@loucompanion/forge-bridge 0.1.3-dev.f66395c3ac21 → 0.1.3-dev.fbe15023cdfe

package/dist/worktree/worktree.service.js

@@ -1,54 +1,65 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { RepositoryCoordinatorLock } from "../sandbox/repository-lock.js";
 import { GitClient } from "../shared/git/git.js";
 import { ensureDirectory, isSubPath, resolveExistingDirectoryPath, safeSegment } from "../shared/path/path.js";
 import { filterArtifactsForLane, injectWorktreeArtifacts } from "./artifact-injector.js";
+import { hydratePriorPhaseArtifacts } from "./prior-phase-artifact-hydrator.js";
 import { warmWorktreeDependencies } from "./dependency-warmer.js";
+import { defaultWorktreeCoordinatorStateRoot, managedRepoRoot, resolveManagedWorktreeRoot, } from "./worktree-paths.js";
 export class GitWorktreeService {
     git;
-    constructor(git = new GitClient()) {
+    coordinator;
+    constructor(git = new GitClient(), coordinator = new RepositoryCoordinatorLock(defaultWorktreeCoordinatorStateRoot())) {
         this.git = git;
+        this.coordinator = coordinator;
     }
     async prepare(request) {
         const allowedRoot = await ensureDirectory(request.allowedRepoRoot);
         const baseBranch = normalizeBranchName(request.baseBranch, "develop");
-        const repoPath = await this.resolveRepoPath(request.repo, allowedRoot, baseBranch);
-        await this.ensureGitIdentity(repoPath);
-        await this.ensureBaseBranch(repoPath, baseBranch);
         const shortId = request.workItem.id.replace(/-/g, "").slice(0, 12);
         const kind = safeSegment(request.workItem.kind, "work-item");
         const fallbackWorktreeKey = `${kind}/${shortId}`;
         const worktreeKey = request.worktreeKey?.trim() || fallbackWorktreeKey;
         const worktreeSegments = worktreeKeySegments(worktreeKey, kind, shortId);
         const branchName = normalizeBranchName(worktreeSegments.join("/"), "work-item/unknown");
-        const worktreeRoot = resolveWorktreeRoot(allowedRoot, repoPath);
-        const worktreePath = path.join(worktreeRoot, ...worktreeSegments);
-        const resolvedWorktreeParent = await ensureDirectory(path.dirname(worktreePath));
-        if (!isSubPath(allowedRoot, resolvedWorktreeParent)) {
-            throw new Error(`Worktree path must stay under ${allowedRoot}.`);
-        }
-        const exists = await directoryExists(worktreePath);
-        let resolvedWorktreePath;
-        if (!exists) {
-            await this.git.run(repoPath, ["worktree", "add", "-B", branchName, worktreePath, baseBranch]);
-            resolvedWorktreePath = await resolveExistingDirectoryPath(worktreePath);
-        }
-        else {
-            resolvedWorktreePath = await resolveExistingDirectoryPath(worktreePath);
-            if (!isSubPath(allowedRoot, resolvedWorktreePath)) {
+        const creationCoordinationPath = this.repoCreationCoordinationPath(request.repo, allowedRoot);
+        const repoPath = await this.coordinator.withLock(creationCoordinationPath, async () => {
+            return await this.resolveRepoPath(request.repo, allowedRoot, baseBranch);
+        });
+        const resolvedWorktreePath = await this.coordinator.withLock(repoPath, async () => {
+            await this.ensureGitIdentity(repoPath);
+            const baseStartPoint = await this.resolveBaseStartPoint(repoPath, baseBranch);
+            const worktreeRoot = resolveManagedWorktreeRoot(allowedRoot, repoPath);
+            const worktreePath = path.join(worktreeRoot, ...worktreeSegments);
+            const resolvedWorktreeParent = await ensureDirectory(path.dirname(worktreePath));
+            if (!isSubPath(allowedRoot, resolvedWorktreeParent)) {
                 throw new Error(`Worktree path must stay under ${allowedRoot}.`);
             }
-            const currentBranch = await this.currentBranch(resolvedWorktreePath);
+            if (!(await directoryExists(worktreePath))) {
+                await this.git.run(repoPath, ["worktree", "add", "-B", branchName, worktreePath, baseStartPoint]);
+                return await resolveExistingDirectoryPath(worktreePath);
+            }
+            const existingWorktreePath = await resolveExistingDirectoryPath(worktreePath);
+            if (!isSubPath(allowedRoot, existingWorktreePath)) {
+                throw new Error(`Worktree path must stay under ${allowedRoot}.`);
+            }
+            const currentBranch = await this.currentBranch(existingWorktreePath);
             if (currentBranch !== branchName) {
-                throw new Error(`Existing worktree ${resolvedWorktreePath} is on branch '${currentBranch}', expected '${branchName}'.`);
+                throw new Error(`Existing worktree ${existingWorktreePath} is on branch '${currentBranch}', expected '${branchName}'.`);
             }
-        }
+            if (shouldResetExistingWorktree(request)) {
+                await this.resetWorktreeToBase(existingWorktreePath, baseStartPoint);
+            }
+            return existingWorktreePath;
+        });
         await this.ensureGitIdentity(resolvedWorktreePath);
         await clearRunArtifactRoots(resolvedWorktreePath, request);
+        const hydratedPriorPhaseArtifactCount = await hydratePriorPhaseArtifacts(resolvedWorktreePath, request.priorPhaseArtifacts);
         const qaReworkPacketPath = await materializeQaReworkPacket(resolvedWorktreePath, request);
         const artifacts = filterArtifactsForLane(request.artifacts, request.lane, request.phase);
         if (artifacts.length > 0) {
-            await injectWorktreeArtifacts(resolvedWorktreePath, artifacts);
+            await injectWorktreeArtifacts(resolvedWorktreePath, artifacts, await this.trackedForgePaths(resolvedWorktreePath));
         }
         const dependencyWarm = await warmWorktreeDependencies({
             baseCheckoutPath: repoPath,
@@ -63,20 +74,36 @@ export class GitWorktreeService {
             baseBranch,
             cleanupWorktrees: request.cleanupWorktrees,
             dependencyWarm,
-            qaReworkPacketPath
+            qaReworkPacketPath,
+            hydratedPriorPhaseArtifactCount
         };
     }
+    async trackedForgePaths(worktreePath) {
+        const output = await this.git.run(worktreePath, ["ls-files", "-z", "--", ".forge"]);
+        return new Set(output.split("\0").filter(Boolean).map(value => value.replaceAll("\\", "/")));
+    }
+    repoCreationCoordinationPath(repo, allowedRoot) {
+        if (repo.serverLocalPath && repo.serverLocalPath.trim().length > 0) {
+            return path.resolve(repo.serverLocalPath);
+        }
+        return this.managedRepoPath(repo, allowedRoot);
+    }
     async release(handle) {
-        if (!handle.cleanupWorktrees || !(await directoryExists(handle.worktreePath))) {
+        if (!handle.cleanupWorktrees) {
             return;
         }
-        try {
-            await this.git.run(handle.repoPath, ["worktree", "remove", "--force", handle.worktreePath]);
-            await this.git.run(handle.repoPath, ["worktree", "prune"]);
-        }
-        catch {
-            await fs.rm(handle.worktreePath, { recursive: true, force: true });
-        }
+        await this.coordinator.withLock(handle.repoPath, async () => {
+            if (!(await directoryExists(handle.worktreePath))) {
+                return;
+            }
+            try {
+                await this.git.run(handle.repoPath, ["worktree", "remove", "--force", handle.worktreePath]);
+                await this.git.run(handle.repoPath, ["worktree", "prune"]);
+            }
+            catch {
+                await fs.rm(handle.worktreePath, { recursive: true, force: true });
+            }
+        });
     }
     async resolveRepoPath(repo, allowedRoot, baseBranch) {
         if (repo.serverLocalPath && repo.serverLocalPath.trim().length > 0) {
@@ -93,7 +120,7 @@ export class GitWorktreeService {
         if (discovered) {
             return discovered;
         }
-        const repoPath = path.join(managedRepoRoot(allowedRoot), `${safeSegment(repo.name, "repo")}-${repo.id.replace(/-/g, "")}`);
+        const repoPath = this.managedRepoPath(repo, allowedRoot);
         if (!(await gitMetadataExists(repoPath, allowedRoot))) {
             const repoPathExists = await pathExists(repoPath);
             if (repoPathExists) {
@@ -124,6 +151,9 @@ export class GitWorktreeService {
         }
         return resolved;
     }
+    managedRepoPath(repo, allowedRoot) {
+        return path.join(managedRepoRoot(allowedRoot), `${safeSegment(repo.name, "repo")}-${repo.id.replace(/-/g, "")}`);
+    }
     async findExistingRepoPath(repo, allowedRoot) {
         const expectedRemote = normalizeRemote(repo.remoteUrl);
         const rawName = repo.name.trim();
@@ -164,21 +194,34 @@ export class GitWorktreeService {
         const resolved = await resolveExistingDirectoryPath(candidate);
         return isSubPath(allowedRoot, resolved) ? resolved : null;
     }
-    async ensureBaseBranch(repoPath, baseBranch) {
-        if (await this.gitRefExists(repoPath, `refs/heads/${baseBranch}`)) {
-            return;
+    async resolveBaseStartPoint(repoPath, baseBranch) {
+        if (baseBranch === "HEAD") {
+            const head = (await this.git.run(repoPath, ["rev-parse", "--verify", "HEAD^{commit}"])).trim();
+            if (!/^[0-9a-f]{40,64}$/iu.test(head)) {
+                throw new Error("The repository checkout does not have a valid committed HEAD revision.");
+            }
+            return head;
         }
+        const localRef = `refs/heads/${baseBranch}`;
+        const remoteRef = `refs/remotes/origin/${baseBranch}`;
         const origin = await this.git.run(repoPath, ["remote", "get-url", "origin"]).catch(() => "");
-        if (origin.trim().length === 0) {
-            throw new Error(`Base branch '${baseBranch}' was not found in the local checkout.`);
+        if (origin.trim().length > 0) {
+            const fetched = await this.git.run(repoPath, ["fetch", "--prune", "origin"])
+                .then(() => true)
+                .catch(() => false);
+            if (fetched && await this.gitRefExists(repoPath, remoteRef)) {
+                return remoteRef;
+            }
         }
-        await this.git.run(repoPath, ["fetch", "origin", `${baseBranch}:refs/remotes/origin/${baseBranch}`]).catch(() => "");
-        if (await this.gitRefExists(repoPath, `refs/remotes/origin/${baseBranch}`)) {
-            await this.git.run(repoPath, ["branch", baseBranch, `refs/remotes/origin/${baseBranch}`]);
-            return;
+        if (await this.gitRefExists(repoPath, localRef)) {
+            return localRef;
         }
         throw new Error(`Base branch '${baseBranch}' was not found locally or on origin.`);
     }
+    async resetWorktreeToBase(worktreePath, baseStartPoint) {
+        await this.git.run(worktreePath, ["reset", "--hard", baseStartPoint]);
+        await this.git.run(worktreePath, ["clean", "-fd"]);
+    }
     async gitRefExists(repoPath, gitRef) {
         return this.git.run(repoPath, ["show-ref", "--verify", "--quiet", gitRef]).then(() => true).catch(() => false);
     }
@@ -190,15 +233,6 @@ export class GitWorktreeService {
         await this.git.run(repoPath, ["config", "user.name", "Forge Bridge"]);
     }
 }
-function managedRepoRoot(allowedRoot) {
-    return path.join(allowedRoot, ".forge-worktrees", "_repos");
-}
-function resolveWorktreeRoot(allowedRoot, repoPath) {
-    const baseName = path.basename(repoPath);
-    return isSubPath(managedRepoRoot(allowedRoot), repoPath)
-        ? path.join(allowedRoot, ".forge-worktrees", baseName)
-        : path.join(path.dirname(repoPath), ".forge-worktrees", baseName);
-}
 function isCloneableRemote(remoteUrl) {
     const trimmed = remoteUrl?.trim() ?? "";
     if (trimmed.length === 0 || trimmed.startsWith("local://")) {
@@ -206,9 +240,12 @@ function isCloneableRemote(remoteUrl) {
     }
     return trimmed.startsWith("git@") || trimmed.includes("://") || path.isAbsolute(trimmed);
 }
-async function clearRunArtifactRoots(worktreePath, request) {
+export async function clearRunArtifactRoots(worktreePath, request) {
     const roots = new Set();
     roots.add(workItemArtifactRoot(worktreePath, request.workItem.id));
+    for (const artifact of request.priorPhaseArtifacts ?? []) {
+        roots.add(workItemArtifactRoot(worktreePath, artifact.workItemId));
+    }
     const ownerType = normalizeOwnerType(request.ownerType);
     const ownerId = request.ownerId?.trim();
     if (ownerType && ownerId) {
@@ -269,6 +306,17 @@ function normalizeOwnerType(value) {
     }
     return null;
 }
+function shouldResetExistingWorktree(request) {
+    const lane = request.lane.trim().toLowerCase();
+    const phase = request.phase.trim().toLowerCase().replace(/-/g, "_");
+    if (lane === "develop" && (phase === "implementation" || phase === "self_review" || phase === "validation")) {
+        return false;
+    }
+    if (lane === "qa" || phase === "qa") {
+        return false;
+    }
+    return true;
+}
 function qaReworkPacketFileName(packetPath) {
     const normalized = packetPath.trim().replace(/\\/g, "/");
     const fileName = normalized.split("/").filter(Boolean).at(-1) ?? "";

package/dist/worktree/worktree.types.d.ts

@@ -1,4 +1,4 @@
-import type { DispatchQaReworkContext, DispatchRepo, DispatchWorkItem, DispatchResolvedArtifact } from "../session/session.types.js";
+import type { DispatchQaReworkContext, DispatchPriorPhaseArtifact, DispatchRepo, DispatchWorkItem, DispatchResolvedArtifact } from "../session/session.types.js";
 import type { WarmDependenciesResult } from "./dependency-warmer.js";
 export interface WorktreePrepareRequest {
     readonly repo: DispatchRepo;
@@ -12,6 +12,7 @@ export interface WorktreePrepareRequest {
     readonly allowedRepoRoot: string;
     readonly cleanupWorktrees: boolean;
     readonly artifacts: readonly DispatchResolvedArtifact[];
+    readonly priorPhaseArtifacts?: readonly DispatchPriorPhaseArtifact[];
     readonly qaRework?: DispatchQaReworkContext | null;
     readonly warmPathOverrides?: readonly string[];
 }
@@ -23,4 +24,5 @@ export interface WorktreeHandle {
     readonly cleanupWorktrees: boolean;
     readonly dependencyWarm?: WarmDependenciesResult;
     readonly qaReworkPacketPath?: string;
+    readonly hydratedPriorPhaseArtifactCount?: number;
 }

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@loucompanion/forge-bridge",
-  "version": "0.1.3-dev.f66395c3ac21",
+  "version": "0.1.3-dev.fbe15023cdfe",
   "description": "Forge runner bridge CLI for connecting local developer machines to Forge dispatch.",
   "license": "UNLICENSED",
   "type": "module",
   "bin": {
+    "forge": "dist/cli/bin.js",
     "forge-bridge": "dist/cli/bin.js"
   },
   "main": "./dist/index.js",
@@ -18,6 +19,7 @@
   },
   "files": [
     "dist",
+    "runtime",
     "README.md"
   ],
   "repository": {
@@ -40,10 +42,11 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "smoke:package": "npm run build && node scripts/smoke-package.mjs",
-    "lint": "eslint \"src/**/*.ts\" \"scripts/**/*.mjs\" \"vitest.config.ts\""
+    "lint": "eslint \"src/**/*.ts\" \"scripts/**/*.mjs\" \"vitest.config.ts\" \"vitest.setup.ts\""
   },
   "dependencies": {
-    "@microsoft/signalr": "^8.0.17"
+    "@microsoft/signalr": "^8.0.17",
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/runtime/windows-job-supervisor.ps1

@@ -0,0 +1,356 @@
+param(
+  [Parameter(Mandatory = $true)]
+  [ValidateSet("Outer", "Inner")]
+  [string]$Mode,
+
+  [Parameter(Mandatory = $true)]
+  [string]$PayloadPath,
+
+  [string]$GateName
+)
+
+$ErrorActionPreference = "Stop"
+
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public static class ForgeWindowsJob
+{
+    [StructLayout(LayoutKind.Sequential)]
+    private struct JOBOBJECT_BASIC_LIMIT_INFORMATION
+    {
+        public long PerProcessUserTimeLimit;
+        public long PerJobUserTimeLimit;
+        public uint LimitFlags;
+        public UIntPtr MinimumWorkingSetSize;
+        public UIntPtr MaximumWorkingSetSize;
+        public uint ActiveProcessLimit;
+        public UIntPtr Affinity;
+        public uint PriorityClass;
+        public uint SchedulingClass;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct IO_COUNTERS
+    {
+        public ulong ReadOperationCount;
+        public ulong WriteOperationCount;
+        public ulong OtherOperationCount;
+        public ulong ReadTransferCount;
+        public ulong WriteTransferCount;
+        public ulong OtherTransferCount;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct JOBOBJECT_EXTENDED_LIMIT_INFORMATION
+    {
+        public JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation;
+        public IO_COUNTERS IoInfo;
+        public UIntPtr ProcessMemoryLimit;
+        public UIntPtr JobMemoryLimit;
+        public UIntPtr PeakProcessMemoryUsed;
+        public UIntPtr PeakJobMemoryUsed;
+    }
+
+    private const uint JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x00002000;
+    private const int JobObjectExtendedLimitInformation = 9;
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern IntPtr CreateJobObject(IntPtr securityAttributes, string name);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern bool SetInformationJobObject(
+        IntPtr job,
+        int informationClass,
+        IntPtr information,
+        uint informationLength);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool TerminateJobObject(IntPtr job, uint exitCode);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    public static IntPtr CreateKillOnCloseJob(string name)
+    {
+        IntPtr job = CreateJobObject(IntPtr.Zero, name);
+        if (job == IntPtr.Zero)
+        {
+            throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error(), "CreateJobObject failed.");
+        }
+
+        var limits = new JOBOBJECT_EXTENDED_LIMIT_INFORMATION();
+        limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+        int size = Marshal.SizeOf(typeof(JOBOBJECT_EXTENDED_LIMIT_INFORMATION));
+        IntPtr pointer = Marshal.AllocHGlobal(size);
+        try
+        {
+            Marshal.StructureToPtr(limits, pointer, false);
+            if (!SetInformationJobObject(job, JobObjectExtendedLimitInformation, pointer, (uint)size))
+            {
+                throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error(), "SetInformationJobObject failed.");
+            }
+        }
+        catch
+        {
+            CloseHandle(job);
+            throw;
+        }
+        finally
+        {
+            Marshal.FreeHGlobal(pointer);
+        }
+
+        return job;
+    }
+
+    public static string BuildArguments(object[] arguments)
+    {
+        var result = new StringBuilder();
+        for (int index = 0; index < arguments.Length; index++)
+        {
+            if (index > 0) result.Append(' ');
+            result.Append(QuoteArgument(Convert.ToString(arguments[index]) ?? String.Empty));
+        }
+        return result.ToString();
+    }
+
+    private static string QuoteArgument(string argument)
+    {
+        if (argument.Length > 0 && argument.IndexOfAny(new[] { ' ', '\t', '\n', '\v', '"' }) < 0)
+        {
+            return argument;
+        }
+
+        var result = new StringBuilder();
+        result.Append('"');
+        int backslashes = 0;
+        foreach (char character in argument)
+        {
+            if (character == '\\')
+            {
+                backslashes++;
+                continue;
+            }
+
+            if (character == '"')
+            {
+                result.Append('\\', backslashes * 2 + 1);
+                result.Append('"');
+                backslashes = 0;
+                continue;
+            }
+
+            result.Append('\\', backslashes);
+            backslashes = 0;
+            result.Append(character);
+        }
+
+        result.Append('\\', backslashes * 2);
+        result.Append('"');
+        return result.ToString();
+    }
+}
+"@
+
+function Read-ForgeSupervisorPayload {
+  if (-not [IO.Path]::IsPathRooted($PayloadPath)) {
+    throw "The supervisor payload path must be absolute."
+  }
+  $json = [IO.File]::ReadAllText($PayloadPath, [Text.Encoding]::UTF8)
+  return $json | ConvertFrom-Json
+}
+
+function New-ForgeChildProcess(
+  [string]$command,
+  [object[]]$arguments,
+  [string]$workingDirectory,
+  [bool]$redirectStreams
+) {
+  $maximumAttempts = 3
+  for ($attempt = 1; $attempt -le $maximumAttempts; $attempt += 1) {
+    $startInfo = New-Object System.Diagnostics.ProcessStartInfo
+    $startInfo.FileName = $command
+    $startInfo.Arguments = [ForgeWindowsJob]::BuildArguments($arguments)
+    $startInfo.WorkingDirectory = $workingDirectory
+    $startInfo.UseShellExecute = $false
+    $startInfo.CreateNoWindow = $true
+    $startInfo.RedirectStandardInput = $redirectStreams
+    $startInfo.RedirectStandardOutput = $redirectStreams
+    $startInfo.RedirectStandardError = $redirectStreams
+
+    $child = New-Object System.Diagnostics.Process
+    $child.StartInfo = $startInfo
+    try {
+      if (-not $child.Start()) {
+        throw "Failed to start supervised process '$command'."
+      }
+      $child | Add-Member -NotePropertyName ForgeStartAttempt -NotePropertyValue $attempt
+      return $child
+    }
+    catch {
+      $nativeError = $_.Exception
+      while ($nativeError.InnerException) {
+        $nativeError = $nativeError.InnerException
+      }
+      $retryable = $nativeError -is [ComponentModel.Win32Exception] -and $nativeError.NativeErrorCode -in @(5, 32, 33)
+      $child.Dispose()
+      if (-not $retryable -or $attempt -eq $maximumAttempts) {
+        throw
+      }
+      Start-Sleep -Milliseconds (100 * $attempt)
+    }
+  }
+}
+
+function Write-ForgeProviderReady([object]$request, [Diagnostics.Process]$provider) {
+  $readyPath = [string]$request.readyPath
+  if ([string]::IsNullOrWhiteSpace($readyPath) -or -not [IO.Path]::IsPathRooted($readyPath)) {
+    throw "The provider-ready path must be absolute."
+  }
+  $payloadDirectory = [IO.Path]::GetDirectoryName([IO.Path]::GetFullPath($PayloadPath))
+  $readyDirectory = [IO.Path]::GetDirectoryName([IO.Path]::GetFullPath($readyPath))
+  if (-not [string]::Equals($payloadDirectory, $readyDirectory, [StringComparison]::OrdinalIgnoreCase)) {
+    throw "The provider-ready path must be beside the supervisor payload."
+  }
+
+  $ready = @{
+    schemaVersion = 1
+    supervisorId = [string]$request.supervisorId
+    rootPid = [int]$env:FORGE_SUPERVISOR_ROOT_PID
+    rootIdentity = [string]$env:FORGE_SUPERVISOR_ROOT_IDENTITY
+    providerPid = $provider.Id
+    providerCreatedAt = $provider.StartTime.ToUniversalTime().ToString("O")
+    providerIdentity = "win32:$($provider.StartTime.ToUniversalTime().Ticks)"
+    startAttempt = [int]$provider.ForgeStartAttempt
+  } | ConvertTo-Json -Compress
+  $temporaryPath = "$readyPath.$([Guid]::NewGuid().ToString('N')).tmp"
+  [IO.File]::WriteAllText($temporaryPath, "$ready`n", (New-Object Text.UTF8Encoding($false)))
+  [IO.File]::Move($temporaryPath, $readyPath)
+}
+
+function Wait-ForgeProviderStartGrant([object]$request) {
+  $grantPath = [string]$request.startGrantPath
+  if ([string]::IsNullOrWhiteSpace($grantPath) -or -not [IO.Path]::IsPathRooted($grantPath)) {
+    throw "The provider start-grant path must be absolute."
+  }
+  $payloadDirectory = [IO.Path]::GetDirectoryName([IO.Path]::GetFullPath($PayloadPath))
+  $grantDirectory = [IO.Path]::GetDirectoryName([IO.Path]::GetFullPath($grantPath))
+  if (-not [string]::Equals($payloadDirectory, $grantDirectory, [StringComparison]::OrdinalIgnoreCase)) {
+    throw "The provider start-grant path must be beside the supervisor payload."
+  }
+  for ($attempt = 0; $attempt -lt 1200; $attempt += 1) {
+    if ([IO.File]::Exists($grantPath)) {
+      return
+    }
+    Start-Sleep -Milliseconds 25
+  }
+  throw "Timed out waiting for the provider start grant."
+}
+
+function Start-ForgeOutputCopies([Diagnostics.Process]$child) {
+  return @(
+    $child.StandardOutput.BaseStream.CopyToAsync([Console]::OpenStandardOutput()),
+    $child.StandardError.BaseStream.CopyToAsync([Console]::OpenStandardError())
+  )
+}
+
+function Write-ForgeStandardInput([Diagnostics.Process]$child, [string]$inputText) {
+  if ($inputText.Length -gt 0) {
+    $child.StandardInput.Write($inputText)
+  }
+  $child.StandardInput.Close()
+}
+
+if ($Mode -eq "Inner") {
+  if ([string]::IsNullOrWhiteSpace($GateName)) {
+    throw "The inner supervisor requires a gate name."
+  }
+
+  $inputText = [Console]::In.ReadToEnd()
+  $request = Read-ForgeSupervisorPayload
+  $gate = [Threading.EventWaitHandle]::OpenExisting($GateName)
+  try {
+    if (-not $gate.WaitOne(30000)) {
+      throw "Timed out waiting for Windows Job Object assignment."
+    }
+  }
+  finally {
+    $gate.Dispose()
+  }
+
+  $provider = New-ForgeChildProcess ([string]$request.command) @($request.args) ([string]$request.cwd) $true
+  Write-ForgeProviderReady $request $provider
+  $copies = Start-ForgeOutputCopies $provider
+  Wait-ForgeProviderStartGrant $request
+  Write-ForgeStandardInput $provider $inputText
+  $provider.WaitForExit()
+  if (-not [Threading.Tasks.Task]::WaitAll([Threading.Tasks.Task[]]$copies, 1000)) {
+    $provider.StandardOutput.Dispose()
+    $provider.StandardError.Dispose()
+  }
+  exit $provider.ExitCode
+}
+
+$inputText = [Console]::In.ReadToEnd()
+$request = Read-ForgeSupervisorPayload
+$env:FORGE_SUPERVISOR_ROOT_PID = [string]$PID
+$env:FORGE_SUPERVISOR_ROOT_IDENTITY = "win32:$([Diagnostics.Process]::GetCurrentProcess().StartTime.ToUniversalTime().Ticks)"
+$parent = [Diagnostics.Process]::GetProcessById([int]$request.parentPid)
+$jobName = "Local\Forge-$([string]$request.supervisorId)"
+$job = [ForgeWindowsJob]::CreateKillOnCloseJob($jobName)
+$gateNameValue = "Local\ForgeGate-$([Guid]::NewGuid().ToString('N'))"
+$createdNew = $false
+$gate = New-Object Threading.EventWaitHandle($false, [Threading.EventResetMode]::ManualReset, $gateNameValue, [ref]$createdNew)
+$inner = $null
+
+try {
+  $powerShell = Join-Path $PSHOME "powershell.exe"
+  $innerArguments = @(
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-ExecutionPolicy",
+    "Bypass",
+    "-File",
+    $PSCommandPath,
+    "-Mode",
+    "Inner",
+    "-PayloadPath",
+    $PayloadPath,
+    "-GateName",
+    $gateNameValue
+  )
+  $inner = New-ForgeChildProcess $powerShell $innerArguments ([string]$request.cwd) $true
+  if (-not [ForgeWindowsJob]::AssignProcessToJobObject($job, $inner.Handle)) {
+    throw (New-Object System.ComponentModel.Win32Exception([Runtime.InteropServices.Marshal]::GetLastWin32Error(), "AssignProcessToJobObject failed."))
+  }
+
+  $copies = Start-ForgeOutputCopies $inner
+  $gate.Set() | Out-Null
+  Write-ForgeStandardInput $inner $inputText
+  while (-not $inner.WaitForExit(250)) {
+    $parent.Refresh()
+    if ($parent.HasExited) {
+      [ForgeWindowsJob]::TerminateJobObject($job, 125) | Out-Null
+      exit 125
+    }
+  }
+
+  $exitCode = $inner.ExitCode
+  [ForgeWindowsJob]::TerminateJobObject($job, 1) | Out-Null
+  [Threading.Tasks.Task]::WaitAll([Threading.Tasks.Task[]]$copies, 2000) | Out-Null
+  exit $exitCode
+}
+finally {
+  if ($inner -and -not $inner.HasExited) {
+    [ForgeWindowsJob]::TerminateJobObject($job, 1) | Out-Null
+  }
+  $gate.Dispose()
+  [ForgeWindowsJob]::CloseHandle($job) | Out-Null
+}