@loucompanion/forge-bridge 0.1.3-dev.b6be5e7f9668 → 0.1.3-dev.ba7d36726eda

package/dist/session/session.service.js

@@ -1,12 +1,27 @@
-import { redactSecrets } from "../shared/redaction/redaction.js";
+import { redactRunnerDispatchEvent, redactRunOnceResultPacket } from "./session-redaction.js";
 import { RoutingProviderCliService } from "./provider-cli/provider-cli.service.js";
 import { GitWorktreeService } from "../worktree/worktree.service.js";
+import { SandboxWorkspaceService } from "../sandbox/workspace.service.js";
+import { HostRuntimeAdmissionExpiredError, hostRuntimeEventResources, } from "../runtime/host-runtime-lease.js";
 export class BridgeSessionService {
     worktrees;
     providerCli;
-    constructor(worktrees = new GitWorktreeService(), providerCli = new RoutingProviderCliService()) {
+    hostRuntime;
+    constructor(worktrees = process.env.FORGE_SANDBOX_ID
+        ? new SandboxWorkspaceService()
+        : new GitWorktreeService(), providerCli = new RoutingProviderCliService(), hostRuntime) {
         this.worktrees = worktrees;
         this.providerCli = providerCli;
+        this.hostRuntime = hostRuntime;
+    }
+    async updateLease(dispatchAttemptId, fencingToken, expiresAt) {
+        await this.hostRuntime?.updateLease(dispatchAttemptId, fencingToken, expiresAt);
+    }
+    async reapHostRuntime(options) {
+        return await this.hostRuntime?.reap?.(options) ?? null;
+    }
+    runtimeCapacity() {
+        return this.hostRuntime?.snapshot?.() ?? null;
     }
     async runOnce(dispatch, sink, signal) {
         validateApiKeySecretGrant(dispatch);
@@ -16,7 +31,12 @@ export class BridgeSessionService {
             if (signal?.aborted) {
                 return;
             }
-            const redacted = redactSecrets(event, redactionSecrets);
+            const redacted = redactRunnerDispatchEvent(event, redactionSecrets);
+            events.push(redacted);
+            await sink.emit(redacted);
+        };
+        const emitLifecycle = async (event) => {
+            const redacted = redactRunnerDispatchEvent(event, redactionSecrets);
             events.push(redacted);
             await sink.emit(redacted);
         };
@@ -27,59 +47,142 @@ export class BridgeSessionService {
             content: "forge-bridge accepted run-once dispatch.",
             eventType: "dispatch_accepted"
         });
-        if (dispatch.draft) {
-            const run = await this.providerCli.runDraft({
-                dispatch,
-                emit,
-                signal
+        let worktree = null;
+        let hostSingletonKeys = null;
+        let hostLease = null;
+        try {
+            if (dispatch.sandbox?.executionMode === "host" && this.hostRuntime) {
+                await emitLifecycle({
+                    role: "runner",
+                    kind: "checkpoint",
+                    content: "Evaluating runner-local managed host admission before preparing the worktree.",
+                    eventType: "host_runtime_admission_waiting",
+                });
+                try {
+                    hostSingletonKeys = await this.hostRuntime.acquire(dispatch, signal);
+                }
+                catch (error) {
+                    if (error instanceof HostRuntimeAdmissionExpiredError) {
+                        await emitLifecycle({
+                            role: "runner",
+                            kind: "error",
+                            content: "Managed host admission expired while the project singleton remained busy; no worktree or runtime resources were created.",
+                            eventType: "host_runtime_admission_expired",
+                        }).catch(() => undefined);
+                    }
+                    throw error;
+                }
+                throwIfAborted(signal);
+                await emitLifecycle({
+                    role: "runner",
+                    kind: "checkpoint",
+                    content: hostSingletonKeys.length > 0
+                        ? `Acquired managed host singleton ${hostSingletonKeys.join(", ")}.`
+                        : "Observed assigned-port evidence permits provisional parallel host admission; the prepared runtime contract must still match before launch.",
+                    eventType: "host_runtime_admission_acquired",
+                });
+            }
+            worktree = await this.worktrees.prepare({
+                repo: dispatch.repo,
+                workItem: dispatch.workItem,
+                baseBranch: dispatch.cycleRun.baseBranch || dispatch.cycleRun.requestedBase,
+                worktreeKey: dispatch.lease.worktreeKey,
+                ownerType: dispatch.cycleRun.ownerType ?? dispatch.lease.ownerType ?? null,
+                ownerId: dispatch.cycleRun.ownerId ?? dispatch.lease.ownerId ?? null,
+                lane: dispatch.execution.lane,
+                phase: dispatch.cycleRun.phase,
+                allowedRepoRoot: dispatch.serverLocal.repoRoot,
+                cleanupWorktrees: dispatch.serverLocal.cleanupWorktrees,
+                artifacts: dispatch.artifacts,
+                priorPhaseArtifacts: dispatch.priorPhaseArtifacts,
+                qaRework: dispatch.qaRework,
+                warmPathOverrides: dispatch.warmPathOverrides
             });
+            const providerDispatch = withPreparedQaReworkPacket(dispatch, worktree.qaReworkPacketPath);
             throwIfAborted(signal);
-            return redactSecrets({
-                schemaVersion: 1,
-                exitCode: 0,
-                summary: run.summary,
-                events,
-                spec: run.spec ?? null,
-                artifact: run.artifact ?? null,
-                artifacts: run.artifacts?.length ? run.artifacts : run.artifact ? [run.artifact] : []
-            }, redactionSecrets);
-        }
-        const worktree = await this.worktrees.prepare({
-            repo: dispatch.repo,
-            workItem: dispatch.workItem,
-            baseBranch: dispatch.cycleRun.baseBranch || dispatch.cycleRun.requestedBase,
-            worktreeKey: dispatch.lease.worktreeKey,
-            ownerType: dispatch.cycleRun.ownerType ?? dispatch.lease.ownerType ?? null,
-            ownerId: dispatch.cycleRun.ownerId ?? dispatch.lease.ownerId ?? null,
-            lane: dispatch.execution.lane,
-            phase: dispatch.cycleRun.phase,
-            allowedRepoRoot: dispatch.serverLocal.repoRoot,
-            cleanupWorktrees: dispatch.serverLocal.cleanupWorktrees,
-            artifacts: dispatch.artifacts,
-            qaRework: dispatch.qaRework,
-            warmPathOverrides: dispatch.warmPathOverrides
-        });
-        const providerDispatch = withPreparedQaReworkPacket(dispatch, worktree.qaReworkPacketPath);
-        throwIfAborted(signal);
-        await emit({
-            role: "runner",
-            kind: "checkpoint",
-            content: `Prepared worktree ${worktree.branchName}.`,
-            eventType: "worktree_prepared"
-        });
-        if (worktree.dependencyWarm) {
-            await emitDependencyWarmEvents(worktree.dependencyWarm, emit);
-        }
-        try {
+            await emit({
+                role: "runner",
+                kind: "checkpoint",
+                content: `Prepared worktree ${worktree.branchName}.`,
+                eventType: "worktree_prepared"
+            });
+            if ((worktree.hydratedPriorPhaseArtifactCount ?? 0) > 0) {
+                await emit({
+                    role: "runner",
+                    kind: "checkpoint",
+                    content: `Hydrated ${worktree.hydratedPriorPhaseArtifactCount} persisted prior-phase artifact(s) into the prepared worktree.`,
+                    eventType: "prior_phase_artifacts_hydrated"
+                });
+            }
+            if (worktree.dependencyWarm) {
+                await emitDependencyWarmEvents(worktree.dependencyWarm, emit);
+            }
+            if (dispatch.sandbox?.executionMode === "host" && this.hostRuntime) {
+                hostLease = await this.hostRuntime.start(dispatch, worktree.worktreePath, signal);
+                await emitLifecycle({
+                    role: "runner",
+                    kind: "checkpoint",
+                    content: `Host runtime lease ${hostLease.lease.leaseId} is active for this worktree.`,
+                    eventType: "sandbox_started",
+                    occurredAt: hostLease.lease.stateChangedAt,
+                    data: JSON.stringify(hostRuntimeEventResources(hostLease.lease, hostLease.runtimeContract)),
+                });
+                await emitLifecycle({
+                    role: "runner",
+                    kind: "checkpoint",
+                    content: "Managed host fallback isolates the worktree, attempt paths, assigned loopback ports, and supervised process trees, but not the host filesystem, network, credentials, or kernel. Serialized projects also hold a runner-local singleton. Enable Run in Docker in Project Settings when stronger isolation is required.",
+                    eventType: "host_runtime_isolation_notice",
+                    data: JSON.stringify({
+                        isolationStrength: "managed_host_process",
+                        remediation: "Enable Run in Docker in Project Settings.",
+                    }),
+                });
+                const unconfiguredPortCount = hostLease.lease.resources.ports.length;
+                hostLease = await this.hostRuntime.startConfiguredProject(dispatch.sandbox.dispatchAttemptId, dispatch.lease.fencingToken, signal);
+                if (hostLease.lease.resources.ports.length > unconfiguredPortCount) {
+                    const assigned = hostLease.lease.resources.ports.at(-1);
+                    await emitLifecycle({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: `Verified supervised project runtime ${assigned.name} on ${assigned.hostIp}:${assigned.hostPort}.`,
+                        eventType: "host_runtime_project_ready",
+                        data: JSON.stringify(hostRuntimeEventResources(hostLease.lease, hostLease.runtimeContract)),
+                    });
+                }
+            }
+            if (dispatch.draft) {
+                throwIfAborted(signal);
+                const run = await this.providerCli.runDraft({
+                    dispatch: providerDispatch,
+                    worktree,
+                    runtimeEnvironment: hostLease?.environment,
+                    emit,
+                    signal
+                });
+                throwIfAborted(signal);
+                const draftArtifacts = run.artifacts?.length ? run.artifacts : run.artifact ? [run.artifact] : [];
+                return redactRunOnceResultPacket({
+                    schemaVersion: 1,
+                    exitCode: 0,
+                    summary: run.summary,
+                    events,
+                    spec: run.spec ?? null,
+                    artifact: run.artifact ?? null,
+                    artifacts: draftArtifacts
+                }, redactionSecrets);
+            }
             throwIfAborted(signal);
-            const lane = dispatch.execution.lane.toLowerCase();
-            const role = dispatch.execution.role.toLowerCase();
+            const lane = dispatch.execution.lane.trim().toLowerCase();
+            const role = dispatch.execution.role.trim().toLowerCase();
+            const cycleKind = dispatch.cycleRun.kind.trim().toLowerCase();
             const isQa = role === "qa" || lane === "qa";
-            const isArchitect = role === "architect" || lane === "architect" || dispatch.cycleRun.kind.toLowerCase() === "architect";
+            const isArchitect = role === "architect" || lane === "architect" || cycleKind === "architect";
+            const isCiRepair = role === "ci_repair" || lane === "ci_repair" || cycleKind === "pr_checks";
             const isConflictResolve = role === "conflict_resolve" || lane === "conflict_resolve";
             const context = {
                 dispatch: providerDispatch,
                 worktree,
+                runtimeEnvironment: hostLease?.environment,
                 emit,
                 signal
             };
@@ -87,12 +190,14 @@ export class BridgeSessionService {
                 ? await this.providerCli.runQa(context)
                 : isArchitect
                     ? await this.providerCli.runArchitect(context)
-                    : isConflictResolve
-                        ? await this.providerCli.runConflictResolve(context)
-                        : await this.providerCli.runImplementation(context);
+                    : isCiRepair
+                        ? await this.providerCli.runCiRepair(context)
+                        : isConflictResolve
+                            ? await this.providerCli.runConflictResolve(context)
+                            : await this.providerCli.runImplementation(context);
             throwIfAborted(signal);
             const phaseArtifacts = run.artifacts?.length ? run.artifacts : run.artifact ? [run.artifact] : [];
-            return redactSecrets({
+            return redactRunOnceResultPacket({
                 schemaVersion: 1,
                 exitCode: 0,
                 summary: run.summary,
@@ -103,7 +208,51 @@ export class BridgeSessionService {
             }, redactionSecrets);
         }
         finally {
-            await this.worktrees.release(worktree);
+            if (hostLease && dispatch.sandbox) {
+                const teardownAt = new Date().toISOString();
+                await emitLifecycle({
+                    role: "runner",
+                    kind: "checkpoint",
+                    content: `Releasing host runtime lease ${hostLease.lease.leaseId}.`,
+                    eventType: "sandbox_teardown_started",
+                    occurredAt: teardownAt,
+                }).catch(() => undefined);
+                try {
+                    const released = await this.hostRuntime?.release(dispatch.sandbox.dispatchAttemptId, dispatch.lease.fencingToken);
+                    if (!released) {
+                        await emitLifecycle({
+                            role: "runner",
+                            kind: "error",
+                            content: "Host runtime cleanup requires reconciliation: the runtime lease was not current during release.",
+                            eventType: "teardown_failed",
+                            occurredAt: new Date().toISOString(),
+                        }).catch(() => undefined);
+                    }
+                    else {
+                        await emitLifecycle({
+                            role: "runner",
+                            kind: "checkpoint",
+                            content: `Released host runtime lease ${released.leaseId}.`,
+                            eventType: "sandbox_teardown_completed",
+                            occurredAt: released.releasedAt,
+                        }).catch(() => undefined);
+                    }
+                }
+                catch (error) {
+                    await emitLifecycle({
+                        role: "runner",
+                        kind: "error",
+                        content: `Host runtime cleanup requires reconciliation: ${error instanceof Error ? error.message : String(error)}`,
+                        eventType: "teardown_failed",
+                        occurredAt: new Date().toISOString(),
+                    }).catch(() => undefined);
+                }
+            }
+            if (!hostLease && hostSingletonKeys && dispatch.sandbox) {
+                await this.hostRuntime?.release(dispatch.sandbox.dispatchAttemptId, dispatch.lease.fencingToken).catch(() => undefined);
+            }
+            if (worktree)
+                await this.worktrees.release(worktree);
         }
     }
 }

package/dist/session/session.types.d.ts

@@ -1,5 +1,5 @@
 export interface RunOnceDispatchPacket {
-    readonly schemaVersion: 1;
+    readonly schemaVersion: 1 | 2;
     readonly userId: string;
     readonly workItem: DispatchWorkItem;
     readonly repo: DispatchRepo;
@@ -8,24 +8,76 @@ export interface RunOnceDispatchPacket {
     readonly lease: DispatchLease;
     readonly execution: DispatchExecution;
     readonly serverLocal: DispatchServerLocalConfig;
+    readonly sandbox?: DispatchSandboxContext | null;
     readonly pullRequest?: DispatchPullRequestContext | null;
     readonly apiKeySecretGrant?: ApiKeySecretGrant | null;
+    readonly apiKeySecretGrantHandle?: ApiKeySecretGrantHandle | null;
     readonly artifacts: readonly DispatchResolvedArtifact[];
+    readonly priorPhaseArtifacts?: readonly DispatchPriorPhaseArtifact[];
     readonly warmPathOverrides?: readonly string[];
     readonly qaBrowser?: DispatchQaBrowserContext | null;
     readonly qaScope?: DispatchQaScope | null;
     readonly qaRework?: DispatchQaReworkContext | null;
     readonly architectRevision?: DispatchArchitectRevisionContext | null;
+    readonly architectDependencies?: DispatchArchitectDependencyContext | null;
     readonly storyDevelop?: DispatchStoryDevelopContext | null;
     readonly storyQa?: DispatchStoryQaContext | null;
+    readonly designerRefs?: DispatchDesignerRefHandoffContext | null;
     readonly draft?: DispatchDraftPrompt | null;
 }
+export interface DispatchSandboxContext {
+    readonly dispatchAttemptId: string;
+    readonly executionLeaseId: string;
+    readonly runnerInstanceId: string;
+    readonly executionMode: "host" | "docker";
+    readonly executionPolicy: "host_allowed" | "sandbox_preferred" | "sandbox_required";
+    readonly networkPolicy: DispatchSandboxNetworkPolicy;
+    readonly requestedResources: DispatchSandboxResourceRequest;
+    readonly runtime?: string | null;
+    readonly sandboxConfigCommitSha?: string | null;
+    readonly inputCommitSha?: string | null;
+    readonly contractDigest?: string | null;
+    readonly imageDigest?: string | null;
+    readonly publicationMode: "bridge_push" | "shared_filesystem";
+    readonly publishGrantHandle?: DispatchPublishGrantHandle | null;
+}
+export interface DispatchPublishGrantHandle {
+    readonly grantId: string;
+    readonly branch: string;
+    readonly expiresAt: string;
+}
+export interface DispatchSandboxResourceRequest {
+    readonly sandboxSlots: number;
+    readonly cpuMillis: number;
+    readonly workerMemoryLimitBytes: number;
+    readonly serviceMemoryLimitBytes: number;
+    readonly runtimeOverheadBytes: number;
+    readonly memoryBytes: number;
+    readonly workspaceBytes: number;
+    readonly pids: number;
+    readonly buildSlots: number;
+}
+export interface DispatchSandboxNetworkPolicy {
+    readonly mode: "offline" | "public_allowlist" | "open_public";
+    readonly allowedHosts: readonly string[];
+}
 export interface DispatchDraftPrompt {
     readonly kind: string;
     readonly systemPrompt: string;
     readonly userPrompt: string;
     readonly projectName?: string | null;
     readonly repoName?: string | null;
+    readonly attachments?: readonly DispatchDraftAttachment[];
+}
+export interface DispatchDraftAttachment {
+    readonly index: number;
+    readonly fileName: string;
+    readonly contentType: string;
+    readonly kind: string;
+    readonly byteCount: number;
+    readonly summary: string;
+    readonly textContent?: string | null;
+    readonly contentBase64?: string | null;
 }
 export interface DispatchQaBrowserContext {
     readonly required: boolean;
@@ -69,6 +121,22 @@ export interface DispatchArchitectRevisionContext {
     readonly priorContentHash: string;
     readonly feedback: string;
 }
+export interface DispatchArchitectDependencyContext {
+    readonly baseBranch: string;
+    readonly prerequisites: readonly DispatchArchitectDependencyItemContext[];
+}
+export interface DispatchArchitectDependencyItemContext {
+    readonly storyId: string;
+    readonly title: string;
+    readonly scheduleIndex?: number | null;
+    readonly waveIndex?: number | null;
+    readonly featureScheduleIndex?: number | null;
+    readonly expectedOutput?: string | null;
+    readonly handoffSummary?: string | null;
+    readonly dependencyReason?: string | null;
+    readonly pullRequestNumber?: number | null;
+    readonly targetBranch: string;
+}
 export interface DispatchStoryDevelopContext {
     readonly storyWorkItemId: string;
     readonly planId: string;
@@ -125,6 +193,55 @@ export interface DispatchStoryQaDependencyContext {
     readonly fromWorkItemId: string;
     readonly toWorkItemId: string;
 }
+export interface DispatchPriorPhaseArtifact {
+    readonly workItemId: string;
+    readonly artifactId: string;
+    readonly cycleRunId: string;
+    readonly phase: "implementation" | "self_review" | "validation";
+    readonly status: string;
+    readonly producedAt: string;
+    readonly sourcePath: string;
+    readonly verdictJson: string;
+    readonly report: string;
+    readonly verdictContentHash: string;
+    readonly reportContentHash: string;
+}
+export interface DispatchDesignerRefHandoffContext {
+    readonly schemaVersion: number;
+    readonly kind: string;
+    readonly ownerType: string;
+    readonly ownerId: string;
+    readonly projectId: string;
+    readonly repoId: string;
+    readonly title: string;
+    readonly refs: readonly DispatchDesignerRefAttachment[];
+}
+export interface DispatchDesignerRefAttachment {
+    readonly ref: DispatchDesignerRef;
+    readonly reason: string;
+    readonly required: boolean;
+    readonly source: string;
+    readonly lineageKind: string;
+    readonly inheritedFromItemType?: string | null;
+    readonly inheritedFromItemId?: string | null;
+    readonly inheritedFromDesignerRefId?: string | null;
+    readonly addedByLane: string;
+    readonly sortOrder: number;
+    readonly createdAt: string;
+}
+export interface DispatchDesignerRef {
+    readonly id: string;
+    readonly projectId: string;
+    readonly repoId: string;
+    readonly refKey: string;
+    readonly kind: string;
+    readonly path: string;
+    readonly anchor?: string | null;
+    readonly title: string;
+    readonly contentHash: string;
+    readonly commitSha: string;
+    readonly createdAt: string;
+}
 export interface DispatchPullRequestContext {
     readonly number: number;
     readonly provider: string;
@@ -214,6 +331,11 @@ export interface ApiKeySecretGrant {
     readonly secret: string;
     readonly expiresAt: string;
 }
+export interface ApiKeySecretGrantHandle {
+    readonly grantId: string;
+    readonly provider: string;
+    readonly expiresAt: string;
+}
 export interface DispatchServerLocalConfig {
     readonly repoRoot: string;
     readonly cleanupWorktrees: boolean;