@loucompanion/forge-bridge 0.1.3-dev.8687c5099dce → 0.1.3-dev.88e93f53db5b

package/dist/bridge/bridge.service.js

@@ -10,6 +10,8 @@ import { BridgeSessionService } from "../session/session.service.js";
 import { ProcessBackedProviderCliService, RoutingProviderCliService, StreamingProviderProcessRunner, } from "../session/provider-cli/provider-cli.service.js";
 import { redactRunnerDispatchEvent, redactRunOnceResultPacket } from "../session/session-redaction.js";
 import { HostRuntimeLeaseManager } from "../runtime/host-runtime-lease.js";
+import { buildMemoryAdmissionDiagnostics } from "../runtime/memory-capacity.js";
+import { estimateWorkspaceBytesFromRepo } from "../runtime/workspace-resource-estimator.js";
 import { GitWorktreeService } from "../worktree/worktree.service.js";
 import { RepositoryCoordinatorLock } from "../sandbox/repository-lock.js";
 import { AttemptCoordinatedProviderProcessRunner, AttemptProcessSupervisorRegistry, } from "../runtime/attempt-process-supervisor-registry.js";
@@ -20,6 +22,20 @@ import { validateSandboxContract } from "../sandbox/contract.js";
 import { runSandboxProcess } from "../sandbox/process.js";
 import { DockerSandboxRuntime, selectSandboxConfigRefs } from "../sandbox/runtime.js";
 import { codexSandboxProviderAuthAdapter, sandboxProviderAuthAdapterFor, sandboxProviderAuthUnavailableMessage } from "../sandbox/provider-auth/codex.js";
+import { formatBytes } from "../shared/format/format-bytes.js";
+/**
+ * Protocol-v2 events are acknowledged one at a time before runOnce returns.
+ * Sending the complete transcript again in DispatchResult made long QA and CI
+ * sessions exceed SignalR's receive limit, disconnecting the bridge after the
+ * provider had already completed. The API combines its acknowledged streamed
+ * events with the terminal result, so the callback only needs the outcome and
+ * artifacts. Protocol v1 retains the transcript for legacy servers.
+ */
+export function compactTerminalResult(dispatch, result) {
+    return dispatch.schemaVersion >= 2 && result.events.length > 0
+        ? { ...result, events: [] }
+        : result;
+}
 export class ForgeBridgeService {
     config;
     connections;
@@ -32,6 +48,8 @@ export class ForgeBridgeService {
     sandboxMaintenanceTimer = null;
     sandboxMaintenanceRunning = false;
     closed = null;
+    transportRecovery = null;
+    transportRecoveryGeneration = 0;
     stopped = false;
     activeSessions = new Map();
     reservations = new Map();
@@ -40,6 +58,7 @@ export class ForgeBridgeService {
     sandboxRuntime;
     sandboxResourceResolver;
     sessions;
+    sandboxAmbientMemoryCommitmentBytes = null;
     constructor(config, sessions = undefined, connections = new SignalRBridgeConnectionFactory(), preflight, sandboxRuntime, sandboxResourceResolver) {
         this.config = config;
         this.connections = connections;
@@ -82,14 +101,39 @@ export class ForgeBridgeService {
         }
         const connection = this.connections.create(this.config);
         this.connection = connection;
+        this.transportRecovery = null;
         this.closed = new Promise((resolve) => {
-            connection.onClose(() => {
+            connection.onClose((error) => {
                 this.stopHeartbeat();
+                this.completeTransportRecovery(error ?? new Error("bridge connection closed"));
                 this.abortActiveSessions("bridge connection closed");
                 this.abortActiveReadinessProbes("bridge connection closed");
                 resolve();
             });
         });
+        connection.onReconnecting?.((error) => {
+            if (connection !== this.connection || this.stopped)
+                return;
+            this.stopHeartbeat();
+            this.beginTransportRecovery();
+            logBridgeStatus(`Forge connection interrupted${error ? `: ${errorMessage(error)}` : ""}. Reconnecting in place; active dispatches remain supervised...`);
+        });
+        connection.onReconnected?.(async () => {
+            if (connection !== this.connection || this.stopped)
+                return;
+            try {
+                await this.registerConnection(connection);
+                this.completeTransportRecovery();
+                this.startHeartbeat();
+                await this.flushCleanupReports().catch(() => undefined);
+                logBridgeStatus("Forge connection restored; active dispatches remain attached to this runner process.");
+            }
+            catch (error) {
+                this.completeTransportRecovery(error);
+                logBridgeStatus(`Forge reconnect registration failed: ${errorMessage(error)}. Closing the connection for a clean retry...`);
+                await connection.stop().catch(() => undefined);
+            }
+        });
         connection.onDispatch((dispatch) => this.handleDispatch(dispatch));
         connection.onOffer?.((dispatch) => this.handleOffer(dispatch));
         connection.onStart?.((dispatch) => this.handleStart(dispatch));
@@ -98,18 +142,39 @@ export class ForgeBridgeService {
         connection.onReap?.((request) => this.handleReap(request));
         connection.onReadinessProbe?.((request) => this.handleReadinessProbe(request));
         await connection.start();
-        await this.invokeAck("Hello", {
-            version: this.config.version,
-            protocolVersion: this.config.protocolVersion,
-            minServerVersion: this.config.minServerVersion ?? null,
-            runnerInstanceId: this.config.runnerInstanceId,
-            capabilities: this.capabilities()
-        });
+        await this.registerConnection(connection);
         await this.flushCleanupReports();
         this.startHeartbeat();
         this.startLeaseWatchdog();
         this.startSandboxMaintenance();
     }
+    async registerConnection(connection) {
+        let storageRecoveryAttempt = 0;
+        while (true) {
+            try {
+                const ack = await connection.invoke("Hello", {
+                    version: this.config.version,
+                    protocolVersion: this.config.protocolVersion,
+                    minServerVersion: this.config.minServerVersion ?? null,
+                    runnerInstanceId: this.config.runnerInstanceId,
+                    capabilities: this.capabilities()
+                });
+                if (!ack.accepted) {
+                    throw new BridgeCallbackRejectedError(ack.code ?? null, ack.message ?? ack.code ?? "Hello callback was rejected.");
+                }
+                return;
+            }
+            catch (error) {
+                if (!isProviderStorageUnavailable(error) || storageRecoveryAttempt >= this.config.reconnectBackoffMs.length) {
+                    throw error;
+                }
+                const backoff = this.config.reconnectBackoffMs[storageRecoveryAttempt] ?? 5000;
+                storageRecoveryAttempt += 1;
+                logBridgeStatus(`Hello reached Forge while storage was recovering. Retrying registration ${storageRecoveryAttempt} in ${formatDelay(backoff)}...`);
+                await delay(backoff);
+            }
+        }
+    }
     async run(signal) {
         let attempt = 0;
         try {
@@ -223,7 +288,8 @@ export class ForgeBridgeService {
             if (normalized.sandbox?.executionMode === "docker") {
                 await this.flushCleanupReports().catch(() => undefined);
             }
-            await this.sendResult(dispatch, redactRunOnceResultPacket(result, redactionSecrets));
+            const redactedResult = redactRunOnceResultPacket(result, redactionSecrets);
+            await this.sendResult(dispatch, compactTerminalResult(dispatch, redactedResult));
         }
         catch (error) {
             const summary = controller.signal.aborted
@@ -254,13 +320,12 @@ export class ForgeBridgeService {
             || dispatch.lease.fencingToken !== envelope.fencingToken)
             return;
         const sandbox = dispatch.sandbox;
-        let existing = this.reservations.get(sandbox.dispatchAttemptId);
-        if (existing && Date.parse(existing.reservedUntil) <= Date.now()) {
-            this.reservations.delete(sandbox.dispatchAttemptId);
-            existing = undefined;
-        }
+        this.expireReservations(Date.now());
+        const existing = this.reservations.get(sandbox.dispatchAttemptId);
         if (existing) {
-            const sameFence = existing.fencingToken === dispatch.lease.fencingToken;
+            const sameFence = existing.leaseId === dispatch.lease.id
+                && existing.fencingToken === dispatch.lease.fencingToken
+                && existing.runnerInstanceId === sandbox.runnerInstanceId;
             await this.sendOfferDecision(dispatch, sameFence, sameFence ? null : "stale_fence", sameFence ? null : "Offer fence conflicts with the existing reservation.", sameFence ? existing.reservedUntil : null, sameFence ? existing.resources : null);
             return;
         }
@@ -287,7 +352,7 @@ export class ForgeBridgeService {
             }
             const providerNetworkFailure = sandboxProviderNetworkFailure(dispatch, this.config);
             if (providerNetworkFailure) {
-                await this.sendOfferDecision(dispatch, false, "provider_network_unavailable", providerNetworkFailure);
+                await this.sendOfferDecision(dispatch, false, "provider_network_policy_denied", providerNetworkFailure);
                 return;
             }
             const authFailure = sandboxAuthFailure(dispatch, this.config);
@@ -296,15 +361,12 @@ export class ForgeBridgeService {
                 return;
             }
         }
-        const runtimeState = this.sandboxRuntime.snapshot();
-        const usedResources = this.usedSandboxResources(runtimeState.degraded);
-        const activeResources = this.activeSandboxResources(runtimeState.degraded);
-        const capacity = this.sandboxResourceCapacity(preflight, activeResources);
         let requestedResources = sandbox.requestedResources;
         let sandboxConfigCommitSha = sandbox.sandboxConfigCommitSha ?? null;
+        const normalizedDispatch = this.normalizeDispatch(dispatch);
         if (sandbox.executionMode === "docker") {
             try {
-                const profile = await this.sandboxResourceResolver(this.normalizeDispatch(dispatch));
+                const profile = await this.sandboxResourceResolver(normalizedDispatch);
                 requestedResources = profile.resources;
                 sandboxConfigCommitSha = profile.sandboxConfigCommitSha;
             }
@@ -313,22 +375,85 @@ export class ForgeBridgeService {
                 return;
             }
         }
-        if (sandbox.executionMode === "docker"
-            && !canReserveSandboxResources(usedResources, requestedResources, capacity)) {
-            await this.sendOfferDecision(dispatch, false, "capacity_unavailable", sandboxCapacityFailureMessage(usedResources, requestedResources, capacity, preflight, this.config));
-            return;
+        else if (normalizedDispatch.repo.serverLocalPath) {
+            // Host execution uses the same project-derived disk reservation as Docker.
+            // The API supplies a placement-time estimate; the runner can safely raise it
+            // from its authoritative checkout before admitting the attempt.
+            const measuredWorkspaceBytes = await estimateWorkspaceBytesFromRepo(normalizedDispatch.repo.serverLocalPath, { role: normalizedDispatch.execution.role }).catch(() => null);
+            if (measuredWorkspaceBytes !== null) {
+                requestedResources = {
+                    ...requestedResources,
+                    workspaceBytes: Math.max(requestedResources.workspaceBytes, measuredWorkspaceBytes),
+                };
+            }
+        }
+        // Resource profiling can await filesystem and Docker work. Admission needs
+        // a dynamic host/daemon sample that began after profiling completed, so an
+        // older in-flight heartbeat inspection cannot supply the commit decision.
+        const admissionPreflight = sandbox.executionMode === "docker"
+            ? await this.preflight.refreshCapacityForAdmission()
+            : preflight;
+        // Resource profiling and preflight may await slow filesystem or Docker I/O.
+        // Re-read every mutable capacity input only after that work, then decide and
+        // commit synchronously. JavaScript cannot interleave another Offer handler
+        // inside this non-async method, so the ledger check and insertion are one
+        // atomic event-loop turn without holding a lock across external I/O.
+        const decision = this.commitOfferReservation(dispatch, requestedResources, admissionPreflight);
+        await this.sendOfferDecision(dispatch, decision.accepted, decision.code, decision.message, decision.reservedUntil, decision.resources, sandboxConfigCommitSha);
+    }
+    commitOfferReservation(dispatch, requestedResources, preparedPreflight) {
+        const sandbox = dispatch.sandbox;
+        const now = Date.now();
+        this.expireReservations(now);
+        const existing = this.reservations.get(sandbox.dispatchAttemptId);
+        if (existing) {
+            const sameFence = existing.leaseId === dispatch.lease.id
+                && existing.fencingToken === dispatch.lease.fencingToken
+                && existing.runnerInstanceId === sandbox.runnerInstanceId;
+            return {
+                accepted: sameFence,
+                code: sameFence ? null : "stale_fence",
+                message: sameFence ? null : "Offer fence conflicts with the existing reservation.",
+                reservedUntil: sameFence ? existing.reservedUntil : null,
+                resources: sameFence ? existing.resources : null,
+            };
         }
-        const reservedUntil = new Date(Math.min(Date.parse(dispatch.lease.expiresAt), Date.now() + 30_000)).toISOString();
-        this.reservations.set(sandbox.dispatchAttemptId, {
+        if (Date.parse(dispatch.lease.expiresAt) <= now) {
+            return rejectedOfferReservation("lease_expired", "Offer lease is already expired.");
+        }
+        if (sandbox.executionMode === "docker") {
+            // A concurrent heartbeat/preflight refresh may have produced a newer
+            // conservative dual-domain sample while this offer was being profiled.
+            const admissionPreflight = this.preflight.current() ?? preparedPreflight;
+            if (!this.config.dockerEnabled || !admissionPreflight?.healthy) {
+                return rejectedOfferReservation(admissionPreflight?.unavailableCode ?? "docker_unavailable", admissionPreflight?.unavailableReason ?? "Docker sandbox preflight is unavailable.");
+            }
+            const runtimeState = this.sandboxRuntime.snapshot();
+            const usedResources = this.usedSandboxResources(runtimeState.degraded);
+            const activeResources = this.activeSandboxResources(runtimeState.degraded);
+            const capacity = this.sandboxResourceCapacity(admissionPreflight, activeResources, usedResources);
+            if (!canReserveSandboxResources(usedResources, requestedResources, capacity)) {
+                return rejectedOfferReservation("capacity_unavailable", sandboxCapacityFailureMessage(usedResources, requestedResources, capacity, admissionPreflight, this.config));
+            }
+        }
+        const reservedUntil = new Date(Math.min(Date.parse(dispatch.lease.expiresAt), now + 30_000)).toISOString();
+        const reservation = {
             leaseId: dispatch.lease.id,
             fencingToken: dispatch.lease.fencingToken,
             runnerInstanceId: sandbox.runnerInstanceId,
             expiresAt: dispatch.lease.expiresAt,
             reservedUntil,
             sandboxed: sandbox.executionMode === "docker",
-            resources: requestedResources
-        });
-        await this.sendOfferDecision(dispatch, true, null, null, reservedUntil, requestedResources, sandboxConfigCommitSha);
+            resources: requestedResources,
+        };
+        this.reservations.set(sandbox.dispatchAttemptId, reservation);
+        return {
+            accepted: true,
+            code: null,
+            message: null,
+            reservedUntil,
+            resources: requestedResources,
+        };
     }
     async handleStart(rawDispatch) {
         const envelope = parseStartEnvelope(rawDispatch);
@@ -637,17 +762,20 @@ export class ForgeBridgeService {
     }
     expireLeases() {
         const now = Date.now();
-        for (const [attemptId, reservation] of this.reservations) {
-            if (Date.parse(reservation.expiresAt) <= now || Date.parse(reservation.reservedUntil) <= now) {
-                this.reservations.delete(attemptId);
-            }
-        }
+        this.expireReservations(now);
         for (const active of this.activeSessions.values()) {
             if (Date.parse(active.leaseExpiresAt) <= now && !active.controller.signal.aborted) {
                 active.controller.abort("dispatch lease expired");
             }
         }
     }
+    expireReservations(now) {
+        for (const [attemptId, reservation] of this.reservations) {
+            if (Date.parse(reservation.expiresAt) <= now || Date.parse(reservation.reservedUntil) <= now) {
+                this.reservations.delete(attemptId);
+            }
+        }
+    }
     stopHeartbeat() {
         if (this.heartbeatTimer) {
             clearInterval(this.heartbeatTimer);
@@ -716,6 +844,11 @@ export class ForgeBridgeService {
         }
     }
     async sendHeartbeat() {
+        // Heartbeats are the recovery path for capacity-blocked work. Refresh the
+        // dynamic sample before advertising it, while reusing the static Docker
+        // capability snapshot established at startup or by an offer.
+        if (this.config.dockerEnabled)
+            await this.preflight.refreshCapacity();
         await this.invokeAck("Heartbeat", {
             status: "online",
             capabilities: this.capabilities(),
@@ -729,7 +862,18 @@ export class ForgeBridgeService {
         const reserved = [...this.reservations.values()].filter(reservation => reservation.sandboxed).length;
         const used = this.usedSandboxResources(runtimeState.degraded);
         const activeResources = this.activeSandboxResources(runtimeState.degraded);
-        const capacity = this.sandboxResourceCapacity(preflight, activeResources);
+        const capacity = this.sandboxResourceCapacity(preflight, activeResources, used);
+        const ambientMemoryCommitmentBytes = this.sandboxAmbientMemoryCommitmentBytes ?? 0;
+        const memoryAdmission = preflight ? buildMemoryAdmissionDiagnostics({
+            sampledAt: preflight.sampledAt,
+            totalMemoryBytes: preflight.totalMemoryBytes,
+            rawAvailableMemoryBytes: preflight.rawAvailableMemoryBytes,
+            stabilizedAvailableMemoryBytes: preflight.availableMemoryBytes,
+            controlPlaneMemoryBytes: process.memoryUsage().rss,
+            reserveMemoryBytes: preflight.hostReserveBytes,
+            committedMemoryBytes: ambientMemoryCommitmentBytes + used.memoryBytes,
+            pendingCommitmentMemoryBytes: Math.max(0, used.memoryBytes - activeResources.memoryBytes),
+        }) : null;
         return {
             schemaVersion: 3,
             activeSessionCount: this.activeSessions.size,
@@ -752,7 +896,7 @@ export class ForgeBridgeService {
             allowsOpenPublicSandbox: this.config.allowOpenPublicSandbox,
             sandboxPublicationModes: [this.config.sandboxPublicationMode ?? "shared_filesystem"],
             sandboxAuthModes: sandboxAuthModesFor(this.config),
-            availableMemoryBytes: preflight ? Math.max(0, capacity.memoryBytes - used.memoryBytes) : null,
+            availableMemoryBytes: memoryAdmission?.availableForAdmissionBytes ?? null,
             availableCpuMillis: preflight ? Math.max(0, capacity.cpuMillis - used.cpuMillis) : null,
             availableWorkspaceBytes: preflight ? Math.max(0, capacity.workspaceBytes - used.workspaceBytes) : null,
             diskLow: preflight?.diskLow ?? null,
@@ -766,8 +910,11 @@ export class ForgeBridgeService {
                 hostReserveBytes: preflight.hostReserveBytes,
                 activeReservationBytes: used.memoryBytes,
                 daemonTotalBytes: preflight.totalMemoryBytes,
-                daemonAvailableBytes: preflight.availableMemoryBytes,
-                availableForAdmissionBytes: Math.max(0, capacity.memoryBytes - used.memoryBytes),
+                daemonAvailableBytes: preflight.rawDaemonAvailableMemoryBytes ?? 0,
+                hostAvailableBytes: preflight.rawHostAvailableMemoryBytes,
+                conservativeAvailableBytes: preflight.rawAvailableMemoryBytes,
+                availableForAdmissionBytes: memoryAdmission.availableForAdmissionBytes,
+                memoryAdmission: memoryAdmission,
             } : null,
             hostRuntime: this.sessions.runtimeCapacity?.() ?? null,
             supportsApiSecretGrant: this.config.supportsApiSecretGrant,
@@ -799,9 +946,15 @@ export class ForgeBridgeService {
             ...Array.from({ length: degradedReservations }, () => defaultSandboxResources())
         ]);
     }
-    sandboxResourceCapacity(preflight, activeResources) {
+    sandboxResourceCapacity(preflight, activeResources, usedResources) {
         if (!preflight)
             return zeroSandboxResources();
+        if (usedResources.memoryBytes === 0 || this.sandboxAmbientMemoryCommitmentBytes === null) {
+            // Freeze non-Forge daemon use while reservations exist. If the bridge
+            // reconnects with managed containers already present, the initial value
+            // is deliberately conservative until their ledger drains.
+            this.sandboxAmbientMemoryCommitmentBytes = Math.max(0, preflight.totalMemoryBytes - preflight.rawAvailableMemoryBytes);
+        }
         return {
             // Host free memory and disk already reflect active containers. Add their
             // commitments back to form a stable total capacity, then subtract them
@@ -811,9 +964,7 @@ export class ForgeBridgeService {
             workerMemoryLimitBytes: 0,
             serviceMemoryLimitBytes: 0,
             runtimeOverheadBytes: 0,
-            memoryBytes: Math.max(0, preflight.availableMemoryBytes
-                - (this.config.sandboxHostMemoryReserveBytes ?? 2 * 1024 ** 3)
-                + activeResources.memoryBytes),
+            memoryBytes: sandboxMemoryCommitmentCapacity(preflight, activeResources.memoryBytes, this.sandboxAmbientMemoryCommitmentBytes),
             workspaceBytes: Math.max(0, preflight.availableWorkspaceBytes
                 - this.config.minimumWorkspaceBytes
                 + activeResources.workspaceBytes),
@@ -822,21 +973,81 @@ export class ForgeBridgeService {
         };
     }
     async invokeAck(methodName, payload) {
-        const connection = this.connection;
-        if (!connection) {
-            throw new Error("Bridge is not connected.");
+        let storageRecoveryAttempt = 0;
+        while (true) {
+            const connection = this.connection;
+            if (!connection) {
+                throw new Error("Bridge is not connected.");
+            }
+            await this.waitForTransportRecovery(connection, this.transportRecovery);
+            const recoveryGeneration = this.transportRecoveryGeneration;
+            try {
+                const ack = await connection.invoke(methodName, payload);
+                if (!ack.accepted) {
+                    throw new BridgeCallbackRejectedError(ack.code ?? null, ack.message ?? ack.code ?? `${methodName} callback was rejected.`);
+                }
+                return ack;
+            }
+            catch (error) {
+                if (connection !== this.connection || this.stopped)
+                    throw error;
+                const recovery = this.transportRecovery;
+                if (recovery && recovery.generation > recoveryGeneration) {
+                    await this.waitForTransportRecovery(connection, recovery);
+                    continue;
+                }
+                if (isProviderStorageUnavailable(error) && storageRecoveryAttempt < this.config.reconnectBackoffMs.length) {
+                    const backoff = this.config.reconnectBackoffMs[storageRecoveryAttempt] ?? 5000;
+                    storageRecoveryAttempt += 1;
+                    logBridgeStatus(`${methodName} reached Forge while storage was recovering. Retrying callback ${storageRecoveryAttempt} in ${formatDelay(backoff)}...`);
+                    await delay(backoff);
+                    continue;
+                }
+                throw error;
+            }
         }
-        const ack = await connection.invoke(methodName, payload);
-        if (!ack.accepted) {
-            throw new BridgeCallbackRejectedError(ack.code ?? null, ack.message ?? ack.code ?? `${methodName} callback was rejected.`);
+    }
+    beginTransportRecovery() {
+        if (this.transportRecovery && !this.transportRecovery.completed)
+            return;
+        let resolve = () => undefined;
+        const promise = new Promise((complete) => { resolve = complete; });
+        this.transportRecoveryGeneration += 1;
+        this.transportRecovery = {
+            generation: this.transportRecoveryGeneration,
+            promise,
+            resolve,
+            completed: false,
+            error: null,
+        };
+    }
+    completeTransportRecovery(error = null) {
+        const recovery = this.transportRecovery;
+        if (!recovery || recovery.completed)
+            return;
+        recovery.completed = true;
+        recovery.error = error;
+        recovery.resolve();
+    }
+    async waitForTransportRecovery(connection, recovery) {
+        if (!recovery)
+            return;
+        if (recovery.completed) {
+            if (recovery.error)
+                throw recovery.error;
+            return;
         }
-        return ack;
+        await recovery.promise;
+        if (connection !== this.connection)
+            throw new Error("Bridge connection changed while recovering.");
+        if (recovery.error)
+            throw recovery.error;
     }
     async waitForClose(signal) {
         if (!this.closed) {
             return;
         }
-        await Promise.race([this.closed, abortPromise(signal)]);
+        await waitForPromiseOrAbort(this.closed, signal);
     }
     async stopConnection() {
         this.stopHeartbeat();
@@ -862,6 +1073,11 @@ function isDispatchNoLongerPending(error) {
     }
     return error instanceof Error && error.message === "Dispatch is no longer pending.";
 }
+function isProviderStorageUnavailable(error) {
+    const message = errorMessage(error).toLowerCase();
+    return message.includes("provider_storage_unavailable")
+        || (message.includes("storage is recovering") && message.includes("503"));
+}
 function createDefaultSessionService(sandboxStateRoot) {
     const rawProcessRunner = new StreamingProviderProcessRunner();
     const processSupervisors = new AttemptProcessSupervisorRegistry();
@@ -890,10 +1106,11 @@ export class SignalRBridgeConnection {
                 Authorization: `Bearer ${config.deviceToken}`
             }
         })
+            .withAutomaticReconnect([...config.reconnectBackoffMs])
             .configureLogging(LogLevel.Warning)
             .build();
         this.connection.on("Superseded", () => {
-            void this.connection.stop();
+            void this.connection.stop().catch(() => undefined);
         });
     }
     start() {
@@ -905,6 +1122,14 @@ export class SignalRBridgeConnection {
     onClose(handler) {
         this.connection.onclose(handler);
     }
+    onReconnecting(handler) {
+        this.connection.onreconnecting(handler);
+    }
+    onReconnected(handler) {
+        this.connection.onreconnected((connectionId) => {
+            void Promise.resolve(handler(connectionId)).catch(() => undefined);
+        });
+    }
     onDispatch(handler) {
         this.connection.on("Dispatch", (raw) => {
             void handler(raw).catch(() => undefined);
@@ -947,9 +1172,7 @@ export class SignalRBridgeConnection {
 export function defaultBridgeServiceConfig(overrides = {}) {
     const defaults = defaultForgeBridgeConfig();
     const cliProviders = splitCsv(process.env.FORGE_CLI_PROVIDERS ?? "codex");
-    const sandboxHostMemoryReserveDefault = process.platform === "linux"
-        ? 2 * 1024 ** 3
-        : 1024 ** 3;
+    const configuredSandboxHostMemoryReserveBytes = optionalPositiveFiniteNumber(process.env.FORGE_SANDBOX_HOST_MEMORY_RESERVE_BYTES);
     const sandboxPublicationMode = process.env.FORGE_SANDBOX_PUBLICATION_MODE === "bridge_push" ? "bridge_push" : "shared_filesystem";
     const config = {
         serverUrl: process.env.FORGE_URL ?? "http://localhost:5208",
@@ -969,7 +1192,9 @@ export function defaultBridgeServiceConfig(overrides = {}) {
         diskHighWatermarkPercent: positiveFiniteNumber(Number(process.env.FORGE_DISK_HIGH_WATERMARK_PERCENT ?? 85), 85),
         diskLowWatermarkPercent: positiveFiniteNumber(Number(process.env.FORGE_DISK_LOW_WATERMARK_PERCENT ?? 75), 75),
         minimumWorkspaceBytes: positiveFiniteNumber(Number(process.env.FORGE_MINIMUM_WORKSPACE_BYTES ?? 10 * 1024 ** 3), 10 * 1024 ** 3),
-        sandboxHostMemoryReserveBytes: positiveFiniteNumber(Number(process.env.FORGE_SANDBOX_HOST_MEMORY_RESERVE_BYTES ?? sandboxHostMemoryReserveDefault), sandboxHostMemoryReserveDefault),
+        // Undefined means preflight derives the bounded reserve from the actual
+        // Docker/host capacity domain after sampling it.
+        sandboxHostMemoryReserveBytes: configuredSandboxHostMemoryReserveBytes,
         defaultSandboxWorkerMemoryLimitBytes: positiveFiniteNumber(Number(process.env.FORGE_SANDBOX_DEFAULT_WORKER_MEMORY_LIMIT_BYTES ?? 2 * 1024 ** 3), 2 * 1024 ** 3),
         defaultSandboxServiceMemoryLimitBytes: nonNegativeFiniteNumber(Number(process.env.FORGE_SANDBOX_DEFAULT_SERVICE_MEMORY_LIMIT_BYTES ?? 0), 0),
         sandboxRuntimeOverheadBytes: Math.max(128 * 1024 ** 2, nonNegativeFiniteNumber(Number(process.env.FORGE_SANDBOX_RUNTIME_OVERHEAD_BYTES ?? 128 * 1024 ** 2), 128 * 1024 ** 2)),
@@ -1022,6 +1247,12 @@ function normalizeServerUrl(serverUrl) {
 function positiveFiniteNumber(value, fallback) {
     return Number.isFinite(value) && value > 0 ? value : fallback;
 }
+function optionalPositiveFiniteNumber(value) {
+    if (value === undefined || value.trim().length === 0)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
 function nonNegativeFiniteNumber(value, fallback) {
     return Number.isFinite(value) && value >= 0 ? value : fallback;
 }
@@ -1195,26 +1426,39 @@ function formatDelay(ms) {
 function logBridgeStatus(message) {
     process.stderr.write(`[${new Date().toISOString()}] ${message}\n`);
 }
-function delay(ms, signal) {
+export function delay(ms, signal) {
     if (signal?.aborted) {
         return Promise.resolve();
     }
     return new Promise((resolve) => {
-        const timeout = setTimeout(resolve, ms);
-        signal?.addEventListener("abort", () => {
+        const complete = () => {
             clearTimeout(timeout);
+            signal?.removeEventListener("abort", complete);
             resolve();
-        }, { once: true });
+        };
+        const timeout = setTimeout(complete, ms);
+        signal?.addEventListener("abort", complete, { once: true });
+        if (signal?.aborted)
+            complete();
     });
 }
-function abortPromise(signal) {
+export async function waitForPromiseOrAbort(promise, signal) {
     if (!signal) {
-        return new Promise(() => undefined);
+        await promise;
+        return;
     }
     if (signal.aborted) {
-        return Promise.resolve();
+        return;
+    }
+    let resolveAbort;
+    const abort = new Promise(resolve => { resolveAbort = resolve; });
+    signal.addEventListener("abort", resolveAbort, { once: true });
+    try {
+        await Promise.race([promise, abort]);
+    }
+    finally {
+        signal.removeEventListener("abort", resolveAbort);
     }
-    return new Promise((resolve) => signal.addEventListener("abort", () => resolve(), { once: true }));
 }
 export function canReapManagedSandboxes(preflight) {
     return canRunDockerMaintenance(preflight);
@@ -1234,9 +1478,14 @@ function sandboxNetworkPolicyFailure(dispatch, config) {
     }
     return null;
 }
-function infrastructureFailureEventType(summary) {
+export function infrastructureFailureEventType(summary) {
+    const sandboxFailure = /^(sandbox_[a-z0-9_.-]+|image_[a-z0-9_.-]+|contract_[a-z0-9_.-]+|teardown_[a-z0-9_.-]+):/u.exec(summary)?.[1];
+    if (sandboxFailure)
+        return sandboxFailure;
     if (summary.startsWith("worktree_prepare_failed:"))
         return "worktree_prepare_failed";
+    if (summary.startsWith("provider_network_unavailable:"))
+        return "provider_network_unavailable";
     if (summary.startsWith("provider_start_unavailable:"))
         return "provider_start_unavailable";
     if (summary.startsWith("host_port_collision:"))
@@ -1308,6 +1557,15 @@ function sandboxAuthFailure(dispatch, config) {
     const doctor = adapter.doctor();
     return doctor.available ? null : doctor.message;
 }
+function rejectedOfferReservation(code, message) {
+    return {
+        accepted: false,
+        code,
+        message,
+        reservedUntil: null,
+        resources: null,
+    };
+}
 export function canReserveSandboxResources(used, requested, capacity) {
     return used.sandboxSlots + requested.sandboxSlots <= capacity.sandboxSlots
         && used.cpuMillis + requested.cpuMillis <= capacity.cpuMillis
@@ -1316,6 +1574,15 @@ export function canReserveSandboxResources(used, requested, capacity) {
         && used.pids + requested.pids <= capacity.pids
         && used.buildSlots + requested.buildSlots <= capacity.buildSlots;
 }
+export function sandboxMemoryCommitmentCapacity(preflight, activeMemoryBytes, ambientMemoryCommitmentBytes = 0) {
+    const ambientCapacity = preflight.availableMemoryBytes
+        - preflight.hostReserveBytes
+        + activeMemoryBytes;
+    const commitmentCapacity = preflight.totalMemoryBytes
+        - preflight.hostReserveBytes
+        - Math.max(0, ambientMemoryCommitmentBytes);
+    return Math.max(0, Math.min(ambientCapacity, commitmentCapacity));
+}
 export function sandboxCapacityFailureMessage(used, requested, capacity, preflight, config) {
     const availableSlots = Math.max(0, capacity.sandboxSlots - used.sandboxSlots);
     if (requested.sandboxSlots > availableSlots) {
@@ -1346,14 +1613,6 @@ export function sandboxCapacityFailureMessage(used, requested, capacity, preflig
     const availableBuildSlots = Math.max(0, capacity.buildSlots - used.buildSlots);
     return `Sandbox build capacity is insufficient: requested ${requested.buildSlots}, available ${availableBuildSlots}, ${used.buildSlots} already reserved.`;
 }
-function formatBytes(bytes) {
-    if (!Number.isFinite(bytes) || bytes <= 0)
-        return "0 B";
-    const units = ["B", "KiB", "MiB", "GiB", "TiB"];
-    const power = Math.min(units.length - 1, Math.floor(Math.log(bytes) / Math.log(1024)));
-    const value = bytes / 1024 ** power;
-    return `${value >= 10 || power === 0 ? value.toFixed(0) : value.toFixed(2)} ${units[power]}`;
-}
 function sumSandboxResources(resources) {
     return resources.reduce((total, resource) => ({
         sandboxSlots: total.sandboxSlots + resource.sandboxSlots,
@@ -1425,8 +1684,16 @@ export async function resolveSandboxResourcesFromRepo(dispatch, baseRuntimeOverh
         throw new Error("The approved immutable sandbox contract is unavailable in the mapped repository.");
     }
     const contract = validateSandboxContract(contractResult.stdout);
+    const workspaceBytes = await estimateWorkspaceBytesFromRepo(repoPath, {
+        role: dispatch.execution.role,
+        serviceCount: contract.contract.services.length,
+        browser: contract.contract.browser,
+    });
     return {
-        resources: resolveDynamicSandboxResources(sandbox.requestedResources, contract.contract.services.length, sandbox.networkPolicy.mode, baseRuntimeOverheadBytes),
+        resources: resolveDynamicSandboxResources({
+            ...sandbox.requestedResources,
+            workspaceBytes: Math.max(sandbox.requestedResources.workspaceBytes, workspaceBytes),
+        }, contract.contract.services.length, sandbox.networkPolicy.mode, baseRuntimeOverheadBytes),
         sandboxConfigCommitSha: configCommitSha,
     };
 }