@loucompanion/forge-bridge 0.1.3-dev.d46a8e73d03d → 0.1.3-dev.e7b62d8fdd33

package/dist/session/provider-cli/provider-cli.service.js

@@ -1,42 +1,85 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { RepositoryCoordinatorLock } from "../../sandbox/repository-lock.js";
 import { GitClient } from "../../shared/git/git.js";
 import { buildSpecBody, selectLaneCommand } from "../../worktree/artifact-injector.js";
+import { defaultWorktreeCoordinatorStateRoot } from "../../worktree/worktree-paths.js";
 import { completionPhaseFromDispatch, prepareCompletionToolRuntime, readCompletionArtifact, usesDebugCycleCompletion, usesDevelopCycleCompletion } from "../phase-completion.js";
-import { cleanupCompletionTools, commitWorktreeChanges, completionPhaseFromArtifact, emitArchitectStructuredEvents, emitCompletionArtifactRecorded, emitDecomposeGateArtifacts, emitDraftGateArtifacts, emitPhaseCompletionEvent, emitPhaseGateEvents, emitQaArtifactRecorded, emitQaStructuredEvents, enforceQaBrowserLaunchTargetGate, LiveArchitectArtifactEmitter, LiveCompletionArtifactEmitter, LiveQaArtifactEmitter, readCompletionArtifactsForRun, readQaCompletionArtifactBundle, summarizeStderr, waitForCompletionArtifact } from "./provider-cli.artifacts.js";
+import { cleanupCompletionTools, commitWorktreeChanges, completionPhaseFromArtifact, emitArchitectStructuredEvents, emitCompletionArtifactRecorded, emitDecomposeGateArtifacts, emitDraftGateArtifacts, emitPhaseCompletionEvent, emitPhaseGateEvents, emitQaArtifactRecorded, emitQaStructuredEvents, enforceQaBrowserLaunchTargetGate, LiveArchitectArtifactEmitter, LiveCompletionArtifactEmitter, LiveQaArtifactEmitter, readCompletionArtifactsForRun, readQaCompletionArtifactBundle, waitForCompletionArtifact } from "./provider-cli.artifacts.js";
 import { DeterministicProviderCliService } from "./provider-cli.deterministic.js";
-import { buildArchitectPrompt, buildConflictResolvePrompt, buildDebugCyclePrompt, buildDevelopCyclePrompt, buildDraftPrompt, buildDraftSpec, buildImplementationPrompt, buildProviderCliCommand, durableDraftInput, buildPullRequestCheckRepairPrompt, buildPullRequestCommentsPrompt, buildQaPrompt, formatProviderCliCommandForCheckpoint, isDecomposeDraftDispatch, isPullRequestCheckRepairDispatch, isPullRequestCommentsDispatch } from "./provider-cli.prompts.js";
+import { buildArchitectPrompt, buildConflictResolvePrompt, buildDebugCyclePrompt, buildDevelopCyclePrompt, buildDraftPrompt, buildDraftSpec, buildImplementationPrompt, buildProviderCliPrompt, buildProviderCliCommand, durableDraftInput, buildPullRequestCheckRepairPrompt, buildPullRequestCommentsPrompt, buildQaPrompt, formatProviderCliCommandForCheckpoint, isDecomposeDraftDispatch, isPullRequestCheckRepairDispatch, isPullRequestCommentsDispatch } from "./provider-cli.prompts.js";
 import { StreamingProviderProcessRunner } from "./provider-cli.process.js";
 import { emitProviderUsageEvent, providerProcessEnv } from "./provider-cli.runtime.js";
 import { clip, createProviderOutputState, parseJsonLine } from "./provider-output-state.js";
+import { writeCiRepairReadinessManifest } from "./ci-repair-readiness.js";
+import { assertRepairHeadEpoch } from "./provider-cli.repair-epoch.js";
+import { PrePublicationValidator, } from "../pre-publication-validation.js";
 export { DeterministicProviderCliService } from "./provider-cli.deterministic.js";
 export { buildProviderCliCommand, codexSandboxModeForPlatform, formatProviderCliCommand, formatProviderCliCommandForCheckpoint } from "./provider-cli.prompts.js";
-export { buildProviderChildEnvironment, chooseWindowsCommandCandidate, StreamingProviderProcessRunner } from "./provider-cli.process.js";
+export { buildProviderChildEnvironment, chooseWindowsCommandCandidate, resolveCodexNpmDirectLaunch, resolvePackageManagerDirectLaunch, resolveWindowsCommandFromPath, PROVIDER_OUTPUT_CAPTURE_LIMIT_CHARS, StreamingProviderProcessRunner } from "./provider-cli.process.js";
 export { buildWindowsLaunchCommand } from "../../shared/process/windows-launch.js";
-async function pushWorktreeBranch(git, worktreePath, branchName, emit) {
-    try {
-        await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
-        return;
-    }
-    catch (err) {
-        if (!isNonFastForwardPushError(err)) {
-            throw err;
+async function pushWorktreeBranch(git, worktreePath, branchName, repoPath, coordinator, signal, emit, expectedRemoteHeadSha) {
+    await coordinator.withLock(repoPath, async () => {
+        if (expectedRemoteHeadSha) {
+            const expected = expectedRemoteHeadSha.trim().toLowerCase();
+            const remoteListing = await git.run(worktreePath, ["ls-remote", "--heads", "origin", `refs/heads/${branchName}`]);
+            const observed = remoteListing.trim().split(/\s+/u)[0]?.toLowerCase() ?? "";
+            if (observed !== expected) {
+                throw new Error(`stale_head: repair publication expected remote ${branchName} at ${expected}, but observed ${observed || "no branch"}; refresh provider state before retrying.`);
+            }
+            try {
+                await git.run(worktreePath, [
+                    "push",
+                    "--porcelain",
+                    "origin",
+                    `HEAD:refs/heads/${branchName}`,
+                    `--force-with-lease=refs/heads/${branchName}:${expected}`,
+                ]);
+            }
+            catch (error) {
+                throw new Error(`stale_head: repair publication for ${branchName} lost its expected-head lease; Forge did not rebase or publish the stale repair: ${errorMessage(error)}`, { cause: error });
+            }
+            return;
         }
-        await emit?.({
-            role: "runner",
-            kind: "checkpoint",
-            content: `Remote branch ${branchName} moved before push; fetching latest and rebasing local changes.`,
-            eventType: "worktree_branch_push_rebase"
-        });
         try {
-            await git.run(worktreePath, ["fetch", "origin", remoteTrackingRefspec(branchName)]);
-            await git.run(worktreePath, ["rebase", `refs/remotes/origin/${branchName}`]);
             await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
+            return;
         }
-        catch (retryErr) {
-            throw new Error(`git push origin HEAD:${branchName} was rejected because the remote branch moved, and automatic fetch/rebase failed: ${errorMessage(retryErr)}`, { cause: retryErr });
+        catch (err) {
+            if (!isNonFastForwardPushError(err)) {
+                throw err;
+            }
+            await emit?.({
+                role: "runner",
+                kind: "checkpoint",
+                content: `Remote branch ${branchName} moved before push; fetching latest and rebasing local changes.`,
+                eventType: "worktree_branch_push_rebase"
+            });
+            try {
+                await git.run(worktreePath, ["fetch", "origin", remoteTrackingRefspec(branchName)]);
+                await git.run(worktreePath, ["rebase", `refs/remotes/origin/${branchName}`]);
+                await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
+            }
+            catch (retryErr) {
+                throw new Error(`worktree_branch_integration_conflict: git push origin HEAD:${branchName} was rejected because the remote branch moved, and automatic fetch/rebase failed: ${errorMessage(retryErr)}`, { cause: retryErr });
+            }
         }
+    }, signal);
+}
+function providerOwnsBranchPublication(context) {
+    return context.dispatch.sandbox?.executionMode !== "docker";
+}
+function prePublicationExecution(context, environment, defaultRunner) {
+    if (context.processRunner)
+        return { environment, processRunner: context.processRunner };
+    if (context.dispatch.sandbox?.executionMode !== "docker")
+        return { environment };
+    const expectedSandboxId = context.dispatch.sandbox.dispatchAttemptId;
+    const observedSandboxId = context.runtimeEnvironment?.FORGE_SANDBOX_ID ?? process.env.FORGE_SANDBOX_ID;
+    if (observedSandboxId !== expectedSandboxId) {
+        throw new Error(`prepublication_execution_scope_invalid: Docker attempt ${expectedSandboxId} has no runner proven to execute inside that sandbox.`);
     }
+    return { environment, processRunner: defaultRunner };
 }
 function remoteTrackingRefspec(branchName) {
     return `refs/heads/${branchName}:refs/remotes/origin/${branchName}`;
@@ -52,6 +95,226 @@ function isNonFastForwardPushError(err) {
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
+function providerCliExitFailure(command, result) {
+    const output = [result.stderr.trim(), result.stdout.trim()]
+        .filter(value => value.length > 0)
+        .join("\n");
+    const detail = clip(output, 1200);
+    const suffix = detail ? `: ${detail}` : "";
+    if (isProviderNetworkFailure(output)) {
+        return new Error(`provider_network_unavailable: ${command} could not reach its provider service${suffix}`);
+    }
+    return new Error(`${command} exited ${result.exitCode}${suffix}`);
+}
+export function isProviderNetworkFailure(output) {
+    const normalized = output.trim().toLowerCase();
+    if (!normalized) {
+        return false;
+    }
+    return [
+        "eai_again",
+        "enotfound",
+        "could not resolve host",
+        "failed to lookup address",
+        "name or service not known",
+        "no such host is known",
+        "temporary failure in name resolution",
+        "network is unreachable",
+        "no route to host",
+        "error sending request for url",
+        "client error (connect)",
+        "connection refused",
+        "connection reset by peer",
+        "stream disconnected before completion",
+    ].some(marker => normalized.includes(marker));
+}
+const defaultProviderToolHeartbeatIntervalMs = 60_000;
+const defaultManagedVerificationProgressIntervalMs = 30_000;
+function compareManagedVerificationSnapshots(left, right) {
+    const leftOrder = managedVerificationStartedAt(left.startedAt) ?? Number.MAX_SAFE_INTEGER;
+    const rightOrder = managedVerificationStartedAt(right.startedAt) ?? Number.MAX_SAFE_INTEGER;
+    return leftOrder - rightOrder || left.commandId.localeCompare(right.commandId);
+}
+function managedVerificationStartedAt(value) {
+    const parsed = Date.parse(value ?? "");
+    return Number.isFinite(parsed) ? parsed : null;
+}
+export class ManagedVerificationProgressEmitter {
+    logDirectory;
+    emit;
+    intervalMs;
+    timer = null;
+    observedStatuses = new Map();
+    completedCommands = new Set();
+    constructor(logDirectory, emit, intervalMs = defaultManagedVerificationProgressIntervalMs) {
+        this.logDirectory = logDirectory;
+        this.emit = emit;
+        this.intervalMs = intervalMs;
+    }
+    start() {
+        if (!this.logDirectory?.trim() || this.timer)
+            return;
+        this.timer = setInterval(() => {
+            void this.scan().catch(() => undefined);
+        }, Math.max(1, this.intervalMs));
+        void this.scan().catch(() => undefined);
+    }
+    async stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+        await this.scan().catch(() => undefined);
+    }
+    async scan() {
+        if (!this.logDirectory?.trim())
+            return;
+        const directory = path.join(this.logDirectory, "managed-commands");
+        const names = await fs.readdir(directory).catch(() => []);
+        const snapshots = await Promise.all(names
+            .filter(name => name.endsWith(".receipt.json"))
+            .map(async (name) => parseManagedVerificationSnapshot(path.join(directory, name))));
+        const current = snapshots
+            .filter((entry) => entry !== null)
+            .sort(compareManagedVerificationSnapshots);
+        if (current.some(snapshot => isManagedVerificationNonterminal(snapshot.status))) {
+            // Durable managed-command receipts are authoritative evidence that Forge
+            // still supervises work even when the provider is not inside an MCP tool
+            // call. Refresh the API idle deadline without inflating the transcript.
+            await this.emit({
+                role: "runner",
+                kind: "status",
+                content: "A supervised managed verification command is still running.",
+                eventType: "provider_tool_heartbeat",
+            });
+        }
+        for (const snapshot of current) {
+            await this.emitTransition(snapshot);
+        }
+    }
+    async emitTransition(current) {
+        const terminal = ["pass", "fail", "timed_out", "timeout_termination_failed", "runner_error"].includes(current.status);
+        if (terminal && this.completedCommands.has(current.commandId))
+            return;
+        const previousStatus = this.observedStatuses.get(current.commandId);
+        if (previousStatus === current.status)
+            return;
+        this.observedStatuses.set(current.commandId, current.status);
+        if (terminal)
+            this.completedCommands.add(current.commandId);
+        // Starting and running are one externally meaningful state. The receipt is
+        // still refreshed on disk for UI telemetry, but repeated output/elapsed
+        // changes must not inflate the provider transcript or session history.
+        if (!terminal && previousStatus === "starting" && current.status === "running")
+            return;
+        const startedAt = managedVerificationStartedAt(current.startedAt);
+        const elapsedMs = startedAt !== null
+            ? Math.max(current.elapsedMs ?? 0, Date.now() - startedAt)
+            : current.elapsedMs;
+        const elapsed = elapsedMs === null ? "an unknown duration" : formatElapsed(elapsedMs);
+        const outputTail = current.lastOutputStream === "stderr"
+            ? current.stderrTail || current.stdoutTail
+            : current.stdoutTail || current.stderrTail;
+        const recovered = previousStatus === undefined && terminal;
+        await this.emit({
+            role: "runner",
+            kind: terminal && current.status !== "pass" ? "error" : "status",
+            content: terminal
+                ? `Managed verification ${current.status} after ${elapsed}${recovered ? " (recovered from its durable receipt)" : ""}${outputTail ? `: ${clip(outputTail, 600)}` : "."}`
+                : `QA started managed verification ${current.commandId}. Forge is supervising it; durable progress remains available in the UI while the provider continues independent work.`,
+            eventType: terminal ? "verification_completed" : "verification_waiting",
+            data: JSON.stringify({
+                command_id: current.commandId,
+                status: current.status,
+                elapsed_ms: elapsedMs,
+                output_revision: current.outputRevision,
+                last_output_at: current.lastOutputAt,
+                recovered,
+            }),
+        });
+    }
+}
+function isManagedVerificationNonterminal(status) {
+    return status === "starting" || status === "running" || status === "waiting_for_build_slot";
+}
+async function parseManagedVerificationSnapshot(receiptPath) {
+    try {
+        const receipt = JSON.parse(await fs.readFile(receiptPath, "utf8"));
+        const commandId = typeof receipt.command_id === "string" ? receipt.command_id : null;
+        const status = typeof receipt.status === "string" ? receipt.status : null;
+        if (!commandId || !status)
+            return null;
+        return {
+            commandId,
+            status,
+            elapsedMs: typeof receipt.elapsed_ms === "number" ? receipt.elapsed_ms : null,
+            startedAt: typeof receipt.started_at === "string" ? receipt.started_at : null,
+            outputRevision: typeof receipt.output_revision === "number" ? receipt.output_revision : null,
+            lastOutputAt: typeof receipt.last_output_at === "string" ? receipt.last_output_at : null,
+            lastOutputStream: receipt.last_output_stream === "stdout" || receipt.last_output_stream === "stderr"
+                ? receipt.last_output_stream
+                : null,
+            stdoutTail: tail(typeof receipt.stdout === "string" ? receipt.stdout : ""),
+            stderrTail: tail(typeof receipt.stderr === "string" ? receipt.stderr : ""),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function tail(value) {
+    return value.trim().split(/\r?\n/u).slice(-4).join("\n");
+}
+function formatElapsed(milliseconds) {
+    const seconds = Math.max(0, Math.round(milliseconds / 1000));
+    const minutes = Math.floor(seconds / 60);
+    return minutes > 0 ? `${minutes}m ${seconds % 60}s` : `${seconds}s`;
+}
+class ProviderToolActivityHeartbeat {
+    outputState;
+    emit;
+    intervalMs;
+    timer = null;
+    constructor(outputState, emit, intervalMs) {
+        this.outputState = outputState;
+        this.emit = emit;
+        this.intervalMs = intervalMs;
+    }
+    async consume(line) {
+        const events = this.outputState.consume(line);
+        this.sync();
+        for (const event of events) {
+            await this.emit(event);
+        }
+    }
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    sync() {
+        if (!this.outputState.hasActiveToolCall) {
+            this.stop();
+            return;
+        }
+        if (this.timer) {
+            return;
+        }
+        this.timer = setInterval(() => {
+            if (!this.outputState.hasActiveToolCall) {
+                this.stop();
+                return;
+            }
+            void this.emit({
+                role: "runner",
+                kind: "status",
+                content: "A supervised provider tool is still running.",
+                eventType: "provider_tool_heartbeat",
+            }).catch(() => undefined);
+        }, Math.max(1, this.intervalMs));
+    }
+}
 const fakeWorkerModel = "server-local-fake-worker";
 export class RoutingProviderCliService {
     realProvider;
@@ -94,9 +357,15 @@ export class RoutingProviderCliService {
 export class ProcessBackedProviderCliService {
     processRunner;
     git;
-    constructor(processRunner = new StreamingProviderProcessRunner(), git = new GitClient()) {
+    providerToolHeartbeatIntervalMs;
+    publicationCoordinator;
+    prePublicationValidator;
+    constructor(processRunner = new StreamingProviderProcessRunner(), git = new GitClient(), providerToolHeartbeatIntervalMs = defaultProviderToolHeartbeatIntervalMs, publicationCoordinator = new RepositoryCoordinatorLock(defaultWorktreeCoordinatorStateRoot()), prePublicationValidator = new PrePublicationValidator()) {
         this.processRunner = processRunner;
         this.git = git;
+        this.providerToolHeartbeatIntervalMs = providerToolHeartbeatIntervalMs;
+        this.publicationCoordinator = publicationCoordinator;
+        this.prePublicationValidator = prePublicationValidator;
     }
     async runDraft(context) {
         const { dispatch } = context;
@@ -110,15 +379,18 @@ export class ProcessBackedProviderCliService {
         await fs.writeFile(path.join(metadataRoot, "spec.md"), buildDraftSpec(dispatch), "utf8");
         const stagedAttachments = await stageDraftAttachments(dispatch, metadataRoot);
         const decomposeDraft = isDecomposeDraftDispatch(dispatch);
-        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: decomposeDraft ? "decompose" : "draft" });
+        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: decomposeDraft ? "decompose" : "draft", runtimeEnvironment: context.runtimeEnvironment });
         const draftPrompt = buildDraftPrompt(dispatch, { attachmentReferences: stagedAttachments.textReferences });
-        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, draftPrompt);
+        const providerPrompt = buildProviderCliPrompt(dispatch, draftPrompt, context.runtimeEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt, usesManagedWindowsHost(dispatch));
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: pipePromptToStdin ? "-" : draftPrompt,
+            prompt: draftPrompt,
+            promptFromStdin: pipePromptToStdin,
             completionTools: completionTools ?? undefined,
             skipGitRepoCheck: false,
-            imagePaths: stagedAttachments.imagePaths
+            imagePaths: stagedAttachments.imagePaths,
+            runtimeEnvironment: context.runtimeEnvironment
         });
         const draftArtifactSlugs = dispatch.artifacts
             .filter((artifact) => artifact.scope === "operational" && ["command", "skill", "hook"].includes(artifact.kind))
@@ -133,7 +405,7 @@ export class ProcessBackedProviderCliService {
             role: "runner",
             kind: "checkpoint",
             content: `Starting provider CLI Draft: ${formatProviderCliCommandForCheckpoint(command)}`,
-            eventType: "provider_cli_started"
+            eventType: "provider_cli_starting"
         });
         await context.emit({
             role: "runner",
@@ -144,6 +416,7 @@ export class ProcessBackedProviderCliService {
             eventType: "completion_tools_configured"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
         try {
             const providerCancellation = new AbortController();
             const abortProvider = () => providerCancellation.abort();
@@ -154,17 +427,23 @@ export class ProcessBackedProviderCliService {
                 context.signal?.addEventListener("abort", abortProvider, { once: true });
             }
             try {
-                const runPromise = this.processRunner.run({
+                const runPromise = (context.processRunner ?? this.processRunner).run({
                     command: command.command,
                     args: command.args,
                     cwd: worktree.worktreePath,
-                    env: providerProcessEnv(dispatch),
-                    stdin: pipePromptToStdin ? draftPrompt : undefined
+                    env: providerProcessEnv(dispatch, context.runtimeEnvironment),
+                    stdin: pipePromptToStdin ? providerPrompt : undefined
                 }, {
+                    onStarted: async () => {
+                        await context.emit({
+                            role: "runner",
+                            kind: "checkpoint",
+                            content: "Provider CLI Draft is supervised and ready.",
+                            eventType: "provider_cli_started"
+                        });
+                    },
                     onStdoutLine: async (line) => {
-                        for (const event of outputState.consume(line)) {
-                            await context.emit(event);
-                        }
+                        await toolHeartbeat.consume(line);
                     }
                 }, providerCancellation.signal);
                 const artifactWaitCancellation = new AbortController();
@@ -199,7 +478,7 @@ export class ProcessBackedProviderCliService {
                     context.signal?.removeEventListener("abort", abortArtifactWait);
                 }
                 if (result.exitCode !== 0 && !earlyProposalArtifact) {
-                    throw new Error(`Provider CLI exited with code ${result.exitCode}${summarizeStderr(result.stderr)}.`);
+                    throw providerCliExitFailure(command.command, result);
                 }
                 await context.emit({
                     role: "runner",
@@ -260,6 +539,7 @@ export class ProcessBackedProviderCliService {
             }
         }
         finally {
+            toolHeartbeat.stop();
             await cleanupCompletionTools(completionTools, context.emit);
         }
     }
@@ -278,21 +558,26 @@ export class ProcessBackedProviderCliService {
         const specPath = path.join(metadataRoot, "spec.md");
         await fs.writeFile(specPath, specBody, "utf8");
         await fs.writeFile(path.join(metadataRoot, "spec.meta.json"), JSON.stringify({ schema_version: 1, status: "approved", produced_by: "forge-lane-command" }) + "\n", "utf8");
-        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase });
+        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase, runtimeEnvironment: context.runtimeEnvironment });
+        const implementationPrompt = debugCycle
+            ? buildDebugCyclePrompt(dispatch, phase)
+            : developCycle
+                ? buildDevelopCyclePrompt(dispatch, phase)
+                : buildImplementationPrompt(dispatch, phase);
+        const providerPrompt = buildProviderCliPrompt(dispatch, implementationPrompt, context.runtimeEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt, usesManagedWindowsHost(dispatch));
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: debugCycle
-                ? buildDebugCyclePrompt(dispatch, phase)
-                : developCycle
-                    ? buildDevelopCyclePrompt(dispatch, phase)
-                    : buildImplementationPrompt(dispatch, phase),
-            completionTools
+            prompt: implementationPrompt,
+            promptFromStdin: pipePromptToStdin,
+            completionTools,
+            runtimeEnvironment: context.runtimeEnvironment
         });
         await context.emit({
             role: "runner",
             kind: "checkpoint",
             content: `Starting provider CLI: ${formatProviderCliCommandForCheckpoint(command)} in ${worktree.worktreePath}`,
-            eventType: "provider_cli_started"
+            eventType: "provider_cli_starting"
         });
         await context.emit({
             role: "runner",
@@ -305,30 +590,38 @@ export class ProcessBackedProviderCliService {
             eventType: "completion_tools_configured"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
         const liveCompletionEvents = new LiveCompletionArtifactEmitter(worktree.worktreePath, dispatch.workItem.id, phase, developCycle, debugCycle, context.emit);
         let result;
         try {
             liveCompletionEvents.start();
-            result = await this.processRunner.run({
+            result = await (context.processRunner ?? this.processRunner).run({
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
-                env: providerProcessEnv(dispatch)
+                env: providerProcessEnv(dispatch, context.runtimeEnvironment),
+                stdin: pipePromptToStdin ? providerPrompt : undefined
             }, {
+                onStarted: async () => {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: "Provider CLI is supervised and ready.",
+                        eventType: "provider_cli_started"
+                    });
+                },
                 onStdoutLine: async (line) => {
-                    for (const event of outputState.consume(line)) {
-                        await context.emit(event);
-                    }
+                    await toolHeartbeat.consume(line);
                 }
             }, context.signal);
         }
         finally {
+            toolHeartbeat.stop();
             await liveCompletionEvents.stop();
             await cleanupCompletionTools(completionTools, context.emit);
         }
         if (result.exitCode !== 0) {
-            const stderr = clip(result.stderr.trim() || result.stdout.trim(), 1200);
-            throw new Error(`${command.command} exited ${result.exitCode}${stderr ? `: ${stderr}` : ""}`);
+            throw providerCliExitFailure(command.command, result);
         }
         await context.emit({
             role: "runner",
@@ -337,9 +630,12 @@ export class ProcessBackedProviderCliService {
             eventType: "provider_cli_completed"
         });
         await emitProviderUsageEvent(context.emit, dispatch, outputState);
+        if (developCycle || phase === "implementation") {
+            await this.prePublicationValidator.validate(worktree.worktreePath, "implementation", publicationCapabilities(context, context.runtimeEnvironment), context.emit, context.signal, prePublicationExecution(context, providerProcessEnv(dispatch, context.runtimeEnvironment), this.processRunner));
+        }
         const committed = await commitWorktreeChanges(this.git, worktree.worktreePath, dispatch.workItem.id);
-        if (developCycle || debugCycle || phase === "implementation") {
-            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, context.emit);
+        if ((developCycle || debugCycle || phase === "implementation") && providerOwnsBranchPublication(context)) {
+            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, worktree.repoPath, this.publicationCoordinator, context.signal, context.emit);
             await context.emit({
                 role: "runner",
                 kind: "checkpoint",
@@ -397,18 +693,23 @@ export class ProcessBackedProviderCliService {
         const specPath = path.join(metadataRoot, "spec.md");
         await fs.writeFile(specPath, specBody, "utf8");
         await fs.writeFile(path.join(metadataRoot, "spec.meta.json"), JSON.stringify({ schema_version: 1, status: "pending_approval", produced_by: "forge-lane-command" }) + "\n", "utf8");
-        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "architect" });
+        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "architect", runtimeEnvironment: context.runtimeEnvironment });
+        const architectPrompt = buildArchitectPrompt(dispatch);
+        const providerPrompt = buildProviderCliPrompt(dispatch, architectPrompt, context.runtimeEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt, usesManagedWindowsHost(dispatch));
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: buildArchitectPrompt(dispatch),
-            completionTools
+            prompt: architectPrompt,
+            promptFromStdin: pipePromptToStdin,
+            completionTools,
+            runtimeEnvironment: context.runtimeEnvironment
         });
         const commandText = formatProviderCliCommandForCheckpoint(command);
         await context.emit({
             role: "runner",
             kind: "checkpoint",
             content: `Starting provider CLI Architect: ${commandText} in ${worktree.worktreePath}`,
-            eventType: "provider_cli_started"
+            eventType: "provider_cli_starting"
         });
         await context.emit({
             role: "runner",
@@ -417,30 +718,36 @@ export class ProcessBackedProviderCliService {
             eventType: "completion_tools_configured"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
         const liveArchitectEvents = new LiveArchitectArtifactEmitter(worktree.worktreePath, dispatch.workItem.id, context.emit);
         let result;
         try {
             liveArchitectEvents.start();
-            result = await this.processRunner.run({
+            result = await (context.processRunner ?? this.processRunner).run({
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
-                env: providerProcessEnv(dispatch)
+                env: providerProcessEnv(dispatch, context.runtimeEnvironment),
+                stdin: pipePromptToStdin ? providerPrompt : undefined
             }, {
-                onStdoutLine: async (line) => {
-                    for (const event of outputState.consume(line)) {
-                        await context.emit(event);
-                    }
-                }
+                onStarted: async () => {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: "Provider CLI Architect is supervised and ready.",
+                        eventType: "provider_cli_started"
+                    });
+                },
+                onStdoutLine: async (line) => await toolHeartbeat.consume(line)
             }, context.signal);
         }
         finally {
+            toolHeartbeat.stop();
             await liveArchitectEvents.stop();
             await cleanupCompletionTools(completionTools, context.emit);
         }
         if (result.exitCode !== 0) {
-            const stderr = clip(result.stderr.trim() || result.stdout.trim(), 1200);
-            throw new Error(`${command.command} exited ${result.exitCode}${stderr ? `: ${stderr}` : ""}`);
+            throw providerCliExitFailure(command.command, result);
         }
         await context.emit({
             role: "runner",
@@ -488,18 +795,23 @@ export class ProcessBackedProviderCliService {
         const specPath = path.join(metadataRoot, "spec.md");
         await fs.writeFile(specPath, specBody, "utf8");
         await fs.writeFile(path.join(metadataRoot, "spec.meta.json"), JSON.stringify({ schema_version: 1, status: "approved", produced_by: "forge-lane-command" }) + "\n", "utf8");
-        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "qa" });
+        const completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "qa", runtimeEnvironment: context.runtimeEnvironment });
+        const qaPrompt = buildQaPrompt(dispatch, specBody);
+        const providerPrompt = buildProviderCliPrompt(dispatch, qaPrompt, context.runtimeEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt, usesManagedWindowsHost(dispatch));
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: buildQaPrompt(dispatch, specBody),
-            completionTools
+            prompt: qaPrompt,
+            promptFromStdin: pipePromptToStdin,
+            completionTools,
+            runtimeEnvironment: context.runtimeEnvironment
         });
         const commandText = formatProviderCliCommandForCheckpoint(command);
         await context.emit({
             role: "runner",
             kind: "checkpoint",
             content: `Starting provider CLI QA: ${commandText} in ${worktree.worktreePath}`,
-            eventType: "provider_cli_started"
+            eventType: "provider_cli_starting"
         });
         await context.emit({
             role: "runner",
@@ -508,30 +820,39 @@ export class ProcessBackedProviderCliService {
             eventType: "completion_tools_configured"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
+        const verificationProgress = new ManagedVerificationProgressEmitter(context.runtimeEnvironment?.FORGE_LOG_DIR, context.emit);
         const liveQaEvents = new LiveQaArtifactEmitter(worktree.worktreePath, dispatch.workItem.id, dispatch, context.emit);
         let result;
         try {
             liveQaEvents.start();
-            result = await this.processRunner.run({
+            verificationProgress.start();
+            result = await (context.processRunner ?? this.processRunner).run({
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
-                env: providerProcessEnv(dispatch)
+                env: providerProcessEnv(dispatch, context.runtimeEnvironment),
+                stdin: pipePromptToStdin ? providerPrompt : undefined
             }, {
-                onStdoutLine: async (line) => {
-                    for (const event of outputState.consume(line)) {
-                        await context.emit(event);
-                    }
-                }
+                onStarted: async () => {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: "Provider CLI QA is supervised and ready.",
+                        eventType: "provider_cli_started"
+                    });
+                },
+                onStdoutLine: async (line) => await toolHeartbeat.consume(line)
             }, context.signal);
         }
         finally {
+            toolHeartbeat.stop();
+            await verificationProgress.stop();
             await liveQaEvents.stop();
             await cleanupCompletionTools(completionTools, context.emit);
         }
         if (result.exitCode !== 0) {
-            const stderr = clip(result.stderr.trim() || result.stdout.trim(), 1200);
-            throw new Error(`${command.command} exited ${result.exitCode}${stderr ? `: ${stderr}` : ""}`);
+            throw providerCliExitFailure(command.command, result);
         }
         await context.emit({
             role: "runner",
@@ -547,7 +868,7 @@ export class ProcessBackedProviderCliService {
                 ? "Provider CLI QA completed but did not produce the complete durable QA artifact bundle."
                 : "Provider CLI QA completed but did not call the Forge QA completion tool.");
         }
-        enforceQaBrowserLaunchTargetGate(dispatch, qaArtifact);
+        await enforceQaBrowserLaunchTargetGate(dispatch, qaArtifact);
         if (!liveQaEvents.hasEmitted()) {
             await emitQaArtifactRecorded(context.emit, worktree.worktreePath, qaArtifact);
             await emitQaStructuredEvents(context.emit, qaArtifact);
@@ -579,41 +900,126 @@ export class ProcessBackedProviderCliService {
     }
     async runPullRequestRepair(context, route) {
         const { dispatch, worktree } = context;
+        const { expectedRepairHeadSha, preparedHeadSha } = await assertRepairHeadEpoch(context, this.git);
         const repairChecks = route === "ci_repair" || isPullRequestCheckRepairDispatch(dispatch);
         const addressComments = !repairChecks && isPullRequestCommentsDispatch(dispatch);
+        let repairSpec = null;
+        let repairEnvironment = context.runtimeEnvironment;
+        let completionTools = null;
+        if (repairChecks) {
+            const metadataRoot = path.join(worktree.worktreePath, ".forge", "work-items", dispatch.workItem.id);
+            await fs.mkdir(metadataRoot, { recursive: true });
+            const laneCommand = selectLaneCommand(dispatch.artifacts, dispatch.execution.lane, dispatch.cycleRun.phase);
+            if (!laneCommand) {
+                throw new Error(`CI repair readiness failed: lane command for '${dispatch.execution.lane}' was not resolved, so the approved spec cannot be materialized.`);
+            }
+            const specBody = buildSpecBody(laneCommand, dispatch.workItem, "ci_repair");
+            const specPath = path.join(metadataRoot, "spec.md");
+            await fs.writeFile(specPath, specBody, "utf8");
+            await fs.writeFile(path.join(metadataRoot, "spec.meta.json"), `${JSON.stringify({ schema_version: 1, status: "approved", produced_by: "forge-lane-command" })}\n`, "utf8");
+            repairSpec = {
+                repoPath: worktree.worktreePath,
+                path: specPath,
+                body: specBody,
+                producedBy: "forge-lane-command",
+                status: "approved",
+            };
+            const readiness = await writeCiRepairReadinessManifest(dispatch, worktree.worktreePath, specPath, context.runtimeEnvironment);
+            repairEnvironment = readiness.environment;
+            completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "ci_repair", runtimeEnvironment: repairEnvironment });
+            await context.emit({
+                role: "runner",
+                kind: "checkpoint",
+                content: `CI repair readiness contract prepared at ${path.relative(worktree.worktreePath, readiness.path).replaceAll(path.sep, "/")}; approved spec, attempt URLs, browser readiness, and local-equivalence policy are available before provider start.`,
+                eventType: "ci_repair_readiness_ready",
+            });
+            await context.emit({
+                role: "runner",
+                kind: "checkpoint",
+                content: "Forge CI repair completion tool configured; provider must call forge.complete_ci_repair before Bridge-owned commit and push.",
+                eventType: "completion_tools_configured",
+            });
+        }
+        const repairPrompt = repairChecks
+            ? buildPullRequestCheckRepairPrompt(dispatch, worktree.branchName)
+            : addressComments
+                ? buildPullRequestCommentsPrompt(dispatch, worktree.branchName)
+                : buildConflictResolvePrompt(dispatch, worktree.branchName);
+        const providerPrompt = buildProviderCliPrompt(dispatch, repairPrompt, repairEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(dispatch.execution.provider, providerPrompt, usesManagedWindowsHost(dispatch));
         const command = buildProviderCliCommand(dispatch, {
             worktreePath: worktree.worktreePath,
-            prompt: repairChecks
-                ? buildPullRequestCheckRepairPrompt(dispatch, worktree.branchName)
-                : addressComments
-                    ? buildPullRequestCommentsPrompt(dispatch, worktree.branchName)
-                    : buildConflictResolvePrompt(dispatch, worktree.branchName)
+            prompt: repairPrompt,
+            promptFromStdin: pipePromptToStdin,
+            completionTools: completionTools ?? undefined,
+            runtimeEnvironment: repairEnvironment
         });
         await context.emit({
             role: "runner",
             kind: "checkpoint",
             content: `Starting provider CLI ${repairChecks ? "CI repair" : addressComments ? "PR comment address" : "conflict resolve"}: ${formatProviderCliCommandForCheckpoint(command)} in ${worktree.worktreePath}`,
-            eventType: "provider_cli_started"
+            eventType: "provider_cli_starting"
         });
         const outputState = createProviderOutputState(dispatch.execution.provider);
-        const result = await this.processRunner.run({
-            command: command.command,
-            args: command.args,
-            cwd: worktree.worktreePath,
-            env: providerProcessEnv(dispatch)
-        }, {
-            onStdoutLine: async (line) => {
-                for (const event of outputState.consume(line)) {
-                    await context.emit(event);
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
+        let result;
+        try {
+            result = await (context.processRunner ?? this.processRunner).run({
+                command: command.command,
+                args: command.args,
+                cwd: worktree.worktreePath,
+                env: providerProcessEnv(dispatch, repairEnvironment),
+                stdin: pipePromptToStdin ? providerPrompt : undefined
+            }, {
+                onStarted: async () => {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: `Provider CLI ${repairChecks ? "CI repair" : addressComments ? "PR comment address" : "conflict resolve"} is supervised and ready.`,
+                        eventType: "provider_cli_started"
+                    });
+                },
+                onStdoutLine: async (line) => {
+                    await toolHeartbeat.consume(line);
                 }
+            }, context.signal);
+        }
+        finally {
+            toolHeartbeat.stop();
+            if (completionTools) {
+                await cleanupCompletionTools(completionTools, context.emit);
             }
-        }, context.signal);
+        }
         if (result.exitCode !== 0) {
-            const stderr = clip(result.stderr.trim() || result.stdout.trim(), 1200);
-            throw new Error(`${command.command} exited ${result.exitCode}${stderr ? `: ${stderr}` : ""}`);
+            throw providerCliExitFailure(command.command, result);
+        }
+        const postProviderHeadSha = (await this.git.run(worktree.worktreePath, ["rev-parse", "HEAD"])).trim();
+        if (postProviderHeadSha.toLowerCase() !== preparedHeadSha.toLowerCase()) {
+            throw new Error(`provider_publication_boundary_violation: PR repair changed HEAD from ${preparedHeadSha} to ${postProviderHeadSha}; Forge requires provider changes to remain uncommitted and unpushed until validation passes.`);
         }
+        let repairArtifact = null;
+        if (repairChecks) {
+            repairArtifact = await readCompletionArtifact(worktree.worktreePath, dispatch.workItem.id, "ci_repair");
+            if (!repairArtifact) {
+                throw new Error("Provider CLI completed but did not call forge.complete_ci_repair. Forge did not commit or push the repair.");
+            }
+            if ((repairArtifact.status ?? "").trim().toLowerCase() !== "pass") {
+                throw new Error(`CI repair completion gate recorded ${repairArtifact.status}; Forge did not commit or push the repair.`);
+            }
+            await emitCompletionArtifactRecorded(context.emit, worktree.worktreePath, repairArtifact);
+            await emitPhaseCompletionEvent(context.emit, repairArtifact);
+            await emitPhaseGateEvents(context.emit, repairArtifact);
+        }
+        const validationProfile = repairChecks
+            ? "ci_repair"
+            : addressComments
+                ? "comment_repair"
+                : "conflict_repair";
+        await this.prePublicationValidator.validate(worktree.worktreePath, validationProfile, publicationCapabilities(context, repairEnvironment), context.emit, context.signal, prePublicationExecution(context, providerProcessEnv(dispatch, repairEnvironment), this.processRunner));
         const committed = await commitWorktreeChanges(this.git, worktree.worktreePath, dispatch.workItem.id);
-        await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, context.emit);
+        if (providerOwnsBranchPublication(context)) {
+            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, worktree.repoPath, this.publicationCoordinator, context.signal, context.emit, expectedRepairHeadSha);
+        }
         await emitProviderUsageEvent(context.emit, dispatch, outputState);
         await context.emit({
             role: "assistant",
@@ -630,10 +1036,24 @@ export class ProcessBackedProviderCliService {
                 ? `${dispatch.execution.provider} CLI repaired PR checks on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
                 : addressComments
                     ? `${dispatch.execution.provider} CLI addressed PR comments on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
-                    : `${dispatch.execution.provider} CLI resolved conflicts on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
+                    : `${dispatch.execution.provider} CLI resolved conflicts on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`,
+            spec: repairSpec,
+            artifact: repairArtifact,
+            artifacts: repairArtifact ? [repairArtifact] : [],
         };
     }
 }
+function publicationCapabilities(context, runtimeEnvironment) {
+    const capabilities = new Set();
+    const launchTarget = context.dispatch.qaBrowser?.launchTarget;
+    if (runtimeEnvironment?.FORGE_PLAYWRIGHT_CONFIG
+        || launchTarget?.url
+        || launchTarget?.command
+        || launchTarget?.managed_runtime_port) {
+        capabilities.add("browser_launch");
+    }
+    return capabilities;
+}
 async function stageDraftAttachments(dispatch, metadataRoot) {
     const attachments = dispatch.draft?.attachments ?? [];
     const stageable = attachments.filter((attachment) => (attachment.kind === "text" && typeof attachment.textContent === "string")
@@ -696,8 +1116,12 @@ function clipFileName(fileName, maxLength) {
     return `${stem.slice(0, maxStemLength)}${extension}`;
 }
 const providerPromptStdinThreshold = 8_000;
-function shouldPipePromptToStdin(provider, prompt) {
-    return provider.trim().toLowerCase() === "codex" && Buffer.byteLength(prompt, "utf8") > providerPromptStdinThreshold;
+function shouldPipePromptToStdin(provider, prompt, force = false) {
+    return provider.trim().toLowerCase() === "codex"
+        && (force || Buffer.byteLength(prompt, "utf8") > providerPromptStdinThreshold);
+}
+function usesManagedWindowsHost(dispatch) {
+    return process.platform === "win32" && dispatch.sandbox?.executionMode === "host";
 }
 function isFakeWorkerModel(model) {
     return model.trim().toLowerCase() === fakeWorkerModel;