@loucompanion/forge-bridge 0.1.3-dev.b3bce6ba65a6 → 0.1.3-dev.ba7d36726eda

package/dist/sandbox/worker.js

@@ -0,0 +1,225 @@
+import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { MonotonicLeaseDeadline } from "./lease-watchdog.js";
+import { terminationMessage, WorkerDeadlineSupervisor } from "./worker-supervisor.js";
+const controlRoot = "/control";
+const runtimeRoot = "/run/forge";
+const workspace = process.env.FORGE_WORKSPACE ?? "/workspace";
+async function main() {
+    const dispatchText = await readBoundedStdin(16 * 1024 * 1024);
+    const bootstrap = JSON.parse(dispatchText);
+    if (bootstrap.schemaVersion !== 1 || !bootstrap.dispatch || typeof bootstrap.leaseControlKey !== "string") {
+        throw new Error("Invalid sandbox bootstrap packet.");
+    }
+    const dispatch = bootstrap.dispatch;
+    const sandbox = dispatch.sandbox;
+    const attemptId = requiredId(sandbox?.dispatchAttemptId, "dispatchAttemptId");
+    const lease = dispatch.lease;
+    const fencingToken = requiredId(lease?.fencingToken, "fencingToken");
+    const leaseDeadline = new MonotonicLeaseDeadline(attemptId, fencingToken, requiredString(lease?.expiresAt, "expiresAt"), bootstrap.leaseControlKey);
+    const limits = requiredLimits(bootstrap.limits);
+    await installServiceEnvironment(attemptId);
+    await fs.mkdir(runtimeRoot, { recursive: true, mode: 0o700 });
+    await fs.mkdir(path.join(controlRoot, "output"), { recursive: true, mode: 0o700 });
+    const dispatchPath = path.join(runtimeRoot, "dispatch.json");
+    const resultPath = path.join(controlRoot, "output", "result.json");
+    await fs.writeFile(dispatchPath, JSON.stringify(dispatch), { mode: 0o600 });
+    const entrypoint = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../cli/bin.js");
+    const runOutcome = await run(process.execPath, [entrypoint, "run-once", "--dispatch", dispatchPath, "--result", resultPath], {
+        deadline: leaseDeadline,
+        updatePath: path.join(runtimeRoot, "lease-update.json"),
+        supervisor: new WorkerDeadlineSupervisor(leaseDeadline, limits.hardWallMs, limits.idleMs)
+    });
+    await fs.rm(dispatchPath, { force: true });
+    if (runOutcome.terminationCode) {
+        await writeTerminationResult(resultPath, runOutcome.terminationCode);
+    }
+    let resultCommitSha = null;
+    let bundleSha256 = null;
+    let bundleBytes = 0;
+    const bundlePath = path.join(controlRoot, "output", "result.bundle");
+    if (!runOutcome.terminationCode && runOutcome.exitCode === 0 && await exists(path.join(workspace, ".git"))) {
+        resultCommitSha = (await capture("git", ["-C", workspace, "rev-parse", "HEAD"])).trim();
+        const resultRef = `refs/forge/results/${attemptId.replace(/-/g, "")}`;
+        await runRequired("git", ["-C", workspace, "update-ref", resultRef, resultCommitSha]);
+        try {
+            await runRequired("git", ["-C", workspace, "bundle", "create", bundlePath, resultRef]);
+        }
+        finally {
+            await run("git", ["-C", workspace, "update-ref", "-d", resultRef]);
+        }
+        const bundle = await fs.readFile(bundlePath);
+        bundleBytes = bundle.length;
+        bundleSha256 = createHash("sha256").update(bundle).digest("hex");
+    }
+    const resultBytes = await fs.readFile(resultPath);
+    const manifest = {
+        schemaVersion: 1,
+        dispatchAttemptId: attemptId,
+        executionLeaseId: sandbox?.executionLeaseId,
+        fencingToken: dispatch.lease?.fencingToken,
+        runnerInstanceId: sandbox?.runnerInstanceId,
+        inputCommitSha: sandbox?.inputCommitSha,
+        resultCommitSha,
+        branch: dispatch.lease?.worktreeKey,
+        contractDigest: sandbox?.contractDigest,
+        imageDigest: sandbox?.imageDigest,
+        result: { path: "result.json", bytes: resultBytes.length, sha256: createHash("sha256").update(resultBytes).digest("hex") },
+        bundle: bundleSha256 ? { path: "result.bundle", bytes: bundleBytes, sha256: bundleSha256 } : null,
+        workerExitCode: runOutcome.exitCode,
+        workerExitClassification: runOutcome.terminationCode ?? "agent_exit"
+    };
+    const temporary = path.join(controlRoot, "output", "manifest.json.tmp");
+    await fs.writeFile(temporary, `${JSON.stringify(manifest)}\n`, { mode: 0o600 });
+    await fs.rename(temporary, path.join(controlRoot, "output", "manifest.json"));
+    return runOutcome.exitCode;
+}
+async function readBoundedStdin(limit) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of process.stdin) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.length;
+        if (total > limit)
+            throw new Error("Dispatch bootstrap exceeds 16 MiB.");
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+async function run(command, args, watchdog) {
+    return await new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"], shell: false });
+        let readingUpdate = false;
+        let killTimer = null;
+        let terminationCode = null;
+        const terminate = (code) => {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return;
+            terminationCode ??= code;
+            emitTerminationEvent(terminationCode);
+            child.kill("SIGTERM");
+            killTimer = setTimeout(() => child.kill("SIGKILL"), 10_000);
+            killTimer.unref?.();
+        };
+        child.stdout.on("data", chunk => {
+            watchdog?.supervisor.touch();
+            process.stdout.write(chunk);
+        });
+        child.stderr.on("data", chunk => {
+            watchdog?.supervisor.touch();
+            process.stderr.write(chunk);
+        });
+        const monitor = watchdog ? setInterval(() => {
+            const reason = watchdog.supervisor.termination();
+            if (reason) {
+                terminate(reason);
+                return;
+            }
+            if (readingUpdate)
+                return;
+            readingUpdate = true;
+            fs.readFile(watchdog.updatePath, "utf8")
+                .then(value => {
+                return watchdog.deadline.apply(JSON.parse(value));
+            })
+                .catch(() => false)
+                .finally(() => { readingUpdate = false; });
+        }, 250) : null;
+        monitor?.unref?.();
+        child.on("error", error => {
+            if (monitor)
+                clearInterval(monitor);
+            if (killTimer)
+                clearTimeout(killTimer);
+            reject(error);
+        });
+        child.on("close", code => {
+            if (monitor)
+                clearInterval(monitor);
+            if (killTimer)
+                clearTimeout(killTimer);
+            resolve({ exitCode: terminationCode ? 124 : code ?? 1, terminationCode });
+        });
+    });
+}
+async function runRequired(command, args) {
+    const outcome = await run(command, args);
+    if (outcome.exitCode !== 0)
+        throw new Error(`${command} failed with exit ${outcome.exitCode}.`);
+}
+async function capture(command, args) {
+    return await new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: ["ignore", "pipe", "inherit"], shell: false });
+        const chunks = [];
+        child.stdout.on("data", chunk => chunks.push(Buffer.from(chunk)));
+        child.on("error", reject);
+        child.on("close", code => code === 0 ? resolve(Buffer.concat(chunks).toString("utf8")) : reject(new Error(`${command} failed with exit ${code}.`)));
+    });
+}
+async function exists(target) { return fs.stat(target).then(() => true).catch(() => false); }
+async function installServiceEnvironment(attemptId) {
+    const attemptHex = attemptId.replace(/-/gu, "").toLowerCase();
+    const postgresPassword = await readServiceCredential("postgres-password");
+    if (postgresPassword)
+        process.env.FORGE_TEST_DATABASE = `postgresql://forge:${encodeURIComponent(postgresPassword)}@forge-${attemptHex}-postgres:5432/forge_test`;
+    const redisPassword = await readServiceCredential("redis-password");
+    if (redisPassword)
+        process.env.FORGE_TEST_REDIS = `redis://:${encodeURIComponent(redisPassword)}@forge-${attemptHex}-redis:6379/0`;
+    const browserToken = await readServiceCredential("browser-token");
+    if (browserToken)
+        process.env.FORGE_BROWSER_TOKEN = browserToken;
+}
+async function readServiceCredential(name) {
+    const target = `/run/forge-secrets/${name}`;
+    const stat = await fs.lstat(target).catch(() => null);
+    if (!stat)
+        return null;
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size < 32 || stat.size > 256) {
+        throw new Error(`Invalid ${name} service credential file.`);
+    }
+    return (await fs.readFile(target, "utf8")).trim();
+}
+function requiredId(value, label) {
+    if (typeof value !== "string" || !/^[0-9a-f-]{32,36}$/i.test(value))
+        throw new Error(`Invalid ${label}.`);
+    return value;
+}
+function requiredString(value, label) {
+    if (typeof value !== "string" || value.length === 0)
+        throw new Error(`Invalid ${label}.`);
+    return value;
+}
+function requiredLimits(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Invalid sandbox watchdog limits.");
+    const limits = value;
+    if (typeof limits.hardWallMs !== "number" || !Number.isSafeInteger(limits.hardWallMs) || limits.hardWallMs < 60_000 || limits.hardWallMs > 28_800_000
+        || typeof limits.idleMs !== "number" || !Number.isSafeInteger(limits.idleMs) || limits.idleMs < 60_000 || limits.idleMs > limits.hardWallMs) {
+        throw new Error("Invalid sandbox watchdog limits.");
+    }
+    return { hardWallMs: limits.hardWallMs, idleMs: limits.idleMs };
+}
+async function writeTerminationResult(resultPath, code) {
+    const message = terminationMessage(code);
+    const result = {
+        schemaVersion: 1,
+        exitCode: 124,
+        summary: message,
+        events: [{ role: "runner", kind: "error", content: message, eventType: code }]
+    };
+    const temporary = `${resultPath}.timeout.tmp`;
+    await fs.writeFile(temporary, `${JSON.stringify(result)}\n`, { mode: 0o600 });
+    await fs.rename(temporary, resultPath);
+}
+function emitTerminationEvent(code) {
+    const message = terminationMessage(code);
+    process.stdout.write(`${JSON.stringify({ type: "runner_event", event: { role: "runner", kind: "error", content: message, eventType: code } })}\n`);
+    process.stderr.write(`${code}: ${message}\n`);
+}
+main().then(code => { process.exitCode = code; }).catch(error => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});

package/dist/sandbox/workspace.service.d.ts

@@ -0,0 +1,13 @@
+import { GitClient } from "../shared/git/git.js";
+import type { WorktreeService } from "../worktree/worktree.base.js";
+import type { WorktreeHandle, WorktreePrepareRequest } from "../worktree/worktree.types.js";
+export declare class SandboxWorkspaceService implements WorktreeService {
+    private readonly workspace;
+    private readonly bundlePath;
+    private readonly inputCommitSha;
+    private readonly git;
+    constructor(workspace?: string, bundlePath?: string, inputCommitSha?: string, git?: GitClient);
+    prepare(request: WorktreePrepareRequest): Promise<WorktreeHandle>;
+    release(_handle: WorktreeHandle): Promise<void>;
+}
+export declare function sandboxInputRefFromBundle(bundleHeads: string, inputCommitSha: string): string;

package/dist/sandbox/workspace.service.js

@@ -0,0 +1,67 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { GitClient } from "../shared/git/git.js";
+import { injectWorktreeArtifacts, filterArtifactsForLane } from "../worktree/artifact-injector.js";
+import { hydratePriorPhaseArtifacts } from "../worktree/prior-phase-artifact-hydrator.js";
+import { clearRunArtifactRoots, normalizeBranchName } from "../worktree/worktree.service.js";
+export class SandboxWorkspaceService {
+    workspace;
+    bundlePath;
+    inputCommitSha;
+    git;
+    constructor(workspace = process.env.FORGE_WORKSPACE ?? "/workspace", bundlePath = process.env.FORGE_INPUT_BUNDLE ?? "/control/input/repo.bundle", inputCommitSha = process.env.FORGE_INPUT_COMMIT_SHA ?? "", git = new GitClient()) {
+        this.workspace = workspace;
+        this.bundlePath = bundlePath;
+        this.inputCommitSha = inputCommitSha;
+        this.git = git;
+    }
+    async prepare(request) {
+        if (!/^[0-9a-f]{40,64}$/i.test(this.inputCommitSha))
+            throw new Error("Sandbox input commit SHA is missing or invalid.");
+        const stat = await fs.stat(this.workspace).catch(() => null);
+        if (!stat?.isDirectory())
+            throw new Error("Sandbox workspace volume is unavailable.");
+        const entries = await fs.readdir(this.workspace);
+        if (entries.length > 0)
+            throw new Error("Sandbox workspace must be empty before bundle import.");
+        const bundleHeads = await this.git.run(path.dirname(this.workspace), ["bundle", "list-heads", this.bundlePath]);
+        const inputRef = sandboxInputRefFromBundle(bundleHeads, this.inputCommitSha);
+        await this.git.run(path.dirname(this.workspace), ["init", this.workspace]);
+        await this.git.run(this.workspace, ["fetch", "--no-tags", "--no-write-fetch-head", this.bundlePath, `${inputRef}:refs/forge/input`]);
+        const actualSha = (await this.git.run(this.workspace, ["rev-parse", "--verify", `${this.inputCommitSha}^{commit}`])).trim();
+        if (actualSha.toLowerCase() !== this.inputCommitSha.toLowerCase())
+            throw new Error("Imported bundle does not contain the exact recorded input commit.");
+        const branchName = normalizeBranchName(request.worktreeKey, `forge/${request.workItem.id.replace(/-/g, "")}`);
+        await this.git.run(this.workspace, ["checkout", "-B", branchName, this.inputCommitSha]);
+        await this.git.run(this.workspace, ["config", "user.email", "forge-agent@forge.local"]);
+        await this.git.run(this.workspace, ["config", "user.name", "Forge Agent"]);
+        await this.git.run(this.workspace, ["config", "core.hooksPath", "/dev/null"]);
+        await clearRunArtifactRoots(this.workspace, request);
+        const artifacts = filterArtifactsForLane(request.artifacts, request.lane, request.phase);
+        if (artifacts.length > 0)
+            await injectWorktreeArtifacts(this.workspace, artifacts);
+        const hydratedPriorPhaseArtifactCount = await hydratePriorPhaseArtifacts(this.workspace, request.priorPhaseArtifacts);
+        return {
+            repoPath: this.workspace,
+            worktreePath: this.workspace,
+            branchName,
+            baseBranch: request.baseBranch,
+            cleanupWorktrees: false,
+            hydratedPriorPhaseArtifactCount
+        };
+    }
+    async release(_handle) {
+        // The host supervisor owns the workspace volume lifecycle.
+    }
+}
+export function sandboxInputRefFromBundle(bundleHeads, inputCommitSha) {
+    const expectedSha = inputCommitSha.toLowerCase();
+    const matches = bundleHeads
+        .split(/\r?\n/u)
+        .map(line => /^([0-9a-f]{40}|[0-9a-f]{64}) (refs\/forge\/inputs\/[0-9a-f]{32})$/iu.exec(line.trim()))
+        .filter((match) => Boolean(match) && match[1].toLowerCase() === expectedSha);
+    if (matches.length !== 1) {
+        throw new Error("Sandbox input bundle does not expose the exact recorded input ref.");
+    }
+    return matches[0][2];
+}

package/dist/session/phase-completion.artifacts.js

@@ -424,7 +424,7 @@ async function synthesizeQaCycleVerdictPayload(config, payload, status) {
     ]);
     merged.browser_checks = dedupeUnknownArray([
         ...qaArray(payload, "browser_checks", payloadEvidence),
-        ...evidenceGates.flatMap((gate) => qaArray(gate, "browser_checks"))
+        ...evidenceGates.flatMap((gate) => qaArray(gate, "browser_checks").map(normalizeInheritedQaBrowserCheck))
     ]);
     merged.sidecars = dedupeUnknownArray([
         ...qaArray(payload, "sidecars", payloadEvidence),
@@ -516,6 +516,27 @@ function dedupeStrings(values) {
     }
     return deduped;
 }
+function normalizeInheritedQaBrowserCheck(browserCheck) {
+    if (!browserCheck || typeof browserCheck !== "object" || Array.isArray(browserCheck)) {
+        return browserCheck;
+    }
+    const record = browserCheck;
+    if (optionalString(record, "summary")) {
+        return record;
+    }
+    const target = optionalString(record, "url") ?? optionalString(record, "route") ?? "the configured browser target";
+    const status = optionalString(record, "status") ?? "recorded";
+    return {
+        ...record,
+        summary: `Inherited browser check ${status} for ${target}.`
+    };
+}
+function normalizeSha256ContentHash(contentHash) {
+    const normalized = contentHash.trim().toLowerCase();
+    return normalized.startsWith("sha256:")
+        ? normalized.slice("sha256:".length)
+        : normalized;
+}
 async function validateQaSidecarReferences(worktreePath, workItemId, sidecars, ownerType, ownerId) {
     if (sidecars.length === 0) {
         return [];
@@ -557,7 +578,7 @@ async function validateQaSidecarReferences(worktreePath, workItemId, sidecars, o
             throw new Error(`sidecars[${index}].bytes does not match the referenced file.`);
         }
         const actualHash = await sha256File(fullPath);
-        if (actualHash !== contentHash.trim().toLowerCase()) {
+        if (actualHash !== normalizeSha256ContentHash(contentHash)) {
             throw new Error(`sidecars[${index}].content_hash does not match the referenced file.`);
         }
         validated.push({

package/dist/session/phase-completion.helpers.js

@@ -626,7 +626,12 @@ export function forgeBridgeCliBinPath() {
     return fileURLToPath(new URL("../cli/bin.js", import.meta.url));
 }
 export function tomlString(value) {
-    return JSON.stringify(value);
+    if (value.includes("'''")) {
+        throw new Error("Codex MCP configuration values cannot contain three consecutive apostrophes.");
+    }
+    // Codex config overrides pass through npm's PowerShell shim on Windows.
+    // Literal TOML strings survive that boundary; basic-string double quotes do not.
+    return `'''${value}'''`;
 }
 export function tomlStringArray(values) {
     return `[${values.map(tomlString).join(", ")}]`;

package/dist/session/phase-completion.runtime.js

@@ -82,7 +82,9 @@ export function codexMcpConfigArgs(runtime) {
         "-c",
         `${prefix}.command=${tomlString(runtime.command)}`,
         "-c",
-        `${prefix}.args=${tomlStringArray(runtime.args)}`
+        `${prefix}.args=${tomlStringArray(runtime.args)}`,
+        "-c",
+        `${prefix}.default_tools_approval_mode=${tomlString("approve")}`
     ];
     for (const [key, value] of Object.entries(runtime.env)) {
         args.push("-c", `${prefix}.env.${key}=${tomlString(value)}`);

package/dist/session/provider-cli/provider-cli.artifacts.d.ts

@@ -18,7 +18,7 @@ export declare function isDebugCompletionPhaseForProvider(phase: CompletionPhase
 export declare function emitQaArtifactRecorded(emit: ProviderCliRunContext["emit"], worktreePath: string, artifact: RunnerDispatchArtifact): Promise<void>;
 export declare function readQaCompletionArtifactBundle(worktreePath: string, workItemId: string, ownerType?: string | null, ownerId?: string | null): Promise<RunnerDispatchArtifact | null>;
 export declare function hasCompleteQaArtifactBundle(worktreePath: string, workItemId: string, ownerType?: string | null, ownerId?: string | null): Promise<boolean>;
-export declare function enforceQaBrowserLaunchTargetGate(dispatch: RunOnceDispatchPacket, artifact: RunnerDispatchArtifact): void;
+export declare function enforceQaBrowserLaunchTargetGate(dispatch: RunOnceDispatchPacket, artifact: RunnerDispatchArtifact): Promise<void>;
 export declare function validateQaBundleSidecarReferences(worktreePath: string, workItemId: string, ownerType?: string | null, ownerId?: string | null): Promise<void>;
 export declare function emitQaStructuredEvents(emit: ProviderCliRunContext["emit"], artifact: RunnerDispatchArtifact): Promise<void>;
 interface QaGateArtifactSnapshot {

package/dist/session/provider-cli/provider-cli.artifacts.js

@@ -5,6 +5,7 @@ import { ensureNoSymbolicLinkPathSegments, isPathUnderRoot, sha256File } from ".
 import { hasLaunchTarget } from "./provider-cli.qa-sidecars.js";
 import { clip, isNodeError, messageFromError, normalizedString, parseJsonLine, stringField } from "./provider-output-state.js";
 const developCyclePhaseOrder = ["implementation", "self_review", "validation"];
+const nonPublishableWorktreePaths = [".forge", ".local"];
 export async function emitDraftGateArtifacts(emit, worktreePath, workItemId) {
     const draftArtifactFiles = {
         draft_intent: "draft.intent.json",
@@ -147,7 +148,9 @@ export async function cleanupCompletionTools(completionTools, emit) {
 }
 export async function commitWorktreeChanges(git, worktreePath, workItemId) {
     await git.run(worktreePath, ["add", "-A"]);
-    await git.run(worktreePath, ["reset", "--", ".forge"]).catch(() => "");
+    for (const reservedPath of nonPublishableWorktreePaths) {
+        await git.run(worktreePath, ["reset", "--", reservedPath]).catch(() => "");
+    }
     const changedFiles = (await git.run(worktreePath, ["diff", "--cached", "--name-only"]))
         .split(/\r?\n/)
         .map((line) => line.trim())
@@ -237,18 +240,39 @@ export async function hasCompleteQaArtifactBundle(worktreePath, workItemId, owne
     }
     return true;
 }
-export function enforceQaBrowserLaunchTargetGate(dispatch, artifact) {
+export async function enforceQaBrowserLaunchTargetGate(dispatch, artifact) {
     const qaBrowser = dispatch.qaBrowser;
     if (!qaBrowser?.required || hasLaunchTarget(qaBrowser.launchTarget ?? null)) {
         return;
     }
+    const evidence = await readJsonObjectFile(path.join(path.dirname(artifact.path), qaArtifactFileNames.evidence));
+    if (hasPassingRepositoryPlaywrightEvidence(evidence)) {
+        return;
+    }
     const verdict = parseJsonLine(artifact.verdictJson) ?? {};
     const status = normalizedString(stringField(verdict, "status") ?? artifact.status ?? "");
     const blockerReason = normalizedString(stringField(verdict, "blocker_reason") ?? "");
     if (status !== "blocked" || blockerReason !== "missing_app_launch_target") {
-        throw new Error("QA browser testing is required but no app launch target was provided; provider must return blocked with blocker_reason missing_app_launch_target.");
+        throw new Error("QA browser testing is required but neither an app launch target nor passing repository Playwright evidence was provided; provider must return blocked with blocker_reason missing_app_launch_target.");
     }
 }
+function hasPassingRepositoryPlaywrightEvidence(evidence) {
+    const passingBrowserCheck = arrayField(evidence, "browser_checks").some(check => normalizedString(stringField(check, "status") ?? "") === "pass"
+        && Boolean(stringField(check, "url") ?? stringField(check, "route")));
+    if (!passingBrowserCheck) {
+        return false;
+    }
+    return arrayField(evidence, "commands").some(command => {
+        const status = normalizedString(stringField(command, "status") ?? "");
+        const exitCode = command.exit_code;
+        const description = [stringField(command, "command"), stringField(command, "summary")]
+            .filter((value) => Boolean(value))
+            .join(" ");
+        return status === "pass"
+            && exitCode === 0
+            && /(?:playwright|test:e2e|e2e(?:\s|:|$)|browser(?:\s|-)?test)/iu.test(description);
+    });
+}
 export async function validateQaBundleSidecarReferences(worktreePath, workItemId, ownerType, ownerId) {
     const artifactRoot = ownerType && ownerId
         ? artifactRootForOwner(worktreePath, ownerType, ownerId)
@@ -444,7 +468,7 @@ export class LiveQaArtifactEmitter {
         if (!artifact) {
             return;
         }
-        enforceQaBrowserLaunchTargetGate(this.dispatch, artifact);
+        await enforceQaBrowserLaunchTargetGate(this.dispatch, artifact);
         this.emittedBundle = true;
         await emitQaArtifactRecorded(this.emit, this.worktreePath, artifact);
         await emitQaStructuredEvents(this.emit, artifact);

package/dist/session/provider-cli/provider-cli.base.d.ts

@@ -2,6 +2,7 @@ import type { ProviderCliDraftContext, ProviderCliRunContext, ProviderCliRunResu
 export interface ProviderCliService {
     runImplementation(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
     runArchitect(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
+    runCiRepair(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
     runConflictResolve(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
     runQa(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
     runDraft(context: ProviderCliDraftContext): Promise<ProviderCliRunResult>;

package/dist/session/provider-cli/provider-cli.deterministic.d.ts

@@ -8,5 +8,7 @@ export declare class DeterministicProviderCliService implements ProviderCliServi
     runImplementation(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
     runArchitect(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
     runQa(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
+    runCiRepair(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
     runConflictResolve(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
+    private runPullRequestRepair;
 }

package/dist/session/provider-cli/provider-cli.deterministic.js

@@ -5,7 +5,7 @@ import { buildSpecBody, selectLaneCommand } from "../../worktree/artifact-inject
 import { completionPhaseFromDispatch, debugCompletionPhaseOrder, expectedCompletionToolName, expectedDebugCompletionToolName, expectedQaCompletionToolName, qaCompletionGateOrder, readCompletionArtifact, usesDebugCycleCompletion, usesDevelopCycleCompletion, writeCompletionArtifact } from "../phase-completion.js";
 import { emitArchitectStructuredEvents, emitCompletionArtifactRecorded, emitQaArtifactRecorded, emitQaGateAccepted, emitQaStructuredEvents, isDebugCompletionPhaseForProvider, nextQaGate, phaseCompleteEventType, qaArtifactRootForDispatch, readQaCompletionArtifactBundle, readQaGateArtifact } from "./provider-cli.artifacts.js";
 import { deterministicBrowserCheck, deterministicBrowserSidecar, hasLaunchTarget, writeQaSidecarFiles } from "./provider-cli.qa-sidecars.js";
-import { buildProviderCliCommand, formatProviderCliCommand, isPullRequestCommentsDispatch, singleLine } from "./provider-cli.prompts.js";
+import { buildProviderCliCommand, formatProviderCliCommand, isPullRequestCheckRepairDispatch, isPullRequestCommentsDispatch, singleLine } from "./provider-cli.prompts.js";
 import { estimatedDeterministicUsage, exactRedactionSecrets } from "./provider-cli.runtime.js";
 import { buildProviderUsageEvent } from "./provider-usage.js";
 import { deterministicArchitectPayload, deterministicCompletionPayload, deterministicQaGatePayload } from "./provider-cli.deterministic-payloads.js";
@@ -202,23 +202,34 @@ export class DeterministicProviderCliService {
             artifacts: [qaArtifact]
         };
     }
+    async runCiRepair(context) {
+        return await this.runPullRequestRepair(context, "ci_repair");
+    }
     async runConflictResolve(context) {
+        return await this.runPullRequestRepair(context, "conflict_resolve");
+    }
+    async runPullRequestRepair(context, route) {
         const { dispatch, worktree } = context;
+        const repairChecks = route === "ci_repair" || isPullRequestCheckRepairDispatch(dispatch);
         const addressComments = isPullRequestCommentsDispatch(dispatch);
-        await this.git.run(worktree.worktreePath, ["commit", "--allow-empty", "-m", `forge bridge ${addressComments ? "pr comments" : "conflict resolve"} for ${dispatch.workItem.id.slice(0, 8)}`]);
+        await this.git.run(worktree.worktreePath, ["commit", "--allow-empty", "-m", `forge bridge ${repairChecks ? "ci repair" : addressComments ? "pr comments" : "conflict resolve"} for ${dispatch.workItem.id.slice(0, 8)}`]);
         await context.emit(buildProviderUsageEvent(dispatch, estimatedDeterministicUsage()));
         await context.emit({
             role: "assistant",
             kind: "message",
-            content: addressComments
-                ? `Deterministic PR comment addressing completed for ${worktree.branchName}.`
-                : `Deterministic conflict resolve completed for ${worktree.branchName}.`,
-            eventType: addressComments ? "pr_comments_complete" : "conflict_resolve_complete"
+            content: repairChecks
+                ? `Deterministic CI repair completed for ${worktree.branchName}.`
+                : addressComments
+                    ? `Deterministic PR comment addressing completed for ${worktree.branchName}.`
+                    : `Deterministic conflict resolve completed for ${worktree.branchName}.`,
+            eventType: repairChecks ? "pr_checks_complete" : addressComments ? "pr_comments_complete" : "conflict_resolve_complete"
         });
         return {
-            summary: addressComments
-                ? `forge-bridge addressed PR comments for ${worktree.branchName}.`
-                : `forge-bridge resolved conflicts for ${worktree.branchName}.`
+            summary: repairChecks
+                ? `forge-bridge repaired PR checks for ${worktree.branchName}.`
+                : addressComments
+                    ? `forge-bridge addressed PR comments for ${worktree.branchName}.`
+                    : `forge-bridge resolved conflicts for ${worktree.branchName}.`
         };
     }
 }

package/dist/session/provider-cli/provider-cli.process.d.ts

@@ -5,6 +5,8 @@ export interface ProviderProcessRunRequest {
     readonly args: readonly string[];
     readonly cwd: string;
     readonly env?: Readonly<Record<string, string>>;
+    readonly stdin?: string;
+    readonly captureOutput?: boolean;
 }
 export interface ProviderProcessRunResult {
     readonly exitCode: number;
@@ -27,5 +29,6 @@ export declare function buildProviderChildEnvironment(requestEnv?: Readonly<Reco
 export declare class StreamingProviderProcessRunner implements ProviderProcessRunner {
     run(request: ProviderProcessRunRequest, handlers?: ProviderProcessHandlers, signal?: AbortSignal): Promise<ProviderProcessRunResult>;
 }
+export declare function resolveCodexNpmDirectLaunch(commandPath: string, args: readonly string[]): LaunchCommand | null;
 export declare function chooseWindowsCommandCandidate(candidates: readonly string[]): string | null;
 export {};