@loucompanion/forge-bridge 0.1.3-dev.b6be5e7f9668 → 0.1.3-dev.ba7d36726eda

package/dist/runtime/host-runtime-promotion.d.ts

@@ -0,0 +1,21 @@
+import type { LoadedHostRuntimeContract } from "./host-runtime-contract.js";
+export interface HostParallelPromotionRecord {
+    readonly schemaVersion: 1;
+    readonly repoId: string;
+    readonly runtimeContractFingerprint: string;
+    readonly observedAt: string;
+    readonly observedDispatchAttemptId: string;
+    readonly verifiedPortNames: readonly string[];
+}
+/** Persists only observed, contract-bound host parallel-safety evidence. */
+export declare class HostParallelPromotionStore {
+    private readonly stateRoot;
+    constructor(stateRoot: string);
+    load(repoId: string): Promise<HostParallelPromotionRecord | null>;
+    observe(repoId: string, runtimeContract: LoadedHostRuntimeContract, dispatchAttemptId: string, verifiedPortNames: readonly string[]): Promise<HostParallelPromotionRecord>;
+    invalidate(repoId: string): Promise<void>;
+    private recordPath;
+}
+export declare function hostRuntimeContractFingerprint(runtimeContract: LoadedHostRuntimeContract): string;
+export declare function hostRuntimeParallelEligible(runtimeContract: LoadedHostRuntimeContract): boolean;
+export declare function configuredLaunchPortNames(runtimeContract: LoadedHostRuntimeContract): readonly string[];

package/dist/runtime/host-runtime-promotion.js

@@ -0,0 +1,128 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+/** Persists only observed, contract-bound host parallel-safety evidence. */
+export class HostParallelPromotionStore {
+    stateRoot;
+    constructor(stateRoot) {
+        this.stateRoot = stateRoot;
+    }
+    async load(repoId) {
+        const normalizedRepoId = normalizeRepoId(repoId);
+        try {
+            const parsed = JSON.parse(await fs.readFile(this.recordPath(normalizedRepoId), "utf8"));
+            return validRecord(parsed, normalizedRepoId) ? parsed : null;
+        }
+        catch (error) {
+            if (error.code === "ENOENT" || error instanceof SyntaxError)
+                return null;
+            throw error;
+        }
+    }
+    async observe(repoId, runtimeContract, dispatchAttemptId, verifiedPortNames) {
+        if (!hostRuntimeParallelEligible(runtimeContract)) {
+            throw new Error("host_parallel_promotion_ineligible: the runtime contract is not eligible for parallel host execution.");
+        }
+        const requiredPorts = configuredLaunchPortNames(runtimeContract);
+        const observedPorts = [...new Set(verifiedPortNames)].sort((left, right) => left.localeCompare(right));
+        if (requiredPorts.length !== observedPorts.length
+            || requiredPorts.some((name, index) => name !== observedPorts[index])) {
+            throw new Error("host_parallel_promotion_unverified: every configured runtime listener must pass its assigned-port probe.");
+        }
+        const normalizedRepoId = normalizeRepoId(repoId);
+        const record = {
+            schemaVersion: 1,
+            repoId: normalizedRepoId,
+            runtimeContractFingerprint: hostRuntimeContractFingerprint(runtimeContract),
+            observedAt: new Date().toISOString(),
+            observedDispatchAttemptId: normalizedUuid(dispatchAttemptId, "dispatch attempt"),
+            verifiedPortNames: observedPorts,
+        };
+        const target = this.recordPath(normalizedRepoId);
+        const root = path.dirname(target);
+        await ensurePrivateDirectory(root);
+        const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+        try {
+            const handle = await fs.open(temporary, "wx", 0o600);
+            try {
+                await handle.writeFile(`${JSON.stringify(record)}\n`, "utf8");
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await fs.rename(temporary, target);
+            return record;
+        }
+        catch (error) {
+            await fs.rm(temporary, { force: true }).catch(() => undefined);
+            throw error;
+        }
+    }
+    async invalidate(repoId) {
+        await fs.rm(this.recordPath(normalizeRepoId(repoId)), { force: true });
+    }
+    recordPath(normalizedRepoId) {
+        const key = createHash("sha256").update(normalizedRepoId).digest("hex");
+        return path.join(this.stateRoot, "runtime-promotion", "host", `${key}.json`);
+    }
+}
+export function hostRuntimeContractFingerprint(runtimeContract) {
+    const canonical = JSON.stringify({
+        schemaVersion: runtimeContract.contract.schemaVersion,
+        runtime: runtimeContract.contract.runtime,
+    });
+    return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
+}
+export function hostRuntimeParallelEligible(runtimeContract) {
+    const runtime = runtimeContract.contract.runtime;
+    return runtimeContract.source === "project"
+        && runtime.hostConcurrency === "parallel"
+        && runtime.browserProfile === "isolated"
+        && runtime.singletonResources.length === 0
+        && runtime.ports.length === 1
+        && runtime.ports[0]?.adapter !== null
+        && runtime.ports[0]?.launch !== null;
+}
+export function configuredLaunchPortNames(runtimeContract) {
+    return runtimeContract.contract.runtime.ports
+        .filter(port => port.launch !== null)
+        .map(port => port.name)
+        .sort((left, right) => left.localeCompare(right));
+}
+function validRecord(value, repoId) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    return record.schemaVersion === 1
+        && record.repoId === repoId
+        && /^sha256:[0-9a-f]{64}$/u.test(record.runtimeContractFingerprint ?? "")
+        && Number.isFinite(Date.parse(record.observedAt ?? ""))
+        && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u.test(record.observedDispatchAttemptId ?? "")
+        && Array.isArray(record.verifiedPortNames)
+        && record.verifiedPortNames.length > 0
+        && record.verifiedPortNames.length <= 16
+        && record.verifiedPortNames.every(name => typeof name === "string" && /^[a-z][a-z0-9_-]{0,63}$/u.test(name));
+}
+function normalizeRepoId(repoId) {
+    const normalized = repoId.trim().toLowerCase();
+    if (!normalized || normalized.length > 512 || Array.from(normalized).some(character => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint < 32 || codePoint === 127;
+    })) {
+        throw new Error("host_parallel_promotion_invalid: repository identity is invalid.");
+    }
+    return normalized;
+}
+function normalizedUuid(value, label) {
+    const normalized = value.trim().toLowerCase();
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u.test(normalized)) {
+        throw new Error(`host_parallel_promotion_invalid: ${label} must be a full UUID.`);
+    }
+    return normalized;
+}
+async function ensurePrivateDirectory(target) {
+    await fs.mkdir(target, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32")
+        await fs.chmod(target, 0o700);
+}

package/dist/runtime/node-host-runtime-adapter.d.ts

@@ -0,0 +1,44 @@
+import { HostPortBroker, type HostPortLaunch, type HostPortLeaseOwner, type HostPortReservation } from "./host-port-broker.js";
+import { type HostRuntimePortAdapter, type HostRuntimePortConfig } from "./host-runtime-contract.js";
+export type HostListenerOwnership = "unbound" | "owned" | "foreign";
+export interface NodeRuntimeCommand {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+    readonly environment?: Readonly<Record<string, string>>;
+}
+export interface NodeRuntimeLaunchRequest extends NodeRuntimeCommand {
+    readonly framework: HostRuntimePortAdapter;
+    readonly port: HostPortReservation;
+    readonly baseUrl: string;
+}
+export interface NodeRuntimeCommandLauncher<T> {
+    readonly launch: (request: NodeRuntimeLaunchRequest, signal?: AbortSignal) => Promise<T>;
+    readonly inspectListener: (value: T, request: NodeRuntimeLaunchRequest, signal?: AbortSignal) => Promise<HostListenerOwnership>;
+    readonly stop: (value: T) => Promise<void>;
+}
+export interface NodeHostRuntimeAdapterOptions {
+    readonly readinessTimeoutMs?: number;
+    readonly readinessPollIntervalMs?: number;
+    readonly httpProbeTimeoutMs?: number;
+    readonly probeHttp?: (url: string, timeoutMs: number, signal?: AbortSignal) => Promise<boolean>;
+}
+export interface NodeRuntimeAdapterLaunch<T> extends HostPortLaunch<T> {
+    readonly request: NodeRuntimeLaunchRequest;
+}
+/**
+ * Launches an explicitly configured HTTP project command beneath the caller's
+ * attempt supervisor. It never shells a command and never promotes a project
+ * by framework detection alone.
+ */
+export declare class NodeHostRuntimeAdapter {
+    private readonly broker;
+    private readonly readinessTimeoutMs;
+    private readonly readinessPollIntervalMs;
+    private readonly httpProbeTimeoutMs;
+    private readonly probeHttp;
+    constructor(broker: HostPortBroker, options?: NodeHostRuntimeAdapterOptions);
+    launch<T>(owner: HostPortLeaseOwner, portConfig: HostRuntimePortConfig, command: NodeRuntimeCommand, launcher: NodeRuntimeCommandLauncher<T>, signal?: AbortSignal): Promise<NodeRuntimeAdapterLaunch<T>>;
+    private waitUntilReady;
+}
+export declare function buildNodeRuntimeLaunchRequest(framework: HostRuntimePortAdapter, portConfig: HostRuntimePortConfig, command: NodeRuntimeCommand, port: HostPortReservation): NodeRuntimeLaunchRequest;

package/dist/runtime/node-host-runtime-adapter.js

@@ -0,0 +1,205 @@
+import path from "node:path";
+import { hostPortEnvironment, } from "./host-runtime-contract.js";
+/**
+ * Launches an explicitly configured HTTP project command beneath the caller's
+ * attempt supervisor. It never shells a command and never promotes a project
+ * by framework detection alone.
+ */
+export class NodeHostRuntimeAdapter {
+    broker;
+    readinessTimeoutMs;
+    readinessPollIntervalMs;
+    httpProbeTimeoutMs;
+    probeHttp;
+    constructor(broker, options = {}) {
+        this.broker = broker;
+        this.readinessTimeoutMs = boundedInteger(options.readinessTimeoutMs ?? 30_000, 100, 120_000, "readinessTimeoutMs");
+        this.readinessPollIntervalMs = boundedInteger(options.readinessPollIntervalMs ?? 100, 10, 5_000, "readinessPollIntervalMs");
+        this.httpProbeTimeoutMs = boundedInteger(options.httpProbeTimeoutMs ?? 1_000, 50, 10_000, "httpProbeTimeoutMs");
+        this.probeHttp = options.probeHttp ?? probeHttpReadiness;
+    }
+    async launch(owner, portConfig, command, launcher, signal) {
+        const framework = portConfig.adapter;
+        if (framework !== "node" && framework !== "vite" && framework !== "next" && framework !== "aspnetcore") {
+            throw new Error("node_runtime_adapter_invalid: port config must explicitly select node, vite, next, or aspnetcore.");
+        }
+        validateCommand(command);
+        if (!portConfig.baseUrlEnv || !portConfig.format) {
+            throw new Error("node_runtime_adapter_invalid: an HTTP baseUrlEnv and loopback format are required.");
+        }
+        let activeRequest = null;
+        const launched = await this.broker.launchWithRetry(owner, {
+            name: portConfig.name,
+            protocol: "tcp",
+        }, {
+            launch: async (port, launchSignal) => {
+                const request = buildNodeRuntimeLaunchRequest(framework, portConfig, command, port);
+                activeRequest = request;
+                return await launcher.launch(request, launchSignal);
+            },
+            verifyOwnership: async (value, _port, verifySignal) => {
+                if (!activeRequest)
+                    throw new Error("node_runtime_adapter_state: launch request was not recorded.");
+                return await this.waitUntilReady(value, activeRequest, launcher, verifySignal);
+            },
+            stop: launcher.stop,
+        }, signal);
+        if (!activeRequest)
+            throw new Error("node_runtime_adapter_state: active launch request is missing.");
+        return { ...launched, request: activeRequest };
+    }
+    async waitUntilReady(value, request, launcher, signal) {
+        const deadline = Date.now() + this.readinessTimeoutMs;
+        while (Date.now() <= deadline) {
+            if (signal?.aborted)
+                throw cancellationError(signal);
+            const ownership = await launcher.inspectListener(value, request, signal);
+            if (ownership === "foreign")
+                return false;
+            if (ownership === "owned" && await this.probeHttp(request.baseUrl, this.httpProbeTimeoutMs, signal)) {
+                return true;
+            }
+            await wait(this.readinessPollIntervalMs, signal);
+        }
+        return false;
+    }
+}
+export function buildNodeRuntimeLaunchRequest(framework, portConfig, command, port) {
+    validateCommand(command);
+    if (port.hostIp !== "127.0.0.1" || port.protocol !== "tcp") {
+        throw new Error("node_runtime_adapter_invalid: project adapters require a TCP IPv4 loopback reservation.");
+    }
+    if (!portConfig.baseUrlEnv || !portConfig.format) {
+        throw new Error("node_runtime_adapter_invalid: an HTTP baseUrlEnv and loopback format are required.");
+    }
+    rejectConflictingFrameworkArguments(framework, command.args);
+    const portEnvironment = hostPortEnvironment(portConfig, port.hostIp, port.hostPort);
+    const baseUrl = portEnvironment[portConfig.baseUrlEnv];
+    if (!baseUrl)
+        throw new Error("node_runtime_adapter_invalid: base URL environment could not be rendered.");
+    const args = framework === "aspnetcore"
+        ? aspNetCoreArguments(command.command, command.args)
+        : [...command.args, ...frameworkArguments(framework, port.hostIp, port.hostPort)];
+    const adapterEnvironment = framework === "aspnetcore"
+        ? { ASPNETCORE_URLS: baseUrl, DOTNET_NOLOGO: "1" }
+        : { HOST: port.hostIp };
+    return {
+        framework,
+        command: command.command,
+        args,
+        cwd: path.resolve(command.cwd),
+        environment: {
+            ...command.environment,
+            ...portEnvironment,
+            ...adapterEnvironment,
+            FORGE_RUNTIME_PORT_NAME: portConfig.name,
+            FORGE_RUNTIME_PORT: String(port.hostPort),
+            FORGE_RUNTIME_BASE_URL: baseUrl,
+        },
+        port,
+        baseUrl,
+    };
+}
+function frameworkArguments(framework, hostIp, hostPort) {
+    if (framework === "vite")
+        return ["--host", hostIp, "--port", String(hostPort), "--strictPort"];
+    if (framework === "next")
+        return ["--hostname", hostIp, "--port", String(hostPort)];
+    return [];
+}
+function rejectConflictingFrameworkArguments(framework, args) {
+    if (framework === "aspnetcore") {
+        const forbidden = new Set(["--urls", "--launch-profile", "-lp", "--no-launch-profile"]);
+        const conflict = args.find(argument => forbidden.has(argument)
+            || [...forbidden].some(flag => argument.startsWith(`${flag}=`)));
+        if (conflict) {
+            throw new Error(`node_runtime_adapter_invalid: command already supplies Forge-owned argument '${conflict}'.`);
+        }
+        return;
+    }
+    if (framework === "node")
+        return;
+    const forbidden = framework === "vite"
+        ? new Set(["--host", "--port", "--strictPort"])
+        : new Set(["--hostname", "--port", "-H", "-p"]);
+    const conflict = args.find(argument => forbidden.has(argument) || [...forbidden].some(flag => argument.startsWith(`${flag}=`)));
+    if (conflict) {
+        throw new Error(`node_runtime_adapter_invalid: command already supplies Forge-owned argument '${conflict}'.`);
+    }
+}
+function aspNetCoreArguments(command, args) {
+    const executable = path.basename(command).toLowerCase();
+    if (executable !== "dotnet" && executable !== "dotnet.exe") {
+        throw new Error("node_runtime_adapter_invalid: aspnetcore adapter requires the dotnet executable.");
+    }
+    if (args[0]?.toLowerCase() !== "run") {
+        throw new Error("node_runtime_adapter_invalid: aspnetcore adapter requires a dotnet run command.");
+    }
+    const applicationArguments = args.indexOf("--");
+    const insertionIndex = applicationArguments < 0 ? args.length : applicationArguments;
+    return [
+        ...args.slice(0, insertionIndex),
+        "--no-launch-profile",
+        ...args.slice(insertionIndex),
+    ];
+}
+function validateCommand(command) {
+    if (!boundedText(command.command, 1024)
+        || !path.isAbsolute(command.cwd)
+        || command.args.length > 128
+        || command.args.some(argument => !boundedText(argument, 4096))) {
+        throw new Error("node_runtime_adapter_invalid: command, arguments, or absolute working directory are invalid.");
+    }
+    for (const [name, value] of Object.entries(command.environment ?? {})) {
+        if (!/^[A-Z_][A-Z0-9_]{0,127}$/u.test(name) || !boundedText(value, 8192)) {
+            throw new Error("node_runtime_adapter_invalid: command environment is invalid.");
+        }
+    }
+}
+async function probeHttpReadiness(url, timeoutMs, signal) {
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+    try {
+        const response = await fetch(url, { redirect: "manual", signal: combined });
+        await response.body?.cancel().catch(() => undefined);
+        return true;
+    }
+    catch (_error) {
+        if (signal?.aborted)
+            throw cancellationError(signal);
+        return false;
+    }
+}
+function wait(milliseconds, signal) {
+    if (signal?.aborted)
+        return Promise.reject(cancellationError(signal));
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", abort);
+            resolve();
+        }, milliseconds);
+        const abort = () => {
+            clearTimeout(timer);
+            reject(cancellationError(signal));
+        };
+        signal?.addEventListener("abort", abort, { once: true });
+    });
+}
+function boundedInteger(value, minimum, maximum, name) {
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+        throw new Error(`node_runtime_adapter_invalid: ${name} must be between ${minimum} and ${maximum}.`);
+    }
+    return value;
+}
+function boundedText(value, maximumLength) {
+    return typeof value === "string"
+        && value.length > 0
+        && value.length <= maximumLength
+        && Array.from(value).every(character => {
+            const codePoint = character.codePointAt(0) ?? 0;
+            return codePoint > 31 && codePoint !== 127;
+        });
+}
+function cancellationError(signal) {
+    return new Error(String(signal?.reason ?? "Node runtime launch cancelled."));
+}

package/dist/runtime/playwright-host-runtime-adapter.d.ts

@@ -0,0 +1,20 @@
+import type { HostRuntimePlaywrightConfig } from "./host-runtime-contract.js";
+export interface PlaywrightHostRuntimeContext {
+    readonly worktreePath: string;
+    readonly temporaryDirectory: string;
+    readonly testOutputDirectory: string;
+    readonly browserProfileDirectory: string;
+    readonly baseUrl: string;
+}
+export interface PreparedPlaywrightHostRuntime {
+    readonly configPath: string;
+    readonly environment: Readonly<Record<string, string>>;
+}
+/**
+ * Prepares a finite Playwright test boundary for a managed-host attempt.
+ * The generated overlay points tests at Forge's verified listener, disables
+ * Playwright-managed web servers, and keeps writable artifacts attempt-local.
+ */
+export declare class PlaywrightHostRuntimeAdapter {
+    prepare(config: HostRuntimePlaywrightConfig, context: PlaywrightHostRuntimeContext): Promise<PreparedPlaywrightHostRuntime>;
+}

package/dist/runtime/playwright-host-runtime-adapter.js

@@ -0,0 +1,136 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+const maximumConfigBytes = 1024 * 1024;
+/**
+ * Prepares a finite Playwright test boundary for a managed-host attempt.
+ * The generated overlay points tests at Forge's verified listener, disables
+ * Playwright-managed web servers, and keeps writable artifacts attempt-local.
+ */
+export class PlaywrightHostRuntimeAdapter {
+    async prepare(config, context) {
+        const worktreePath = path.resolve(context.worktreePath);
+        const sourceConfig = path.resolve(worktreePath, config.config);
+        const [realWorktree, realSource] = await Promise.all([
+            fs.realpath(worktreePath),
+            fs.realpath(sourceConfig),
+        ]);
+        assertContained(realWorktree, realSource, "project Playwright config");
+        const sourceStat = await fs.stat(realSource);
+        if (!sourceStat.isFile() || sourceStat.size < 1 || sourceStat.size > maximumConfigBytes) {
+            throw new Error(`playwright_runtime_adapter_invalid: project config must be a regular 1-${maximumConfigBytes} byte file.`);
+        }
+        const temporaryDirectory = await realContainedDirectory(context.temporaryDirectory, realWorktree, "temporary directory");
+        const testOutputDirectory = await realContainedDirectory(context.testOutputDirectory, realWorktree, "test output directory");
+        const browserProfileDirectory = await realContainedDirectory(context.browserProfileDirectory, realWorktree, "browser profile directory");
+        const attemptRoot = path.dirname(temporaryDirectory);
+        if (path.dirname(testOutputDirectory) !== attemptRoot || path.dirname(browserProfileDirectory) !== attemptRoot) {
+            throw new Error("playwright_runtime_adapter_invalid: writable directories must belong to the same attempt root.");
+        }
+        const baseUrl = loopbackHttpUrl(context.baseUrl);
+        const overlayPath = path.join(temporaryDirectory, "forge.playwright.config.mjs");
+        await fs.writeFile(overlayPath, renderOverlay({
+            projectConfigUrl: pathToFileURL(realSource).href,
+            projectConfigDirectory: path.dirname(realSource),
+            testOutputDirectory,
+            baseUrl,
+            workers: config.workers,
+        }), { encoding: "utf8", mode: 0o600 });
+        return {
+            configPath: overlayPath,
+            environment: {
+                FORGE_PLAYWRIGHT_CONFIG: overlayPath,
+                FORGE_PLAYWRIGHT_BASE_URL: baseUrl,
+                PLAYWRIGHT_HTML_OUTPUT_DIR: path.join(testOutputDirectory, "html-report"),
+                PLAYWRIGHT_BLOB_OUTPUT_DIR: path.join(testOutputDirectory, "blob-report"),
+                PLAYWRIGHT_JUNIT_OUTPUT_NAME: path.join(testOutputDirectory, "results.xml"),
+                PLAYWRIGHT_JSON_OUTPUT_NAME: path.join(testOutputDirectory, "results.json"),
+                FORGE_BROWSER_PROFILE_DIR: browserProfileDirectory,
+                FORGE_TEST_OUTPUT_DIR: testOutputDirectory,
+            },
+        };
+    }
+}
+function renderOverlay(values) {
+    return [
+        "// Generated by forge-bridge for one fenced host attempt.",
+        "import path from \"node:path\";",
+        `import projectConfig from ${JSON.stringify(values.projectConfigUrl)};`,
+        `const projectConfigDirectory = ${JSON.stringify(values.projectConfigDirectory)};`,
+        "const resolveConfigPath = value => typeof value === \"string\" && !path.isAbsolute(value)",
+        "  ? path.resolve(projectConfigDirectory, value)",
+        "  : value;",
+        "const resolveModulePath = value => typeof value === \"string\" && value.startsWith(\".\")",
+        "  ? path.resolve(projectConfigDirectory, value)",
+        "  : value;",
+        "const resolveUse = use => ({",
+        "  ...(use ?? {}),",
+        "  storageState: typeof use?.storageState === \"string\" ? resolveConfigPath(use.storageState) : use?.storageState,",
+        "  baseURL: " + JSON.stringify(values.baseUrl) + ",",
+        "});",
+        "const forgeUse = resolveUse(projectConfig.use);",
+        "const forgeProjects = Array.isArray(projectConfig.projects)",
+        "  ? projectConfig.projects.map(project => ({",
+        "      ...project,",
+        "      testDir: resolveConfigPath(project.testDir),",
+        "      snapshotDir: resolveConfigPath(project.snapshotDir),",
+        "      use: resolveUse(project.use),",
+        "    }))",
+        "  : projectConfig.projects;",
+        "const forgeReporter = Array.isArray(projectConfig.reporter)",
+        "  ? projectConfig.reporter.map(reporter => Array.isArray(reporter)",
+        "      ? [resolveModulePath(reporter[0]), ...reporter.slice(1)]",
+        "      : resolveModulePath(reporter))",
+        "  : resolveModulePath(projectConfig.reporter);",
+        "export default {",
+        "  ...projectConfig,",
+        "  testDir: resolveConfigPath(projectConfig.testDir),",
+        "  snapshotDir: resolveConfigPath(projectConfig.snapshotDir),",
+        "  globalSetup: resolveModulePath(projectConfig.globalSetup),",
+        "  globalTeardown: resolveModulePath(projectConfig.globalTeardown),",
+        "  reporter: forgeReporter,",
+        `  outputDir: ${JSON.stringify(values.testOutputDirectory)},`,
+        `  workers: ${values.workers},`,
+        "  webServer: undefined,",
+        "  use: forgeUse,",
+        "  projects: forgeProjects,",
+        "};",
+        "",
+    ].join("\n");
+}
+async function realContainedDirectory(target, realWorktree, label) {
+    const realTarget = await fs.realpath(path.resolve(target));
+    if (realTarget === realWorktree || isContained(realWorktree, realTarget)) {
+        throw new Error(`playwright_runtime_adapter_invalid: ${label} must be attempt-private and outside the worktree.`);
+    }
+    const stat = await fs.stat(realTarget);
+    if (!stat.isDirectory())
+        throw new Error(`playwright_runtime_adapter_invalid: ${label} must be a directory.`);
+    return realTarget;
+}
+function assertContained(parent, child, label) {
+    if (!isContained(parent, child)) {
+        throw new Error(`playwright_runtime_adapter_invalid: ${label} must stay inside the prepared worktree.`);
+    }
+}
+function isContained(parent, child) {
+    const relative = path.relative(parent, child);
+    return Boolean(relative) && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function loopbackHttpUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("playwright_runtime_adapter_invalid: base URL must be an HTTP loopback URL.");
+    }
+    if ((url.protocol !== "http:" && url.protocol !== "https:")
+        || url.hostname !== "127.0.0.1"
+        || !url.port
+        || url.username
+        || url.password) {
+        throw new Error("playwright_runtime_adapter_invalid: base URL must be an HTTP loopback URL.");
+    }
+    return url.href.replace(/\/$/u, "");
+}

package/dist/runtime/runtime-isolation-lease.d.ts

@@ -0,0 +1,67 @@
+export declare const runtimeIsolationLeaseStates: readonly ["reserved", "starting", "active", "releasing", "released", "degraded"];
+export type RuntimeIsolationLeaseState = typeof runtimeIsolationLeaseStates[number];
+export type RuntimeIsolationMode = "docker" | "host";
+export interface RuntimeIsolationPort {
+    readonly name: string;
+    readonly protocol: "tcp" | "udp";
+    readonly hostIp: "127.0.0.1" | "::1";
+    readonly hostPort: number;
+    readonly targetPort: number;
+}
+export interface RuntimeIsolationPath {
+    readonly path: string;
+    readonly role: string;
+}
+export interface RuntimeIsolationDockerResource {
+    readonly type: "container" | "network" | "volume";
+    readonly name: string;
+    readonly role: string;
+    readonly id?: string | null;
+}
+export interface RuntimeIsolationResources {
+    readonly memoryReservationBytes: number;
+    readonly cpuMillis: number;
+    readonly pids: number;
+    readonly ports: readonly RuntimeIsolationPort[];
+    readonly paths: readonly RuntimeIsolationPath[];
+    readonly processSupervisorId: string | null;
+    readonly dockerResources: readonly RuntimeIsolationDockerResource[];
+    readonly singletonKeys: readonly string[];
+}
+export interface RuntimeIsolationLease {
+    readonly schemaVersion: 1;
+    readonly leaseId: string;
+    readonly dispatchAttemptId: string;
+    readonly executionLeaseId: string;
+    readonly fencingToken: string;
+    readonly runnerId: string;
+    readonly runnerInstanceId: string;
+    readonly worktreeKey: string;
+    readonly worktreePath: string;
+    readonly mode: RuntimeIsolationMode;
+    readonly state: RuntimeIsolationLeaseState;
+    readonly createdAt: string;
+    readonly stateChangedAt: string;
+    readonly expiresAt: string;
+    readonly releasedAt: string | null;
+    readonly resources: RuntimeIsolationResources;
+}
+export interface RuntimeIsolationLeaseInput {
+    readonly leaseId: string;
+    readonly dispatchAttemptId: string;
+    readonly executionLeaseId: string;
+    readonly fencingToken: string;
+    readonly runnerId: string;
+    readonly runnerInstanceId: string;
+    readonly worktreeKey: string;
+    readonly worktreePath: string;
+    readonly mode: RuntimeIsolationMode;
+    readonly expiresAt: string;
+    readonly resources: RuntimeIsolationResources;
+    readonly createdAt?: string;
+}
+export declare function createRuntimeIsolationLease(input: RuntimeIsolationLeaseInput): RuntimeIsolationLease;
+export declare function transitionRuntimeIsolationLease(lease: RuntimeIsolationLease, nextState: RuntimeIsolationLeaseState, occurredAt?: string): RuntimeIsolationLease;
+export declare function renewRuntimeIsolationLease(lease: RuntimeIsolationLease, fencingToken: string, expiresAt: string): RuntimeIsolationLease | null;
+export declare function withRuntimeIsolationResources(lease: RuntimeIsolationLease, resources: RuntimeIsolationResources): RuntimeIsolationLease;
+export declare function validRuntimeIsolationLease(value: unknown): value is RuntimeIsolationLease;