            return 0;
+        }
+        if (argv[1] === "--help" || argv[1] === "-h") {
+            io.stdout.write(commandHelpText(argv[0]));
+            return 0;
+        }
+        if (argv[0] === "version" || argv[0] === "--version" || argv[0] === "-v") {
+            io.stdout.write(`forge-bridge ${defaultBridgeServiceConfig().version ?? forgeBridgeVersion}\n`);
+            return 0;
+        }
         const args = parseArgs(argv);
         if (!args.ok) {
             io.stderr.write(`${args.error}\n`);
@@ -44,6 +61,7 @@ export class ForgeBridgeCliService {
             process.once("SIGINT", stop);
             process.once("SIGTERM", stop);
             try {
+                io.stdout.write(connectStartupText(config));
                 await this.bridgeFactory(config).run(controller.signal);
                 return 0;
             }
@@ -176,19 +194,23 @@ function parseEnvSecretGrant(raw) {
     };
 }
 function exactSecrets(dispatch) {
-    return dispatch.apiKeySecretGrant?.secret ? [dispatch.apiKeySecretGrant.secret] : [];
+    return exactSecretValues(dispatch.apiKeySecretGrant?.secret, process.env.FORGE_DEVICE_TOKEN);
 }
 function readEnvSecretValuesForRedaction() {
+    const secrets = [];
     const raw = process.env[apiKeySecretGrantEnv];
-    if (!raw) {
-        return [];
-    }
-    try {
-        return [parseEnvSecretGrant(raw).secret];
-    }
-    catch {
-        return [];
+    if (raw) {
+        try {
+            secrets.push(parseEnvSecretGrant(raw).secret);
+        }
+        catch {
+            // Ignore malformed grant env here; command handling will report the parse error.
+        }
     }
+    return exactSecretValues(...secrets, process.env.FORGE_DEVICE_TOKEN);
+}
+function exactSecretValues(...values) {
+    return values.filter((value) => typeof value === "string" && value.length > 0);
 }
 export function parseArgs(argv) {
     if (argv[0] === "connect") {
@@ -474,6 +496,7 @@ function pairedConfig(current, args, claim) {
         supportsManagedWorktrees: current.supportsManagedWorktrees ?? true,
         supportsManagedForgeArtifacts: current.supportsManagedForgeArtifacts ?? true,
         supportsRunnerAuthoredPhaseArtifacts: current.supportsRunnerAuthoredPhaseArtifacts ?? true,
+        supportsDraftRunOnce: current.supportsDraftRunOnce ?? true,
         repoMappings: current.repoMappings ?? []
     };
 }
@@ -522,7 +545,199 @@ function normalizeServerUrl(serverUrl) {
     return serverUrl.endsWith("/") ? serverUrl : `${serverUrl}/`;
 }
 function usage() {
-    return "Usage: forge-bridge run-once --dispatch <dispatch-json-path> --result <result-json-path> | forge-bridge mcp --worktree <path> --work-item-id <id> --phase <phase> | forge-bridge pair [code] [--server <url>] | forge-bridge connect --server <url> --runner-id <id> --device-token <token> | forge-bridge add-repo <label> <path> | forge-bridge remove-repo <label> | forge-bridge status [--check-updates] | forge-bridge cleanup [--stale|--merged|--all|--force]";
+    return helpText();
+}
+function helpText() {
+    const version = defaultBridgeServiceConfig().version ?? forgeBridgeVersion;
+    return [
+        `🛠 Forge Bridge ${version} — Local provider runners for Forge.`,
+        "",
+        "Usage: forge-bridge [options] [command]",
+        "",
+        "Options:",
+        "  -h, --help       Display help for command",
+        "  -v, --version    Output the version number",
+        "",
+        "Commands:",
+        "  Hint: commands suffixed with * have detailed help. Run <command> --help for details.",
+        "  connect *        Start the runner bridge and wait for Forge dispatches",
+        "  pair *           Pair this machine with Forge and save runner credentials",
+        "  status *         Show config, runner identity, repos, provider CLIs, and updates",
+        "  add-repo *       Map a Forge repo label/name to a local checkout path",
+        "  remove-repo *    Remove a saved repo mapping",
+        "  cleanup *        Prune managed bridge worktrees",
+        "  version *        Print the installed bridge package version",
+        "  help *           Display help for command",
+        "  run-once *       Internal: run one dispatch packet from JSON",
+        "  mcp *            Internal: run the phase-completion MCP server",
+        "",
+        "Examples:",
+        "  npm install -g @loucompanion/forge-bridge@next",
+        "  forge-bridge pair 1234-5678 --server https://srv1493013.tail66073d.ts.net:8443 --repo-root \"%USERPROFILE%\\ForgeRepos\"",
+        "  forge-bridge connect",
+        "  forge-bridge status --check-updates",
+        "  forge-bridge add-repo Forge D:\\Programming\\repos\\Forge",
+        "  forge-bridge cleanup --stale",
+        "",
+        "Troubleshooting:",
+        "  If Forge says the bridge is old: npm install -g @loucompanion/forge-bridge@next",
+        "  If connect shows 502/500: leave it open; it reconnects with backoff while dev restarts.",
+        "  If a provider is missing: run forge-bridge status --check-updates and verify CLI login.",
+        "",
+        "Docs:",
+        "  https://github.com/coleman399/Forge/tree/develop/tools/forge-bridge#readme",
+        "",
+    ].join("\n");
+}
+function commandHelpText(command) {
+    switch (command) {
+        case "pair":
+            return [
+                "Forge Bridge — pair",
+                "Pair this machine with Forge and save runner credentials.",
+                "",
+                "Usage:",
+                "  forge-bridge pair [code] [options]",
+                "",
+                "Options:",
+                "  --server <url>              Forge server URL.",
+                "  --repo-root <path>          Folder where bridge-managed repos/worktrees live.",
+                "  --name <name>               Display name for this runner.",
+                "  --fingerprint <value>       Stable device fingerprint override.",
+                "  --cli-provider <list>       Comma-separated providers, e.g. codex,cursor.",
+                "  --cleanup-worktrees         Enable managed worktree cleanup.",
+                "  --no-cleanup-worktrees      Disable managed worktree cleanup.",
+                "",
+                "Example:",
+                "  forge-bridge pair 1234-5678 --server https://forge.example.com --repo-root \"%USERPROFILE%\\ForgeRepos\"",
+                "",
+            ].join("\n");
+        case "connect":
+            return [
+                "Forge Bridge — connect",
+                "Start the runner bridge and keep it connected for Forge dispatches.",
+                "",
+                "Usage:",
+                "  forge-bridge connect [options]",
+                "",
+                "Options:",
+                "  --server <url>              Forge server URL; saved config is used when omitted.",
+                "  --runner-id <id>            Runner id; saved config is used when omitted.",
+                "  --device-token <token>      Device token; saved config is used when omitted.",
+                "  --repo-root <path>          Override repo/worktree folder for this run.",
+                "  --cli-provider <list>       Comma-separated providers, e.g. codex,cursor.",
+                "  --heartbeat-interval-ms <n> Heartbeat interval in milliseconds.",
+                "  --cleanup-worktrees         Enable managed worktree cleanup for this run.",
+                "  --no-cleanup-worktrees      Disable managed worktree cleanup for this run.",
+                "",
+                "Example:",
+                "  forge-bridge connect",
+                "",
+            ].join("\n");
+        case "status":
+            return [
+                "Forge Bridge — status",
+                "Show saved configuration, paired runner identity, repo mappings, detected provider CLIs, and optional update info.",
+                "",
+                "Usage:",
+                "  forge-bridge status [--check-updates]",
+                "",
+                "Example:",
+                "  forge-bridge status --check-updates",
+                "",
+            ].join("\n");
+        case "add-repo":
+            return [
+                "Forge Bridge — add-repo",
+                "Map a Forge repo label/name to an existing local checkout.",
+                "",
+                "Usage:",
+                "  forge-bridge add-repo <label> <path>",
+                "",
+                "Example:",
+                "  forge-bridge add-repo Forge D:\\Programming\\repos\\Forge",
+                "",
+            ].join("\n");
+        case "remove-repo":
+            return [
+                "Forge Bridge — remove-repo",
+                "Remove a saved local repo mapping.",
+                "",
+                "Usage:",
+                "  forge-bridge remove-repo <label>",
+                "",
+            ].join("\n");
+        case "cleanup":
+            return [
+                "Forge Bridge — cleanup",
+                "Prune managed bridge worktrees under the configured repo folder.",
+                "",
+                "Usage:",
+                "  forge-bridge cleanup [--stale|--merged|--all] [--force]",
+                "",
+                "Examples:",
+                "  forge-bridge cleanup --stale",
+                "  forge-bridge cleanup --all --force",
+                "",
+            ].join("\n");
+        case "run-once":
+            return [
+                "Forge Bridge — run-once",
+                "Internal command used by Forge to run a single dispatch packet.",
+                "",
+                "Usage:",
+                "  forge-bridge run-once --dispatch <dispatch-json-path> --result <result-json-path>",
+                "",
+            ].join("\n");
+        case "mcp":
+            return [
+                "Forge Bridge — mcp",
+                "Internal MCP server used by provider CLIs to report Forge phase artifacts.",
+                "",
+                "Usage:",
+                "  forge-bridge mcp --worktree <path> --work-item-id <id> --phase <phase>",
+                "",
+            ].join("\n");
+        case "version":
+            return [
+                "Forge Bridge — version",
+                "Print the installed bridge package version.",
+                "",
+                "Usage:",
+                "  forge-bridge version",
+                "",
+            ].join("\n");
+        default:
+            return [
+                `Unknown forge-bridge command: ${command}`,
+                "",
+                "Run `forge-bridge help` to see available commands.",
+                "",
+            ].join("\n");
+    }
+}
+function connectStartupText(config) {
+    const runner = config.runnerId
+        ? `${config.runnerId}${config.deviceName ? ` (${config.deviceName})` : ""}`
+        : "not configured";
+    return [
+        `Forge Bridge ${config.version}`,
+        "Starting runner bridge...",
+        "",
+        "Startup:",
+        `  server: ${config.serverUrl || "not configured"}`,
+        `  runner: ${runner}`,
+        `  config: ${resolveLocalConfigPath()}`,
+        `  repo folder: ${config.defaultRepoRoot || "not configured"}`,
+        `  providers: ${formatList(config.cliProviders)}`,
+        `  cleanup worktrees: ${config.cleanupWorktrees ? "enabled" : "disabled"}`,
+        "",
+        "Press Ctrl+C to stop.",
+        "",
+    ].join("\n");
+}
+function formatList(values) {
+    return values.length > 0 ? values.join(", ") : "none";
 }
 async function writeJsonAtomic(outputPath, value) {
     await fs.mkdir(path.dirname(outputPath), { recursive: true });

package/dist/cli/local-config.d.ts

@@ -16,6 +16,7 @@ export interface BridgeLocalConfig {
     readonly supportsManagedWorktrees?: boolean;
     readonly supportsManagedForgeArtifacts?: boolean;
     readonly supportsRunnerAuthoredPhaseArtifacts?: boolean;
+    readonly supportsDraftRunOnce?: boolean;
 }
 export interface LocalRepoMapping extends BridgeRepoMapping {
     readonly label: string;

package/dist/cli/local-config.js

@@ -49,11 +49,12 @@ export function applyLocalConfigDefaults(config, local) {
         providerStatuses: normalizeProviderStatuses(local.providerStatuses) ?? providerStatusesFor(cliProviders),
         projectLabels: local.projectLabels ?? config.projectLabels,
         repoMappings: local.repoMappings ?? config.repoMappings,
-        sandboxProfiles: local.sandboxProfiles ?? config.sandboxProfiles,
+        sandboxProfiles: normalizeSandboxProfiles(local.sandboxProfiles ?? config.sandboxProfiles, cliProviders) ?? config.sandboxProfiles,
         supportsApiSecretGrant: local.supportsApiSecretGrant ?? config.supportsApiSecretGrant,
         supportsManagedWorktrees: local.supportsManagedWorktrees ?? config.supportsManagedWorktrees,
         supportsManagedForgeArtifacts: local.supportsManagedForgeArtifacts ?? config.supportsManagedForgeArtifacts,
-        supportsRunnerAuthoredPhaseArtifacts: local.supportsRunnerAuthoredPhaseArtifacts ?? config.supportsRunnerAuthoredPhaseArtifacts
+        supportsRunnerAuthoredPhaseArtifacts: local.supportsRunnerAuthoredPhaseArtifacts ?? config.supportsRunnerAuthoredPhaseArtifacts,
+        supportsDraftRunOnce: local.supportsDraftRunOnce ?? config.supportsDraftRunOnce
     };
 }
 export async function addRepoMapping(label, repoPath) {
@@ -111,7 +112,8 @@ function normalizeLocalConfig(config) {
         supportsApiSecretGrant: config.supportsApiSecretGrant,
         supportsManagedWorktrees: config.supportsManagedWorktrees,
         supportsManagedForgeArtifacts: config.supportsManagedForgeArtifacts,
-        supportsRunnerAuthoredPhaseArtifacts: config.supportsRunnerAuthoredPhaseArtifacts
+        supportsRunnerAuthoredPhaseArtifacts: config.supportsRunnerAuthoredPhaseArtifacts,
+        supportsDraftRunOnce: config.supportsDraftRunOnce
     };
 }
 function emptyConfig() {
@@ -149,6 +151,19 @@ function splitCsv(value) {
         .map((entry) => entry.trim())
         .filter((entry) => entry.length > 0);
 }
+function normalizeSandboxProfiles(profiles, cliProviders) {
+    const normalized = cleanList(profiles);
+    if (process.platform === "win32"
+        && cliProviders.some((provider) => provider.toLowerCase() === "codex")
+        && normalized?.some((profile) => profile.toLowerCase() === "provider-workspace-write")
+        && !normalized.some((profile) => profile.toLowerCase() === "danger-full-access")) {
+        return [
+            ...normalized.filter((profile) => profile.toLowerCase() !== "provider-workspace-write"),
+            "danger-full-access"
+        ];
+    }
+    return normalized;
+}
 function normalizeRepoMappings(values) {
     return (values ?? [])
         .filter((mapping) => !!mapping.label?.trim() && !!mapping.localPath?.trim())

package/dist/config.js

@@ -2,7 +2,7 @@ import os from "node:os";
 import path from "node:path";
 export function defaultForgeBridgeConfig() {
     return {
-        defaultRepoRoot: path.join(os.tmpdir(), "forge-phase5-repos"),
+        defaultRepoRoot: path.join(os.tmpdir(), "forge-repos"),
         cleanupWorktrees: true
     };
 }