@loucompanion/forge-bridge 0.1.3-dev.ba7d36726eda → 0.1.3-dev.bca7d0ccee53

package/dist/session/provider-cli/provider-cli.service.js

@@ -1,7 +1,9 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { RepositoryCoordinatorLock } from "../../sandbox/repository-lock.js";
 import { GitClient } from "../../shared/git/git.js";
 import { buildSpecBody, selectLaneCommand } from "../../worktree/artifact-injector.js";
+import { defaultWorktreeCoordinatorStateRoot } from "../../worktree/worktree-paths.js";
 import { completionPhaseFromDispatch, prepareCompletionToolRuntime, readCompletionArtifact, usesDebugCycleCompletion, usesDevelopCycleCompletion } from "../phase-completion.js";
 import { cleanupCompletionTools, commitWorktreeChanges, completionPhaseFromArtifact, emitArchitectStructuredEvents, emitCompletionArtifactRecorded, emitDecomposeGateArtifacts, emitDraftGateArtifacts, emitPhaseCompletionEvent, emitPhaseGateEvents, emitQaArtifactRecorded, emitQaStructuredEvents, enforceQaBrowserLaunchTargetGate, LiveArchitectArtifactEmitter, LiveCompletionArtifactEmitter, LiveQaArtifactEmitter, readCompletionArtifactsForRun, readQaCompletionArtifactBundle, summarizeStderr, waitForCompletionArtifact } from "./provider-cli.artifacts.js";
 import { DeterministicProviderCliService } from "./provider-cli.deterministic.js";
@@ -9,34 +11,37 @@ import { buildArchitectPrompt, buildConflictResolvePrompt, buildDebugCyclePrompt
 import { StreamingProviderProcessRunner } from "./provider-cli.process.js";
 import { emitProviderUsageEvent, providerProcessEnv } from "./provider-cli.runtime.js";
 import { clip, createProviderOutputState, parseJsonLine } from "./provider-output-state.js";
+import { writeCiRepairReadinessManifest } from "./ci-repair-readiness.js";
 export { DeterministicProviderCliService } from "./provider-cli.deterministic.js";
 export { buildProviderCliCommand, codexSandboxModeForPlatform, formatProviderCliCommand, formatProviderCliCommandForCheckpoint } from "./provider-cli.prompts.js";
-export { buildProviderChildEnvironment, chooseWindowsCommandCandidate, resolveCodexNpmDirectLaunch, StreamingProviderProcessRunner } from "./provider-cli.process.js";
+export { buildProviderChildEnvironment, chooseWindowsCommandCandidate, resolveCodexNpmDirectLaunch, resolvePackageManagerDirectLaunch, resolveWindowsCommandFromPath, StreamingProviderProcessRunner } from "./provider-cli.process.js";
 export { buildWindowsLaunchCommand } from "../../shared/process/windows-launch.js";
-async function pushWorktreeBranch(git, worktreePath, branchName, emit) {
-    try {
-        await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
-        return;
-    }
-    catch (err) {
-        if (!isNonFastForwardPushError(err)) {
-            throw err;
-        }
-        await emit?.({
-            role: "runner",
-            kind: "checkpoint",
-            content: `Remote branch ${branchName} moved before push; fetching latest and rebasing local changes.`,
-            eventType: "worktree_branch_push_rebase"
-        });
+async function pushWorktreeBranch(git, worktreePath, branchName, repoPath, coordinator, signal, emit) {
+    await coordinator.withLock(repoPath, async () => {
         try {
-            await git.run(worktreePath, ["fetch", "origin", remoteTrackingRefspec(branchName)]);
-            await git.run(worktreePath, ["rebase", `refs/remotes/origin/${branchName}`]);
             await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
+            return;
         }
-        catch (retryErr) {
-            throw new Error(`git push origin HEAD:${branchName} was rejected because the remote branch moved, and automatic fetch/rebase failed: ${errorMessage(retryErr)}`, { cause: retryErr });
+        catch (err) {
+            if (!isNonFastForwardPushError(err)) {
+                throw err;
+            }
+            await emit?.({
+                role: "runner",
+                kind: "checkpoint",
+                content: `Remote branch ${branchName} moved before push; fetching latest and rebasing local changes.`,
+                eventType: "worktree_branch_push_rebase"
+            });
+            try {
+                await git.run(worktreePath, ["fetch", "origin", remoteTrackingRefspec(branchName)]);
+                await git.run(worktreePath, ["rebase", `refs/remotes/origin/${branchName}`]);
+                await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
+            }
+            catch (retryErr) {
+                throw new Error(`worktree_branch_integration_conflict: git push origin HEAD:${branchName} was rejected because the remote branch moved, and automatic fetch/rebase failed: ${errorMessage(retryErr)}`, { cause: retryErr });
+            }
         }
-    }
+    }, signal);
 }
 function providerOwnsBranchPublication(context) {
     return context.dispatch.sandbox?.executionMode !== "docker";
@@ -55,6 +60,179 @@ function isNonFastForwardPushError(err) {
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
+const defaultProviderToolHeartbeatIntervalMs = 60_000;
+const defaultManagedVerificationProgressIntervalMs = 30_000;
+function compareManagedVerificationSnapshots(left, right) {
+    const leftOrder = managedVerificationStartedAt(left.startedAt) ?? Number.MAX_SAFE_INTEGER;
+    const rightOrder = managedVerificationStartedAt(right.startedAt) ?? Number.MAX_SAFE_INTEGER;
+    return leftOrder - rightOrder || left.commandId.localeCompare(right.commandId);
+}
+function managedVerificationStartedAt(value) {
+    const parsed = Date.parse(value ?? "");
+    return Number.isFinite(parsed) ? parsed : null;
+}
+export class ManagedVerificationProgressEmitter {
+    logDirectory;
+    emit;
+    intervalMs;
+    timer = null;
+    observedStatuses = new Map();
+    completedCommands = new Set();
+    constructor(logDirectory, emit, intervalMs = defaultManagedVerificationProgressIntervalMs) {
+        this.logDirectory = logDirectory;
+        this.emit = emit;
+        this.intervalMs = intervalMs;
+    }
+    start() {
+        if (!this.logDirectory?.trim() || this.timer)
+            return;
+        this.timer = setInterval(() => {
+            void this.scan().catch(() => undefined);
+        }, Math.max(1, this.intervalMs));
+        void this.scan().catch(() => undefined);
+    }
+    async stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+        await this.scan().catch(() => undefined);
+    }
+    async scan() {
+        if (!this.logDirectory?.trim())
+            return;
+        const directory = path.join(this.logDirectory, "managed-commands");
+        const names = await fs.readdir(directory).catch(() => []);
+        const snapshots = await Promise.all(names
+            .filter(name => name.endsWith(".receipt.json"))
+            .map(async (name) => parseManagedVerificationSnapshot(path.join(directory, name))));
+        const current = snapshots
+            .filter((entry) => entry !== null)
+            .sort(compareManagedVerificationSnapshots);
+        for (const snapshot of current) {
+            await this.emitTransition(snapshot);
+        }
+    }
+    async emitTransition(current) {
+        const terminal = ["pass", "fail", "timed_out", "timeout_termination_failed", "runner_error"].includes(current.status);
+        if (terminal && this.completedCommands.has(current.commandId))
+            return;
+        const previousStatus = this.observedStatuses.get(current.commandId);
+        if (previousStatus === current.status)
+            return;
+        this.observedStatuses.set(current.commandId, current.status);
+        if (terminal)
+            this.completedCommands.add(current.commandId);
+        // Starting and running are one externally meaningful state. The receipt is
+        // still refreshed on disk for UI telemetry, but repeated output/elapsed
+        // changes must not inflate the provider transcript or session history.
+        if (!terminal && previousStatus === "starting" && current.status === "running")
+            return;
+        const startedAt = managedVerificationStartedAt(current.startedAt);
+        const elapsedMs = startedAt !== null
+            ? Math.max(current.elapsedMs ?? 0, Date.now() - startedAt)
+            : current.elapsedMs;
+        const elapsed = elapsedMs === null ? "an unknown duration" : formatElapsed(elapsedMs);
+        const outputTail = current.lastOutputStream === "stderr"
+            ? current.stderrTail || current.stdoutTail
+            : current.stdoutTail || current.stderrTail;
+        const recovered = previousStatus === undefined && terminal;
+        await this.emit({
+            role: "runner",
+            kind: terminal && current.status !== "pass" ? "error" : "status",
+            content: terminal
+                ? `Managed verification ${current.status} after ${elapsed}${recovered ? " (recovered from its durable receipt)" : ""}${outputTail ? `: ${clip(outputTail, 600)}` : "."}`
+                : `QA started managed verification ${current.commandId}. Forge is supervising it; durable progress remains available in the UI while the provider continues independent work.`,
+            eventType: terminal ? "verification_completed" : "verification_waiting",
+            data: JSON.stringify({
+                command_id: current.commandId,
+                status: current.status,
+                elapsed_ms: elapsedMs,
+                output_revision: current.outputRevision,
+                last_output_at: current.lastOutputAt,
+                recovered,
+            }),
+        });
+    }
+}
+async function parseManagedVerificationSnapshot(receiptPath) {
+    try {
+        const receipt = JSON.parse(await fs.readFile(receiptPath, "utf8"));
+        const commandId = typeof receipt.command_id === "string" ? receipt.command_id : null;
+        const status = typeof receipt.status === "string" ? receipt.status : null;
+        if (!commandId || !status)
+            return null;
+        return {
+            commandId,
+            status,
+            elapsedMs: typeof receipt.elapsed_ms === "number" ? receipt.elapsed_ms : null,
+            startedAt: typeof receipt.started_at === "string" ? receipt.started_at : null,
+            outputRevision: typeof receipt.output_revision === "number" ? receipt.output_revision : null,
+            lastOutputAt: typeof receipt.last_output_at === "string" ? receipt.last_output_at : null,
+            lastOutputStream: receipt.last_output_stream === "stdout" || receipt.last_output_stream === "stderr"
+                ? receipt.last_output_stream
+                : null,
+            stdoutTail: tail(typeof receipt.stdout === "string" ? receipt.stdout : ""),
+            stderrTail: tail(typeof receipt.stderr === "string" ? receipt.stderr : ""),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function tail(value) {
+    return value.trim().split(/\r?\n/u).slice(-4).join("\n");
+}
+function formatElapsed(milliseconds) {
+    const seconds = Math.max(0, Math.round(milliseconds / 1000));
+    const minutes = Math.floor(seconds / 60);
+    return minutes > 0 ? `${minutes}m ${seconds % 60}s` : `${seconds}s`;
+}
+class ProviderToolActivityHeartbeat {
+    outputState;
+    emit;
+    intervalMs;
+    timer = null;
+    constructor(outputState, emit, intervalMs) {
+        this.outputState = outputState;
+        this.emit = emit;
+        this.intervalMs = intervalMs;
+    }
+    async consume(line) {
+        const events = this.outputState.consume(line);
+        this.sync();
+        for (const event of events) {
+            await this.emit(event);
+        }
+    }
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    sync() {
+        if (!this.outputState.hasActiveToolCall) {
+            this.stop();
+            return;
+        }
+        if (this.timer) {
+            return;
+        }
+        this.timer = setInterval(() => {
+            if (!this.outputState.hasActiveToolCall) {
+                this.stop();
+                return;
+            }
+            void this.emit({
+                role: "runner",
+                kind: "status",
+                content: "A supervised provider tool is still running.",
+                eventType: "provider_tool_heartbeat",
+            }).catch(() => undefined);
+        }, Math.max(1, this.intervalMs));
+    }
+}
 const fakeWorkerModel = "server-local-fake-worker";
 export class RoutingProviderCliService {
     realProvider;
@@ -97,9 +275,13 @@ export class RoutingProviderCliService {
 export class ProcessBackedProviderCliService {
     processRunner;
     git;
-    constructor(processRunner = new StreamingProviderProcessRunner(), git = new GitClient()) {
+    providerToolHeartbeatIntervalMs;
+    publicationCoordinator;
+    constructor(processRunner = new StreamingProviderProcessRunner(), git = new GitClient(), providerToolHeartbeatIntervalMs = defaultProviderToolHeartbeatIntervalMs, publicationCoordinator = new RepositoryCoordinatorLock(defaultWorktreeCoordinatorStateRoot())) {
         this.processRunner = processRunner;
         this.git = git;
+        this.providerToolHeartbeatIntervalMs = providerToolHeartbeatIntervalMs;
+        this.publicationCoordinator = publicationCoordinator;
     }
     async runDraft(context) {
         const { dispatch } = context;
@@ -113,10 +295,10 @@ export class ProcessBackedProviderCliService {
         await fs.writeFile(path.join(metadataRoot, "spec.md"), buildDraftSpec(dispatch), "utf8");
         const stagedAttachments = await stageDraftAttachments(dispatch, metadataRoot);
         const decomposeDraft = isDecomposeDraftDispatch(dispatch);
-        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: decomposeDraft ? "decompose" : "draft" });
+        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: decomposeDraft ? "decompose" : "draft", runtimeEnvironment: context.runtimeEnvironment });
         const draftPrompt = buildDraftPrompt(dispatch, { attachmentReferences: stagedAttachments.textReferences });
         const providerPrompt = buildProviderCliPrompt(dispatch, draftPrompt, context.runtimeEnvironment);
-        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt, usesManagedWindowsHost(dispatch));
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
             prompt: draftPrompt,
@@ -139,7 +321,7 @@ export class ProcessBackedProviderCliService {
             role: "runner",
             kind: "checkpoint",
             content: `Starting provider CLI Draft: ${formatProviderCliCommandForCheckpoint(command)}`,
-            eventType: "provider_cli_started"
+            eventType: "provider_cli_starting"
         });
         await context.emit({
             role: "runner",
@@ -150,6 +332,7 @@ export class ProcessBackedProviderCliService {
             eventType: "completion_tools_configured"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
         try {
             const providerCancellation = new AbortController();
             const abortProvider = () => providerCancellation.abort();
@@ -160,17 +343,23 @@ export class ProcessBackedProviderCliService {
                 context.signal?.addEventListener("abort", abortProvider, { once: true });
             }
             try {
-                const runPromise = this.processRunner.run({
+                const runPromise = (context.processRunner ?? this.processRunner).run({
                     command: command.command,
                     args: command.args,
                     cwd: worktree.worktreePath,
                     env: providerProcessEnv(dispatch, context.runtimeEnvironment),
                     stdin: pipePromptToStdin ? providerPrompt : undefined
                 }, {
+                    onStarted: async () => {
+                        await context.emit({
+                            role: "runner",
+                            kind: "checkpoint",
+                            content: "Provider CLI Draft is supervised and ready.",
+                            eventType: "provider_cli_started"
+                        });
+                    },
                     onStdoutLine: async (line) => {
-                        for (const event of outputState.consume(line)) {
-                            await context.emit(event);
-                        }
+                        await toolHeartbeat.consume(line);
                     }
                 }, providerCancellation.signal);
                 const artifactWaitCancellation = new AbortController();
@@ -266,6 +455,7 @@ export class ProcessBackedProviderCliService {
             }
         }
         finally {
+            toolHeartbeat.stop();
             await cleanupCompletionTools(completionTools, context.emit);
         }
     }
@@ -284,14 +474,18 @@ export class ProcessBackedProviderCliService {
         const specPath = path.join(metadataRoot, "spec.md");
         await fs.writeFile(specPath, specBody, "utf8");
         await fs.writeFile(path.join(metadataRoot, "spec.meta.json"), JSON.stringify({ schema_version: 1, status: "approved", produced_by: "forge-lane-command" }) + "\n", "utf8");
-        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase });
+        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase, runtimeEnvironment: context.runtimeEnvironment });
+        const implementationPrompt = debugCycle
+            ? buildDebugCyclePrompt(dispatch, phase)
+            : developCycle
+                ? buildDevelopCyclePrompt(dispatch, phase)
+                : buildImplementationPrompt(dispatch, phase);
+        const providerPrompt = buildProviderCliPrompt(dispatch, implementationPrompt, context.runtimeEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt, usesManagedWindowsHost(dispatch));
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: debugCycle
-                ? buildDebugCyclePrompt(dispatch, phase)
-                : developCycle
-                    ? buildDevelopCyclePrompt(dispatch, phase)
-                    : buildImplementationPrompt(dispatch, phase),
+            prompt: implementationPrompt,
+            promptFromStdin: pipePromptToStdin,
             completionTools,
             runtimeEnvironment: context.runtimeEnvironment
         });
@@ -299,7 +493,7 @@ export class ProcessBackedProviderCliService {
             role: "runner",
             kind: "checkpoint",
             content: `Starting provider CLI: ${formatProviderCliCommandForCheckpoint(command)} in ${worktree.worktreePath}`,
-            eventType: "provider_cli_started"
+            eventType: "provider_cli_starting"
         });
         await context.emit({
             role: "runner",
@@ -312,24 +506,33 @@ export class ProcessBackedProviderCliService {
             eventType: "completion_tools_configured"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
         const liveCompletionEvents = new LiveCompletionArtifactEmitter(worktree.worktreePath, dispatch.workItem.id, phase, developCycle, debugCycle, context.emit);
         let result;
         try {
             liveCompletionEvents.start();
-            result = await this.processRunner.run({
+            result = await (context.processRunner ?? this.processRunner).run({
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
-                env: providerProcessEnv(dispatch, context.runtimeEnvironment)
+                env: providerProcessEnv(dispatch, context.runtimeEnvironment),
+                stdin: pipePromptToStdin ? providerPrompt : undefined
             }, {
+                onStarted: async () => {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: "Provider CLI is supervised and ready.",
+                        eventType: "provider_cli_started"
+                    });
+                },
                 onStdoutLine: async (line) => {
-                    for (const event of outputState.consume(line)) {
-                        await context.emit(event);
-                    }
+                    await toolHeartbeat.consume(line);
                 }
             }, context.signal);
         }
         finally {
+            toolHeartbeat.stop();
             await liveCompletionEvents.stop();
             await cleanupCompletionTools(completionTools, context.emit);
         }
@@ -346,7 +549,7 @@ export class ProcessBackedProviderCliService {
         await emitProviderUsageEvent(context.emit, dispatch, outputState);
         const committed = await commitWorktreeChanges(this.git, worktree.worktreePath, dispatch.workItem.id);
         if ((developCycle || debugCycle || phase === "implementation") && providerOwnsBranchPublication(context)) {
-            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, context.emit);
+            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, worktree.repoPath, this.publicationCoordinator, context.signal, context.emit);
             await context.emit({
                 role: "runner",
                 kind: "checkpoint",
@@ -404,10 +607,14 @@ export class ProcessBackedProviderCliService {
         const specPath = path.join(metadataRoot, "spec.md");
         await fs.writeFile(specPath, specBody, "utf8");
         await fs.writeFile(path.join(metadataRoot, "spec.meta.json"), JSON.stringify({ schema_version: 1, status: "pending_approval", produced_by: "forge-lane-command" }) + "\n", "utf8");
-        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "architect" });
+        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "architect", runtimeEnvironment: context.runtimeEnvironment });
+        const architectPrompt = buildArchitectPrompt(dispatch);
+        const providerPrompt = buildProviderCliPrompt(dispatch, architectPrompt, context.runtimeEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt, usesManagedWindowsHost(dispatch));
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: buildArchitectPrompt(dispatch),
+            prompt: architectPrompt,
+            promptFromStdin: pipePromptToStdin,
             completionTools,
             runtimeEnvironment: context.runtimeEnvironment
         });
@@ -416,7 +623,7 @@ export class ProcessBackedProviderCliService {
             role: "runner",
             kind: "checkpoint",
             content: `Starting provider CLI Architect: ${commandText} in ${worktree.worktreePath}`,
-            eventType: "provider_cli_started"
+            eventType: "provider_cli_starting"
         });
         await context.emit({
             role: "runner",
@@ -425,24 +632,31 @@ export class ProcessBackedProviderCliService {
             eventType: "completion_tools_configured"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
         const liveArchitectEvents = new LiveArchitectArtifactEmitter(worktree.worktreePath, dispatch.workItem.id, context.emit);
         let result;
         try {
             liveArchitectEvents.start();
-            result = await this.processRunner.run({
+            result = await (context.processRunner ?? this.processRunner).run({
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
-                env: providerProcessEnv(dispatch, context.runtimeEnvironment)
+                env: providerProcessEnv(dispatch, context.runtimeEnvironment),
+                stdin: pipePromptToStdin ? providerPrompt : undefined
             }, {
-                onStdoutLine: async (line) => {
-                    for (const event of outputState.consume(line)) {
-                        await context.emit(event);
-                    }
-                }
+                onStarted: async () => {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: "Provider CLI Architect is supervised and ready.",
+                        eventType: "provider_cli_started"
+                    });
+                },
+                onStdoutLine: async (line) => await toolHeartbeat.consume(line)
             }, context.signal);
         }
         finally {
+            toolHeartbeat.stop();
             await liveArchitectEvents.stop();
             await cleanupCompletionTools(completionTools, context.emit);
         }
@@ -496,10 +710,14 @@ export class ProcessBackedProviderCliService {
         const specPath = path.join(metadataRoot, "spec.md");
         await fs.writeFile(specPath, specBody, "utf8");
         await fs.writeFile(path.join(metadataRoot, "spec.meta.json"), JSON.stringify({ schema_version: 1, status: "approved", produced_by: "forge-lane-command" }) + "\n", "utf8");
-        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "qa" });
+        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "qa", runtimeEnvironment: context.runtimeEnvironment });
+        const qaPrompt = buildQaPrompt(dispatch, specBody);
+        const providerPrompt = buildProviderCliPrompt(dispatch, qaPrompt, context.runtimeEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt, usesManagedWindowsHost(dispatch));
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: buildQaPrompt(dispatch, specBody),
+            prompt: qaPrompt,
+            promptFromStdin: pipePromptToStdin,
             completionTools,
             runtimeEnvironment: context.runtimeEnvironment
         });
@@ -508,7 +726,7 @@ export class ProcessBackedProviderCliService {
             role: "runner",
             kind: "checkpoint",
             content: `Starting provider CLI QA: ${commandText} in ${worktree.worktreePath}`,
-            eventType: "provider_cli_started"
+            eventType: "provider_cli_starting"
         });
         await context.emit({
             role: "runner",
@@ -517,24 +735,34 @@ export class ProcessBackedProviderCliService {
             eventType: "completion_tools_configured"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
+        const verificationProgress = new ManagedVerificationProgressEmitter(context.runtimeEnvironment?.FORGE_LOG_DIR, context.emit);
         const liveQaEvents = new LiveQaArtifactEmitter(worktree.worktreePath, dispatch.workItem.id, dispatch, context.emit);
         let result;
         try {
             liveQaEvents.start();
-            result = await this.processRunner.run({
+            verificationProgress.start();
+            result = await (context.processRunner ?? this.processRunner).run({
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
-                env: providerProcessEnv(dispatch, context.runtimeEnvironment)
+                env: providerProcessEnv(dispatch, context.runtimeEnvironment),
+                stdin: pipePromptToStdin ? providerPrompt : undefined
             }, {
-                onStdoutLine: async (line) => {
-                    for (const event of outputState.consume(line)) {
-                        await context.emit(event);
-                    }
-                }
+                onStarted: async () => {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: "Provider CLI QA is supervised and ready.",
+                        eventType: "provider_cli_started"
+                    });
+                },
+                onStdoutLine: async (line) => await toolHeartbeat.consume(line)
             }, context.signal);
         }
         finally {
+            toolHeartbeat.stop();
+            await verificationProgress.stop();
             await liveQaEvents.stop();
             await cleanupCompletionTools(completionTools, context.emit);
         }
@@ -590,41 +818,113 @@ export class ProcessBackedProviderCliService {
         const { dispatch, worktree } = context;
         const repairChecks = route === "ci_repair" || isPullRequestCheckRepairDispatch(dispatch);
         const addressComments = !repairChecks && isPullRequestCommentsDispatch(dispatch);
+        let repairSpec = null;
+        let repairEnvironment = context.runtimeEnvironment;
+        let completionTools = null;
+        if (repairChecks) {
+            const metadataRoot = path.join(worktree.worktreePath, ".forge", "work-items", dispatch.workItem.id);
+            await fs.mkdir(metadataRoot, { recursive: true });
+            const laneCommand = selectLaneCommand(dispatch.artifacts, dispatch.execution.lane, dispatch.cycleRun.phase);
+            if (!laneCommand) {
+                throw new Error(`CI repair readiness failed: lane command for '${dispatch.execution.lane}' was not resolved, so the approved spec cannot be materialized.`);
+            }
+            const specBody = buildSpecBody(laneCommand, dispatch.workItem, "ci_repair");
+            const specPath = path.join(metadataRoot, "spec.md");
+            await fs.writeFile(specPath, specBody, "utf8");
+            await fs.writeFile(path.join(metadataRoot, "spec.meta.json"), `${JSON.stringify({ schema_version: 1, status: "approved", produced_by: "forge-lane-command" })}\n`, "utf8");
+            repairSpec = {
+                repoPath: worktree.worktreePath,
+                path: specPath,
+                body: specBody,
+                producedBy: "forge-lane-command",
+                status: "approved",
+            };
+            const readiness = await writeCiRepairReadinessManifest(dispatch, worktree.worktreePath, specPath, context.runtimeEnvironment);
+            repairEnvironment = readiness.environment;
+            completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "ci_repair", runtimeEnvironment: repairEnvironment });
+            await context.emit({
+                role: "runner",
+                kind: "checkpoint",
+                content: `CI repair readiness contract prepared at ${path.relative(worktree.worktreePath, readiness.path).replaceAll(path.sep, "/")}; approved spec, attempt URLs, browser readiness, and local-equivalence policy are available before provider start.`,
+                eventType: "ci_repair_readiness_ready",
+            });
+            await context.emit({
+                role: "runner",
+                kind: "checkpoint",
+                content: "Forge CI repair completion tool configured; provider must call forge.complete_ci_repair before Bridge-owned commit and push.",
+                eventType: "completion_tools_configured",
+            });
+        }
+        const repairPrompt = repairChecks
+            ? buildPullRequestCheckRepairPrompt(dispatch, worktree.branchName)
+            : addressComments
+                ? buildPullRequestCommentsPrompt(dispatch, worktree.branchName)
+                : buildConflictResolvePrompt(dispatch, worktree.branchName);
+        const providerPrompt = buildProviderCliPrompt(dispatch, repairPrompt, repairEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt, usesManagedWindowsHost(dispatch));
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: repairChecks
-                ? buildPullRequestCheckRepairPrompt(dispatch, worktree.branchName)
-                : addressComments
-                    ? buildPullRequestCommentsPrompt(dispatch, worktree.branchName)
-                    : buildConflictResolvePrompt(dispatch, worktree.branchName),
-            runtimeEnvironment: context.runtimeEnvironment
+            prompt: repairPrompt,
+            promptFromStdin: pipePromptToStdin,
+            completionTools: completionTools ?? undefined,
+            runtimeEnvironment: repairEnvironment
         });
         await context.emit({
             role: "runner",
             kind: "checkpoint",
             content: `Starting provider CLI ${repairChecks ? "CI repair" : addressComments ? "PR comment address" : "conflict resolve"}: ${formatProviderCliCommandForCheckpoint(command)} in ${worktree.worktreePath}`,
-            eventType: "provider_cli_started"
+            eventType: "provider_cli_starting"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
-        const result = await this.processRunner.run({
-            command: command.command,
-            args: command.args,
-            cwd: worktree.worktreePath,
-            env: providerProcessEnv(dispatch, context.runtimeEnvironment)
-        }, {
-            onStdoutLine: async (line) => {
-                for (const event of outputState.consume(line)) {
-                    await context.emit(event);
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
+        let result;
+        try {
+            result = await (context.processRunner ?? this.processRunner).run({
+                command: command.command,
+                args: command.args,
+                cwd: worktree.worktreePath,
+                env: providerProcessEnv(dispatch, repairEnvironment),
+                stdin: pipePromptToStdin ? providerPrompt : undefined
+            }, {
+                onStarted: async () => {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: `Provider CLI ${repairChecks ? "CI repair" : addressComments ? "PR comment address" : "conflict resolve"} is supervised and ready.`,
+                        eventType: "provider_cli_started"
+                    });
+                },
+                onStdoutLine: async (line) => {
+                    await toolHeartbeat.consume(line);
                 }
+            }, context.signal);
+        }
+        finally {
+            toolHeartbeat.stop();
+            if (completionTools) {
+                await cleanupCompletionTools(completionTools, context.emit);
             }
-        }, context.signal);
+        }
         if (result.exitCode !== 0) {
             const stderr = clip(result.stderr.trim() || result.stdout.trim(), 1200);
             throw new Error(`${command.command} exited ${result.exitCode}${stderr ? `: ${stderr}` : ""}`);
         }
+        let repairArtifact = null;
+        if (repairChecks) {
+            repairArtifact = await readCompletionArtifact(worktree.worktreePath, dispatch.workItem.id, "ci_repair");
+            if (!repairArtifact) {
+                throw new Error("Provider CLI completed but did not call forge.complete_ci_repair. Forge did not commit or push the repair.");
+            }
+            if ((repairArtifact.status ?? "").trim().toLowerCase() !== "pass") {
+                throw new Error(`CI repair completion gate recorded ${repairArtifact.status}; Forge did not commit or push the repair.`);
+            }
+            await emitCompletionArtifactRecorded(context.emit, worktree.worktreePath, repairArtifact);
+            await emitPhaseCompletionEvent(context.emit, repairArtifact);
+            await emitPhaseGateEvents(context.emit, repairArtifact);
+        }
         const committed = await commitWorktreeChanges(this.git, worktree.worktreePath, dispatch.workItem.id);
         if (providerOwnsBranchPublication(context)) {
-            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, context.emit);
+            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, worktree.repoPath, this.publicationCoordinator, context.signal, context.emit);
         }
         await emitProviderUsageEvent(context.emit, dispatch, outputState);
         await context.emit({
@@ -642,7 +942,10 @@ export class ProcessBackedProviderCliService {
                 ? `${dispatch.execution.provider} CLI repaired PR checks on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
                 : addressComments
                     ? `${dispatch.execution.provider} CLI addressed PR comments on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
-                    : `${dispatch.execution.provider} CLI resolved conflicts on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
+                    : `${dispatch.execution.provider} CLI resolved conflicts on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`,
+            spec: repairSpec,
+            artifact: repairArtifact,
+            artifacts: repairArtifact ? [repairArtifact] : [],
         };
     }
 }
@@ -708,8 +1011,12 @@ function clipFileName(fileName, maxLength) {
     return `${stem.slice(0, maxStemLength)}${extension}`;
 }
 const providerPromptStdinThreshold = 8_000;
-function shouldPipePromptToStdin(provider, prompt) {
-    return provider.trim().toLowerCase() === "codex" && Buffer.byteLength(prompt, "utf8") > providerPromptStdinThreshold;
+function shouldPipePromptToStdin(provider, prompt, force = false) {
+    return provider.trim().toLowerCase() === "codex"
+        && (force || Buffer.byteLength(prompt, "utf8") > providerPromptStdinThreshold);
+}
+function usesManagedWindowsHost(dispatch) {
+    return process.platform === "win32" && dispatch.sandbox?.executionMode === "host";
 }
 function isFakeWorkerModel(model) {
     return model.trim().toLowerCase() === fakeWorkerModel;