@loucompanion/forge-bridge 0.1.3-dev.fbe15023cdfe → 0.1.4-dev.04a1e5b9e484

package/dist/shared/provider-capabilities.d.ts

@@ -1 +1,4 @@
+import { type BridgeChatCapability } from "../bridge/bridge-chat.types.js";
+import type { BridgeProviderStatus } from "../bridge/bridge.types.js";
 export declare function supportsDraftImageAttachmentsFor(cliProviders: readonly string[]): boolean;
+export declare function bridgeChatCapabilityFor(cliProviders: readonly string[], providerStatuses: Readonly<Record<string, BridgeProviderStatus>>, baseCapability?: BridgeChatCapability | null): BridgeChatCapability;

package/dist/shared/provider-capabilities.js

@@ -1,3 +1,88 @@
+import { bridgeChatProtocolVersion, normalizeBridgeChatCapability, unavailableBridgeChatCapability, } from "../bridge/bridge-chat.types.js";
+const defaultBridgeChatMaxMessageBytes = 128 * 1024;
+const defaultBridgeChatMaxContextRefs = 8;
 export function supportsDraftImageAttachmentsFor(cliProviders) {
     return cliProviders.some((provider) => provider.trim().toLowerCase() === "codex");
 }
+export function bridgeChatCapabilityFor(cliProviders, providerStatuses, baseCapability) {
+    const base = normalizeBridgeChatCapability(baseCapability ?? unavailableBridgeChatCapability());
+    if (base.protocolVersion !== bridgeChatProtocolVersion) {
+        return base;
+    }
+    const providers = chatProviderEntries(cliProviders, providerStatuses);
+    const usableProviders = providers.filter((provider) => provider.status?.signedIn !== false);
+    if (usableProviders.length === 0) {
+        return unavailableBridgeChatCapability(bridgeChatProtocolVersion, providers.length === 0 ? "no_cli_providers" : "no_signed_in_cli_providers", providers.length === 0
+            ? "No CLI providers are configured for Bridge Chat."
+            : "No signed-in CLI providers are available for Bridge Chat.");
+    }
+    return normalizeBridgeChatCapability({
+        ...base,
+        availability: usableProviders.length === providers.length ? "available" : "degraded",
+        protocolVersion: bridgeChatProtocolVersion,
+        supportedProviders: usableProviders.map((provider) => provider.providerKind),
+        supportedModels: sortedUniqueStrings(usableProviders.flatMap((provider) => provider.status?.models ?? []), false),
+        supportsTextStreaming: true,
+        supportsCancel: true,
+        supportsResume: true,
+        supportsProviderThreadContinuity: true,
+        supportsAttachments: true,
+        supportsActionBrokerGrants: true,
+        maxMessageBytes: base.maxMessageBytes || defaultBridgeChatMaxMessageBytes,
+        maxContextRefs: base.maxContextRefs || defaultBridgeChatMaxContextRefs,
+        unavailableCode: null,
+        unavailableReason: null,
+    });
+}
+function chatProviderEntries(cliProviders, providerStatuses) {
+    const statuses = new Map();
+    for (const [provider, status] of Object.entries(providerStatuses)) {
+        const providerKind = provider.trim().toLowerCase();
+        if (providerKind.length === 0)
+            continue;
+        statuses.set(providerKind, { providerKind, status });
+    }
+    const providers = new Map();
+    for (const provider of cliProviders) {
+        const providerKind = provider.trim().toLowerCase();
+        if (providerKind.length === 0)
+            continue;
+        providers.set(providerKind, {
+            providerKind,
+            status: statuses.get(providerKind)?.status,
+        });
+    }
+    for (const [providerKind, entry] of statuses) {
+        if (!providers.has(providerKind)) {
+            providers.set(providerKind, entry);
+        }
+    }
+    return [...providers.values()].sort((left, right) => compareStable(left.providerKind, right.providerKind));
+}
+function sortedUniqueStrings(values, lower) {
+    const byKey = new Map();
+    for (const value of values) {
+        const clean = value.trim();
+        if (clean.length === 0)
+            continue;
+        const normalized = lower ? clean.toLowerCase() : clean;
+        const key = normalized.toLowerCase();
+        if (!byKey.has(key)) {
+            byKey.set(key, normalized);
+        }
+    }
+    return [...byKey.values()].sort(compareStable);
+}
+function compareStable(left, right) {
+    const leftKey = left.toLowerCase();
+    const rightKey = right.toLowerCase();
+    if (leftKey < rightKey)
+        return -1;
+    if (leftKey > rightKey)
+        return 1;
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+}

package/dist/shared/redaction/redaction.d.ts

@@ -1,2 +1,3 @@
 export declare function redactSecrets<T>(value: T, exactSecrets?: readonly string[]): T;
+export declare function shouldRedactJsonProperty(key: string): boolean;
 export declare function redactText(value: string, exactSecrets?: readonly string[]): string;

package/dist/shared/redaction/redaction.js

@@ -1,14 +1,41 @@
 const secretKeyPattern = /(api[_-]?key|authorization|bearer|client[_-]?secret|password|secret|token)/i;
+// Serialized artifact keys follow the existing assignment policy, not the broad
+// object redactor: tokenCount/maxTokens are evidence, not credential values.
+const jsonCredentialKeyPattern = /(api[_-]?key|client[_-]?secret|password|secret|token)$/i;
 const attachmentContentKeyPattern = /^(textContent|contentBase64)$/i;
+const bridgeChatHandoffGrantKeyPattern = /^(tempFileToken|grantNonce|nonce|handle|grantId|handoffId|attachmentId)$/i;
+const sensitiveFilenameKeyPattern = /^(fileName|filename)$/i;
 const serializedAttachmentContentPattern = /("(?:textContent|contentBase64)"\s*:\s*")(?:(?:\\.)|[^"\\])*(")/gi;
+const serializedBridgeChatHandoffGrantPattern = /("(?:tempFileToken|grantNonce|nonce|handle|grantId|handoffId|attachmentId)"\s*:\s*")(?:(?:\\.)|[^"\\])*(")/gi;
+const serializedSensitiveFilenamePattern = /("(?:fileName|filename)"\s*:\s*")(?:(?:\\.)|[^"\\])*(")/gi;
 const authorizationCredentialPattern = /(\bauthorization\s*[:=]\s*(?:bearer|basic)?\s*)([^"',\s]+)/gi;
 const bearerCredentialPattern = /(\bbearer\s+)([^"',\s]+)/gi;
 const secretAssignmentPattern = /(api[_-]?key|client[_-]?secret|password|secret|token)(\s*["']?\s*[:=]\s*["']?\s*)([^"',\s]+)/gi;
+// Keep this boundary in parity with Forge.Api's SecretRedactor. Without it, the
+// `sk-` substring in a structural identifier such as `task-skill-contract`
+// is mistaken for a provider credential and corrupts the artifact after it has
+// already passed schema validation.
+const providerKeyPattern = /(?<![a-zA-Z0-9])sk-[a-zA-Z0-9_-]{12,}/g;
 export function redactSecrets(value, exactSecrets = []) {
     return redactValue(value, exactSecrets);
 }
+export function shouldRedactJsonProperty(key) {
+    // Assignment redaction already permits whitespace before the delimiter. Match
+    // that policy without normalizing the actual JSON property name on the wire.
+    const policyKey = key.trim();
+    return jsonCredentialKeyPattern.test(policyKey)
+        || /^(authorization|bearer)$/i.test(policyKey)
+        || attachmentContentKeyPattern.test(policyKey)
+        || bridgeChatHandoffGrantKeyPattern.test(policyKey)
+        || (redactSensitiveFilenames() && sensitiveFilenameKeyPattern.test(policyKey));
+}
 export function redactText(value, exactSecrets = []) {
-    let redacted = value.replace(serializedAttachmentContentPattern, "$1[REDACTED]$2");
+    let redacted = value
+        .replace(serializedAttachmentContentPattern, "$1[REDACTED]$2")
+        .replace(serializedBridgeChatHandoffGrantPattern, "$1[REDACTED]$2");
+    if (redactSensitiveFilenames()) {
+        redacted = redacted.replace(serializedSensitiveFilenamePattern, "$1[REDACTED]$2");
+    }
     for (const secret of exactSecrets) {
         if (secret.length > 0) {
             redacted = redacted.split(secret).join("[REDACTED]");
@@ -18,7 +45,7 @@ export function redactText(value, exactSecrets = []) {
         .replace(authorizationCredentialPattern, "$1[REDACTED]")
         .replace(bearerCredentialPattern, "$1[REDACTED]")
         .replace(secretAssignmentPattern, "$1$2[REDACTED]")
-        .replace(/(sk-[a-zA-Z0-9_-]{12,})/g, "[REDACTED]");
+        .replace(providerKeyPattern, "[REDACTED]");
 }
 function redactValue(value, exactSecrets) {
     if (typeof value === "string") {
@@ -32,6 +59,15 @@ function redactValue(value, exactSecrets) {
     }
     return Object.fromEntries(Object.entries(value).map(([key, item]) => [
         key,
-        secretKeyPattern.test(key) || attachmentContentKeyPattern.test(key) ? "[REDACTED]" : redactValue(item, exactSecrets)
+        secretKeyPattern.test(key)
+            || attachmentContentKeyPattern.test(key)
+            || bridgeChatHandoffGrantKeyPattern.test(key)
+            || (redactSensitiveFilenames() && sensitiveFilenameKeyPattern.test(key))
+            ? "[REDACTED]"
+            : redactValue(item, exactSecrets)
     ]));
 }
+function redactSensitiveFilenames() {
+    const value = process.env.FORGE_REDACT_FILENAMES?.trim().toLowerCase();
+    return value === "1" || value === "true" || value === "yes";
+}

package/dist/shared/time/monotonic.d.ts

@@ -0,0 +1 @@
+export declare function monotonicNowMs(): number;

package/dist/shared/time/monotonic.js

@@ -0,0 +1,8 @@
+// Elapsed time and local deadlines use the monotonic clock. The wall clock can step:
+// a WSL VM's clock is corrected in multi-second jumps, which would end a local wait
+// early or count time that never passed. Timestamps that are persisted or compared
+// across processes (lease expiry, receipts, file mtimes) stay on the wall clock.
+// Read through the global so test fake timers that replace `performance` apply.
+export function monotonicNowMs() {
+    return performance.now();
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const forgeBridgeVersion = "0.1.3-dev.fbe15023cdfe";
+export declare const forgeBridgeVersion = "0.1.4-dev.04a1e5b9e484";

package/dist/version.js

@@ -1 +1 @@
-export const forgeBridgeVersion = "0.1.3-dev.fbe15023cdfe";
+export const forgeBridgeVersion = "0.1.4-dev.04a1e5b9e484";

package/dist/worktree/dependency-warmer.d.ts

@@ -9,6 +9,13 @@ export interface WarmDependenciesRequest {
     readonly worktreePath: string;
     readonly allowedRoot: string;
     readonly warmPathOverrides?: readonly string[];
+    readonly preparationPolicy?: DependencyPreparationPolicy;
+}
+export interface DependencyPreparationPolicy {
+    readonly isolation?: string;
+    readonly trustDomain?: string;
+    readonly invalidationEpoch?: string;
+    readonly toolchainVersions?: Readonly<Partial<Record<DependencyEcosystem | "npm" | "pnpm", string>>>;
 }
 export interface InstallFallbackResult {
     readonly ecosystem: DependencyEcosystem;
@@ -20,12 +27,24 @@ export interface WarmDependenciesResult {
     readonly linked: readonly string[];
     readonly skipped: readonly string[];
     readonly fallbacks: readonly InstallFallbackResult[];
+    readonly receipts: readonly DependencyPreparationReceiptResult[];
+}
+export interface DependencyPreparationReceiptResult {
+    readonly ecosystem: DependencyEcosystem;
+    readonly packageRoot: string;
+    readonly command: string;
+    readonly cacheHit: boolean;
+    readonly fingerprint: string;
+    readonly receiptPath: string;
+    /** End-to-end receipt lookup/preparation time, including coordinator wait. */
+    readonly durationMs: number;
 }
 export interface CommandExecutor {
     run(cwd: string, command: string, args: readonly string[], options?: CommandExecutionOptions): Promise<void>;
 }
 export interface CommandExecutionOptions {
     readonly env?: NodeJS.ProcessEnv;
+    readonly windowsVerbatimArguments?: boolean;
 }
 export declare function detectWarmPaths(repoRoot: string, warmPathOverrides?: readonly string[]): Promise<WarmPathEntry[]>;
 export declare function warmWorktreeDependencies(request: WarmDependenciesRequest, executor?: CommandExecutor): Promise<WarmDependenciesResult>;
@@ -39,14 +58,27 @@ export interface NpmLaunchOptions {
     readonly platform?: NodeJS.Platform;
     readonly homeDir?: string;
     readonly candidates?: readonly string[];
+    readonly pathExists?: (candidate: string) => boolean;
+}
+export interface PackageManagerEnvironmentOptions {
+    readonly platform?: NodeJS.Platform;
+    readonly execPath?: string;
+    readonly pathExists?: (candidate: string) => boolean;
+    readonly maximumPathLength?: number;
+    readonly packageRoot?: string;
+    readonly requiredPathDirectories?: readonly string[];
+}
+export interface PackageManagerLaunch {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly requiredPathDirectories?: readonly string[];
+    readonly windowsVerbatimArguments?: boolean;
 }
-export declare function resolveNpmLaunch(args: readonly string[], options?: NpmLaunchOptions): {
-    command: string;
-    args: readonly string[];
-};
-export declare function resolvePnpmLaunch(args: readonly string[]): {
-    command: string;
-    args: readonly string[];
-};
+export declare function resolveNpmLaunch(args: readonly string[], options?: NpmLaunchOptions): PackageManagerLaunch;
+export declare function resolvePnpmLaunch(args: readonly string[], options?: NpmLaunchOptions): PackageManagerLaunch;
 export declare function formatCommandFailureOutput(stdout: string, stderr: string): string;
-export declare function unattendedPackageManagerEnvironment(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function unattendedPackageManagerEnvironment(env?: NodeJS.ProcessEnv, options?: PackageManagerEnvironmentOptions): NodeJS.ProcessEnv;
+export declare function unattendedDependencyEnvironment(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function compactWindowsPackageManagerPath(pathValue: string, env?: NodeJS.ProcessEnv, options?: PackageManagerEnvironmentOptions): string;
+export declare function windowsPackageManagerLifecyclePathPrefix(packageRoot: string): string;
+export declare function windowsPackageManagerPathBudget(packageRoot: string): number;