@loucompanion/forge-bridge 0.1.1-dev.f599637d804e → 0.1.3-dev.0b2f81d660c0

package/dist/bridge/bridge.service.js

@@ -1,6 +1,8 @@
-import { HubConnectionBuilder, LogLevel } from "@microsoft/signalr";
+import { HubConnectionBuilder, HttpTransportType, LogLevel } from "@microsoft/signalr";
+import fs from "node:fs";
 import path from "node:path";
 import { defaultForgeBridgeConfig } from "../config.js";
+import { supportsDraftImageAttachmentsFor } from "../shared/provider-capabilities.js";
 import { redactSecrets, redactText } from "../shared/redaction/redaction.js";
 import { BridgeSessionService } from "../session/session.service.js";
 import { failureResult, parseRunOnceDispatchPacket } from "../session/session.types.js";
@@ -48,15 +50,22 @@ export class ForgeBridgeService {
             while (!this.stopped && !signal?.aborted) {
                 try {
                     await this.connectOnce();
+                    if (attempt > 0) {
+                        logBridgeStatus("Connected to Forge. Waiting for dispatches...");
+                    }
                     attempt = 0;
                     await this.waitForClose(signal);
+                    if (!this.stopped && !signal?.aborted) {
+                        logBridgeStatus("Connection closed. Reconnecting...");
+                    }
                 }
-                catch {
+                catch (error) {
                     if (this.stopped || signal?.aborted) {
                         break;
                     }
                     const backoff = this.config.reconnectBackoffMs[Math.min(attempt, this.config.reconnectBackoffMs.length - 1)] ?? 5000;
                     attempt += 1;
+                    logBridgeStatus(`Connect attempt ${attempt} failed: ${errorMessage(error)}. Retrying in ${formatDelay(backoff)}...`);
                     await delay(backoff, signal);
                 }
             }
@@ -154,7 +163,7 @@ export class ForgeBridgeService {
         this.activeSessions.clear();
     }
     normalizeDispatch(dispatch) {
-        const mapping = findRepoMapping(dispatch, this.config.repoMappings);
+        const mapping = findRepoMapping(dispatch, repoMappingsFor(this.config));
         const localPath = mapping?.localPath?.trim();
         const repoRoot = localPath ? path.dirname(path.resolve(localPath)) : this.config.defaultRepoRoot;
         const qaLaunchTarget = normalizeQaAppLaunchTarget(mapping?.qaAppLaunchTarget) ?? dispatch.qaBrowser?.launchTarget ?? null;
@@ -222,13 +231,16 @@ export class ForgeBridgeService {
             cliProviders: this.config.cliProviders,
             providerStatuses: this.config.providerStatuses,
             projectLabels: this.config.projectLabels,
-            repoMappings: this.config.repoMappings,
+            repoMappings: repoMappingsFor(this.config),
             os: this.config.os,
             sandboxProfiles: this.config.sandboxProfiles,
             supportsApiSecretGrant: this.config.supportsApiSecretGrant,
             supportsManagedWorktrees: this.config.supportsManagedWorktrees,
             supportsManagedForgeArtifacts: this.config.supportsManagedForgeArtifacts,
-            supportsRunnerAuthoredPhaseArtifacts: this.config.supportsRunnerAuthoredPhaseArtifacts
+            supportsRunnerAuthoredPhaseArtifacts: this.config.supportsRunnerAuthoredPhaseArtifacts,
+            supportsDraftRunOnce: this.config.supportsDraftRunOnce,
+            supportsDraftAttachments: this.config.supportsDraftAttachments,
+            supportsDraftImageAttachments: this.config.supportsDraftImageAttachments
         };
     }
     async invokeAck(methodName, payload) {
@@ -284,7 +296,13 @@ export class SignalRBridgeConnection {
         url.searchParams.set("runnerId", config.runnerId);
         this.connection = new HubConnectionBuilder()
             .withUrl(url.toString(), {
-            accessTokenFactory: () => config.deviceToken
+            // Query-string access tokens are intentionally rejected by the API. The bridge is
+            // a Node CLI, so use long polling where Authorization headers are carried on each
+            // HTTP request instead of relying on browser/WebSocket token fallbacks.
+            transport: HttpTransportType.LongPolling,
+            headers: {
+                Authorization: `Bearer ${config.deviceToken}`
+            }
         })
             .configureLogging(LogLevel.Warning)
             .build();
@@ -332,6 +350,9 @@ export function defaultBridgeServiceConfig(overrides = {}) {
         supportsManagedWorktrees: true,
         supportsManagedForgeArtifacts: true,
         supportsRunnerAuthoredPhaseArtifacts: true,
+        supportsDraftRunOnce: true,
+        supportsDraftAttachments: true,
+        supportsDraftImageAttachments: supportsDraftImageAttachmentsFor(cliProviders),
         version: process.env.FORGE_BRIDGE_VERSION ?? forgeBridgeVersion,
         protocolVersion: 1,
         minServerVersion: null,
@@ -341,7 +362,9 @@ export function defaultBridgeServiceConfig(overrides = {}) {
     };
     return {
         ...config,
+        providerStatuses: overrides.providerStatuses ?? providerStatusesFor(config.cliProviders),
         sandboxProfiles: config.sandboxProfiles ?? defaultSandboxProfiles(config.cliProviders),
+        supportsDraftImageAttachments: (overrides.supportsDraftImageAttachments ?? true) && supportsDraftImageAttachmentsFor(config.cliProviders),
         heartbeatIntervalMs: positiveFiniteNumber(config.heartbeatIntervalMs, 30_000)
     };
 }
@@ -360,10 +383,13 @@ function positiveFiniteNumber(value, fallback) {
 function providerStatusesFor(providers) {
     return Object.fromEntries(providers.map((provider) => [provider, { signedIn: true, version: "", models: configuredModelsFor(provider) }]));
 }
-function defaultSandboxProfiles(providers) {
-    return providers.some((provider) => provider.toLowerCase() === "codex")
-        ? ["provider-workspace-write"]
-        : ["none"];
+function defaultSandboxProfiles(providers, platform = process.platform) {
+    if (!providers.some((provider) => provider.toLowerCase() === "codex")) {
+        return ["none"];
+    }
+    return platform === "win32"
+        ? ["danger-full-access"]
+        : ["provider-workspace-write"];
 }
 function configuredModelsFor(provider) {
     const envName = `FORGE_${provider.replace(/[^a-zA-Z0-9]/g, "_").toUpperCase()}_MODELS`;
@@ -375,6 +401,62 @@ function splitCsv(value) {
         .map((entry) => entry.trim())
         .filter((entry) => entry.length > 0);
 }
+function repoMappingsFor(config) {
+    const explicit = [...config.repoMappings];
+    const discovered = discoverRepoRootMappings(config.defaultRepoRoot);
+    if (explicit.length === 0) {
+        return discovered;
+    }
+    const explicitKeys = new Set(explicit.flatMap(mappingKeys));
+    return [
+        ...explicit,
+        ...discovered.filter((mapping) => !mappingKeys(mapping).some((key) => explicitKeys.has(key)))
+    ];
+}
+function discoverRepoRootMappings(defaultRepoRoot) {
+    const root = defaultRepoRoot.trim();
+    if (!root) {
+        return [];
+    }
+    const resolvedRoot = path.resolve(root);
+    const mappings = [];
+    if (isGitCheckout(resolvedRoot)) {
+        mappings.push({ name: path.basename(resolvedRoot), localPath: resolvedRoot });
+    }
+    let entries;
+    try {
+        entries = fs.readdirSync(resolvedRoot, { withFileTypes: true });
+    }
+    catch {
+        return mappings;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory()) {
+            continue;
+        }
+        const localPath = path.join(resolvedRoot, entry.name);
+        if (isGitCheckout(localPath)) {
+            mappings.push({ name: entry.name, localPath });
+        }
+    }
+    return mappings.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function isGitCheckout(localPath) {
+    try {
+        return fs.existsSync(path.join(localPath, ".git"));
+    }
+    catch {
+        return false;
+    }
+}
+function mappingKeys(mapping) {
+    return [
+        mapping.repoId ? `id:${mapping.repoId.toLowerCase()}` : null,
+        mapping.name ? `name:${mapping.name.trim().toLowerCase()}` : null,
+        mapping.remoteUrl ? `remote:${mapping.remoteUrl.trim().toLowerCase()}` : null,
+        mapping.localPath ? `path:${path.resolve(mapping.localPath).toLowerCase()}` : null
+    ].filter((key) => Boolean(key));
+}
 function findRepoMapping(dispatch, mappings) {
     return mappings.find((mapping) => {
         if (!mapping.localPath?.trim()) {
@@ -431,13 +513,24 @@ function invalidDispatchSummary(error) {
     const detail = error instanceof Error ? error.message : String(error);
     return `Invalid bridge dispatch packet: ${detail}`;
 }
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function formatDelay(ms) {
+    if (ms >= 1000 && ms % 1000 === 0) {
+        return `${ms / 1000}s`;
+    }
+    return `${ms}ms`;
+}
+function logBridgeStatus(message) {
+    process.stderr.write(`[${new Date().toISOString()}] ${message}\n`);
+}
 function delay(ms, signal) {
     if (signal?.aborted) {
         return Promise.resolve();
     }
     return new Promise((resolve) => {
         const timeout = setTimeout(resolve, ms);
-        timeout.unref?.();
         signal?.addEventListener("abort", () => {
             clearTimeout(timeout);
             resolve();
@@ -453,9 +546,16 @@ function abortPromise(signal) {
     }
     return new Promise((resolve) => signal.addEventListener("abort", () => resolve(), { once: true }));
 }
+const maxAttachmentExactSecretLength = 8 * 1024;
 function exactSecrets(dispatch, config) {
     return [
         dispatch.apiKeySecretGrant?.secret,
-        config.deviceToken
+        config.deviceToken,
+        ...boundedAttachmentExactSecrets(dispatch)
     ].filter((secret) => typeof secret === "string" && secret.length > 0);
 }
+function boundedAttachmentExactSecrets(dispatch) {
+    return (dispatch.draft?.attachments ?? [])
+        .flatMap((attachment) => [attachment.textContent, attachment.contentBase64])
+        .filter((secret) => typeof secret === "string" && secret.length > 0 && secret.length <= maxAttachmentExactSecretLength);
+}

package/dist/bridge/bridge.types.d.ts

@@ -16,6 +16,9 @@ export interface BridgeServiceConfig {
     readonly supportsManagedWorktrees: boolean;
     readonly supportsManagedForgeArtifacts: boolean;
     readonly supportsRunnerAuthoredPhaseArtifacts: boolean;
+    readonly supportsDraftRunOnce: boolean;
+    readonly supportsDraftAttachments: boolean;
+    readonly supportsDraftImageAttachments: boolean;
     readonly version: string;
     readonly protocolVersion: number;
     readonly minServerVersion?: string | null;
@@ -55,6 +58,9 @@ export interface BridgeCapabilities {
     readonly supportsManagedWorktrees?: boolean | null;
     readonly supportsManagedForgeArtifacts?: boolean | null;
     readonly supportsRunnerAuthoredPhaseArtifacts?: boolean | null;
+    readonly supportsDraftRunOnce?: boolean | null;
+    readonly supportsDraftAttachments?: boolean | null;
+    readonly supportsDraftImageAttachments?: boolean | null;
 }
 export interface BridgeHelloRequest {
     readonly version: string;

package/dist/cli/cli.help.d.ts

@@ -0,0 +1,2 @@
+export declare function helpText(): string;
+export declare function commandHelpText(command: string): string;

package/dist/cli/cli.help.js

@@ -0,0 +1,171 @@
+import { defaultBridgeServiceConfig } from "../bridge/bridge.service.js";
+import { forgeBridgeVersion } from "../version.js";
+export function helpText() {
+    const version = defaultBridgeServiceConfig().version ?? forgeBridgeVersion;
+    return [
+        `🛠 Forge Bridge ${version} — Local provider runners for Forge.`,
+        "",
+        "Usage: forge-bridge [options] [command]",
+        "",
+        "Options:",
+        "  -h, --help       Display help for command",
+        "  -v, --version    Output the version number",
+        "",
+        "Commands:",
+        "  Hint: commands suffixed with * have detailed help. Run <command> --help for details.",
+        "  connect *        Start the runner bridge and wait for Forge dispatches",
+        "  pair *           Pair this machine with Forge and save runner credentials",
+        "  status *         Show config, runner identity, repos, provider CLIs, and updates",
+        "  add-repo *       Map a Forge repo label/name to a local checkout path",
+        "  remove-repo *    Remove a saved repo mapping",
+        "  cleanup *        Prune managed bridge worktrees",
+        "  version *        Print the installed bridge package version",
+        "  help *           Display help for command",
+        "  run-once *       Internal: run one dispatch packet from JSON",
+        "  mcp *            Internal: run the phase-completion MCP server",
+        "",
+        "Examples:",
+        "  npm install -g @loucompanion/forge-bridge@next",
+        "  forge-bridge pair 1234-5678 --server https://srv1493013.tail66073d.ts.net:8443 --repo-root \"%USERPROFILE%\\ForgeRepos\"",
+        "  forge-bridge connect",
+        "  forge-bridge status --check-updates",
+        "  forge-bridge add-repo Forge D:\\Programming\\repos\\Forge",
+        "  forge-bridge cleanup --stale",
+        "",
+        "Troubleshooting:",
+        "  If Forge says the bridge is old: npm install -g @loucompanion/forge-bridge@next",
+        "  If connect shows 502/500: leave it open; it reconnects with backoff while dev restarts.",
+        "  If a provider is missing: run forge-bridge status --check-updates and verify CLI login.",
+        "",
+        "Docs:",
+        "  https://github.com/coleman399/Forge/tree/develop/tools/forge-bridge#readme",
+        "",
+    ].join("\n");
+}
+export function commandHelpText(command) {
+    switch (command) {
+        case "pair":
+            return [
+                "Forge Bridge — pair",
+                "Pair this machine with Forge and save runner credentials.",
+                "",
+                "Usage:",
+                "  forge-bridge pair [code] [options]",
+                "",
+                "Options:",
+                "  --server <url>              Forge server URL.",
+                "  --repo-root <path>          Folder where bridge-managed repos/worktrees live.",
+                "  --name <name>               Display name for this runner.",
+                "  --fingerprint <value>       Stable device fingerprint override.",
+                "  --cli-provider <list>       Comma-separated providers, e.g. codex,cursor.",
+                "  --cleanup-worktrees         Enable managed worktree cleanup.",
+                "  --no-cleanup-worktrees      Disable managed worktree cleanup.",
+                "",
+                "Example:",
+                "  forge-bridge pair 1234-5678 --server https://forge.example.com --repo-root \"%USERPROFILE%\\ForgeRepos\"",
+                "",
+            ].join("\n");
+        case "connect":
+            return [
+                "Forge Bridge — connect",
+                "Start the runner bridge and keep it connected for Forge dispatches.",
+                "",
+                "Usage:",
+                "  forge-bridge connect [options]",
+                "",
+                "Options:",
+                "  --server <url>              Forge server URL; saved config is used when omitted.",
+                "  --runner-id <id>            Runner id; saved config is used when omitted.",
+                "  --device-token <token>      Device token; saved config is used when omitted.",
+                "  --repo-root <path>          Override repo/worktree folder for this run.",
+                "  --cli-provider <list>       Comma-separated providers, e.g. codex,cursor.",
+                "  --heartbeat-interval-ms <n> Heartbeat interval in milliseconds.",
+                "  --cleanup-worktrees         Enable managed worktree cleanup for this run.",
+                "  --no-cleanup-worktrees      Disable managed worktree cleanup for this run.",
+                "",
+                "Example:",
+                "  forge-bridge connect",
+                "",
+            ].join("\n");
+        case "status":
+            return [
+                "Forge Bridge — status",
+                "Show saved configuration, paired runner identity, repo mappings, detected provider CLIs, and optional update info.",
+                "",
+                "Usage:",
+                "  forge-bridge status [--check-updates]",
+                "",
+                "Example:",
+                "  forge-bridge status --check-updates",
+                "",
+            ].join("\n");
+        case "add-repo":
+            return [
+                "Forge Bridge — add-repo",
+                "Map a Forge repo label/name to an existing local checkout.",
+                "",
+                "Usage:",
+                "  forge-bridge add-repo <label> <path>",
+                "",
+                "Example:",
+                "  forge-bridge add-repo Forge D:\\Programming\\repos\\Forge",
+                "",
+            ].join("\n");
+        case "remove-repo":
+            return [
+                "Forge Bridge — remove-repo",
+                "Remove a saved local repo mapping.",
+                "",
+                "Usage:",
+                "  forge-bridge remove-repo <label>",
+                "",
+            ].join("\n");
+        case "cleanup":
+            return [
+                "Forge Bridge — cleanup",
+                "Prune managed bridge worktrees under the configured repo folder.",
+                "",
+                "Usage:",
+                "  forge-bridge cleanup [--stale|--merged|--all] [--force]",
+                "",
+                "Examples:",
+                "  forge-bridge cleanup --stale",
+                "  forge-bridge cleanup --all --force",
+                "",
+            ].join("\n");
+        case "run-once":
+            return [
+                "Forge Bridge — run-once",
+                "Internal command used by Forge to run a single dispatch packet.",
+                "",
+                "Usage:",
+                "  forge-bridge run-once --dispatch <dispatch-json-path> --result <result-json-path>",
+                "",
+            ].join("\n");
+        case "mcp":
+            return [
+                "Forge Bridge — mcp",
+                "Internal MCP server used by provider CLIs to report Forge phase artifacts.",
+                "",
+                "Usage:",
+                "  forge-bridge mcp --worktree <path> --work-item-id <id> --phase <phase>",
+                "",
+            ].join("\n");
+        case "version":
+            return [
+                "Forge Bridge — version",
+                "Print the installed bridge package version.",
+                "",
+                "Usage:",
+                "  forge-bridge version",
+                "",
+            ].join("\n");
+        default:
+            return [
+                `Unknown forge-bridge command: ${command}`,
+                "",
+                "Run `forge-bridge help` to see available commands.",
+                "",
+            ].join("\n");
+    }
+}

package/dist/cli/cli.service.js

@@ -5,12 +5,16 @@ import path from "node:path";
 import { createInterface } from "node:readline/promises";
 import { promisify } from "node:util";
 import { resolveCursorAgentDirectLaunch } from "../shared/cursor-agent/cursor-agent.launch.js";
+import { buildWindowsCmdLaunch } from "../shared/process/windows-launch.js";
+import { supportsDraftImageAttachmentsFor } from "../shared/provider-capabilities.js";
 import { redactSecrets, redactText } from "../shared/redaction/redaction.js";
 import { defaultBridgeServiceConfig, ForgeBridgeService } from "../bridge/bridge.service.js";
+import { forgeBridgeVersion } from "../version.js";
 import { addRepoMapping, applyLocalConfigDefaults, providerStatusesFor, readLocalConfigSync, removeRepoMapping, resolveLocalConfigPath, writeLocalConfig } from "./local-config.js";
 import { BridgeSessionService } from "../session/session.service.js";
 import { parseCompletionMcpArgs, runCompletionMcpServer } from "../session/phase-completion.js";
 import { failureResult, parseRunOnceDispatchPacket } from "../session/session.types.js";
+import { commandHelpText, helpText } from "./cli.help.js";
 const apiKeySecretGrantEnv = "FORGE_API_KEY_SECRET_GRANT";
 const execFileAsync = promisify(execFile);
 export class ForgeBridgeCliService {
@@ -23,6 +27,22 @@ export class ForgeBridgeCliService {
         this.pairRunner = pairRunner;
     }
     async run(argv, io = { stdout: process.stdout, stderr: process.stderr }) {
+        if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
+            io.stdout.write(helpText());
+            return 0;
+        }
+        if (argv[0] === "help") {
+            io.stdout.write(argv[1] ? commandHelpText(argv[1]) : helpText());
+            return 0;
+        }
+        if (argv[1] === "--help" || argv[1] === "-h") {
+            io.stdout.write(commandHelpText(argv[0]));
+            return 0;
+        }
+        if (argv[0] === "version" || argv[0] === "--version" || argv[0] === "-v") {
+            io.stdout.write(`forge-bridge ${defaultBridgeServiceConfig().version ?? forgeBridgeVersion}\n`);
+            return 0;
+        }
         const args = parseArgs(argv);
         if (!args.ok) {
             io.stderr.write(`${args.error}\n`);
@@ -44,6 +64,7 @@ export class ForgeBridgeCliService {
             process.once("SIGINT", stop);
             process.once("SIGTERM", stop);
             try {
+                io.stdout.write(connectStartupText(config));
                 await this.bridgeFactory(config).run(controller.signal);
                 return 0;
             }
@@ -235,7 +256,7 @@ export function parseArgs(argv) {
     if (argv[0] !== "run-once") {
         return {
             ok: false,
-            error: usage()
+            error: helpText()
         };
     }
     let dispatchPath = null;
@@ -478,6 +499,9 @@ function pairedConfig(current, args, claim) {
         supportsManagedWorktrees: current.supportsManagedWorktrees ?? true,
         supportsManagedForgeArtifacts: current.supportsManagedForgeArtifacts ?? true,
         supportsRunnerAuthoredPhaseArtifacts: current.supportsRunnerAuthoredPhaseArtifacts ?? true,
+        supportsDraftRunOnce: current.supportsDraftRunOnce ?? true,
+        supportsDraftAttachments: current.supportsDraftAttachments ?? true,
+        supportsDraftImageAttachments: supportsDraftImageAttachmentsFor(args.cliProviders),
         repoMappings: current.repoMappings ?? []
     };
 }
@@ -525,8 +549,28 @@ function normalizePairingCode(code) {
 function normalizeServerUrl(serverUrl) {
     return serverUrl.endsWith("/") ? serverUrl : `${serverUrl}/`;
 }
-function usage() {
-    return "Usage: forge-bridge run-once --dispatch <dispatch-json-path> --result <result-json-path> | forge-bridge mcp --worktree <path> --work-item-id <id> --phase <phase> | forge-bridge pair [code] [--server <url>] | forge-bridge connect --server <url> --runner-id <id> --device-token <token> | forge-bridge add-repo <label> <path> | forge-bridge remove-repo <label> | forge-bridge status [--check-updates] | forge-bridge cleanup [--stale|--merged|--all|--force]";
+function connectStartupText(config) {
+    const runner = config.runnerId
+        ? `${config.runnerId}${config.deviceName ? ` (${config.deviceName})` : ""}`
+        : "not configured";
+    return [
+        `Forge Bridge ${config.version}`,
+        "Starting runner bridge...",
+        "",
+        "Startup:",
+        `  server: ${config.serverUrl || "not configured"}`,
+        `  runner: ${runner}`,
+        `  config: ${resolveLocalConfigPath()}`,
+        `  repo folder: ${config.defaultRepoRoot || "not configured"}`,
+        `  providers: ${formatList(config.cliProviders)}`,
+        `  cleanup worktrees: ${config.cleanupWorktrees ? "enabled" : "disabled"}`,
+        "",
+        "Press Ctrl+C to stop.",
+        "",
+    ].join("\n");
+}
+function formatList(values) {
+    return values.length > 0 ? values.join(", ") : "none";
 }
 async function writeJsonAtomic(outputPath, value) {
     await fs.mkdir(path.dirname(outputPath), { recursive: true });
@@ -651,17 +695,9 @@ async function execVersionCommand(probe, timeout = 2000) {
         if (process.platform !== "win32") {
             throw error;
         }
-        return await execFileAsync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", windowsCommandLine(probe)], { timeout });
-    }
-}
-function windowsCommandLine(probe) {
-    return [probe.command, ...probe.args].map(quoteWindowsCommandLineArg).join(" ");
-}
-function quoteWindowsCommandLineArg(value) {
-    if (value.length > 0 && !/[\s"]/.test(value)) {
-        return value;
+        const launch = buildWindowsCmdLaunch(probe.command, probe.args);
+        return await execFileAsync(launch.command, [...launch.args], { timeout });
     }
-    return `"${value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/g, "$1$1")}"`;
 }
 function versionLine(output) {
     const lines = output

package/dist/cli/local-config.d.ts

@@ -16,6 +16,9 @@ export interface BridgeLocalConfig {
     readonly supportsManagedWorktrees?: boolean;
     readonly supportsManagedForgeArtifacts?: boolean;
     readonly supportsRunnerAuthoredPhaseArtifacts?: boolean;
+    readonly supportsDraftRunOnce?: boolean;
+    readonly supportsDraftAttachments?: boolean;
+    readonly supportsDraftImageAttachments?: boolean;
 }
 export interface LocalRepoMapping extends BridgeRepoMapping {
     readonly label: string;

package/dist/cli/local-config.js

@@ -49,11 +49,14 @@ export function applyLocalConfigDefaults(config, local) {
         providerStatuses: normalizeProviderStatuses(local.providerStatuses) ?? providerStatusesFor(cliProviders),
         projectLabels: local.projectLabels ?? config.projectLabels,
         repoMappings: local.repoMappings ?? config.repoMappings,
-        sandboxProfiles: local.sandboxProfiles ?? config.sandboxProfiles,
+        sandboxProfiles: normalizeSandboxProfiles(local.sandboxProfiles ?? config.sandboxProfiles, cliProviders) ?? config.sandboxProfiles,
         supportsApiSecretGrant: local.supportsApiSecretGrant ?? config.supportsApiSecretGrant,
         supportsManagedWorktrees: local.supportsManagedWorktrees ?? config.supportsManagedWorktrees,
         supportsManagedForgeArtifacts: local.supportsManagedForgeArtifacts ?? config.supportsManagedForgeArtifacts,
-        supportsRunnerAuthoredPhaseArtifacts: local.supportsRunnerAuthoredPhaseArtifacts ?? config.supportsRunnerAuthoredPhaseArtifacts
+        supportsRunnerAuthoredPhaseArtifacts: local.supportsRunnerAuthoredPhaseArtifacts ?? config.supportsRunnerAuthoredPhaseArtifacts,
+        supportsDraftRunOnce: local.supportsDraftRunOnce ?? config.supportsDraftRunOnce,
+        supportsDraftAttachments: local.supportsDraftAttachments ?? config.supportsDraftAttachments,
+        supportsDraftImageAttachments: local.supportsDraftImageAttachments ?? config.supportsDraftImageAttachments
     };
 }
 export async function addRepoMapping(label, repoPath) {
@@ -111,7 +114,10 @@ function normalizeLocalConfig(config) {
         supportsApiSecretGrant: config.supportsApiSecretGrant,
         supportsManagedWorktrees: config.supportsManagedWorktrees,
         supportsManagedForgeArtifacts: config.supportsManagedForgeArtifacts,
-        supportsRunnerAuthoredPhaseArtifacts: config.supportsRunnerAuthoredPhaseArtifacts
+        supportsRunnerAuthoredPhaseArtifacts: config.supportsRunnerAuthoredPhaseArtifacts,
+        supportsDraftRunOnce: config.supportsDraftRunOnce,
+        supportsDraftAttachments: config.supportsDraftAttachments,
+        supportsDraftImageAttachments: config.supportsDraftImageAttachments
     };
 }
 function emptyConfig() {
@@ -149,6 +155,19 @@ function splitCsv(value) {
         .map((entry) => entry.trim())
         .filter((entry) => entry.length > 0);
 }
+function normalizeSandboxProfiles(profiles, cliProviders) {
+    const normalized = cleanList(profiles);
+    if (process.platform === "win32"
+        && cliProviders.some((provider) => provider.toLowerCase() === "codex")
+        && normalized?.some((profile) => profile.toLowerCase() === "provider-workspace-write")
+        && !normalized.some((profile) => profile.toLowerCase() === "danger-full-access")) {
+        return [
+            ...normalized.filter((profile) => profile.toLowerCase() !== "provider-workspace-write"),
+            "danger-full-access"
+        ];
+    }
+    return normalized;
+}
 function normalizeRepoMappings(values) {
     return (values ?? [])
         .filter((mapping) => !!mapping.label?.trim() && !!mapping.localPath?.trim())

package/dist/config.js

@@ -2,7 +2,7 @@ import os from "node:os";
 import path from "node:path";
 export function defaultForgeBridgeConfig() {
     return {
-        defaultRepoRoot: path.join(os.tmpdir(), "forge-phase5-repos"),
+        defaultRepoRoot: path.join(os.tmpdir(), "forge-repos"),
         cleanupWorktrees: true
     };
 }

package/dist/session/phase-completion.artifacts.d.ts

@@ -0,0 +1,10 @@
+import { type CompletionArtifactReference, type CompletionPhase, type CompletionToolServerConfig, type DecomposeCompletionGate, type DraftCompletionGate, type QaCompletionGate } from "./phase-completion.js";
+import type { RunnerDispatchArtifact } from "./session.types.js";
+export declare function writeDecomposeGateCompletionArtifact(config: CompletionToolServerConfig, gate: DecomposeCompletionGate, toolName: string, input: unknown): Promise<CompletionArtifactReference>;
+export declare function writeDraftGateCompletionArtifact(config: CompletionToolServerConfig, gate: DraftCompletionGate, toolName: string, input: unknown): Promise<CompletionArtifactReference>;
+export declare function writeCompletionArtifact(config: CompletionToolServerConfig, toolName: string, input: unknown): Promise<CompletionArtifactReference>;
+export declare function writeArchitectCompletionArtifact(config: CompletionToolServerConfig, payload: Record<string, unknown>, status: string, producedBy: string): Promise<CompletionArtifactReference>;
+export declare function writeQaGateCompletionArtifact(config: CompletionToolServerConfig, gate: QaCompletionGate, input: unknown): Promise<CompletionArtifactReference>;
+export declare function writeQaCompletionArtifact(config: CompletionToolServerConfig, payload: Record<string, unknown>, status: string, producedBy: string): Promise<CompletionArtifactReference>;
+export declare function readQaGateArtifact(config: CompletionToolServerConfig, gate: QaCompletionGate): Promise<Record<string, unknown>>;
+export declare function readCompletionArtifact(worktreePath: string, workItemId: string, phase: CompletionPhase, ownerType?: string | null, ownerId?: string | null): Promise<RunnerDispatchArtifact | null>;