@loucompanion/forge-bridge 0.1.3-dev.bd0c67bbf352 → 0.1.3-dev.f2b8822ce953

package/dist/session/provider-cli/provider-cli.prompts.js

@@ -0,0 +1,387 @@
+import { codexMcpConfigArgs, completionPhaseFromDispatch, completionPromptForDebugCycle, completionPromptForDevelopCycle, completionPromptForDraftCycle, completionPromptForPhase, completionPromptForQaCycle } from "../phase-completion.js";
+import { isDebugCompletionPhaseForProvider } from "./provider-cli.artifacts.js";
+import { hasLaunchTarget } from "./provider-cli.qa-sidecars.js";
+export function buildDraftSpec(dispatch) {
+    return `# Draft Generation Context
+
+Project: ${dispatch.draft?.projectName ?? dispatch.repo.name}
+Repository: ${dispatch.draft?.repoName ?? dispatch.repo.name}
+Draft kind: ${dispatch.draft?.kind ?? "draft"}
+
+## User Prompt
+
+${dispatch.draft?.userPrompt ?? ""}
+`;
+}
+export function buildDraftPrompt(dispatch) {
+    const draft = dispatch.draft;
+    if (!draft) {
+        throw new Error("Draft prompt is missing.");
+    }
+    const decomposeDraft = isDecomposeDraftDispatch(dispatch);
+    const draftArtifacts = dispatch.artifacts
+        .filter((artifact) => artifact.scope === "operational" && ["command", "skill", "hook"].includes(artifact.kind))
+        .map((artifact) => `## ${artifact.kind}: ${artifact.slug}\n${artifact.body.trim()}`)
+        .join("\n\n");
+    const artifactSection = draftArtifacts
+        ? `\n\n# Injected Draft command/skills/hooks\n\n${draftArtifacts}`
+        : "";
+    const projectSection = [
+        draft.projectName ? `Project: ${draft.projectName}` : null,
+        draft.repoName ? `Repository: ${draft.repoName}` : null
+    ].filter(Boolean).join("\n");
+    const scopedProjectSection = projectSection ? `\n\n# Selected project context\n\n${projectSection}` : "";
+    return `${draft.systemPrompt}${scopedProjectSection}${artifactSection}
+
+Draft kind: ${draft.kind}
+
+${draft.userPrompt}
+
+${decomposeDraft
+        ? `Use the injected command/skills/hooks as lane instructions. You must call each Forge Decompose MCP completion tool in order. Do not claim Decompose is complete until forge.complete_decompose_proposal accepts the final proposal_json.
+
+Complete these gates in order: decompose_subject_intake -> decompose_context_review -> decompose_breakdown_strategy -> decompose_child_items -> decompose_dependency_graph -> decompose_critic -> decompose_proposal.
+
+The final proposal_json object must contain summary, optional blockedReason, and candidates.`
+        : `${completionPromptForDraftCycle("draft_intent")}
+
+Use the injected command/skills/hooks as lane instructions. You must call each Forge Draft MCP completion tool in order. Do not claim the Draft is complete until forge.complete_draft_proposal accepts the final draft_json.`}
+
+Do not modify source files.`;
+}
+export function isDecomposeDraftKind(kind) {
+    return kind === "work_order_decomposition" || kind === "feature_decomposition";
+}
+export function isDecomposeDraftDispatch(dispatch) {
+    return dispatch.execution.lane.trim().toLowerCase() === "decompose"
+        || dispatch.session.lane.trim().toLowerCase() === "decompose"
+        || isDecomposeDraftKind(dispatch.draft?.kind?.trim().toLowerCase());
+}
+export function formatProviderCliCommand(command) {
+    return [command.command, ...command.args].map(singleLine).join(" ");
+}
+export function singleLine(value) {
+    return value.replace(/\s+/g, " ").trim();
+}
+export function buildProviderCliCommand(dispatch, run) {
+    const provider = dispatch.execution.provider.trim();
+    const normalizedProvider = provider.toLowerCase();
+    const model = dispatch.execution.model.trim();
+    if (normalizedProvider === "codex") {
+        const args = run ? ["-s", codexSandboxModeForPlatform(), "-a", "never", "exec"] : ["exec"];
+        if (run?.completionTools) {
+            args.push(...codexMcpConfigArgs(run.completionTools));
+        }
+        args.push("--model", model);
+        if (run) {
+            args.push("--json");
+            if (run.worktreePath) {
+                args.push("--cd", run.worktreePath);
+            }
+            if (run.skipGitRepoCheck) {
+                args.push("--skip-git-repo-check");
+            }
+            args.push(run.prompt ?? "");
+        }
+        return { command: "codex", args };
+    }
+    if (normalizedProvider === "cursor") {
+        const args = ["--print", "--output-format", "stream-json", "--model", model];
+        if (run?.worktreePath) {
+            args.push("--workspace", run.worktreePath);
+        }
+        if (run?.prompt) {
+            args.push("--yolo", "--approve-mcps", "--trust", run.prompt);
+        }
+        return { command: "cursor-agent", args };
+    }
+    const args = ["--model", model];
+    if (run?.prompt) {
+        args.push(run.prompt);
+    }
+    return { command: provider, args };
+}
+export function codexSandboxModeForPlatform(platform = process.platform) {
+    return platform === "win32" ? "danger-full-access" : "workspace-write";
+}
+export function buildArchitectPrompt(dispatch) {
+    return `You are Forge's Architect lane running locally in a prepared git worktree.
+
+Work item: ${dispatch.workItem.id} — ${dispatch.workItem.title}
+
+Plan only. Do not implement source changes, do not create Develop phase artifacts, and do not mark the spec approved.
+Read injected Forge context under .forge plus the repository shape, then produce a repo-grounded implementation DAG with task tests, phase gates, final QA coverage, and a pending-approval spec.
+Implementation DAG tasks are Develop child tasks only: include focused repo/product implementation changes. Do not create child Develop tasks for parent-story QA, sign-off, materialized child inventory, child-count evidence, parent plan artifact checks, or final integrated acceptance proof; put those checks in qa_plan.final_qa.
+${architectDependencyInstruction(dispatch)}
+${architectRevisionInstruction(dispatch)}
+Forge owns protocol files: write Architect artifacts only through the completion MCP tool.
+
+${completionPromptForPhase("architect")}
+
+Finish only after calling forge.complete_architect_plan with implementation_plan, qa_plan, status, summary, and report/report_markdown.`;
+}
+export function architectDependencyInstruction(dispatch) {
+    if (!dispatch.architectDependencies || dispatch.architectDependencies.prerequisites.length === 0) {
+        return "";
+    }
+    const dependencies = dispatch.architectDependencies.prerequisites
+        .map((dependency, index) => {
+        const schedule = dependency.scheduleIndex === null || dependency.scheduleIndex === undefined
+            ? "schedule index unknown"
+            : `schedule index ${dependency.scheduleIndex}`;
+        const wave = dependency.waveIndex === null || dependency.waveIndex === undefined
+            ? "wave unknown"
+            : `wave ${dependency.waveIndex}`;
+        const featureSchedule = dependency.featureScheduleIndex === null || dependency.featureScheduleIndex === undefined
+            ? ""
+            : `, feature schedule ${dependency.featureScheduleIndex}`;
+        const outputSource = dependency.pullRequestNumber === null || dependency.pullRequestNumber === undefined
+            ? `manual completion on ${dependency.targetBranch}`
+            : `merged PR ${dependency.pullRequestNumber} into ${dependency.targetBranch}`;
+        return `${index + 1}. ${dependency.title} (${dependency.storyId}, ${schedule}, ${wave}${featureSchedule})
+   - Expected output: ${dependency.expectedOutput ?? "Predecessor output recorded by Work Order dependency graph."}
+   - Handoff summary: ${dependency.handoffSummary ?? "Use the predecessor implementation as the foundation for this story."}
+   - Dependency reason: ${dependency.dependencyReason ?? "This story depends on predecessor output."}
+   - Output source: ${outputSource}`;
+    })
+        .join("\n");
+    return `
+Dependency Schedule Context:
+This story is scheduled after predecessor work that should already be available on base branch ${dispatch.architectDependencies.baseBranch}.
+
+${dependencies}
+
+Use this predecessor output as foundation. Do not redesign or recreate predecessor scope. If the expected output is unavailable in the checkout/base branch, stop and report dependency_output_unavailable.`;
+}
+export function architectRevisionInstruction(dispatch) {
+    if (!dispatch.architectRevision) {
+        return "";
+    }
+    return `
+Architect revision context:
+- Previous plan id: ${dispatch.architectRevision.priorPlanId}
+- Previous content hash: ${dispatch.architectRevision.priorContentHash}
+- Reviewer feedback: ${dispatch.architectRevision.feedback}
+Revise the prior plan in response to the feedback. Preserve accepted scope and only change what the feedback requires.`;
+}
+export function buildImplementationPrompt(dispatch, phase = completionPhaseFromDispatch(dispatch)) {
+    return `You are Forge's ${phase.replace(/_/g, " ")} phase runner running locally in a prepared git worktree.
+
+Read .forge/work-items/${dispatch.workItem.id}/spec.md and any prior phase artifacts required by this phase.
+${phaseWorkInstruction(phase)}
+${qaReworkImplementationInstruction(dispatch)}
+Use the repository's existing conventions. Run relevant tests when practical.
+Forge owns protocol files: worktree prep, injected .forge commands/hooks/skills, phase verdict artifacts, reports, and commits.
+Read Forge-provided context under .forge when needed, but do not edit .forge files or create Forge verdict/report artifacts by hand.
+
+${completionPromptForPhase(phase)}
+
+Finish with a concise summary of changed files and verification after calling the completion tool.`;
+}
+export function buildDevelopCyclePrompt(dispatch, phase = completionPhaseFromDispatch(dispatch)) {
+    return `You are Forge's develop-cycle runner running locally in a prepared git worktree.
+
+Read .forge/work-items/${dispatch.workItem.id}/spec.md, implement the work item, self-review the diff, then validate it in this same provider session.
+Start in the ${phase.replace(/_/g, " ")} phase. Do not stop after implementation if it passes; continue through self-review and validation using the next instruction returned by each completion tool.
+${qaReworkImplementationInstruction(dispatch)}
+Use the repository's existing conventions. Run relevant tests when practical.
+Forge owns protocol files: worktree prep, injected .forge commands/hooks/skills, phase verdict artifacts, reports, and commits.
+Read Forge-provided context under .forge when needed, but do not edit .forge files or create Forge verdict/report artifacts by hand.
+
+${completionPromptForDevelopCycle(phase)}
+
+Finish with a concise summary of changed files and verification after the validation completion tool has accepted the work, or after the current phase tool records a non-pass blocker.`;
+}
+export function buildDebugCyclePrompt(dispatch, phase = completionPhaseFromDispatch(dispatch)) {
+    return `You are Forge's Debug lane running locally in a prepared git worktree for a bug work item.
+
+Read .forge/work-items/${dispatch.workItem.id}/spec.md, reproduce or characterize the bug, isolate root cause, apply the smallest safe fix, then prove the regression in this same provider session.
+Start in the ${phase.replace(/_/g, " ")} gate. Do not stop after a passing Debug gate; continue through the next Debug MCP instruction returned by the tool server until debug_regression is accepted or the current gate records a non-pass blocker.
+${debugQaReworkInstruction(dispatch)}
+Use the repository's existing conventions. Run focused tests when practical, especially the original repro and required regressions.
+Forge owns protocol files: worktree prep, injected .forge commands/hooks/skills, Debug verdict artifacts, reports, and commits.
+Read Forge-provided context under .forge when needed, but do not edit .forge files or create Forge Debug artifacts by hand.
+
+${completionPromptForDebugCycle(isDebugCompletionPhaseForProvider(phase) ? phase : "debug_repro")}
+
+Finish with a concise summary of changed files and verification after the debug_regression completion tool has accepted the work, or after the current Debug gate tool records a non-pass blocker.`;
+}
+export function qaReworkImplementationInstruction(dispatch) {
+    if (!dispatch.qaRework) {
+        return "";
+    }
+    return `
+QA rework context:
+- Attempt ${dispatch.qaRework.attempt}/${dispatch.qaRework.maxAttempts}
+- Rework packet: ${dispatch.qaRework.packetPath}
+- Required QA finding IDs: ${dispatch.qaRework.findingIds.join(", ")}
+Read the packet JSON and fix or explicitly dispute each listed finding. The implementation completion artifact must include resolved_findings entries for every required QA ID with qa_id, status, summary, evidence, changed_files, tests_added_or_updated, and regression_evidence.
+Use only these resolved_findings status values: resolved, disputed, or not_reproduced. Use resolved when the finding was fixed; do not use fixed.`;
+}
+export function debugQaReworkInstruction(dispatch) {
+    if (!dispatch.qaRework) {
+        return "";
+    }
+    return `
+QA rework context for Debug:
+- Attempt ${dispatch.qaRework.attempt}/${dispatch.qaRework.maxAttempts}
+- Rework packet: ${dispatch.qaRework.packetPath}
+- Required QA finding IDs: ${dispatch.qaRework.findingIds.join(", ")}
+Read the packet JSON, reproduce or characterize each listed finding, fix or explicitly dispute it, and include resolved_findings entries for every required QA ID in forge.complete_debug_fix with qa_id, status, summary, evidence, changed_files, tests_added_or_updated, and regression_evidence.
+Use only these resolved_findings status values: resolved, disputed, or not_reproduced. Use resolved when the finding was fixed; do not use fixed.`;
+}
+export function qaReworkRetestInstruction(dispatch) {
+    if (!dispatch.qaRework) {
+        return "";
+    }
+    return `
+QA retest context:
+- Rework attempt ${dispatch.qaRework.attempt}/${dispatch.qaRework.maxAttempts}
+- Rework packet: ${dispatch.qaRework.packetPath}
+- Priority finding IDs: ${dispatch.qaRework.findingIds.join(", ")}
+Prioritize retesting the listed QA findings and their required regressions before deciding pass, needs_rework, or blocked.`;
+}
+export function phaseWorkInstruction(phase) {
+    if (phase === "self_review") {
+        return "Review the implementation diff, apply safe fixes when needed, and record remaining risks explicitly.";
+    }
+    if (phase === "validation") {
+        return "Run the validation commands and deterministic drift checks needed to prove the work is ready for QA.";
+    }
+    return "Implement the work item and keep the change focused.";
+}
+export function qaBrowserInstruction(dispatch) {
+    const qaBrowser = dispatch.qaBrowser;
+    const qaScope = dispatch.qaScope;
+    if (!qaBrowser) {
+        return "Browser/app launch context: not provided by Forge.";
+    }
+    const scopeAuthority = qaScope
+        ? qaScope.source === "heuristic"
+            ? "Forge's transient heuristic fallback"
+            : "persisted QA scope"
+        : "Forge heuristics";
+    const scopeEvidence = qaScope
+        ? `\n- QA scope required evidence: ${qaScope.required_evidence.length > 0 ? qaScope.required_evidence.join(", ") : "none"}\n- QA scope not applicable: ${qaScope.not_applicable.length > 0 ? qaScope.not_applicable.join(", ") : "none"}${qaScope.rationale ? `\n- QA scope rationale: ${qaScope.rationale}` : ""}`
+        : "";
+    const launchTarget = qaBrowser.launchTarget;
+    if (qaBrowser.required && !hasLaunchTarget(launchTarget ?? null)) {
+        return `Browser/app launch context:\n- UI/browser QA is required for this item by ${scopeAuthority}.\n- No app launch target was provided.\n- Return blocked with blocker_reason: missing_app_launch_target instead of pretending browser testing occurred.${scopeEvidence}\n- Artifact sidecars path when available: ${qaBrowser.artifactsPath || `.forge/work-items/${dispatch.workItem.id}/artifacts/qa`}`;
+    }
+    if (!launchTarget) {
+        return `Browser/app launch context:\n- UI/browser QA is not required by ${scopeAuthority} for this item.\n- If you determine browser testing is needed, return blocked with blocker_reason: missing_app_launch_target unless you can safely identify a launch target from the repo.${scopeEvidence}\n- Browser sidecars path: ${qaBrowser.artifactsPath || `.forge/work-items/${dispatch.workItem.id}/artifacts/qa`}`;
+    }
+    const routes = launchTarget.routes.length > 0 ? launchTarget.routes.join(", ") : "not specified";
+    return `Browser/app launch context:\n- Browser QA required: ${qaBrowser.required ? `yes, by ${scopeAuthority}` : `no by ${scopeAuthority}, unless the diff/AC requires it`}\n- URL: ${launchTarget.url || "not specified"}\n- Ready URL: ${launchTarget.ready_url || "not specified"}\n- Launch command: ${launchTarget.command || "not specified"}\n- Working directory: ${launchTarget.working_directory || "repo root"}\n- Routes to cover: ${routes}\n- Notes: ${launchTarget.notes || "none"}${scopeEvidence}\n- Browser sidecars path: ${qaBrowser.artifactsPath || `.forge/work-items/${dispatch.workItem.id}/artifacts/qa`}`;
+}
+export function storyQaInstruction(dispatch) {
+    const storyQa = dispatch.storyQa;
+    if (!storyQa) {
+        return "";
+    }
+    const childLines = storyQa.childTasks.map((child) => {
+        const dependencies = child.dependencyWorkItemIds.length > 0
+            ? child.dependencyWorkItemIds.join(", ")
+            : "none";
+        const validation = child.validationArtifact
+            ? `${child.validationArtifact.status} (${child.validationArtifact.path || "artifact path unavailable"})`
+            : "missing";
+        const childQa = child.qaArtifact
+            ? `${child.qaArtifact.status} (${child.qaArtifact.path || "artifact path unavailable"})`
+            : "not present";
+        return `- ${child.title} (${child.workItemId}, architect ${child.architectTaskId}, phase ${child.phaseId}/${child.phaseOrder}); deps: ${dependencies}; validation: ${validation}; child QA: ${childQa}`;
+    }).join("\n");
+    const finalQa = storyQa.finalQaChecks.length > 0
+        ? storyQa.finalQaChecks.map((check) => `- ${check}`).join("\n")
+        : "- No final QA checks were provided in qa.plan.final_qa.";
+    return `Story QA integration context:
+- Story work item: ${storyQa.storyWorkItemId}
+- Plan: ${storyQa.planId} / ${storyQa.planContentHash}
+- Story worktree: ${storyQa.worktreeKey}
+- Branch: ${storyQa.branch}
+- Architect implementation.plan.json provided: ${storyQa.implementationPlanJson ? "yes" : "no"}
+- Architect qa.plan.json provided: ${storyQa.qaPlanJson ? "yes" : "no"}
+Materialized child tasks and evidence:
+${childLines || "- No child tasks were provided."}
+Architect final QA checks:
+${finalQa}
+This is parent Story QA: inspect the integrated Story result, all current-plan child specs/evidence, and the final worktree state. Do not treat the final child task as separately signed off.`;
+}
+export function buildQaPrompt(dispatch, laneSpec) {
+    return `You are Forge's QA lane running locally in a prepared git worktree.
+
+First read and follow the injected QA lane command at .forge/work-items/${dispatch.workItem.id}/spec.md. It defines the required gated QA skill workflow for this run.
+
+Injected QA lane command and work item spec:
+${laneSpec}
+
+---
+
+Work item: ${dispatch.workItem.id}
+Title: ${dispatch.workItem.title}
+Description:
+${dispatch.workItem.description || "Not provided."}
+
+Acceptance criteria:
+${dispatch.workItem.acceptanceCriteria || "Not specified."}
+
+Repro steps / scenario:
+${dispatch.workItem.reproSteps || "Not provided."}
+
+System info / environment notes:
+${dispatch.workItem.systemInfo || "Not provided."}
+
+${storyQaInstruction(dispatch)}
+Inspect the validated implementation and Forge artifacts under .forge/work-items/${dispatch.workItem.id}/artifacts/ when present, especially implementation, self-review, and validation evidence.
+${qaBrowserInstruction(dispatch)}
+${qaReworkRetestInstruction(dispatch)}
+QA is read-mostly: inspect code, run commands, and exercise browser/app flows when available, but do not edit product source or tests.
+Record concrete evidence. For UI/browser work, include browser_checks with URLs/routes, actions, observed results, screenshots/traces when available, console errors, failed network requests, and responsive checks. Store browser sidecars under .forge/work-items/${dispatch.workItem.id}/artifacts/qa/.
+Report in-scope defects as actionable findings with repro steps, expected/actual behavior, evidence, likely area, required fix, and required regression.
+Out-of-scope or follow-up issues belong in candidate_bugs instead of blocking the current item.
+
+${completionPromptForQaCycle()}
+
+Finish with a concise summary only after forge.complete_qa_verdict accepts the QA bundle.`;
+}
+export function buildConflictResolvePrompt(dispatch, branchName) {
+    const targetBranch = dispatch.cycleRun.requestedBase || dispatch.repo.defaultBranch || "main";
+    return `You are Forge's Conflict Resolve lane running locally in a prepared git worktree.
+
+The current branch is the pull request branch ${branchName}. Resolve merge conflicts against ${targetBranch}.
+Fetch origin, merge or rebase ${targetBranch} into ${branchName}, resolve conflicts conservatively, run relevant validation when practical, commit the resolution, and push ${branchName} to origin.
+Keep the original work item intent intact:
+- Work item: ${dispatch.workItem.id}
+- Title: ${dispatch.workItem.title}
+- Acceptance criteria: ${dispatch.workItem.acceptanceCriteria || "Not specified"}
+
+Finish with a concise summary of the conflicts resolved and verification performed.`;
+}
+export function buildPullRequestCommentsPrompt(dispatch, branchName) {
+    const pr = dispatch.pullRequest;
+    const targetBranch = pr?.targetBranch || dispatch.cycleRun.requestedBase || dispatch.repo.defaultBranch || "main";
+    const prLocator = pr
+        ? `PR #${pr.number}${pr.url ? ` (${pr.url})` : ""}`
+        : "the open pull request for this work item";
+    return `You are Forge's Pull Request Comments lane running locally in a prepared git worktree.
+
+The current branch is the pull request branch ${branchName}. Address unresolved review comments on ${prLocator}.
+PR context:
+- Provider: ${pr?.provider || "not provided"}
+- Source branch: ${pr?.sourceBranch || branchName}
+- Target branch: ${targetBranch}
+- Unresolved comments: ${pr?.unresolvedThreads ?? "unknown"}
+
+Use the PR URL, local git metadata, and available GitHub tooling/auth to inspect unresolved review threads. Make focused code or test changes that answer the feedback, commit the changes, and push ${branchName} to origin.
+After the push succeeds, Forge will resolve the addressed review threads through the pull request API.
+If the review thread contents are unavailable, stop with a clear summary of what could not be accessed instead of guessing.
+Keep the original work item intent intact:
+- Work item: ${dispatch.workItem.id}
+- Title: ${dispatch.workItem.title}
+- Acceptance criteria: ${dispatch.workItem.acceptanceCriteria || "Not specified"}
+
+Finish with a concise summary of comments addressed and verification performed.`;
+}
+export function isPullRequestCommentsDispatch(dispatch) {
+    return dispatch.cycleRun.kind.trim().toLowerCase() === "pr_comments";
+}

package/dist/session/provider-cli/provider-cli.qa-sidecars.d.ts

@@ -0,0 +1,11 @@
+import type { DispatchQaAppLaunchTarget } from "../session.types.js";
+interface QaSidecarFile {
+    readonly relativePath: string;
+    readonly content: string;
+}
+export declare function hasLaunchTarget(target: DispatchQaAppLaunchTarget | null): boolean;
+export declare function deterministicBrowserSidecar(workItemId: string, target: DispatchQaAppLaunchTarget, ownerType?: string | null, ownerId?: string | null): QaSidecarFile;
+export declare function deterministicBrowserCheck(target: DispatchQaAppLaunchTarget, screenshotPath: string): Record<string, unknown>;
+export declare function primaryLaunchRoute(target: DispatchQaAppLaunchTarget): string;
+export declare function writeQaSidecarFiles(worktreePath: string, files: readonly QaSidecarFile[]): Promise<Array<Record<string, unknown>>>;
+export {};

package/dist/session/provider-cli/provider-cli.qa-sidecars.js

@@ -0,0 +1,65 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+export function hasLaunchTarget(target) {
+    return Boolean(target?.url?.trim()
+        || target?.ready_url?.trim()
+        || target?.command?.trim()
+        || (target?.routes ?? []).some((route) => route.trim().length > 0));
+}
+export function deterministicBrowserSidecar(workItemId, target, ownerType, ownerId) {
+    const route = primaryLaunchRoute(target);
+    return {
+        relativePath: qaArtifactRelativePath(workItemId, "qa/screenshots/deterministic-browser-check.txt", ownerType, ownerId),
+        content: `Deterministic Forge QA browser evidence\nRoute: ${route}\nConsole errors: []\nNetwork errors: []\nResponsive checks: desktop, mobile\n`
+    };
+}
+export function deterministicBrowserCheck(target, screenshotPath) {
+    const route = primaryLaunchRoute(target);
+    return {
+        route,
+        url: route,
+        status: "pass",
+        summary: "Deterministic browser QA exercised the configured launch target.",
+        actions: ["open launch target", "walk acceptance criteria", "check console/network summaries", "check responsive viewport"],
+        screenshots: [screenshotPath],
+        console_errors: [],
+        network_errors: [],
+        responsive_checks: ["desktop", "mobile"]
+    };
+}
+export function primaryLaunchRoute(target) {
+    return target.ready_url?.trim()
+        || target.url?.trim()
+        || target.routes.find((route) => route.trim().length > 0)?.trim()
+        || target.command?.trim()
+        || "app launch command";
+}
+export async function writeQaSidecarFiles(worktreePath, files) {
+    const sidecars = [];
+    for (const file of files) {
+        const fullPath = path.resolve(worktreePath, file.relativePath);
+        const relativePath = path.relative(worktreePath, fullPath).split(path.sep).join("/");
+        if (relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
+            throw new Error(`QA sidecar path must stay under the worktree: ${file.relativePath}`);
+        }
+        await fs.mkdir(path.dirname(fullPath), { recursive: true });
+        await fs.writeFile(fullPath, file.content, "utf8");
+        sidecars.push({
+            path: relativePath,
+            content_hash: sha256(file.content),
+            bytes: Buffer.byteLength(file.content, "utf8")
+        });
+    }
+    return sidecars;
+}
+function qaArtifactRelativePath(workItemId, fileName, ownerType, ownerId) {
+    if (ownerType && ownerId) {
+        const ownerDirectory = ownerType.trim().toLowerCase() === "story" ? "stories" : "work-items";
+        return [".forge", ownerDirectory, ownerId, "artifacts", fileName].join("/");
+    }
+    return [".forge", "work-items", workItemId, "artifacts", fileName].join("/");
+}
+function sha256(content) {
+    return crypto.createHash("sha256").update(content).digest("hex");
+}

package/dist/session/provider-cli/provider-cli.runtime.d.ts

@@ -0,0 +1,9 @@
+import type { RunOnceDispatchPacket } from "../session.types.js";
+import type { ProviderCliRunContext } from "./provider-cli.types.js";
+import type { ProviderOutputState } from "./provider-output-state.js";
+import { type ProviderUsage } from "./provider-usage.js";
+export declare function providerProcessEnv(dispatch: RunOnceDispatchPacket): Readonly<Record<string, string>> | undefined;
+export declare function providerCredentialEnv(dispatch: RunOnceDispatchPacket): Readonly<Record<string, string>>;
+export declare function exactRedactionSecrets(dispatch: RunOnceDispatchPacket): readonly string[];
+export declare function emitProviderUsageEvent(emit: ProviderCliRunContext["emit"], dispatch: RunOnceDispatchPacket, outputState: ProviderOutputState): Promise<void>;
+export declare function estimatedDeterministicUsage(): ProviderUsage;

package/dist/session/provider-cli/provider-cli.runtime.js

@@ -0,0 +1,40 @@
+import { completionRedactionEnv } from "../phase-completion.js";
+import { addUsage, buildProviderUsageEvent, emptyUsage, hasUsage } from "./provider-usage.js";
+export function providerProcessEnv(dispatch) {
+    const env = {
+        ...completionRedactionEnv(exactRedactionSecrets(dispatch)),
+        ...providerCredentialEnv(dispatch)
+    };
+    return Object.keys(env).length > 0 ? env : undefined;
+}
+export function providerCredentialEnv(dispatch) {
+    const secret = dispatch.apiKeySecretGrant?.secret;
+    if (!secret || !dispatch.execution.requiresApiKeySecretGrant) {
+        return {};
+    }
+    const provider = dispatch.execution.provider.trim().toLowerCase();
+    if (provider === "codex" || provider === "openai") {
+        return { OPENAI_API_KEY: secret };
+    }
+    return {};
+}
+export function exactRedactionSecrets(dispatch) {
+    const secret = dispatch.apiKeySecretGrant?.secret;
+    if (!secret || !dispatch.execution.requiresApiKeySecretGrant) {
+        return [];
+    }
+    return [secret];
+}
+export async function emitProviderUsageEvent(emit, dispatch, outputState) {
+    const usage = outputState.usage;
+    if (hasUsage(usage)) {
+        await emit(buildProviderUsageEvent(dispatch, usage));
+    }
+}
+export function estimatedDeterministicUsage() {
+    return addUsage(emptyUsage("estimated"), {
+        inputTokens: 1000,
+        outputTokens: 400,
+        source: "estimated"
+    });
+}

package/dist/session/provider-cli/provider-cli.service.d.ts

@@ -1,36 +1,12 @@
 import { GitClient } from "../../shared/git/git.js";
-import { type CompletionToolRuntime } from "../phase-completion.js";
 import type { ProviderCliService } from "./provider-cli.base.js";
 import type { ProviderCliDraftContext, ProviderCliRunContext, ProviderCliRunResult } from "./provider-cli.types.js";
-import type { RunOnceDispatchPacket } from "../session.types.js";
-export interface ProviderCliCommand {
-    readonly command: string;
-    readonly args: readonly string[];
-}
-export interface ProviderProcessRunRequest {
-    readonly command: string;
-    readonly args: readonly string[];
-    readonly cwd: string;
-    readonly env?: Readonly<Record<string, string>>;
-}
-export interface ProviderProcessRunResult {
-    readonly exitCode: number;
-    readonly stdout: string;
-    readonly stderr: string;
-}
-export interface ProviderProcessRunner {
-    run(request: ProviderProcessRunRequest, handlers?: ProviderProcessHandlers, signal?: AbortSignal): Promise<ProviderProcessRunResult>;
-}
-export interface ProviderProcessHandlers {
-    onStdoutLine?(line: string): Promise<void> | void;
-    onStderrLine?(line: string): Promise<void> | void;
-}
-interface ProviderChildEnvironmentOptions {
-    readonly parentEnv?: NodeJS.ProcessEnv;
-    readonly platform?: NodeJS.Platform;
-    readonly homeDir?: string;
-}
-export declare function buildProviderChildEnvironment(requestEnv?: Readonly<Record<string, string>>, options?: ProviderChildEnvironmentOptions): NodeJS.ProcessEnv;
+import { type ProviderProcessRunner } from "./provider-cli.process.js";
+export { DeterministicProviderCliService } from "./provider-cli.deterministic.js";
+export { buildProviderCliCommand, codexSandboxModeForPlatform, formatProviderCliCommand } from "./provider-cli.prompts.js";
+export { buildProviderChildEnvironment, chooseWindowsCommandCandidate, StreamingProviderProcessRunner } from "./provider-cli.process.js";
+export { buildWindowsLaunchCommand } from "../../shared/process/windows-launch.js";
+export type { ProviderCliCommand, ProviderProcessRunner, ProviderProcessRunRequest, ProviderProcessRunResult } from "./provider-cli.process.js";
 export declare class RoutingProviderCliService implements ProviderCliService {
     private readonly realProvider;
     private readonly deterministicProvider;
@@ -51,26 +27,3 @@ export declare class ProcessBackedProviderCliService implements ProviderCliServi
     runQa(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
     runConflictResolve(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
 }
-export declare class DeterministicProviderCliService implements ProviderCliService {
-    private readonly git;
-    constructor(git?: GitClient);
-    runDraft(context: ProviderCliDraftContext): Promise<ProviderCliRunResult>;
-    runImplementation(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
-    runArchitect(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
-    runQa(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
-    runConflictResolve(context: ProviderCliRunContext): Promise<ProviderCliRunResult>;
-}
-export declare class StreamingProviderProcessRunner implements ProviderProcessRunner {
-    run(request: ProviderProcessRunRequest, handlers?: ProviderProcessHandlers, signal?: AbortSignal): Promise<ProviderProcessRunResult>;
-}
-export declare function chooseWindowsCommandCandidate(candidates: readonly string[]): string | null;
-export declare function buildWindowsLaunchCommand(commandPath: string, args: readonly string[]): ProviderCliCommand;
-export declare function formatProviderCliCommand(command: ProviderCliCommand): string;
-export declare function buildProviderCliCommand(dispatch: RunOnceDispatchPacket, run?: {
-    readonly prompt?: string;
-    readonly worktreePath?: string;
-    readonly completionTools?: CompletionToolRuntime;
-    readonly skipGitRepoCheck?: boolean;
-}): ProviderCliCommand;
-export declare function codexSandboxModeForPlatform(platform?: NodeJS.Platform): "workspace-write" | "danger-full-access";
-export {};