@loucompanion/forge-bridge 0.1.3-dev.09aeeb7ccadf → 0.1.3-dev.1fe428dd78ab

package/dist/session/provider-cli/provider-cli.service.js

@@ -5,7 +5,7 @@ import { buildSpecBody, selectLaneCommand } from "../../worktree/artifact-inject
 import { completionPhaseFromDispatch, prepareCompletionToolRuntime, readCompletionArtifact, usesDebugCycleCompletion, usesDevelopCycleCompletion } from "../phase-completion.js";
 import { cleanupCompletionTools, commitWorktreeChanges, completionPhaseFromArtifact, emitArchitectStructuredEvents, emitCompletionArtifactRecorded, emitDecomposeGateArtifacts, emitDraftGateArtifacts, emitPhaseCompletionEvent, emitPhaseGateEvents, emitQaArtifactRecorded, emitQaStructuredEvents, enforceQaBrowserLaunchTargetGate, LiveArchitectArtifactEmitter, LiveCompletionArtifactEmitter, LiveQaArtifactEmitter, readCompletionArtifactsForRun, readQaCompletionArtifactBundle, summarizeStderr, waitForCompletionArtifact } from "./provider-cli.artifacts.js";
 import { DeterministicProviderCliService } from "./provider-cli.deterministic.js";
-import { buildArchitectPrompt, buildConflictResolvePrompt, buildDebugCyclePrompt, buildDevelopCyclePrompt, buildDraftPrompt, buildDraftSpec, buildImplementationPrompt, buildProviderCliCommand, durableDraftInput, buildPullRequestCommentsPrompt, buildQaPrompt, formatProviderCliCommandForCheckpoint, isDecomposeDraftDispatch, isPullRequestCommentsDispatch } from "./provider-cli.prompts.js";
+import { buildArchitectPrompt, buildConflictResolvePrompt, buildDebugCyclePrompt, buildDevelopCyclePrompt, buildDraftPrompt, buildDraftSpec, buildImplementationPrompt, buildProviderCliCommand, durableDraftInput, buildPullRequestCheckRepairPrompt, buildPullRequestCommentsPrompt, buildQaPrompt, formatProviderCliCommandForCheckpoint, isDecomposeDraftDispatch, isPullRequestCheckRepairDispatch, isPullRequestCommentsDispatch } from "./provider-cli.prompts.js";
 import { StreamingProviderProcessRunner } from "./provider-cli.process.js";
 import { emitProviderUsageEvent, providerProcessEnv } from "./provider-cli.runtime.js";
 import { clip, createProviderOutputState, parseJsonLine } from "./provider-output-state.js";
@@ -70,6 +70,11 @@ export class RoutingProviderCliService {
             ? await this.deterministicProvider.runArchitect(context)
             : await this.realProvider.runArchitect(context);
     }
+    async runCiRepair(context) {
+        return isFakeWorkerModel(context.dispatch.execution.model)
+            ? await this.deterministicProvider.runCiRepair(context)
+            : await this.realProvider.runCiRepair(context);
+    }
     async runConflictResolve(context) {
         return isFakeWorkerModel(context.dispatch.execution.model)
             ? await this.deterministicProvider.runConflictResolve(context)
@@ -566,19 +571,28 @@ export class ProcessBackedProviderCliService {
             artifacts: [qaArtifact]
         };
     }
+    async runCiRepair(context) {
+        return await this.runPullRequestRepair(context, "ci_repair");
+    }
     async runConflictResolve(context) {
+        return await this.runPullRequestRepair(context, "conflict_resolve");
+    }
+    async runPullRequestRepair(context, route) {
         const { dispatch, worktree } = context;
-        const addressComments = isPullRequestCommentsDispatch(dispatch);
+        const repairChecks = route === "ci_repair" || isPullRequestCheckRepairDispatch(dispatch);
+        const addressComments = !repairChecks && isPullRequestCommentsDispatch(dispatch);
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: addressComments
-                ? buildPullRequestCommentsPrompt(dispatch, worktree.branchName)
-                : buildConflictResolvePrompt(dispatch, worktree.branchName)
+            prompt: repairChecks
+                ? buildPullRequestCheckRepairPrompt(dispatch, worktree.branchName)
+                : addressComments
+                    ? buildPullRequestCommentsPrompt(dispatch, worktree.branchName)
+                    : buildConflictResolvePrompt(dispatch, worktree.branchName)
         });
         await context.emit({
             role: "runner",
             kind: "checkpoint",
-            content: `Starting provider CLI ${addressComments ? "PR comment address" : "conflict resolve"}: ${formatProviderCliCommandForCheckpoint(command)} in ${worktree.worktreePath}`,
+            content: `Starting provider CLI ${repairChecks ? "CI repair" : addressComments ? "PR comment address" : "conflict resolve"}: ${formatProviderCliCommandForCheckpoint(command)} in ${worktree.worktreePath}`,
             eventType: "provider_cli_started"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
@@ -604,15 +618,19 @@ export class ProcessBackedProviderCliService {
         await context.emit({
             role: "assistant",
             kind: "message",
-            content: outputState.finalMessage || (addressComments
-                ? `${dispatch.execution.provider} CLI addressed pull request comments for ${worktree.branchName}.`
-                : `${dispatch.execution.provider} CLI resolved merge conflicts for ${worktree.branchName}.`),
-            eventType: addressComments ? "pr_comments_complete" : "conflict_resolve_complete"
+            content: outputState.finalMessage || (repairChecks
+                ? `${dispatch.execution.provider} CLI repaired pull request checks for ${worktree.branchName}.`
+                : addressComments
+                    ? `${dispatch.execution.provider} CLI addressed pull request comments for ${worktree.branchName}.`
+                    : `${dispatch.execution.provider} CLI resolved merge conflicts for ${worktree.branchName}.`),
+            eventType: repairChecks ? "pr_checks_complete" : addressComments ? "pr_comments_complete" : "conflict_resolve_complete"
         });
         return {
-            summary: addressComments
-                ? `${dispatch.execution.provider} CLI addressed PR comments on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
-                : `${dispatch.execution.provider} CLI resolved conflicts on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
+            summary: repairChecks
+                ? `${dispatch.execution.provider} CLI repaired PR checks on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
+                : addressComments
+                    ? `${dispatch.execution.provider} CLI addressed PR comments on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
+                    : `${dispatch.execution.provider} CLI resolved conflicts on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
         };
     }
 }

package/dist/session/session.service.js

@@ -1,10 +1,13 @@
 import { redactSecrets } from "../shared/redaction/redaction.js";
 import { RoutingProviderCliService } from "./provider-cli/provider-cli.service.js";
 import { GitWorktreeService } from "../worktree/worktree.service.js";
+import { SandboxWorkspaceService } from "../sandbox/workspace.service.js";
 export class BridgeSessionService {
     worktrees;
     providerCli;
-    constructor(worktrees = new GitWorktreeService(), providerCli = new RoutingProviderCliService()) {
+    constructor(worktrees = process.env.FORGE_SANDBOX_ID
+        ? new SandboxWorkspaceService()
+        : new GitWorktreeService(), providerCli = new RoutingProviderCliService()) {
         this.worktrees = worktrees;
         this.providerCli = providerCli;
     }
@@ -75,10 +78,12 @@ export class BridgeSessionService {
                 }, redactionSecrets);
             }
             throwIfAborted(signal);
-            const lane = dispatch.execution.lane.toLowerCase();
-            const role = dispatch.execution.role.toLowerCase();
+            const lane = dispatch.execution.lane.trim().toLowerCase();
+            const role = dispatch.execution.role.trim().toLowerCase();
+            const cycleKind = dispatch.cycleRun.kind.trim().toLowerCase();
             const isQa = role === "qa" || lane === "qa";
-            const isArchitect = role === "architect" || lane === "architect" || dispatch.cycleRun.kind.toLowerCase() === "architect";
+            const isArchitect = role === "architect" || lane === "architect" || cycleKind === "architect";
+            const isCiRepair = role === "ci_repair" || lane === "ci_repair" || cycleKind === "pr_checks";
             const isConflictResolve = role === "conflict_resolve" || lane === "conflict_resolve";
             const context = {
                 dispatch: providerDispatch,
@@ -90,9 +95,11 @@ export class BridgeSessionService {
                 ? await this.providerCli.runQa(context)
                 : isArchitect
                     ? await this.providerCli.runArchitect(context)
-                    : isConflictResolve
-                        ? await this.providerCli.runConflictResolve(context)
-                        : await this.providerCli.runImplementation(context);
+                    : isCiRepair
+                        ? await this.providerCli.runCiRepair(context)
+                        : isConflictResolve
+                            ? await this.providerCli.runConflictResolve(context)
+                            : await this.providerCli.runImplementation(context);
             throwIfAborted(signal);
             const phaseArtifacts = run.artifacts?.length ? run.artifacts : run.artifact ? [run.artifact] : [];
             return redactSecrets({

package/dist/session/session.types.d.ts

@@ -1,5 +1,5 @@
 export interface RunOnceDispatchPacket {
-    readonly schemaVersion: 1;
+    readonly schemaVersion: 1 | 2;
     readonly userId: string;
     readonly workItem: DispatchWorkItem;
     readonly repo: DispatchRepo;
@@ -8,8 +8,10 @@ export interface RunOnceDispatchPacket {
     readonly lease: DispatchLease;
     readonly execution: DispatchExecution;
     readonly serverLocal: DispatchServerLocalConfig;
+    readonly sandbox?: DispatchSandboxContext | null;
     readonly pullRequest?: DispatchPullRequestContext | null;
     readonly apiKeySecretGrant?: ApiKeySecretGrant | null;
+    readonly apiKeySecretGrantHandle?: ApiKeySecretGrantHandle | null;
     readonly artifacts: readonly DispatchResolvedArtifact[];
     readonly warmPathOverrides?: readonly string[];
     readonly qaBrowser?: DispatchQaBrowserContext | null;
@@ -22,6 +24,39 @@ export interface RunOnceDispatchPacket {
     readonly designerRefs?: DispatchDesignerRefHandoffContext | null;
     readonly draft?: DispatchDraftPrompt | null;
 }
+export interface DispatchSandboxContext {
+    readonly dispatchAttemptId: string;
+    readonly executionLeaseId: string;
+    readonly runnerInstanceId: string;
+    readonly executionMode: "host" | "docker";
+    readonly executionPolicy: "host_allowed" | "sandbox_preferred" | "sandbox_required";
+    readonly networkPolicy: DispatchSandboxNetworkPolicy;
+    readonly requestedResources: DispatchSandboxResourceRequest;
+    readonly runtime?: string | null;
+    readonly sandboxConfigCommitSha?: string | null;
+    readonly inputCommitSha?: string | null;
+    readonly contractDigest?: string | null;
+    readonly imageDigest?: string | null;
+    readonly publicationMode: "bridge_push" | "shared_filesystem";
+    readonly publishGrantHandle?: DispatchPublishGrantHandle | null;
+}
+export interface DispatchPublishGrantHandle {
+    readonly grantId: string;
+    readonly branch: string;
+    readonly expiresAt: string;
+}
+export interface DispatchSandboxResourceRequest {
+    readonly sandboxSlots: number;
+    readonly cpuMillis: number;
+    readonly memoryBytes: number;
+    readonly workspaceBytes: number;
+    readonly pids: number;
+    readonly buildSlots: number;
+}
+export interface DispatchSandboxNetworkPolicy {
+    readonly mode: "offline" | "public_allowlist" | "open_public";
+    readonly allowedHosts: readonly string[];
+}
 export interface DispatchDraftPrompt {
     readonly kind: string;
     readonly systemPrompt: string;
@@ -279,6 +314,11 @@ export interface ApiKeySecretGrant {
     readonly secret: string;
     readonly expiresAt: string;
 }
+export interface ApiKeySecretGrantHandle {
+    readonly grantId: string;
+    readonly provider: string;
+    readonly expiresAt: string;
+}
 export interface DispatchServerLocalConfig {
     readonly repoRoot: string;
     readonly cleanupWorktrees: boolean;

package/dist/session/session.types.js

@@ -2,11 +2,11 @@ import path from "node:path";
 export function parseRunOnceDispatchPacket(value) {
     const packet = asObject(value, "dispatch packet");
     const schemaVersion = requiredNumber(packet, "schemaVersion");
-    if (schemaVersion !== 1) {
+    if (schemaVersion !== 1 && schemaVersion !== 2) {
         throw new Error(`Unsupported dispatch schemaVersion: ${schemaVersion}`);
     }
     return {
-        schemaVersion: 1,
+        schemaVersion,
         userId: requiredString(packet, "userId"),
         workItem: parseWorkItem(packet.workItem),
         repo: parseRepo(packet.repo),
@@ -15,8 +15,10 @@ export function parseRunOnceDispatchPacket(value) {
         lease: parseLease(packet.lease),
         execution: parseExecution(packet.execution),
         serverLocal: parseServerLocal(packet.serverLocal),
+        sandbox: parseSandbox(packet.sandbox, schemaVersion),
         pullRequest: parsePullRequest(packet.pullRequest),
         apiKeySecretGrant: parseApiKeySecretGrant(packet.apiKeySecretGrant),
+        apiKeySecretGrantHandle: parseApiKeySecretGrantHandle(packet.apiKeySecretGrantHandle),
         artifacts: parseArtifacts(packet.artifacts),
         warmPathOverrides: parseWarmPathOverrides(packet.warmPathOverrides),
         qaBrowser: parseQaBrowser(packet.qaBrowser),
@@ -30,6 +32,104 @@ export function parseRunOnceDispatchPacket(value) {
         draft: parseDraftPrompt(packet.draft)
     };
 }
+function parseSandbox(value, schemaVersion) {
+    if (value === undefined || value === null) {
+        if (schemaVersion === 2) {
+            throw new Error("sandbox is required for dispatch schemaVersion 2.");
+        }
+        return null;
+    }
+    const sandbox = asObject(value, "sandbox");
+    const executionMode = requiredString(sandbox, "executionMode");
+    if (executionMode !== "host" && executionMode !== "docker") {
+        throw new Error("sandbox.executionMode must be host or docker.");
+    }
+    const executionPolicy = requiredString(sandbox, "executionPolicy");
+    if (executionPolicy !== "host_allowed" && executionPolicy !== "sandbox_preferred" && executionPolicy !== "sandbox_required") {
+        throw new Error("sandbox.executionPolicy is invalid.");
+    }
+    return {
+        dispatchAttemptId: requiredString(sandbox, "dispatchAttemptId"),
+        executionLeaseId: requiredString(sandbox, "executionLeaseId"),
+        runnerInstanceId: requiredString(sandbox, "runnerInstanceId"),
+        executionMode,
+        executionPolicy,
+        networkPolicy: parseSandboxNetworkPolicy(sandbox.networkPolicy),
+        requestedResources: parseSandboxResourceRequest(sandbox.requestedResources),
+        runtime: optionalString(sandbox, "runtime"),
+        sandboxConfigCommitSha: optionalString(sandbox, "sandboxConfigCommitSha"),
+        inputCommitSha: optionalString(sandbox, "inputCommitSha"),
+        contractDigest: optionalString(sandbox, "contractDigest"),
+        imageDigest: optionalString(sandbox, "imageDigest"),
+        publicationMode: parsePublicationMode(sandbox.publicationMode),
+        publishGrantHandle: parsePublishGrantHandle(sandbox.publishGrantHandle)
+    };
+}
+function parsePublicationMode(value) {
+    if (value === undefined || value === null)
+        return "shared_filesystem";
+    if (value !== "bridge_push" && value !== "shared_filesystem")
+        throw new Error("sandbox.publicationMode is invalid.");
+    return value;
+}
+function parsePublishGrantHandle(value) {
+    if (value === undefined || value === null)
+        return null;
+    const handle = asObject(value, "sandbox.publishGrantHandle");
+    const grantId = requiredString(handle, "grantId");
+    const branch = requiredString(handle, "branch");
+    const expiresAt = requiredString(handle, "expiresAt");
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(grantId)) {
+        throw new Error("sandbox.publishGrantHandle.grantId is invalid.");
+    }
+    if (branch.length > 240)
+        throw new Error("sandbox.publishGrantHandle.branch is too long.");
+    if (!Number.isFinite(Date.parse(expiresAt)))
+        throw new Error("sandbox.publishGrantHandle.expiresAt is invalid.");
+    return { grantId, branch, expiresAt };
+}
+function parseSandboxResourceRequest(value) {
+    if (value === undefined || value === null) {
+        return {
+            sandboxSlots: 1,
+            cpuMillis: 2000,
+            memoryBytes: 4 * 1024 ** 3,
+            workspaceBytes: 10 * 1024 ** 3,
+            pids: 512,
+            buildSlots: 1
+        };
+    }
+    const resources = asObject(value, "sandbox.requestedResources");
+    return {
+        sandboxSlots: boundedInteger(resources, "sandboxSlots", 1, 4),
+        cpuMillis: boundedInteger(resources, "cpuMillis", 100, 64_000),
+        memoryBytes: boundedInteger(resources, "memoryBytes", 128 * 1024 ** 2, 512 * 1024 ** 3),
+        workspaceBytes: boundedInteger(resources, "workspaceBytes", 1024 ** 3, 10 * 1024 ** 4),
+        pids: boundedInteger(resources, "pids", 32, 65_536),
+        buildSlots: boundedInteger(resources, "buildSlots", 0, 4)
+    };
+}
+function parseSandboxNetworkPolicy(value) {
+    if (value === undefined || value === null)
+        return { mode: "public_allowlist", allowedHosts: [] };
+    const policy = asObject(value, "sandbox.networkPolicy");
+    const mode = requiredString(policy, "mode");
+    if (mode !== "offline" && mode !== "public_allowlist" && mode !== "open_public") {
+        throw new Error("sandbox.networkPolicy.mode is invalid.");
+    }
+    const rawHosts = policy.allowedHosts ?? [];
+    if (!Array.isArray(rawHosts) || rawHosts.some((host) => typeof host !== "string")) {
+        throw new Error("sandbox.networkPolicy.allowedHosts must be a string array.");
+    }
+    const allowedHosts = [...new Set(rawHosts.map(host => host.trim().toLowerCase()).filter(Boolean))];
+    if (allowedHosts.length > 128 || allowedHosts.some(host => !/^(?:\*\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(host))) {
+        throw new Error("sandbox.networkPolicy.allowedHosts contains an invalid hostname.");
+    }
+    if (mode !== "public_allowlist" && allowedHosts.length > 0) {
+        throw new Error("sandbox.networkPolicy.allowedHosts requires public_allowlist mode.");
+    }
+    return { mode, allowedHosts };
+}
 export function failureResult(summary, events = []) {
     return {
         schemaVersion: 1,
@@ -172,6 +272,16 @@ function parseApiKeySecretGrant(value) {
         expiresAt: requiredString(grant, "expiresAt")
     };
 }
+function parseApiKeySecretGrantHandle(value) {
+    if (value === undefined || value === null)
+        return null;
+    const grant = asObject(value, "apiKeySecretGrantHandle");
+    return {
+        grantId: requiredString(grant, "grantId"),
+        provider: requiredString(grant, "provider"),
+        expiresAt: requiredString(grant, "expiresAt")
+    };
+}
 function parseServerLocal(value) {
     const serverLocal = asObject(value, "serverLocal");
     return {
@@ -616,3 +726,10 @@ function requiredNumber(source, key) {
     }
     return value;
 }
+function boundedInteger(source, key, minimum, maximum) {
+    const value = requiredNumber(source, key);
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+        throw new Error(`${key} must be an integer from ${minimum} through ${maximum}.`);
+    }
+    return value;
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const forgeBridgeVersion = "0.1.3-dev.09aeeb7ccadf";
+export declare const forgeBridgeVersion = "0.1.3-dev.1fe428dd78ab";

package/dist/version.js

@@ -1 +1 @@
-export const forgeBridgeVersion = "0.1.3-dev.09aeeb7ccadf";
+export const forgeBridgeVersion = "0.1.3-dev.1fe428dd78ab";

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@loucompanion/forge-bridge",
-  "version": "0.1.3-dev.09aeeb7ccadf",
+  "version": "0.1.3-dev.1fe428dd78ab",
   "description": "Forge runner bridge CLI for connecting local developer machines to Forge dispatch.",
   "license": "UNLICENSED",
   "type": "module",
   "bin": {
+    "forge": "dist/cli/bin.js",
     "forge-bridge": "dist/cli/bin.js"
   },
   "main": "./dist/index.js",
@@ -43,7 +44,8 @@
     "lint": "eslint \"src/**/*.ts\" \"scripts/**/*.mjs\" \"vitest.config.ts\""
   },
   "dependencies": {
-    "@microsoft/signalr": "^8.0.17"
+    "@microsoft/signalr": "^8.0.17",
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",