@loucompanion/forge-bridge 0.1.3-dev.fbe15023cdfe → 0.1.4-dev.41da3780c451

package/dist/session/managed-attempt-tools.js

@@ -1,17 +1,32 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { resetGeneratedOutputs } from "../runtime/generated-output-reset.js";
-import { StreamingProviderProcessRunner } from "./provider-cli/provider-cli.process.js";
+import { DockerEngineProbe } from "../runtime/docker-engine-probe.js";
+import { attemptDatabaseCapabilityEnvironment, attemptDatabaseCapabilitySecrets, } from "../runtime/attempt-database-broker.js";
+import { assertHostDatabaseCapabilityBoundary } from "../runtime/host-database-capability-boundary.js";
+import { nativeTestPostgresFallbackConfigEnvironment, nativeTestPostgresFallbackDatabaseMode, nativeTestPostgresFallbackEnvironment, readNativeTestPostgresFallback, } from "../runtime/native-test-postgres-fallback.js";
+import { redactText } from "../shared/redaction/redaction.js";
+import { ManagedBuildCoordinator } from "./managed-build-coordinator.js";
+import { managedBuildConfiguration, publishManagedBuildReceipt, verifyManagedBuildReceipt, } from "./managed-build-receipt.js";
+import { managedLongTierTimeoutMs, managedMaximumCommandTimeoutMs, managedVerificationTierTimeoutMs, } from "./managed-verification-timeouts.js";
+import { resolveWindowsCommandFromPath, StreamingProviderProcessRunner } from "./provider-cli/provider-cli.process.js";
+import { monotonicNowMs } from "../shared/time/monotonic.js";
 const managedCommandNames = new Set(["forge.run_managed_command", "run_managed_command"]);
 const startManagedCommandNames = new Set(["forge.start_managed_command", "start_managed_command"]);
 const getManagedCommandNames = new Set(["forge.get_managed_command", "get_managed_command"]);
 const waitManagedCommandNames = new Set(["forge.wait_managed_command", "wait_managed_command"]);
+const startManagedVerificationNames = new Set(["forge.start_managed_verification", "start_managed_verification"]);
 const resetGeneratedOutputNames = new Set(["forge.reset_generated_outputs", "reset_generated_outputs"]);
 const maximumCapturedCharacters = 200_000;
-const maximumReturnedOutputCharacters = 12_000;
+const maximumReturnedOutputCharacters = 4_000;
 const maximumReportedFailedTests = 50;
-const maximumSynchronousWaitMs = 240_000;
+// Keep a wait slice comfortably below the MCP transport deadline. The managed
+// process remains supervised and its durable receipt continues to update after
+// this call returns, so a shorter slice avoids converting healthy long-running
+// commands into ambiguous MCP failures.
+const maximumSynchronousWaitMs = 45_000;
+const managedCommandRetryAfterMs = 60_000;
 const managedCommandLaunchTimeoutMs = 60_000;
 const managedCommandProgressPersistIntervalMs = 5_000;
 const managedCommandReceiptPollIntervalMs = 1_000;
@@ -24,6 +39,7 @@ const terminalManagedCommandStatuses = new Set([
     "timeout_termination_failed",
     "runner_error",
 ]);
+const managedVerificationBuildCoverage = "forge_dotnet_test_graph_v1";
 const managedCommandTasks = new Map();
 export const managedAttemptToolNames = [
     "forge.run_managed_command",
@@ -34,6 +50,8 @@ export const managedAttemptToolNames = [
     "get_managed_command",
     "forge.wait_managed_command",
     "wait_managed_command",
+    "forge.start_managed_verification",
+    "start_managed_verification",
     "forge.reset_generated_outputs",
     "reset_generated_outputs",
 ];
@@ -42,15 +60,39 @@ export function isManagedAttemptTool(name) {
         || startManagedCommandNames.has(name)
         || getManagedCommandNames.has(name)
         || waitManagedCommandNames.has(name)
+        || startManagedVerificationNames.has(name)
         || resetGeneratedOutputNames.has(name);
 }
 export function managedAttemptToolDefinition(name) {
+    if (startManagedVerificationNames.has(name)) {
+        return {
+            name,
+            description: "Start a canonical Forge verification profile with runner-owned cwd, arguments, attempt output, timeout, and process supervision. Prefer this over reconstructing broad .NET commands. Continue independent work, then use forge.wait_managed_command for a transport-safe terminal receipt.",
+            inputSchema: {
+                type: "object",
+                additionalProperties: false,
+                required: ["profile"],
+                properties: {
+                    profile: {
+                        type: "string",
+                        enum: ["dotnet_unit", "dotnet_contract", "dotnet_api_component", "dotnet_orchestration", "dotnet_infrastructure", "dotnet_solution", "dotnet_affected"],
+                    },
+                    shard_count: { type: "integer", minimum: 1, maximum: 32, default: 1 },
+                    shard_index: { type: "integer", minimum: 0, maximum: 31, default: 0 },
+                    run_all_shards: { type: "boolean", default: false },
+                    max_parallelism: { type: "integer", minimum: 1, maximum: 4, default: 2 },
+                    no_build: { type: "boolean", default: false },
+                    timeout_ms: { type: "integer", minimum: 1000, maximum: 7200000 },
+                },
+            },
+        };
+    }
     if (managedCommandNames.has(name) || startManagedCommandNames.has(name)) {
         return {
             name,
             description: startManagedCommandNames.has(name)
-                ? "Start a long command in an attempt-owned process tree and return a durable command ID immediately. Continue independent work, then call forge.wait_managed_command once for its terminal receipt."
-                : "Run a short command in an attempt-owned process tree. Commands with a timeout above four minutes automatically start asynchronously; continue independent work, then call forge.wait_managed_command once for the durable result.",
+                ? "Start a long command in an attempt-owned process tree and return a durable command ID immediately. Continue independent work, then use forge.wait_managed_command for a transport-safe terminal receipt."
+                : "Run a short command in an attempt-owned process tree. Commands with a timeout above four minutes automatically start asynchronously; continue independent work, then use forge.wait_managed_command for the durable result.",
             inputSchema: {
                 type: "object",
                 additionalProperties: false,
@@ -81,14 +123,14 @@ export function managedAttemptToolDefinition(name) {
     if (waitManagedCommandNames.has(name)) {
         return {
             name,
-            description: "Wait for a command started by Forge's managed command runner to reach a terminal state. Use this once after completing work that is independent of the command; Forge streams durable progress while this call waits.",
+            description: "Wait up to 45 seconds for a managed command terminal receipt. If it remains active, the call succeeds with command_continues=true and retry_after_ms; continue independent work or wait again later. Live progress remains in the durable receipt/UI; do not poll get_managed_command.",
             inputSchema: {
                 type: "object",
                 additionalProperties: false,
                 required: ["command_id"],
                 properties: {
                     command_id: { type: "string", minLength: 1 },
-                    wait_timeout_ms: { type: "integer", minimum: 1000, maximum: 7200000, default: 7200000 },
+                    wait_timeout_ms: { type: "integer", minimum: 1000, maximum: 45000, default: 45000 },
                 },
             },
         };
@@ -113,6 +155,7 @@ export async function callManagedAttemptTool(name, input, worktreePath) {
             structuredContent: {
                 status: "pass",
                 quarantined_paths: result.quarantinedPaths,
+                retained_paths: result.retainedPaths,
                 quarantine_directory: result.quarantineDirectory,
             },
         };
@@ -123,14 +166,20 @@ export async function callManagedAttemptTool(name, input, worktreePath) {
     if (waitManagedCommandNames.has(name)) {
         return await waitManagedCommand(input);
     }
+    if (startManagedVerificationNames.has(name)) {
+        return await startManagedVerification(input, worktreePath);
+    }
     if (!managedCommandNames.has(name) && !startManagedCommandNames.has(name)) {
         throw new Error(`Unknown managed attempt tool: ${name}`);
     }
-    const record = asRecord(input);
+    return await launchManagedCommand(asRecord(input), worktreePath, startManagedCommandNames.has(name));
+}
+async function launchManagedCommand(record, worktreePath, forceAsync, verificationProfile, buildProducingOverride, buildReceiptReuse) {
     const command = requiredInputString(record, "command");
     const args = requiredStringArray(record, "args");
     const timeoutMs = optionalTimeout(record.timeout_ms);
     const cwd = await containedWorkingDirectory(worktreePath, record.cwd);
+    await validatePlaywrightCommandProject(command, args, cwd);
     const logDirectory = requiredAttemptEnvironment("FORGE_LOG_DIR");
     await fs.mkdir(path.join(logDirectory, "managed-commands"), { recursive: true, mode: 0o700 });
     const commandId = randomUUID();
@@ -146,8 +195,12 @@ export async function callManagedAttemptTool(name, input, worktreePath) {
         metadataPath,
         receiptPath,
         startedAt: Date.now(),
+        verificationProfile,
+        worktreePath,
+        buildProducing: buildProducingOverride ?? isBuildProducingManagedCommand(command, args),
+        buildReceiptReuse,
     };
-    if (startManagedCommandNames.has(name) || timeoutMs > maximumSynchronousWaitMs) {
+    if (forceAsync || timeoutMs > maximumSynchronousWaitMs) {
         const started = managedCommandResult({
             ...invocation,
             timedOut: false,
@@ -161,16 +214,198 @@ export async function callManagedAttemptTool(name, input, worktreePath) {
         managedCommandTasks.set(commandId, task);
         void task.finally(() => managedCommandTasks.delete(commandId)).catch(() => undefined);
         return {
-            ...started,
+            ...managedCommandPublicResult(started),
             content: [{
                     type: "text",
-                    text: `Forge managed command ${commandId} started asynchronously. Continue independent work, then call forge.wait_managed_command once with this command_id for the terminal receipt.`,
+                    text: `Forge managed command ${commandId} started asynchronously. Continue independent work, then use forge.wait_managed_command with this command_id for a transport-safe terminal receipt.`,
                 }],
         };
     }
     return await executeManagedCommand(invocation);
 }
+async function startManagedVerification(input, worktreePath) {
+    const record = asRecord(input);
+    const profile = requiredInputString(record, "profile");
+    const shardCount = optionalBoundedInteger(record.shard_count, "shard_count", 1, 32, 1);
+    const shardIndex = optionalBoundedInteger(record.shard_index, "shard_index", 0, 31, 0);
+    if (shardIndex >= shardCount) {
+        throw new Error("managed_verification_invalid: shard_index must be less than shard_count.");
+    }
+    const noBuild = optionalBoolean(record.no_build, "no_build", false);
+    const runAllShards = optionalBoolean(record.run_all_shards, "run_all_shards", false);
+    const maxParallelism = optionalBoundedInteger(record.max_parallelism, "max_parallelism", 1, 4, 2);
+    if (runAllShards && shardCount < 2) {
+        throw new Error("managed_verification_invalid: run_all_shards requires shard_count of at least 2.");
+    }
+    if (runAllShards && shardIndex !== 0) {
+        throw new Error("managed_verification_invalid: shard_index must be 0 when run_all_shards is enabled.");
+    }
+    if (runAllShards && noBuild) {
+        throw new Error("managed_verification_invalid: run_all_shards owns the single prerequisite build and cannot be combined with no_build.");
+    }
+    const outputDirectory = requiredAttemptEnvironment("FORGE_TEST_OUTPUT_DIR");
+    const profileCommand = buildManagedVerificationCommand(profile, outputDirectory, shardCount, shardIndex, noBuild, runAllShards, maxParallelism);
+    const buildReceiptReuse = noBuild
+        ? await verifyManagedBuildReceipt({
+            worktreePath,
+            configuration: managedBuildConfiguration(profileCommand.command, profileCommand.args),
+            requiredCoverage: managedVerificationBuildCoverage,
+        })
+        : undefined;
+    return await launchManagedCommand({
+        command: profileCommand.command,
+        args: profileCommand.args,
+        timeout_ms: record.timeout_ms ?? profileCommand.timeoutMs,
+    }, worktreePath, true, profile, !noBuild, buildReceiptReuse);
+}
+export function buildManagedVerificationCommand(profile, outputDirectory, shardCount, shardIndex, noBuild, runAllShards = false, maxParallelism = 2) {
+    if (profile === "dotnet_affected") {
+        // The tests an uncommitted change can affect: one build, Unit and Contract whole, then
+        // only the affected heavier-tier classes. The script owns its build and its selection.
+        if (runAllShards || shardCount !== 1 || shardIndex !== 0 || noBuild) {
+            throw new Error("managed_verification_invalid: dotnet_affected selects its own tests and owns its build; it accepts no sharding or no_build.");
+        }
+        return {
+            command: process.execPath,
+            args: ["scripts/run-affected-dotnet-tests.mjs", "--results-directory", outputDirectory],
+            // A change that reaches tests without naming a type runs the heavier tiers whole.
+            timeoutMs: managedMaximumCommandTimeoutMs,
+        };
+    }
+    if (profile === "dotnet_solution") {
+        if (runAllShards) {
+            throw new Error("managed_verification_invalid: dotnet_solution does not support run_all_shards; select a test tier instead.");
+        }
+        if (shardCount !== 1 || shardIndex !== 0) {
+            throw new Error("managed_verification_invalid: dotnet_solution does not accept sharding; select a test tier instead.");
+        }
+        const command = preferredPowerShellExecutable();
+        const args = [
+            "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", "scripts/run-dotnet-test-suite.ps1",
+            "-ResultsDirectory", outputDirectory,
+            "-MaxParallelism", String(maxParallelism),
+        ];
+        if (noBuild)
+            args.push("-NoBuild");
+        return { command, args, timeoutMs: managedLongTierTimeoutMs };
+    }
+    const tiers = {
+        dotnet_unit: "Unit",
+        dotnet_contract: "Contract",
+        dotnet_api_component: "ApiComponent",
+        dotnet_orchestration: "Orchestration",
+        dotnet_infrastructure: "Infrastructure",
+    };
+    const tier = tiers[profile];
+    if (!tier)
+        throw new Error(`managed_verification_invalid: unsupported profile ${profile}.`);
+    const command = preferredPowerShellExecutable();
+    if (runAllShards) {
+        return {
+            command,
+            args: [
+                "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", "scripts/run-dotnet-test-tier-set.ps1",
+                "-Tier", tier,
+                "-ResultsDirectory", outputDirectory,
+                "-ShardCount", String(shardCount),
+                "-MaxParallelism", String(maxParallelism),
+            ],
+            timeoutMs: managedVerificationTierTimeoutMs(tier, { shardCount, maxParallelism }),
+        };
+    }
+    const args = [
+        "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", "scripts/run-dotnet-test-tier.ps1",
+        "-Tier", tier,
+        "-ResultsDirectory", outputDirectory,
+        "-ShardCount", String(shardCount),
+        "-ShardIndex", String(shardIndex),
+    ];
+    if (noBuild)
+        args.push("-NoBuild");
+    return { command, args, timeoutMs: managedVerificationTierTimeoutMs(tier) };
+}
+export function preferredPowerShellExecutable(platform = process.platform, pathValue = process.env.PATH ?? "") {
+    if (platform !== "win32")
+        return "pwsh";
+    return resolveWindowsCommandFromPath("pwsh.exe", pathValue) ?? "powershell.exe";
+}
+export function validatePlaywrightProjectName(project, availableProjects) {
+    if (!availableProjects.includes(project)) {
+        throw new Error(`managed_command_capability_unavailable: Playwright project '${project}' is not advertised by the selected config. Available projects: ${availableProjects.join(", ") || "none"}.`);
+    }
+}
+async function validatePlaywrightCommandProject(command, args, cwd) {
+    const invocation = [path.basename(command).toLowerCase(), ...args.map(argument => argument.toLowerCase())];
+    if (!invocation.some(argument => argument.includes("playwright")))
+        return;
+    const project = optionValue(args, "--project");
+    if (!project)
+        return;
+    const configuredPath = optionValue(args, "--config") ?? process.env.FORGE_PLAYWRIGHT_CONFIG;
+    const candidates = configuredPath
+        ? [path.resolve(cwd, configuredPath)]
+        : ["playwright.config.ts", "playwright.config.js", "playwright.config.mjs"].map(file => path.join(cwd, file));
+    for (const candidate of candidates) {
+        try {
+            const source = await fs.readFile(candidate, "utf8");
+            const projects = playwrightProjectNamesFromConfigSource(source);
+            validatePlaywrightProjectName(project, projects);
+            return;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    throw new Error("managed_command_capability_unavailable: Playwright config was not found; project selection cannot be validated.");
+}
+export function playwrightProjectNamesFromConfigSource(source) {
+    const marker = source.match(/^\/\/ forge-playwright-projects: (\[[^\r\n]*\])$/mu)?.[1];
+    if (!marker) {
+        return [...source.matchAll(/\bname\s*:\s*["']([^"']+)["']/gu)].map(match => match[1]);
+    }
+    try {
+        const parsed = JSON.parse(marker);
+        return Array.isArray(parsed)
+            ? parsed.filter((value) => typeof value === "string" && value.trim().length > 0)
+            : [];
+    }
+    catch {
+        return [];
+    }
+}
+function optionValue(args, name) {
+    const direct = args.find(argument => argument.startsWith(`${name}=`));
+    if (direct)
+        return direct.slice(name.length + 1).trim() || null;
+    const index = args.indexOf(name);
+    return index >= 0 ? args[index + 1]?.trim() || null : null;
+}
 async function executeManagedCommand(invocation) {
+    if (!invocation.buildProducing)
+        return await executeManagedCommandProcess(invocation);
+    return await new ManagedBuildCoordinator().withBuildSlot(invocation.worktreePath, async (buildQueueWaitMs) => await executeManagedCommandProcess({ ...invocation, buildQueueWaitMs }), async () => {
+        const waiting = managedCommandResult({
+            ...invocation,
+            timedOut: false,
+            status: "waiting_for_build_slot",
+            exitCode: null,
+            stdout: "",
+            stderr: "",
+        });
+        await persistManagedCommandReceipt(invocation.receiptPath, waiting.structuredContent);
+    });
+}
+async function executeManagedCommandProcess(invocation) {
+    assertHostDatabaseCapabilityBoundary();
+    const databaseEnvironment = invocation.verificationProfile
+        ? await managedVerificationDatabaseEnvironment()
+        : {};
+    const exactSecrets = [
+        ...Object.values(databaseEnvironment).filter(value => value !== nativeTestPostgresFallbackDatabaseMode),
+        // The attempt's brokered database login reaches managed commands; their output never shows it.
+        ...attemptDatabaseCapabilitySecrets(process.env[attemptDatabaseCapabilityEnvironment]),
+    ];
     const environment = inheritedEnvironment({
         FORGE_RUNTIME_MODE: "host",
         FORGE_RESOURCE_LEASE_ID: requiredAttemptEnvironment("FORGE_RESOURCE_LEASE_ID"),
@@ -183,6 +418,17 @@ async function executeManagedCommand(invocation) {
         FORGE_TEST_OUTPUT_DIR: requiredAttemptEnvironment("FORGE_TEST_OUTPUT_DIR"),
         FORGE_PROCESS_SUPERVISOR_ID: `managed-${invocation.commandId.replaceAll("-", "")}`,
         FORGE_PROCESS_SUPERVISOR_METADATA_PATH: invocation.metadataPath,
+        ...(invocation.verificationProfile
+            ? {
+                FORGE_MANAGED_VERIFICATION_PROFILE: invocation.verificationProfile,
+                // Managed verification executes mutable worktree scripts, SDK targets,
+                // and test assemblies. It uses an attempt-owned container, or the
+                // dedicated native test cluster while Docker is unavailable; it never
+                // receives a capability for a server that holds real data.
+                FORGE_MANAGED_VERIFICATION_DATABASE_MODE: "container_only",
+                ...databaseEnvironment,
+            }
+            : {}),
     });
     let stdout = "";
     let stderr = "";
@@ -191,8 +437,29 @@ async function executeManagedCommand(invocation) {
     let timer = null;
     let outputRevision = 0;
     let lastOutputAt = null;
+    let lastOutputStream = null;
     let lastProgressPersistedAt = 0;
     let progressPersistence = Promise.resolve();
+    let progressHeartbeat = null;
+    let progressFinished = false;
+    const persistProgress = (force = false) => {
+        if (progressFinished)
+            return progressPersistence;
+        const next = persistManagedCommandProgressIfDue(invocation, () => ({ stdout, stderr, outputRevision, lastOutputAt, lastOutputStream }), progressPersistence, () => lastProgressPersistedAt, value => { lastProgressPersistedAt = value; }, force);
+        // A heartbeat write is best-effort: one failed write (a locked or full disk) must
+        // not poison the chain, freeze later heartbeats, or fail a command that succeeded.
+        progressPersistence = force ? next.catch(() => undefined) : next;
+        return progressPersistence;
+    };
+    // Stop progress writes and let any in flight land before a terminal receipt is
+    // written, so a late "running" snapshot can never replace it.
+    const settleProgress = async () => {
+        progressFinished = true;
+        if (progressHeartbeat)
+            clearInterval(progressHeartbeat);
+        progressHeartbeat = null;
+        await progressPersistence;
+    };
     const launchTimer = setTimeout(() => {
         timedOut = true;
         controller.abort(new Error(`managed_command_launch_timeout: process supervisor was not ready within ${managedCommandLaunchTimeoutMs}ms.`));
@@ -216,30 +483,51 @@ async function executeManagedCommand(invocation) {
                     stderr,
                     outputRevision,
                     lastOutputAt,
+                    lastOutputStream,
                 });
                 await persistManagedCommandReceipt(invocation.receiptPath, running.structuredContent);
                 timer = setTimeout(() => {
                     timedOut = true;
                     controller.abort(new Error(`managed_command_timeout: exceeded ${invocation.timeoutMs}ms.`));
                 }, invocation.timeoutMs);
+                // Output alone does not keep the receipt current: a test tier can print a burst
+                // and then run quietly for many minutes. Without this heartbeat the elapsed time
+                // and the burst's last lines freeze, and a waiting agent sees a hung command.
+                // The run can already have failed while the "running" write above was pending.
+                if (progressFinished)
+                    return;
+                progressHeartbeat = setInterval(() => {
+                    void persistProgress(true);
+                }, managedCommandProgressPersistIntervalMs);
+                progressHeartbeat.unref();
             },
             onStdoutLine: (line) => {
-                stdout = appendBounded(stdout, line);
+                stdout = appendBounded(stdout, redactText(line, exactSecrets));
                 outputRevision += 1;
                 lastOutputAt = Date.now();
-                progressPersistence = persistManagedCommandProgressIfDue(invocation, () => ({ stdout, stderr, outputRevision, lastOutputAt }), progressPersistence, () => lastProgressPersistedAt, value => { lastProgressPersistedAt = value; });
-                return progressPersistence;
+                lastOutputStream = "stdout";
+                return persistProgress();
             },
             onStderrLine: (line) => {
-                stderr = appendBounded(stderr, line);
+                stderr = appendBounded(stderr, redactText(line, exactSecrets));
                 outputRevision += 1;
                 lastOutputAt = Date.now();
-                progressPersistence = persistManagedCommandProgressIfDue(invocation, () => ({ stdout, stderr, outputRevision, lastOutputAt }), progressPersistence, () => lastProgressPersistedAt, value => { lastProgressPersistedAt = value; });
-                return progressPersistence;
+                lastOutputStream = "stderr";
+                return persistProgress();
             },
         }, controller.signal);
-        await progressPersistence;
+        await settleProgress();
         const status = timedOut ? "timed_out" : result.exitCode === 0 ? "pass" : "fail";
+        const receiptCoverage = managedBuildReceiptCoverage(invocation);
+        const buildReceipt = status === "pass" && receiptCoverage
+            ? await publishManagedBuildReceipt({
+                worktreePath: invocation.worktreePath,
+                command: invocation.command,
+                args: invocation.args,
+                configuration: managedBuildConfiguration(invocation.command, invocation.args),
+                coverage: receiptCoverage,
+            })
+            : invocation.buildReceiptReuse;
         const receipt = managedCommandResult({
             ...invocation,
             timedOut,
@@ -249,13 +537,21 @@ async function executeManagedCommand(invocation) {
             stderr,
             outputRevision,
             lastOutputAt,
+            lastOutputStream,
+            buildReceipt,
+            buildReceiptReused: invocation.buildReceiptReuse !== undefined,
         });
         await persistManagedCommandReceipt(invocation.receiptPath, receipt.structuredContent);
-        return receipt;
+        return managedCommandPublicResult(receipt);
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
+        // The failure may be a progress write itself; it is reported below.
+        await settleProgress().catch(() => undefined);
+        const message = redactText(error instanceof Error ? error.message : String(error), exactSecrets);
         stderr = appendBounded(stderr, message);
+        outputRevision += 1;
+        lastOutputAt = Date.now();
+        lastOutputStream = "stderr";
         const receipt = managedCommandResult({
             ...invocation,
             timedOut,
@@ -265,14 +561,17 @@ async function executeManagedCommand(invocation) {
             stderr,
             outputRevision,
             lastOutputAt,
+            lastOutputStream,
         });
         await persistManagedCommandReceipt(invocation.receiptPath, receipt.structuredContent);
-        return receipt;
+        return managedCommandPublicResult(receipt);
     }
     finally {
         clearTimeout(launchTimer);
         if (timer)
             clearTimeout(timer);
+        if (progressHeartbeat)
+            clearInterval(progressHeartbeat);
     }
 }
 async function readManagedCommand(input) {
@@ -291,7 +590,7 @@ async function readManagedCommand(input) {
     const status = typeof receipt.status === "string" ? receipt.status : "unknown";
     const stdout = typeof receipt.stdout === "string" ? receipt.stdout : "";
     const stderr = typeof receipt.stderr === "string" ? receipt.stderr : "";
-    return {
+    return managedCommandPublicResult({
         content: [{
                 type: "text",
                 text: terminalManagedCommandStatuses.has(status)
@@ -307,13 +606,14 @@ async function readManagedCommand(input) {
             }],
         structuredContent: receipt,
         isError: terminalManagedCommandStatuses.has(status) && status !== "pass",
-    };
+    });
 }
 async function waitManagedCommand(input) {
     const record = asRecord(input);
     const commandId = validatedCommandId(record);
-    const waitTimeoutMs = optionalWaitTimeout(record.wait_timeout_ms);
-    const deadline = Date.now() + waitTimeoutMs;
+    const requestedWaitTimeoutMs = optionalWaitTimeout(record.wait_timeout_ms);
+    const waitTimeoutMs = Math.min(requestedWaitTimeoutMs, maximumSynchronousWaitMs);
+    const deadline = monotonicNowMs() + waitTimeoutMs;
     const receiptPath = managedCommandReceiptPath(requiredAttemptEnvironment("FORGE_LOG_DIR"), commandId);
     const task = managedCommandTasks.get(commandId);
     if (task) {
@@ -324,20 +624,43 @@ async function waitManagedCommand(input) {
         if (result)
             return result;
     }
-    while (Date.now() < deadline) {
+    while (monotonicNowMs() < deadline) {
         const result = await readManagedCommand({ command_id: commandId });
         if (terminalManagedCommandStatuses.has(String(result.structuredContent.status))) {
             return result;
         }
-        await delay(Math.min(managedCommandReceiptPollIntervalMs, Math.max(1, deadline - Date.now())));
+        await delay(Math.min(managedCommandReceiptPollIntervalMs, Math.max(1, deadline - monotonicNowMs())));
     }
     const receipt = await readManagedCommand({ command_id: commandId });
+    // Only a running receipt is refreshed on a heartbeat; queued or starting receipts are
+    // written once, so their elapsed time says nothing about progress.
+    const elapsedMs = receipt.structuredContent.elapsed_ms;
+    const timeoutMs = receipt.structuredContent.timeout_ms;
+    const lastOutputAt = Date.parse(String(receipt.structuredContent.last_output_at));
+    const progress = receipt.structuredContent.status === "running" && typeof elapsedMs === "number"
+        ? ` It has run for ${Math.round(elapsedMs / 1000)}s`
+            + (Number.isFinite(lastOutputAt) ? `, last output ${Math.max(0, Math.round((Date.now() - lastOutputAt) / 1000))}s ago` : ", with no output yet")
+            + `. Forge refreshes this receipt every ${managedCommandProgressPersistIntervalMs / 1000}s, so a rising elapsed time means the command is still alive even when it is quiet.`
+            // Agents otherwise abandon long verification tiers and record a blocker that is not one.
+            + (typeof timeoutMs === "number"
+                ? ` Forge itself ends it at its ${Math.round(timeoutMs / 60_000)}-minute limit if it hangs, so keep waiting; a running command is not a blocker.`
+                : "")
+        : "";
     return {
         ...receipt,
         content: [{
                 type: "text",
-                text: `Forge is still supervising managed command ${commandId} after waiting ${waitTimeoutMs}ms. Its durable receipt remains at ${receiptPath}.`,
+                text: `Forge is still supervising managed command ${commandId} after this ${waitTimeoutMs}ms transport-safe wait.${progress} Continue independent work or call forge.wait_managed_command again after ${managedCommandRetryAfterMs}ms. Its durable receipt remains at ${receiptPath}.`,
             }],
+        structuredContent: {
+            ...receipt.structuredContent,
+            command_continues: true,
+            terminal: false,
+            wait_timeout_ms: waitTimeoutMs,
+            requested_wait_timeout_ms: requestedWaitTimeoutMs,
+            retry_after_ms: managedCommandRetryAfterMs,
+        },
+        isError: false,
     };
 }
 function managedCommandReceiptPath(logDirectory, commandId) {
@@ -403,16 +726,70 @@ function managedCommandResult(values) {
                 || values.stderr.length >= maximumCapturedCharacters,
             output_revision: values.outputRevision ?? 0,
             last_output_at: values.lastOutputAt ? new Date(values.lastOutputAt).toISOString() : null,
+            last_output_stream: values.lastOutputStream ?? null,
             supervisor_metadata_path: values.metadataPath,
             receipt_path: values.receiptPath,
+            verification_profile: values.verificationProfile ?? null,
+            verification_profile_runner_authored: values.verificationProfile !== undefined,
+            build_producing: values.buildProducing,
+            build_coordination: values.buildProducing ? "per_worktree_exclusive" : null,
+            build_queue_wait_ms: values.buildQueueWaitMs ?? 0,
+            build_receipt_reused: values.buildReceiptReused ?? false,
+            build_receipt: values.buildReceipt ? {
+                fingerprint: values.buildReceipt.fingerprint,
+                receipt_path: values.buildReceipt.receiptPath,
+                producer_command: values.buildReceipt.producerCommand,
+                configuration: values.buildReceipt.configuration,
+                coverage: values.buildReceipt.coverage,
+                output_count: values.buildReceipt.outputCount,
+            } : null,
+            runtime_configuration: managedRuntimeConfiguration(),
             process_tree_terminated: values.status === "timed_out" ? true : values.timedOut ? false : undefined,
         },
         isError: isTerminal && values.status !== "pass",
     };
 }
-function persistManagedCommandProgressIfDue(invocation, snapshot, previousPersistence, lastPersistedAt, setLastPersistedAt) {
+function managedRuntimeConfiguration() {
+    const providerOnlySpecs = process.env.FORGE_CI_REPAIR_PROVIDER_ONLY_SPECS?.trim();
+    let providerOnlySpecCount = 0;
+    if (providerOnlySpecs) {
+        try {
+            const parsed = JSON.parse(providerOnlySpecs);
+            providerOnlySpecCount = Array.isArray(parsed)
+                ? parsed.filter(value => typeof value === "string" && value.length > 0).length
+                : 0;
+        }
+        catch {
+            providerOnlySpecCount = 0;
+        }
+    }
+    return {
+        attempt_database_schema: process.env.FORGE_ATTEMPT_DATABASE_SCHEMA ?? null,
+        attempt_database_readiness_path: process.env.FORGE_ATTEMPT_DATABASE_READINESS_PATH ?? null,
+        playwright_config: process.env.FORGE_PLAYWRIGHT_CONFIG ?? null,
+        provider_only_spec_count: providerOnlySpecCount,
+        provider_only_spec_fingerprint: providerOnlySpecs
+            ? `sha256:${createHash("sha256").update(providerOnlySpecs).digest("hex")}`
+            : null,
+    };
+}
+function managedCommandPublicResult(result) {
+    const stdout = typeof result.structuredContent.stdout === "string" ? result.structuredContent.stdout : "";
+    const stderr = typeof result.structuredContent.stderr === "string" ? result.structuredContent.stderr : "";
+    const { stdout: _stdout, stderr: _stderr, ...receipt } = result.structuredContent;
+    return {
+        ...result,
+        structuredContent: {
+            ...receipt,
+            stdout_tail: tail(stdout, maximumReturnedOutputCharacters),
+            stderr_tail: tail(stderr, maximumReturnedOutputCharacters),
+            full_output_in_receipt: true,
+        },
+    };
+}
+function persistManagedCommandProgressIfDue(invocation, snapshot, previousPersistence, lastPersistedAt, setLastPersistedAt, force = false) {
     const now = Date.now();
-    if (now - lastPersistedAt() < managedCommandProgressPersistIntervalMs)
+    if (!force && now - lastPersistedAt() < managedCommandProgressPersistIntervalMs)
         return previousPersistence;
     setLastPersistedAt(now);
     const current = snapshot();
@@ -447,12 +824,75 @@ function inheritedEnvironment(overrides) {
     }
     return { ...env, ...overrides };
 }
+/**
+ * Runner-authored verification normally uses its attempt-owned Testcontainers
+ * database. Only when the Docker engine is unavailable does it switch to the
+ * operator-provisioned native test cluster, which holds no real data.
+ */
+export async function managedVerificationDatabaseEnvironment(dockerAvailable = async () => (await new DockerEngineProbe().refresh(true)).available, readFallback = () => {
+    const configPath = process.env[nativeTestPostgresFallbackConfigEnvironment]?.trim();
+    return configPath ? readNativeTestPostgresFallback(configPath) : null;
+}) {
+    const fallback = readFallback();
+    if (!fallback || await dockerAvailable())
+        return {};
+    return nativeTestPostgresFallbackEnvironment(fallback);
+}
+export function isBuildProducingManagedCommand(command, args) {
+    const executable = path.basename(command).toLowerCase();
+    if (executable === "dotnet" || executable === "dotnet.exe") {
+        const verb = args.find(argument => !argument.startsWith("-"))?.toLowerCase();
+        if (!verb || !new Set(["build", "test", "restore", "publish", "pack", "msbuild"]).has(verb))
+            return false;
+        return verb === "restore" || !args.some(argument => argument.toLowerCase() === "--no-build");
+    }
+    if (["powershell", "powershell.exe", "pwsh", "pwsh.exe"].includes(executable)) {
+        const fileIndex = args.findIndex(argument => argument.toLowerCase() === "-file");
+        const script = fileIndex >= 0 ? path.basename(args[fileIndex + 1] ?? "").toLowerCase() : "";
+        if (script === "run-dotnet-test-tier-set.ps1" || script === "run-dotnet-test-suite.ps1") {
+            return !args.some(argument => argument.toLowerCase() === "-nobuild");
+        }
+        if (script === "run-dotnet-test-tier.ps1") {
+            return !args.some(argument => argument.toLowerCase() === "-nobuild");
+        }
+    }
+    return false;
+}
+function managedBuildReceiptCoverage(invocation) {
+    if (!invocation.buildProducing)
+        return null;
+    if (invocation.verificationProfile)
+        return managedVerificationBuildCoverage;
+    const executable = path.basename(invocation.command).toLowerCase();
+    if (executable === "dotnet" || executable === "dotnet.exe") {
+        const verb = invocation.args.find(argument => !argument.startsWith("-"))?.toLowerCase();
+        if (!verb || !new Set(["build", "test"]).has(verb))
+            return null;
+        const target = invocation.args.find(argument => /\.(?:sln|slnx|csproj)$/iu.test(argument));
+        if (target && (/\.(?:sln|slnx)$/iu.test(target) || /(?:^|[\\/])Forge\.Api\.Tests\.csproj$/iu.test(target))) {
+            return managedVerificationBuildCoverage;
+        }
+        return null;
+    }
+    if (["powershell", "powershell.exe", "pwsh", "pwsh.exe"].includes(executable)) {
+        const fileIndex = invocation.args.findIndex(argument => argument.toLowerCase() === "-file");
+        const script = fileIndex >= 0 ? path.basename(invocation.args[fileIndex + 1] ?? "").toLowerCase() : "";
+        if (["run-dotnet-test-tier.ps1", "run-dotnet-test-tier-set.ps1", "run-dotnet-test-suite.ps1"].includes(script)
+            && !invocation.args.some(argument => argument.toLowerCase() === "-nobuild")) {
+            return managedVerificationBuildCoverage;
+        }
+    }
+    return null;
+}
 function looksSensitiveEnvironmentName(name) {
     const normalized = name.trim().toUpperCase();
     return normalized.includes("SECRET")
         || normalized.includes("TOKEN")
         || normalized.includes("PASSWORD")
         || normalized.includes("CREDENTIAL")
+        || normalized.includes("CONNECTION_STRING")
+        || normalized.startsWith("CONNECTIONSTRINGS__")
+        || normalized.startsWith("CONNECTIONSTRINGS:")
         || normalized.endsWith("_API_KEY")
         || normalized === "OPENAI_API_KEY";
 }
@@ -499,12 +939,27 @@ function optionalTimeout(value) {
 }
 function optionalWaitTimeout(value) {
     if (value === undefined)
-        return 7_200_000;
-    if (!Number.isSafeInteger(value) || value < 1_000 || value > 7_200_000) {
-        throw new Error("managed_command_invalid: wait_timeout_ms must be an integer from 1000 through 7200000.");
+        return maximumSynchronousWaitMs;
+    if (!Number.isSafeInteger(value) || value < 1_000 || value > maximumSynchronousWaitMs) {
+        throw new Error(`managed_command_invalid: wait_timeout_ms must be an integer from 1000 through ${maximumSynchronousWaitMs}.`);
     }
     return value;
 }
+function optionalBoundedInteger(value, name, minimum, maximum, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+        throw new Error(`managed_verification_invalid: ${name} must be an integer from ${minimum} through ${maximum}.`);
+    }
+    return value;
+}
+function optionalBoolean(value, name, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "boolean")
+        throw new Error(`managed_verification_invalid: ${name} must be a boolean.`);
+    return value;
+}
 async function delay(ms) {
     await new Promise(resolve => setTimeout(resolve, ms));
 }