@loucompanion/forge-bridge 0.1.3-dev.d1ca67076aa9 → 0.1.3-dev.d46a8e73d03d

package/dist/session/session.types.d.ts

@@ -1,5 +1,5 @@
 export interface RunOnceDispatchPacket {
-    readonly schemaVersion: 1;
+    readonly schemaVersion: 1 | 2;
     readonly userId: string;
     readonly workItem: DispatchWorkItem;
     readonly repo: DispatchRepo;
@@ -8,8 +8,10 @@ export interface RunOnceDispatchPacket {
     readonly lease: DispatchLease;
     readonly execution: DispatchExecution;
     readonly serverLocal: DispatchServerLocalConfig;
+    readonly sandbox?: DispatchSandboxContext | null;
     readonly pullRequest?: DispatchPullRequestContext | null;
     readonly apiKeySecretGrant?: ApiKeySecretGrant | null;
+    readonly apiKeySecretGrantHandle?: ApiKeySecretGrantHandle | null;
     readonly artifacts: readonly DispatchResolvedArtifact[];
     readonly warmPathOverrides?: readonly string[];
     readonly qaBrowser?: DispatchQaBrowserContext | null;
@@ -22,12 +24,56 @@ export interface RunOnceDispatchPacket {
     readonly designerRefs?: DispatchDesignerRefHandoffContext | null;
     readonly draft?: DispatchDraftPrompt | null;
 }
+export interface DispatchSandboxContext {
+    readonly dispatchAttemptId: string;
+    readonly executionLeaseId: string;
+    readonly runnerInstanceId: string;
+    readonly executionMode: "host" | "docker";
+    readonly executionPolicy: "host_allowed" | "sandbox_preferred" | "sandbox_required";
+    readonly networkPolicy: DispatchSandboxNetworkPolicy;
+    readonly requestedResources: DispatchSandboxResourceRequest;
+    readonly runtime?: string | null;
+    readonly sandboxConfigCommitSha?: string | null;
+    readonly inputCommitSha?: string | null;
+    readonly contractDigest?: string | null;
+    readonly imageDigest?: string | null;
+    readonly publicationMode: "bridge_push" | "shared_filesystem";
+    readonly publishGrantHandle?: DispatchPublishGrantHandle | null;
+}
+export interface DispatchPublishGrantHandle {
+    readonly grantId: string;
+    readonly branch: string;
+    readonly expiresAt: string;
+}
+export interface DispatchSandboxResourceRequest {
+    readonly sandboxSlots: number;
+    readonly cpuMillis: number;
+    readonly memoryBytes: number;
+    readonly workspaceBytes: number;
+    readonly pids: number;
+    readonly buildSlots: number;
+}
+export interface DispatchSandboxNetworkPolicy {
+    readonly mode: "offline" | "public_allowlist" | "open_public";
+    readonly allowedHosts: readonly string[];
+}
 export interface DispatchDraftPrompt {
     readonly kind: string;
     readonly systemPrompt: string;
     readonly userPrompt: string;
     readonly projectName?: string | null;
     readonly repoName?: string | null;
+    readonly attachments?: readonly DispatchDraftAttachment[];
+}
+export interface DispatchDraftAttachment {
+    readonly index: number;
+    readonly fileName: string;
+    readonly contentType: string;
+    readonly kind: string;
+    readonly byteCount: number;
+    readonly summary: string;
+    readonly textContent?: string | null;
+    readonly contentBase64?: string | null;
 }
 export interface DispatchQaBrowserContext {
     readonly required: boolean;
@@ -268,6 +314,11 @@ export interface ApiKeySecretGrant {
     readonly secret: string;
     readonly expiresAt: string;
 }
+export interface ApiKeySecretGrantHandle {
+    readonly grantId: string;
+    readonly provider: string;
+    readonly expiresAt: string;
+}
 export interface DispatchServerLocalConfig {
     readonly repoRoot: string;
     readonly cleanupWorktrees: boolean;

package/dist/session/session.types.js

@@ -2,11 +2,11 @@ import path from "node:path";
 export function parseRunOnceDispatchPacket(value) {
     const packet = asObject(value, "dispatch packet");
     const schemaVersion = requiredNumber(packet, "schemaVersion");
-    if (schemaVersion !== 1) {
+    if (schemaVersion !== 1 && schemaVersion !== 2) {
         throw new Error(`Unsupported dispatch schemaVersion: ${schemaVersion}`);
     }
     return {
-        schemaVersion: 1,
+        schemaVersion,
         userId: requiredString(packet, "userId"),
         workItem: parseWorkItem(packet.workItem),
         repo: parseRepo(packet.repo),
@@ -15,8 +15,10 @@ export function parseRunOnceDispatchPacket(value) {
         lease: parseLease(packet.lease),
         execution: parseExecution(packet.execution),
         serverLocal: parseServerLocal(packet.serverLocal),
+        sandbox: parseSandbox(packet.sandbox, schemaVersion),
         pullRequest: parsePullRequest(packet.pullRequest),
         apiKeySecretGrant: parseApiKeySecretGrant(packet.apiKeySecretGrant),
+        apiKeySecretGrantHandle: parseApiKeySecretGrantHandle(packet.apiKeySecretGrantHandle),
         artifacts: parseArtifacts(packet.artifacts),
         warmPathOverrides: parseWarmPathOverrides(packet.warmPathOverrides),
         qaBrowser: parseQaBrowser(packet.qaBrowser),
@@ -30,6 +32,107 @@ export function parseRunOnceDispatchPacket(value) {
         draft: parseDraftPrompt(packet.draft)
     };
 }
+function parseSandbox(value, schemaVersion) {
+    if (value === undefined || value === null) {
+        if (schemaVersion === 2) {
+            throw new Error("sandbox is required for dispatch schemaVersion 2.");
+        }
+        return null;
+    }
+    const sandbox = asObject(value, "sandbox");
+    const executionMode = requiredString(sandbox, "executionMode");
+    if (executionMode !== "host" && executionMode !== "docker") {
+        throw new Error("sandbox.executionMode must be host or docker.");
+    }
+    const executionPolicy = requiredString(sandbox, "executionPolicy");
+    if (executionPolicy !== "host_allowed" && executionPolicy !== "sandbox_preferred" && executionPolicy !== "sandbox_required") {
+        throw new Error("sandbox.executionPolicy is invalid.");
+    }
+    return {
+        dispatchAttemptId: requiredString(sandbox, "dispatchAttemptId"),
+        executionLeaseId: requiredString(sandbox, "executionLeaseId"),
+        runnerInstanceId: requiredString(sandbox, "runnerInstanceId"),
+        executionMode,
+        executionPolicy,
+        networkPolicy: parseSandboxNetworkPolicy(sandbox.networkPolicy),
+        requestedResources: parseSandboxResourceRequest(sandbox.requestedResources),
+        runtime: optionalString(sandbox, "runtime"),
+        sandboxConfigCommitSha: optionalString(sandbox, "sandboxConfigCommitSha"),
+        inputCommitSha: optionalString(sandbox, "inputCommitSha"),
+        contractDigest: optionalString(sandbox, "contractDigest"),
+        imageDigest: optionalString(sandbox, "imageDigest"),
+        publicationMode: parsePublicationMode(sandbox.publicationMode),
+        publishGrantHandle: parsePublishGrantHandle(sandbox.publishGrantHandle)
+    };
+}
+function parsePublicationMode(value) {
+    if (value === undefined || value === null)
+        return "shared_filesystem";
+    if (value !== "bridge_push" && value !== "shared_filesystem")
+        throw new Error("sandbox.publicationMode is invalid.");
+    return value;
+}
+function parsePublishGrantHandle(value) {
+    if (value === undefined || value === null)
+        return null;
+    const handle = asObject(value, "sandbox.publishGrantHandle");
+    const grantId = requiredString(handle, "grantId");
+    const branch = requiredString(handle, "branch");
+    const expiresAt = requiredString(handle, "expiresAt");
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(grantId)) {
+        throw new Error("sandbox.publishGrantHandle.grantId is invalid.");
+    }
+    if (branch.length > 240)
+        throw new Error("sandbox.publishGrantHandle.branch is too long.");
+    if (!Number.isFinite(Date.parse(expiresAt)))
+        throw new Error("sandbox.publishGrantHandle.expiresAt is invalid.");
+    return { grantId, branch, expiresAt };
+}
+function parseSandboxResourceRequest(value) {
+    if (value === undefined || value === null) {
+        return {
+            sandboxSlots: 1,
+            cpuMillis: 2000,
+            memoryBytes: 2 * 1024 ** 3,
+            workspaceBytes: 10 * 1024 ** 3,
+            pids: 512,
+            buildSlots: 1
+        };
+    }
+    const resources = asObject(value, "sandbox.requestedResources");
+    return {
+        sandboxSlots: boundedInteger(resources, "sandboxSlots", 1, 4),
+        cpuMillis: boundedInteger(resources, "cpuMillis", 100, 64_000),
+        memoryBytes: boundedInteger(resources, "memoryBytes", 128 * 1024 ** 2, 512 * 1024 ** 3),
+        workspaceBytes: boundedInteger(resources, "workspaceBytes", 1024 ** 3, 10 * 1024 ** 4),
+        pids: boundedInteger(resources, "pids", 32, 65_536),
+        buildSlots: boundedInteger(resources, "buildSlots", 0, 4)
+    };
+}
+function parseSandboxNetworkPolicy(value) {
+    if (value === undefined || value === null)
+        return { mode: "offline", allowedHosts: [] };
+    const policy = asObject(value, "sandbox.networkPolicy");
+    const mode = requiredString(policy, "mode");
+    if (mode !== "offline" && mode !== "public_allowlist" && mode !== "open_public") {
+        throw new Error("sandbox.networkPolicy.mode is invalid.");
+    }
+    const rawHosts = policy.allowedHosts ?? [];
+    if (!Array.isArray(rawHosts) || rawHosts.some((host) => typeof host !== "string")) {
+        throw new Error("sandbox.networkPolicy.allowedHosts must be a string array.");
+    }
+    const allowedHosts = [...new Set(rawHosts.map(host => host.trim().toLowerCase()).filter(Boolean))];
+    if (allowedHosts.length > 128 || allowedHosts.some(host => !/^(?:\*\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(host))) {
+        throw new Error("sandbox.networkPolicy.allowedHosts contains an invalid hostname.");
+    }
+    if (mode !== "public_allowlist" && allowedHosts.length > 0) {
+        throw new Error("sandbox.networkPolicy.allowedHosts requires public_allowlist mode.");
+    }
+    if (mode === "public_allowlist" && allowedHosts.length === 0) {
+        return { mode: "offline", allowedHosts: [] };
+    }
+    return { mode, allowedHosts };
+}
 export function failureResult(summary, events = []) {
     return {
         schemaVersion: 1,
@@ -121,9 +224,45 @@ function parseDraftPrompt(value) {
     return {
         kind: requiredString(draft, "kind"),
         systemPrompt: requiredString(draft, "systemPrompt"),
-        userPrompt: requiredString(draft, "userPrompt")
+        userPrompt: requiredString(draft, "userPrompt"),
+        projectName: optionalString(draft, "projectName"),
+        repoName: optionalString(draft, "repoName"),
+        attachments: parseDraftAttachments(draft.attachments)
     };
 }
+function parseDraftAttachments(value) {
+    if (value === undefined || value === null) {
+        return [];
+    }
+    if (!Array.isArray(value)) {
+        throw new Error("draft.attachments must be an array when provided.");
+    }
+    return value.map((entry, index) => {
+        const attachment = asObject(entry, `draft.attachments[${index}]`);
+        const kind = requiredString(attachment, "kind").trim().toLowerCase();
+        if (kind !== "text" && kind !== "image") {
+            throw new Error(`draft.attachments[${index}].kind must be text or image.`);
+        }
+        const textContent = optionalString(attachment, "textContent");
+        const contentBase64 = optionalString(attachment, "contentBase64");
+        if (kind === "text" && textContent === null) {
+            throw new Error(`draft.attachments[${index}].textContent is required for text attachments.`);
+        }
+        if (kind === "image" && contentBase64 === null) {
+            throw new Error(`draft.attachments[${index}].contentBase64 is required for image attachments.`);
+        }
+        return {
+            index: optionalNonNegativeInteger(attachment, "index") ?? index,
+            fileName: requiredString(attachment, "fileName"),
+            contentType: optionalString(attachment, "contentType") ?? "",
+            kind,
+            byteCount: optionalNonNegativeInteger(attachment, "byteCount") ?? 0,
+            summary: optionalString(attachment, "summary") ?? "",
+            textContent,
+            contentBase64
+        };
+    });
+}
 function parseApiKeySecretGrant(value) {
     if (value === undefined || value === null) {
         return null;
@@ -136,6 +275,16 @@ function parseApiKeySecretGrant(value) {
         expiresAt: requiredString(grant, "expiresAt")
     };
 }
+function parseApiKeySecretGrantHandle(value) {
+    if (value === undefined || value === null)
+        return null;
+    const grant = asObject(value, "apiKeySecretGrantHandle");
+    return {
+        grantId: requiredString(grant, "grantId"),
+        provider: requiredString(grant, "provider"),
+        expiresAt: requiredString(grant, "expiresAt")
+    };
+}
 function parseServerLocal(value) {
     const serverLocal = asObject(value, "serverLocal");
     return {
@@ -580,3 +729,10 @@ function requiredNumber(source, key) {
     }
     return value;
 }
+function boundedInteger(source, key, minimum, maximum) {
+    const value = requiredNumber(source, key);
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+        throw new Error(`${key} must be an integer from ${minimum} through ${maximum}.`);
+    }
+    return value;
+}

package/dist/shared/process/windows-launch.d.ts

@@ -2,7 +2,7 @@ export interface LaunchCommand {
     readonly command: string;
     readonly args: readonly string[];
 }
-export declare function buildWindowsCmdLaunch(command: string, args: readonly string[]): LaunchCommand;
+export declare function buildWindowsCmdLaunch(command: string, args: readonly string[], comSpec?: string | undefined): LaunchCommand;
 export declare function buildWindowsLaunchCommand(commandPath: string, args: readonly string[]): LaunchCommand;
 export declare function windowsCommandLine(command: string, args: readonly string[]): string;
 export declare function quoteWindowsCommandLineArg(value: string): string;

package/dist/shared/process/windows-launch.js

@@ -1,8 +1,11 @@
 import path from "node:path";
-export function buildWindowsCmdLaunch(command, args) {
+export function buildWindowsCmdLaunch(command, args, comSpec = process.env.ComSpec) {
+    const resolvedComSpec = comSpec?.trim();
+    const commandLine = windowsCommandLine(command, args);
+    const cmdPayload = commandLine.startsWith('"') ? `"${commandLine}"` : commandLine;
     return {
-        command: process.env.ComSpec ?? "cmd.exe",
-        args: ["/d", "/s", "/v:off", "/c", `"${windowsCommandLine(command, args)}"`]
+        command: resolvedComSpec || "cmd.exe",
+        args: ["/d", "/s", "/v:off", "/c", cmdPayload]
     };
 }
 export function buildWindowsLaunchCommand(commandPath, args) {

package/dist/shared/provider-capabilities.d.ts

@@ -0,0 +1 @@
+export declare function supportsDraftImageAttachmentsFor(cliProviders: readonly string[]): boolean;

package/dist/shared/provider-capabilities.js

@@ -0,0 +1,3 @@
+export function supportsDraftImageAttachmentsFor(cliProviders) {
+    return cliProviders.some((provider) => provider.trim().toLowerCase() === "codex");
+}

package/dist/shared/redaction/redaction.js

@@ -1,9 +1,11 @@
 const secretKeyPattern = /(api[_-]?key|authorization|bearer|client[_-]?secret|password|secret|token)/i;
+const attachmentContentKeyPattern = /^(textContent|contentBase64)$/i;
+const serializedAttachmentContentPattern = /("(?:textContent|contentBase64)"\s*:\s*")(?:(?:\\.)|[^"\\])*(")/gi;
 export function redactSecrets(value, exactSecrets = []) {
     return redactValue(value, exactSecrets);
 }
 export function redactText(value, exactSecrets = []) {
-    let redacted = value;
+    let redacted = value.replace(serializedAttachmentContentPattern, "$1[REDACTED]$2");
     for (const secret of exactSecrets) {
         if (secret.length > 0) {
             redacted = redacted.split(secret).join("[REDACTED]");
@@ -25,6 +27,6 @@ function redactValue(value, exactSecrets) {
     }
     return Object.fromEntries(Object.entries(value).map(([key, item]) => [
         key,
-        secretKeyPattern.test(key) ? "[REDACTED]" : redactValue(item, exactSecrets)
+        secretKeyPattern.test(key) || attachmentContentKeyPattern.test(key) ? "[REDACTED]" : redactValue(item, exactSecrets)
     ]));
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const forgeBridgeVersion = "0.1.3-dev.d1ca67076aa9";
+export declare const forgeBridgeVersion = "0.1.3-dev.d46a8e73d03d";

package/dist/version.js

@@ -1 +1 @@
-export const forgeBridgeVersion = "0.1.3-dev.d1ca67076aa9";
+export const forgeBridgeVersion = "0.1.3-dev.d46a8e73d03d";

package/dist/worktree/dependency-warmer.d.ts

@@ -30,3 +30,14 @@ export declare function createDirectoryLink(sourcePath: string, targetPath: stri
 export declare function lockfilesDiffer(baseCheckoutPath: string, worktreePath: string, packageRootRelative: string): Promise<boolean>;
 export declare function requiresInstallFallback(entry: WarmPathEntry, baseCheckoutPath: string, worktreePath: string, sourceExists: boolean): Promise<string | null>;
 export declare function declaresNativeModules(packageRootPath: string): Promise<boolean>;
+export interface NpmLaunchOptions {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly execPath?: string;
+    readonly platform?: NodeJS.Platform;
+    readonly homeDir?: string;
+    readonly candidates?: readonly string[];
+}
+export declare function resolveNpmLaunch(args: readonly string[], options?: NpmLaunchOptions): {
+    command: string;
+    args: readonly string[];
+};

package/dist/worktree/dependency-warmer.js

@@ -1,6 +1,9 @@
+import { existsSync, realpathSync } from "node:fs";
 import fs from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
 import { NodeProcessRunner } from "../shared/process/process.js";
+import { buildWindowsCmdLaunch } from "../shared/process/windows-launch.js";
 import { isSubPath } from "../shared/path/path.js";
 const SKIP_DIR_NAMES = new Set([
     ".git",
@@ -184,7 +187,8 @@ async function runInstallFallback(entry, worktreePath, reason, executor) {
     if (entry.ecosystem === "node") {
         const lockPath = path.join(cwd, "package-lock.json");
         const args = (await pathExists(lockPath)) ? ["ci"] : ["install"];
-        await executor.run(cwd, "npm", args);
+        const launch = resolveNpmLaunch(args);
+        await executor.run(cwd, launch.command, launch.args);
         return { ecosystem: entry.ecosystem, packageRoot: entry.packageRoot, reason, command: `npm ${args.join(" ")}` };
     }
     if (entry.ecosystem === "python") {
@@ -286,6 +290,46 @@ async function sha256File(filePath) {
     const content = await fs.readFile(filePath);
     return crypto.createHash("sha256").update(content).digest("hex");
 }
+export function resolveNpmLaunch(args, options = {}) {
+    const env = options.env ?? process.env;
+    const execPath = options.execPath ?? process.execPath;
+    const npmExecPath = env.npm_execpath;
+    if (npmExecPath) {
+        return { command: execPath, args: [npmExecPath, ...args] };
+    }
+    const platform = options.platform ?? process.platform;
+    if (platform === "win32") {
+        const comSpec = options.env ? env.ComSpec ?? "cmd.exe" : env.ComSpec;
+        return buildWindowsCmdLaunch("npm.cmd", args, comSpec);
+    }
+    for (const candidate of options.candidates ?? defaultNpmCliCandidates(execPath, options.homeDir ?? os.homedir())) {
+        const resolvedCandidate = tryResolveNpmCandidate(candidate);
+        if (resolvedCandidate) {
+            return { command: execPath, args: [resolvedCandidate, ...args] };
+        }
+    }
+    return { command: "npm", args };
+}
+function tryResolveNpmCandidate(candidate) {
+    try {
+        if (!existsSync(candidate)) {
+            return null;
+        }
+        return realpathSync(candidate);
+    }
+    catch {
+        return null;
+    }
+}
+function defaultNpmCliCandidates(execPath, homeDir) {
+    const candidates = [];
+    const execDir = path.dirname(execPath);
+    if (path.isAbsolute(execDir)) {
+        candidates.push(path.join(execDir, "npm"), path.join(execDir, "npm-cli.js"), path.join(execDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"));
+    }
+    candidates.push("/usr/bin/npm", "/usr/local/bin/npm", path.join(homeDir, ".npm-global", "bin", "npm"), path.join(homeDir, ".npm-global", "lib", "node_modules", "npm", "bin", "npm-cli.js"));
+    return candidates;
+}
 const defaultCommandExecutor = {
     async run(cwd, command, args) {
         const result = await defaultProcessRunner.run({ command, cwd, args });

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@loucompanion/forge-bridge",
-  "version": "0.1.3-dev.d1ca67076aa9",
+  "version": "0.1.3-dev.d46a8e73d03d",
   "description": "Forge runner bridge CLI for connecting local developer machines to Forge dispatch.",
   "license": "UNLICENSED",
   "type": "module",
   "bin": {
+    "forge": "dist/cli/bin.js",
     "forge-bridge": "dist/cli/bin.js"
   },
   "main": "./dist/index.js",
@@ -43,7 +44,8 @@
     "lint": "eslint \"src/**/*.ts\" \"scripts/**/*.mjs\" \"vitest.config.ts\""
   },
   "dependencies": {
-    "@microsoft/signalr": "^8.0.17"
+    "@microsoft/signalr": "^8.0.17",
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",