@loucompanion/forge-bridge 0.1.3-dev.b6be5e7f9668 → 0.1.3-dev.ba293ccf876b

package/dist/shared/process/process.js

@@ -5,22 +5,27 @@ export class NodeProcessRunner {
         return await new Promise((resolve, reject) => {
             const child = spawn(request.command, request.args, {
                 cwd: request.cwd,
+                env: request.env,
                 stdio: ["ignore", "pipe", "pipe"]
             });
             let stdout = "";
             let stderr = "";
             child.on("error", reject);
-            const stdoutReader = readline.createInterface({ input: child.stdout });
-            const stderrReader = readline.createInterface({ input: child.stderr });
-            stdoutReader.on("line", (line) => {
+            const stdoutReader = request.rawOutput ? undefined : readline.createInterface({ input: child.stdout });
+            const stderrReader = request.rawOutput ? undefined : readline.createInterface({ input: child.stderr });
+            if (request.rawOutput) {
+                child.stdout.setEncoding("utf8").on("data", chunk => { stdout += chunk; });
+                child.stderr.setEncoding("utf8").on("data", chunk => { stderr += chunk; });
+            }
+            stdoutReader?.on("line", (line) => {
                 stdout += `${line}\n`;
             });
-            stderrReader.on("line", (line) => {
+            stderrReader?.on("line", (line) => {
                 stderr += `${line}\n`;
             });
             child.on("close", (code) => {
-                stdoutReader.close();
-                stderrReader.close();
+                stdoutReader?.close();
+                stderrReader?.close();
                 resolve({
                     exitCode: code ?? 1,
                     stdout,

package/dist/shared/process/windows-launch.d.ts

@@ -0,0 +1,8 @@
+export interface LaunchCommand {
+    readonly command: string;
+    readonly args: readonly string[];
+}
+export declare function buildWindowsCmdLaunch(command: string, args: readonly string[], comSpec?: string | undefined): LaunchCommand;
+export declare function buildWindowsLaunchCommand(commandPath: string, args: readonly string[]): LaunchCommand;
+export declare function windowsCommandLine(command: string, args: readonly string[]): string;
+export declare function quoteWindowsCommandLineArg(value: string): string;

package/dist/shared/process/windows-launch.js

@@ -0,0 +1,41 @@
+import path from "node:path";
+export function buildWindowsCmdLaunch(command, args, comSpec = process.env.ComSpec) {
+    const resolvedComSpec = comSpec?.trim();
+    const commandLine = windowsCommandLine(command, args);
+    const cmdPayload = commandLine.startsWith('"') ? `"${commandLine}"` : commandLine;
+    return {
+        command: resolvedComSpec || "cmd.exe",
+        args: ["/d", "/s", "/v:off", "/c", cmdPayload]
+    };
+}
+export function buildWindowsLaunchCommand(commandPath, args) {
+    const extension = path.extname(commandPath).toLowerCase();
+    if (extension === ".ps1") {
+        return {
+            command: powershellExecutable(),
+            args: ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", commandPath, ...args]
+        };
+    }
+    if (extension === ".cmd" || extension === ".bat") {
+        return buildWindowsCmdLaunch(commandPath, args);
+    }
+    return { command: commandPath, args };
+}
+export function windowsCommandLine(command, args) {
+    return [command, ...args].map(quoteWindowsCommandLineArg).join(" ");
+}
+export function quoteWindowsCommandLineArg(value) {
+    const escaped = value
+        .replace(/\^/g, "^^")
+        .replace(/%/g, "^%");
+    if (escaped.length > 0 && !/[\s"&|<>()^%!]/.test(escaped)) {
+        return escaped;
+    }
+    return `"${escaped.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/g, "$1$1")}"`;
+}
+function powershellExecutable() {
+    const systemRoot = process.env.SystemRoot;
+    return systemRoot
+        ? path.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+        : "powershell.exe";
+}

package/dist/shared/provider-capabilities.d.ts

@@ -0,0 +1 @@
+export declare function supportsDraftImageAttachmentsFor(cliProviders: readonly string[]): boolean;

package/dist/shared/provider-capabilities.js

@@ -0,0 +1,3 @@
+export function supportsDraftImageAttachmentsFor(cliProviders) {
+    return cliProviders.some((provider) => provider.trim().toLowerCase() === "codex");
+}

package/dist/shared/redaction/redaction.js

@@ -1,17 +1,29 @@
 const secretKeyPattern = /(api[_-]?key|authorization|bearer|client[_-]?secret|password|secret|token)/i;
+const attachmentContentKeyPattern = /^(textContent|contentBase64)$/i;
+const serializedAttachmentContentPattern = /("(?:textContent|contentBase64)"\s*:\s*")(?:(?:\\.)|[^"\\])*(")/gi;
+const authorizationCredentialPattern = /(\bauthorization\s*[:=]\s*(?:bearer|basic)?\s*)([^"',\s]+)/gi;
+const bearerCredentialPattern = /(\bbearer\s+)([^"',\s]+)/gi;
+const secretAssignmentPattern = /(api[_-]?key|client[_-]?secret|password|secret|token)(\s*["']?\s*[:=]\s*["']?\s*)([^"',\s]+)/gi;
+// Keep this boundary in parity with Forge.Api's SecretRedactor. Without it, the
+// `sk-` substring in a structural identifier such as `task-skill-contract`
+// is mistaken for a provider credential and corrupts the artifact after it has
+// already passed schema validation.
+const providerKeyPattern = /(?<![a-zA-Z0-9])sk-[a-zA-Z0-9_-]{12,}/g;
 export function redactSecrets(value, exactSecrets = []) {
     return redactValue(value, exactSecrets);
 }
 export function redactText(value, exactSecrets = []) {
-    let redacted = value;
+    let redacted = value.replace(serializedAttachmentContentPattern, "$1[REDACTED]$2");
     for (const secret of exactSecrets) {
         if (secret.length > 0) {
             redacted = redacted.split(secret).join("[REDACTED]");
         }
     }
     return redacted
-        .replace(/(api[_-]?key|authorization|bearer|client[_-]?secret|password|secret|token)(["':=\s]+)([^"',\s]+)/gi, "$1$2[REDACTED]")
-        .replace(/(sk-[a-zA-Z0-9_-]{12,})/g, "[REDACTED]");
+        .replace(authorizationCredentialPattern, "$1[REDACTED]")
+        .replace(bearerCredentialPattern, "$1[REDACTED]")
+        .replace(secretAssignmentPattern, "$1$2[REDACTED]")
+        .replace(providerKeyPattern, "[REDACTED]");
 }
 function redactValue(value, exactSecrets) {
     if (typeof value === "string") {
@@ -25,6 +37,6 @@ function redactValue(value, exactSecrets) {
     }
     return Object.fromEntries(Object.entries(value).map(([key, item]) => [
         key,
-        secretKeyPattern.test(key) ? "[REDACTED]" : redactValue(item, exactSecrets)
+        secretKeyPattern.test(key) || attachmentContentKeyPattern.test(key) ? "[REDACTED]" : redactValue(item, exactSecrets)
     ]));
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const forgeBridgeVersion = "0.1.3-dev.b6be5e7f9668";
+export declare const forgeBridgeVersion = "0.1.3-dev.ba293ccf876b";

package/dist/version.js

@@ -1 +1 @@
-export const forgeBridgeVersion = "0.1.3-dev.b6be5e7f9668";
+export const forgeBridgeVersion = "0.1.3-dev.ba293ccf876b";

package/dist/worktree/artifact-injector.d.ts

@@ -1,9 +1,10 @@
 import type { DispatchResolvedArtifact } from "../session/session.types.js";
-export declare function injectWorktreeArtifacts(worktreePath: string, artifacts: readonly DispatchResolvedArtifact[]): Promise<void>;
+export declare function injectWorktreeArtifacts(worktreePath: string, artifacts: readonly DispatchResolvedArtifact[], protectedRelativePaths?: ReadonlySet<string>): Promise<void>;
 export declare function filterArtifactsForLane(artifacts: readonly DispatchResolvedArtifact[], lane: string, phase: string): readonly DispatchResolvedArtifact[];
-export declare function writeArtifact(worktreePath: string, artifact: DispatchResolvedArtifact): Promise<void>;
+export declare function writeArtifact(worktreePath: string, artifact: DispatchResolvedArtifact, protectedRelativePaths?: ReadonlySet<string>): Promise<void>;
 export declare function selectLaneCommand(artifacts: readonly DispatchResolvedArtifact[], lane: string, phase: string): DispatchResolvedArtifact | undefined;
 export declare function resolveCommandSlug(lane: string, phase: string): string;
+export declare function artifactExecutionBody(artifact: DispatchResolvedArtifact): string;
 export declare function buildSpecBody(laneCommand: DispatchResolvedArtifact, workItem: {
     readonly id: string;
     readonly title: string;

package/dist/worktree/artifact-injector.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import { spawn } from "node:child_process";
 import fs from "node:fs/promises";
 import path from "node:path";
 const DEBUG_OPERATIONAL_SKILLS = new Set(["debug-repro", "debug-root-cause", "debug-fix", "debug-regression"]);
@@ -36,22 +37,32 @@ const DRAFT_OPERATIONAL_SKILLS = new Set([
     "draft-repo-context",
     "draft-graph-context",
     "draft-product-scope",
-    "draft-work-order-plan",
     "draft-critic",
     "draft-proposal"
 ]);
+const DRAFT_WORK_ITEM_OPERATIONAL_SKILLS = new Set([
+    "draft-work-item-plan"
+]);
+const DRAFT_WORK_ORDER_OPERATIONAL_SKILLS = new Set([
+    "draft-work-order-plan"
+]);
 const DRAFT_OPERATIONAL_HOOKS = new Set([
     "draft-intent",
     "draft-repo-context",
     "draft-graph-context",
     "draft-product-scope",
-    "draft-work-order-plan",
     "draft-critic",
     "draft-proposal"
 ]);
-export async function injectWorktreeArtifacts(worktreePath, artifacts) {
+const DRAFT_WORK_ITEM_OPERATIONAL_HOOKS = new Set([
+    "draft-work-item-plan"
+]);
+const DRAFT_WORK_ORDER_OPERATIONAL_HOOKS = new Set([
+    "draft-work-order-plan"
+]);
+export async function injectWorktreeArtifacts(worktreePath, artifacts, protectedRelativePaths = new Set()) {
     for (const artifact of artifacts) {
-        await writeArtifact(worktreePath, artifact);
+        await writeArtifact(worktreePath, artifact, protectedRelativePaths);
     }
 }
 export function filterArtifactsForLane(artifacts, lane, phase) {
@@ -64,11 +75,11 @@ export function filterArtifactsForLane(artifacts, lane, phase) {
         return artifacts.filter((artifact) => shouldInjectArchitectArtifact(artifact, commandSlug));
     }
     if (normalizedLane === "draft") {
-        return artifacts.filter((artifact) => shouldInjectDraftArtifact(artifact, commandSlug));
+        return artifacts.filter((artifact) => shouldInjectDraftArtifact(artifact, commandSlug, phase));
     }
     return artifacts;
 }
-export async function writeArtifact(worktreePath, artifact) {
+export async function writeArtifact(worktreePath, artifact, protectedRelativePaths = new Set()) {
     const writtenHash = sha256(artifact.body);
     if (writtenHash !== artifact.contentHash.toLowerCase()) {
         throw new Error(`Injected artifact '${artifact.slug}' content_hash mismatch (expected ${artifact.contentHash}, got ${writtenHash}).`);
@@ -83,6 +94,11 @@ export async function writeArtifact(worktreePath, artifact) {
         ? path.resolve(scopeDir, slug, "SKILL.md")
         : path.resolve(scopeDir, `${slug}.md`);
     assertInside(forgeRoot, filePath, "Artifact file");
+    const relativePath = path.relative(worktreePath, filePath).replaceAll(path.sep, "/");
+    if (protectedRelativePaths.has(relativePath)) {
+        await restoreTrackedArtifactIfItMatchesManagedBody(worktreePath, filePath, relativePath, artifact);
+        return;
+    }
     await fs.mkdir(path.dirname(filePath), { recursive: true });
     await fs.writeFile(filePath, artifact.body, "utf8");
 }
@@ -110,6 +126,39 @@ export function resolveCommandSlug(lane, phase) {
             return "dev-prompt";
     }
 }
+async function restoreTrackedArtifactIfItMatchesManagedBody(worktreePath, filePath, relativePath, artifact) {
+    const current = await fs.readFile(filePath, "utf8").catch(() => null);
+    if (current === null
+        || (current !== artifact.body && current !== artifactExecutionBody(artifact)))
+        return;
+    const result = await new Promise((resolve) => {
+        const child = spawn("git", ["show", `HEAD:${relativePath}`], {
+            cwd: worktreePath,
+            windowsHide: true,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        let stdout = "";
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", chunk => { stdout += chunk; });
+        child.on("error", () => resolve({ exitCode: 1, stdout: "" }));
+        child.on("close", code => resolve({ exitCode: code ?? 1, stdout }));
+    });
+    if (result.exitCode === 0)
+        await fs.writeFile(filePath, result.stdout, "utf8");
+}
+export function artifactExecutionBody(artifact) {
+    const content = artifact.body;
+    if (!content.startsWith("---"))
+        return content;
+    const end = content.indexOf("\n---", 3);
+    if (end < 3)
+        return content;
+    let bodyStart = end + 4;
+    while (bodyStart < content.length && (content[bodyStart] === "\n" || content[bodyStart] === "\r")) {
+        bodyStart += 1;
+    }
+    return content.slice(bodyStart);
+}
 function shouldInjectDebugArtifact(artifact, commandSlug) {
     if (artifact.scope.trim().toLowerCase() !== "operational") {
         return false;
@@ -142,7 +191,7 @@ function shouldInjectArchitectArtifact(artifact, commandSlug) {
             return false;
     }
 }
-function shouldInjectDraftArtifact(artifact, commandSlug) {
+function shouldInjectDraftArtifact(artifact, commandSlug, phase) {
     if (artifact.scope.trim().toLowerCase() !== "operational") {
         return false;
     }
@@ -151,15 +200,38 @@ function shouldInjectDraftArtifact(artifact, commandSlug) {
         case "command":
             return slug === commandSlug;
         case "skill":
-            return DRAFT_OPERATIONAL_SKILLS.has(slug);
+            return DRAFT_OPERATIONAL_SKILLS.has(slug) || draftPhaseSkills(phase).has(slug);
         case "hook":
-            return DRAFT_OPERATIONAL_HOOKS.has(slug);
+            return DRAFT_OPERATIONAL_HOOKS.has(slug) || draftPhaseHooks(phase).has(slug);
         default:
             return false;
     }
 }
+function draftPhaseSkills(phase) {
+    switch (normalizeDraftPhase(phase)) {
+        case "work_order":
+            return DRAFT_WORK_ORDER_OPERATIONAL_SKILLS;
+        case "story":
+            return DRAFT_WORK_ITEM_OPERATIONAL_SKILLS;
+        default:
+            return DRAFT_WORK_ITEM_OPERATIONAL_SKILLS;
+    }
+}
+function draftPhaseHooks(phase) {
+    switch (normalizeDraftPhase(phase)) {
+        case "work_order":
+            return DRAFT_WORK_ORDER_OPERATIONAL_HOOKS;
+        case "story":
+            return DRAFT_WORK_ITEM_OPERATIONAL_HOOKS;
+        default:
+            return DRAFT_WORK_ITEM_OPERATIONAL_HOOKS;
+    }
+}
+function normalizeDraftPhase(phase) {
+    return phase.trim().toLowerCase().replaceAll("-", "_");
+}
 export function buildSpecBody(laneCommand, workItem, phase = "implementation") {
-    const prompt = laneCommand.body.replaceAll("{workItemId}", workItem.id);
+    const prompt = artifactExecutionBody(laneCommand).replaceAll("{workItemId}", workItem.id);
     return `---
 work_item_id: ${workItem.id}
 status: approved

package/dist/worktree/dependency-warmer.d.ts

@@ -9,6 +9,13 @@ export interface WarmDependenciesRequest {
     readonly worktreePath: string;
     readonly allowedRoot: string;
     readonly warmPathOverrides?: readonly string[];
+    readonly preparationPolicy?: DependencyPreparationPolicy;
+}
+export interface DependencyPreparationPolicy {
+    readonly isolation?: string;
+    readonly trustDomain?: string;
+    readonly invalidationEpoch?: string;
+    readonly toolchainVersions?: Readonly<Partial<Record<DependencyEcosystem | "npm" | "pnpm", string>>>;
 }
 export interface InstallFallbackResult {
     readonly ecosystem: DependencyEcosystem;
@@ -20,9 +27,23 @@ export interface WarmDependenciesResult {
     readonly linked: readonly string[];
     readonly skipped: readonly string[];
     readonly fallbacks: readonly InstallFallbackResult[];
+    readonly receipts: readonly DependencyPreparationReceiptResult[];
+}
+export interface DependencyPreparationReceiptResult {
+    readonly ecosystem: DependencyEcosystem;
+    readonly packageRoot: string;
+    readonly command: string;
+    readonly cacheHit: boolean;
+    readonly fingerprint: string;
+    readonly receiptPath: string;
+    /** End-to-end receipt lookup/preparation time, including coordinator wait. */
+    readonly durationMs: number;
 }
 export interface CommandExecutor {
-    run(cwd: string, command: string, args: readonly string[]): Promise<void>;
+    run(cwd: string, command: string, args: readonly string[], options?: CommandExecutionOptions): Promise<void>;
+}
+export interface CommandExecutionOptions {
+    readonly env?: NodeJS.ProcessEnv;
 }
 export declare function detectWarmPaths(repoRoot: string, warmPathOverrides?: readonly string[]): Promise<WarmPathEntry[]>;
 export declare function warmWorktreeDependencies(request: WarmDependenciesRequest, executor?: CommandExecutor): Promise<WarmDependenciesResult>;
@@ -30,3 +51,20 @@ export declare function createDirectoryLink(sourcePath: string, targetPath: stri
 export declare function lockfilesDiffer(baseCheckoutPath: string, worktreePath: string, packageRootRelative: string): Promise<boolean>;
 export declare function requiresInstallFallback(entry: WarmPathEntry, baseCheckoutPath: string, worktreePath: string, sourceExists: boolean): Promise<string | null>;
 export declare function declaresNativeModules(packageRootPath: string): Promise<boolean>;
+export interface NpmLaunchOptions {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly execPath?: string;
+    readonly platform?: NodeJS.Platform;
+    readonly homeDir?: string;
+    readonly candidates?: readonly string[];
+}
+export declare function resolveNpmLaunch(args: readonly string[], options?: NpmLaunchOptions): {
+    command: string;
+    args: readonly string[];
+};
+export declare function resolvePnpmLaunch(args: readonly string[]): {
+    command: string;
+    args: readonly string[];
+};
+export declare function formatCommandFailureOutput(stdout: string, stderr: string): string;
+export declare function unattendedPackageManagerEnvironment(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;