@loucompanion/forge-bridge 0.1.3-dev.b3bce6ba65a6 → 0.1.3-dev.ba7d36726eda

package/dist/session/provider-cli/provider-cli.service.js

@@ -5,14 +5,56 @@ import { buildSpecBody, selectLaneCommand } from "../../worktree/artifact-inject
 import { completionPhaseFromDispatch, prepareCompletionToolRuntime, readCompletionArtifact, usesDebugCycleCompletion, usesDevelopCycleCompletion } from "../phase-completion.js";
 import { cleanupCompletionTools, commitWorktreeChanges, completionPhaseFromArtifact, emitArchitectStructuredEvents, emitCompletionArtifactRecorded, emitDecomposeGateArtifacts, emitDraftGateArtifacts, emitPhaseCompletionEvent, emitPhaseGateEvents, emitQaArtifactRecorded, emitQaStructuredEvents, enforceQaBrowserLaunchTargetGate, LiveArchitectArtifactEmitter, LiveCompletionArtifactEmitter, LiveQaArtifactEmitter, readCompletionArtifactsForRun, readQaCompletionArtifactBundle, summarizeStderr, waitForCompletionArtifact } from "./provider-cli.artifacts.js";
 import { DeterministicProviderCliService } from "./provider-cli.deterministic.js";
-import { buildArchitectPrompt, buildConflictResolvePrompt, buildDebugCyclePrompt, buildDevelopCyclePrompt, buildDraftPrompt, buildDraftSpec, buildImplementationPrompt, buildProviderCliCommand, durableDraftInput, buildPullRequestCommentsPrompt, buildQaPrompt, formatProviderCliCommandForCheckpoint, isDecomposeDraftDispatch, isPullRequestCommentsDispatch } from "./provider-cli.prompts.js";
+import { buildArchitectPrompt, buildConflictResolvePrompt, buildDebugCyclePrompt, buildDevelopCyclePrompt, buildDraftPrompt, buildDraftSpec, buildImplementationPrompt, buildProviderCliPrompt, buildProviderCliCommand, durableDraftInput, buildPullRequestCheckRepairPrompt, buildPullRequestCommentsPrompt, buildQaPrompt, formatProviderCliCommandForCheckpoint, isDecomposeDraftDispatch, isPullRequestCheckRepairDispatch, isPullRequestCommentsDispatch } from "./provider-cli.prompts.js";
 import { StreamingProviderProcessRunner } from "./provider-cli.process.js";
 import { emitProviderUsageEvent, providerProcessEnv } from "./provider-cli.runtime.js";
 import { clip, createProviderOutputState, parseJsonLine } from "./provider-output-state.js";
 export { DeterministicProviderCliService } from "./provider-cli.deterministic.js";
 export { buildProviderCliCommand, codexSandboxModeForPlatform, formatProviderCliCommand, formatProviderCliCommandForCheckpoint } from "./provider-cli.prompts.js";
-export { buildProviderChildEnvironment, chooseWindowsCommandCandidate, StreamingProviderProcessRunner } from "./provider-cli.process.js";
+export { buildProviderChildEnvironment, chooseWindowsCommandCandidate, resolveCodexNpmDirectLaunch, StreamingProviderProcessRunner } from "./provider-cli.process.js";
 export { buildWindowsLaunchCommand } from "../../shared/process/windows-launch.js";
+async function pushWorktreeBranch(git, worktreePath, branchName, emit) {
+    try {
+        await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
+        return;
+    }
+    catch (err) {
+        if (!isNonFastForwardPushError(err)) {
+            throw err;
+        }
+        await emit?.({
+            role: "runner",
+            kind: "checkpoint",
+            content: `Remote branch ${branchName} moved before push; fetching latest and rebasing local changes.`,
+            eventType: "worktree_branch_push_rebase"
+        });
+        try {
+            await git.run(worktreePath, ["fetch", "origin", remoteTrackingRefspec(branchName)]);
+            await git.run(worktreePath, ["rebase", `refs/remotes/origin/${branchName}`]);
+            await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
+        }
+        catch (retryErr) {
+            throw new Error(`git push origin HEAD:${branchName} was rejected because the remote branch moved, and automatic fetch/rebase failed: ${errorMessage(retryErr)}`, { cause: retryErr });
+        }
+    }
+}
+function providerOwnsBranchPublication(context) {
+    return context.dispatch.sandbox?.executionMode !== "docker";
+}
+function remoteTrackingRefspec(branchName) {
+    return `refs/heads/${branchName}:refs/remotes/origin/${branchName}`;
+}
+function isNonFastForwardPushError(err) {
+    const message = errorMessage(err).toLowerCase();
+    return message.includes("non-fast-forward")
+        || message.includes("fetch first")
+        || message.includes("tip of your current branch is behind")
+        || message.includes("updates were rejected because the tip of your current branch is behind")
+        || message.includes("stale info");
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
 const fakeWorkerModel = "server-local-fake-worker";
 export class RoutingProviderCliService {
     realProvider;
@@ -31,6 +73,11 @@ export class RoutingProviderCliService {
             ? await this.deterministicProvider.runArchitect(context)
             : await this.realProvider.runArchitect(context);
     }
+    async runCiRepair(context) {
+        return isFakeWorkerModel(context.dispatch.execution.model)
+            ? await this.deterministicProvider.runCiRepair(context)
+            : await this.realProvider.runCiRepair(context);
+    }
     async runConflictResolve(context) {
         return isFakeWorkerModel(context.dispatch.execution.model)
             ? await this.deterministicProvider.runConflictResolve(context)
@@ -64,13 +111,20 @@ export class ProcessBackedProviderCliService {
         await fs.mkdir(metadataRoot, { recursive: true });
         await fs.writeFile(path.join(metadataRoot, "draft-input.json"), JSON.stringify(durableDraftInput(dispatch), null, 2) + "\n", "utf8");
         await fs.writeFile(path.join(metadataRoot, "spec.md"), buildDraftSpec(dispatch), "utf8");
+        const stagedAttachments = await stageDraftAttachments(dispatch, metadataRoot);
         const decomposeDraft = isDecomposeDraftDispatch(dispatch);
         const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: decomposeDraft ? "decompose" : "draft" });
+        const draftPrompt = buildDraftPrompt(dispatch, { attachmentReferences: stagedAttachments.textReferences });
+        const providerPrompt = buildProviderCliPrompt(dispatch, draftPrompt, context.runtimeEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt);
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: buildDraftPrompt(dispatch),
+            prompt: draftPrompt,
+            promptFromStdin: pipePromptToStdin,
             completionTools: completionTools ?? undefined,
-            skipGitRepoCheck: false
+            skipGitRepoCheck: false,
+            imagePaths: stagedAttachments.imagePaths,
+            runtimeEnvironment: context.runtimeEnvironment
         });
         const draftArtifactSlugs = dispatch.artifacts
             .filter((artifact) => artifact.scope === "operational" && ["command", "skill", "hook"].includes(artifact.kind))
@@ -110,7 +164,8 @@ export class ProcessBackedProviderCliService {
                     command: command.command,
                     args: command.args,
                     cwd: worktree.worktreePath,
-                    env: providerProcessEnv(dispatch)
+                    env: providerProcessEnv(dispatch, context.runtimeEnvironment),
+                    stdin: pipePromptToStdin ? providerPrompt : undefined
                 }, {
                     onStdoutLine: async (line) => {
                         for (const event of outputState.consume(line)) {
@@ -237,7 +292,8 @@ export class ProcessBackedProviderCliService {
                 : developCycle
                     ? buildDevelopCyclePrompt(dispatch, phase)
                     : buildImplementationPrompt(dispatch, phase),
-            completionTools
+            completionTools,
+            runtimeEnvironment: context.runtimeEnvironment
         });
         await context.emit({
             role: "runner",
@@ -264,7 +320,7 @@ export class ProcessBackedProviderCliService {
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
-                env: providerProcessEnv(dispatch)
+                env: providerProcessEnv(dispatch, context.runtimeEnvironment)
             }, {
                 onStdoutLine: async (line) => {
                     for (const event of outputState.consume(line)) {
@@ -289,8 +345,8 @@ export class ProcessBackedProviderCliService {
         });
         await emitProviderUsageEvent(context.emit, dispatch, outputState);
         const committed = await commitWorktreeChanges(this.git, worktree.worktreePath, dispatch.workItem.id);
-        if (developCycle || debugCycle || phase === "implementation") {
-            await this.git.run(worktree.worktreePath, ["push", "origin", `HEAD:${worktree.branchName}`]);
+        if ((developCycle || debugCycle || phase === "implementation") && providerOwnsBranchPublication(context)) {
+            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, context.emit);
             await context.emit({
                 role: "runner",
                 kind: "checkpoint",
@@ -352,7 +408,8 @@ export class ProcessBackedProviderCliService {
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
             prompt: buildArchitectPrompt(dispatch),
-            completionTools
+            completionTools,
+            runtimeEnvironment: context.runtimeEnvironment
         });
         const commandText = formatProviderCliCommandForCheckpoint(command);
         await context.emit({
@@ -376,7 +433,7 @@ export class ProcessBackedProviderCliService {
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
-                env: providerProcessEnv(dispatch)
+                env: providerProcessEnv(dispatch, context.runtimeEnvironment)
             }, {
                 onStdoutLine: async (line) => {
                     for (const event of outputState.consume(line)) {
@@ -443,7 +500,8 @@ export class ProcessBackedProviderCliService {
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
             prompt: buildQaPrompt(dispatch, specBody),
-            completionTools
+            completionTools,
+            runtimeEnvironment: context.runtimeEnvironment
         });
         const commandText = formatProviderCliCommandForCheckpoint(command);
         await context.emit({
@@ -467,7 +525,7 @@ export class ProcessBackedProviderCliService {
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
-                env: providerProcessEnv(dispatch)
+                env: providerProcessEnv(dispatch, context.runtimeEnvironment)
             }, {
                 onStdoutLine: async (line) => {
                     for (const event of outputState.consume(line)) {
@@ -498,7 +556,7 @@ export class ProcessBackedProviderCliService {
                 ? "Provider CLI QA completed but did not produce the complete durable QA artifact bundle."
                 : "Provider CLI QA completed but did not call the Forge QA completion tool.");
         }
-        enforceQaBrowserLaunchTargetGate(dispatch, qaArtifact);
+        await enforceQaBrowserLaunchTargetGate(dispatch, qaArtifact);
         if (!liveQaEvents.hasEmitted()) {
             await emitQaArtifactRecorded(context.emit, worktree.worktreePath, qaArtifact);
             await emitQaStructuredEvents(context.emit, qaArtifact);
@@ -522,19 +580,29 @@ export class ProcessBackedProviderCliService {
             artifacts: [qaArtifact]
         };
     }
+    async runCiRepair(context) {
+        return await this.runPullRequestRepair(context, "ci_repair");
+    }
     async runConflictResolve(context) {
+        return await this.runPullRequestRepair(context, "conflict_resolve");
+    }
+    async runPullRequestRepair(context, route) {
         const { dispatch, worktree } = context;
-        const addressComments = isPullRequestCommentsDispatch(dispatch);
+        const repairChecks = route === "ci_repair" || isPullRequestCheckRepairDispatch(dispatch);
+        const addressComments = !repairChecks && isPullRequestCommentsDispatch(dispatch);
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: addressComments
-                ? buildPullRequestCommentsPrompt(dispatch, worktree.branchName)
-                : buildConflictResolvePrompt(dispatch, worktree.branchName)
+            prompt: repairChecks
+                ? buildPullRequestCheckRepairPrompt(dispatch, worktree.branchName)
+                : addressComments
+                    ? buildPullRequestCommentsPrompt(dispatch, worktree.branchName)
+                    : buildConflictResolvePrompt(dispatch, worktree.branchName),
+            runtimeEnvironment: context.runtimeEnvironment
         });
         await context.emit({
             role: "runner",
             kind: "checkpoint",
-            content: `Starting provider CLI ${addressComments ? "PR comment address" : "conflict resolve"}: ${formatProviderCliCommandForCheckpoint(command)} in ${worktree.worktreePath}`,
+            content: `Starting provider CLI ${repairChecks ? "CI repair" : addressComments ? "PR comment address" : "conflict resolve"}: ${formatProviderCliCommandForCheckpoint(command)} in ${worktree.worktreePath}`,
             eventType: "provider_cli_started"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
@@ -542,7 +610,7 @@ export class ProcessBackedProviderCliService {
             command: command.command,
             args: command.args,
             cwd: worktree.worktreePath,
-            env: providerProcessEnv(dispatch)
+            env: providerProcessEnv(dispatch, context.runtimeEnvironment)
         }, {
             onStdoutLine: async (line) => {
                 for (const event of outputState.consume(line)) {
@@ -555,23 +623,94 @@ export class ProcessBackedProviderCliService {
             throw new Error(`${command.command} exited ${result.exitCode}${stderr ? `: ${stderr}` : ""}`);
         }
         const committed = await commitWorktreeChanges(this.git, worktree.worktreePath, dispatch.workItem.id);
-        await this.git.run(worktree.worktreePath, ["push", "origin", `HEAD:${worktree.branchName}`]);
+        if (providerOwnsBranchPublication(context)) {
+            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, context.emit);
+        }
         await emitProviderUsageEvent(context.emit, dispatch, outputState);
         await context.emit({
             role: "assistant",
             kind: "message",
-            content: outputState.finalMessage || (addressComments
-                ? `${dispatch.execution.provider} CLI addressed pull request comments for ${worktree.branchName}.`
-                : `${dispatch.execution.provider} CLI resolved merge conflicts for ${worktree.branchName}.`),
-            eventType: addressComments ? "pr_comments_complete" : "conflict_resolve_complete"
+            content: outputState.finalMessage || (repairChecks
+                ? `${dispatch.execution.provider} CLI repaired pull request checks for ${worktree.branchName}.`
+                : addressComments
+                    ? `${dispatch.execution.provider} CLI addressed pull request comments for ${worktree.branchName}.`
+                    : `${dispatch.execution.provider} CLI resolved merge conflicts for ${worktree.branchName}.`),
+            eventType: repairChecks ? "pr_checks_complete" : addressComments ? "pr_comments_complete" : "conflict_resolve_complete"
         });
         return {
-            summary: addressComments
-                ? `${dispatch.execution.provider} CLI addressed PR comments on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
-                : `${dispatch.execution.provider} CLI resolved conflicts on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
+            summary: repairChecks
+                ? `${dispatch.execution.provider} CLI repaired PR checks on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
+                : addressComments
+                    ? `${dispatch.execution.provider} CLI addressed PR comments on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
+                    : `${dispatch.execution.provider} CLI resolved conflicts on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
         };
     }
 }
+async function stageDraftAttachments(dispatch, metadataRoot) {
+    const attachments = dispatch.draft?.attachments ?? [];
+    const stageable = attachments.filter((attachment) => (attachment.kind === "text" && typeof attachment.textContent === "string")
+        || (attachment.kind === "image" && typeof attachment.contentBase64 === "string"));
+    if (stageable.length === 0) {
+        return { textReferences: [], imagePaths: [] };
+    }
+    const attachmentRoot = path.join(metadataRoot, "draft-attachments");
+    const worktreeRoot = path.resolve(metadataRoot, "../../..");
+    await fs.mkdir(attachmentRoot, { recursive: true });
+    const textReferences = [];
+    const imagePaths = [];
+    for (const attachment of stageable) {
+        const fileName = `${String(attachment.index + 1).padStart(2, "0")}-${safeAttachmentFileName(attachment.fileName)}`;
+        const absolutePath = path.join(attachmentRoot, fileName);
+        if (attachment.kind === "text") {
+            await fs.writeFile(absolutePath, attachment.textContent ?? "", { encoding: "utf8", mode: 0o600 });
+            textReferences.push({ index: attachment.index, path: path.relative(worktreeRoot, absolutePath).replaceAll(path.sep, "/") });
+            continue;
+        }
+        const imageContent = decodeDraftImageAttachment(attachment.contentBase64 ?? "", attachment.fileName, attachment.index);
+        await fs.writeFile(absolutePath, imageContent, { mode: 0o600 });
+        imagePaths.push(absolutePath);
+    }
+    return { textReferences, imagePaths };
+}
+function decodeDraftImageAttachment(contentBase64, fileName, index) {
+    const normalized = contentBase64.replace(/\s+/gu, "");
+    if (normalized.length === 0 || normalized.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/u.test(normalized)) {
+        throw new Error(`Draft image attachment ${index + 1} (${fileName}) is not valid base64.`);
+    }
+    const decoded = Buffer.from(normalized, "base64");
+    if (decoded.length === 0 || decoded.toString("base64") !== normalized) {
+        throw new Error(`Draft image attachment ${index + 1} (${fileName}) is not valid base64.`);
+    }
+    return decoded;
+}
+function safeAttachmentFileName(fileName) {
+    const sanitized = path.basename(fileName || "attachment.txt")
+        .replace(/[^a-zA-Z0-9._-]/gu, "_")
+        .replace(/[. ]+$/gu, "") || "attachment.txt";
+    const maxFileNameLength = 120;
+    const clipped = clipFileName(sanitized, maxFileNameLength);
+    const extension = path.extname(clipped);
+    const stem = path.basename(clipped, extension).replace(/[. ]+$/gu, "") || "attachment";
+    const windowsReservedName = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/iu;
+    const safeStem = stem === "." || stem === ".." || windowsReservedName.test(stem) ? `attachment-${stem.replaceAll(".", "_")}` : stem;
+    return clipFileName(`${safeStem}${extension}`, maxFileNameLength);
+}
+function clipFileName(fileName, maxLength) {
+    if (fileName.length <= maxLength) {
+        return fileName;
+    }
+    const originalExtension = path.extname(fileName);
+    const extension = originalExtension.length > maxLength - 1
+        ? originalExtension.slice(0, maxLength - 1)
+        : originalExtension;
+    const stem = path.basename(fileName, originalExtension);
+    const maxStemLength = Math.max(1, maxLength - extension.length);
+    return `${stem.slice(0, maxStemLength)}${extension}`;
+}
+const providerPromptStdinThreshold = 8_000;
+function shouldPipePromptToStdin(provider, prompt) {
+    return provider.trim().toLowerCase() === "codex" && Buffer.byteLength(prompt, "utf8") > providerPromptStdinThreshold;
+}
 function isFakeWorkerModel(model) {
     return model.trim().toLowerCase() === fakeWorkerModel;
 }

package/dist/session/provider-cli/provider-cli.types.d.ts

@@ -3,12 +3,14 @@ import type { WorktreeHandle } from "../../worktree/worktree.types.js";
 export interface ProviderCliRunContext {
     readonly dispatch: RunOnceDispatchPacket;
     readonly worktree: WorktreeHandle;
+    readonly runtimeEnvironment?: Readonly<Record<string, string>>;
     readonly signal?: AbortSignal;
     emit(event: RunnerDispatchEvent): Promise<void>;
 }
 export interface ProviderCliDraftContext {
     readonly dispatch: RunOnceDispatchPacket;
     readonly worktree: WorktreeHandle;
+    readonly runtimeEnvironment?: Readonly<Record<string, string>>;
     readonly signal?: AbortSignal;
     emit(event: RunnerDispatchEvent): Promise<void>;
 }

package/dist/session/session-redaction.d.ts

@@ -0,0 +1,3 @@
+import type { RunOnceResultPacket, RunnerDispatchEvent } from "./session.types.js";
+export declare function redactRunnerDispatchEvent(event: RunnerDispatchEvent, exactSecrets?: readonly string[]): RunnerDispatchEvent;
+export declare function redactRunOnceResultPacket(result: RunOnceResultPacket, exactSecrets?: readonly string[]): RunOnceResultPacket;

package/dist/session/session-redaction.js

@@ -0,0 +1,23 @@
+import { redactSecrets } from "../shared/redaction/redaction.js";
+const integrityProtectedEventDataTypes = new Set(["sandbox_started"]);
+export function redactRunnerDispatchEvent(event, exactSecrets = []) {
+    if (!event.data || !integrityProtectedEventDataTypes.has(event.eventType)) {
+        return redactSecrets(event, exactSecrets);
+    }
+    // sandbox_started data is runner-authored protocol metadata. Its runtime
+    // lease repeats the dispatch fence so the API can validate ownership. The
+    // transcript redactor treats any serialized `*Token` field as a secret and
+    // must not rewrite that identity before transport or result persistence.
+    const { data, ...transcript } = event;
+    return {
+        ...redactSecrets(transcript, exactSecrets),
+        data,
+    };
+}
+export function redactRunOnceResultPacket(result, exactSecrets = []) {
+    const { events, ...payload } = result;
+    return {
+        ...redactSecrets(payload, exactSecrets),
+        events: events.map(event => redactRunnerDispatchEvent(event, exactSecrets)),
+    };
+}

package/dist/session/session.base.d.ts

@@ -1,7 +1,11 @@
 import type { RunOnceDispatchPacket, RunOnceResultPacket, RunnerDispatchEvent } from "./session.types.js";
+import type { HostRuntimeCapacitySnapshot, HostRuntimeReapOptions, HostRuntimeReapReport } from "../runtime/host-runtime-lease.js";
 export interface SessionEventSink {
     emit(event: RunnerDispatchEvent): Promise<void>;
 }
 export interface SessionService {
     runOnce(dispatch: RunOnceDispatchPacket, sink: SessionEventSink, signal?: AbortSignal): Promise<RunOnceResultPacket>;
+    updateLease?(dispatchAttemptId: string, fencingToken: string, expiresAt: string): Promise<void>;
+    reapHostRuntime?(options: HostRuntimeReapOptions): Promise<HostRuntimeReapReport | null>;
+    runtimeCapacity?(): HostRuntimeCapacitySnapshot | null;
 }

package/dist/session/session.service.d.ts

@@ -2,9 +2,14 @@ import type { ProviderCliService } from "./provider-cli/provider-cli.base.js";
 import type { SessionEventSink, SessionService } from "./session.base.js";
 import type { RunOnceDispatchPacket, RunOnceResultPacket } from "./session.types.js";
 import type { WorktreeService } from "../worktree/worktree.base.js";
+import { type HostRuntimeCapacitySnapshot, type HostRuntimeLeaseRuntime, type HostRuntimeReapOptions, type HostRuntimeReapReport } from "../runtime/host-runtime-lease.js";
 export declare class BridgeSessionService implements SessionService {
     private readonly worktrees;
     private readonly providerCli;
-    constructor(worktrees?: WorktreeService, providerCli?: ProviderCliService);
+    private readonly hostRuntime?;
+    constructor(worktrees?: WorktreeService, providerCli?: ProviderCliService, hostRuntime?: HostRuntimeLeaseRuntime | undefined);
+    updateLease(dispatchAttemptId: string, fencingToken: string, expiresAt: string): Promise<void>;
+    reapHostRuntime(options: HostRuntimeReapOptions): Promise<HostRuntimeReapReport | null>;
+    runtimeCapacity(): HostRuntimeCapacitySnapshot | null;
     runOnce(dispatch: RunOnceDispatchPacket, sink: SessionEventSink, signal?: AbortSignal): Promise<RunOnceResultPacket>;
 }