@loucompanion/forge-bridge 0.1.3-dev.fbe15023cdfe → 0.1.4-dev.9445952e33ba

package/dist/session/provider-cli/provider-cli.service.js

@@ -1,47 +1,186 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { RepositoryCoordinatorLock } from "../../sandbox/repository-lock.js";
 import { GitClient } from "../../shared/git/git.js";
 import { buildSpecBody, selectLaneCommand } from "../../worktree/artifact-injector.js";
+import { defaultWorktreeCoordinatorStateRoot } from "../../worktree/worktree-paths.js";
 import { completionPhaseFromDispatch, prepareCompletionToolRuntime, readCompletionArtifact, usesDebugCycleCompletion, usesDevelopCycleCompletion } from "../phase-completion.js";
-import { cleanupCompletionTools, commitWorktreeChanges, completionPhaseFromArtifact, emitArchitectStructuredEvents, emitCompletionArtifactRecorded, emitDecomposeGateArtifacts, emitDraftGateArtifacts, emitPhaseCompletionEvent, emitPhaseGateEvents, emitQaArtifactRecorded, emitQaStructuredEvents, enforceQaBrowserLaunchTargetGate, LiveArchitectArtifactEmitter, LiveCompletionArtifactEmitter, LiveQaArtifactEmitter, readCompletionArtifactsForRun, readQaCompletionArtifactBundle, summarizeStderr, waitForCompletionArtifact } from "./provider-cli.artifacts.js";
+import { ForgeFailureError } from "../session.types.js";
+import { cleanupCompletionTools, commitWorktreeChanges, completionPhaseFromArtifact, emitArchitectStructuredEvents, emitCompletionArtifactRecorded, emitDecomposeGateArtifacts, emitDraftGateArtifacts, emitPhaseCompletionEvent, emitPhaseGateEvents, emitQaArtifactRecorded, emitQaStructuredEvents, enforceQaBrowserLaunchTargetGate, LiveArchitectArtifactEmitter, LiveCompletionArtifactEmitter, LiveQaArtifactEmitter, readCompletionArtifactsForRun, readQaCompletionArtifactBundle, stagePublishableWorktreeChanges, waitForCompletionArtifact } from "./provider-cli.artifacts.js";
 import { DeterministicProviderCliService } from "./provider-cli.deterministic.js";
 import { buildArchitectPrompt, buildConflictResolvePrompt, buildDebugCyclePrompt, buildDevelopCyclePrompt, buildDraftPrompt, buildDraftSpec, buildImplementationPrompt, buildProviderCliPrompt, buildProviderCliCommand, durableDraftInput, buildPullRequestCheckRepairPrompt, buildPullRequestCommentsPrompt, buildQaPrompt, formatProviderCliCommandForCheckpoint, isDecomposeDraftDispatch, isPullRequestCheckRepairDispatch, isPullRequestCommentsDispatch } from "./provider-cli.prompts.js";
-import { StreamingProviderProcessRunner } from "./provider-cli.process.js";
-import { emitProviderUsageEvent, providerProcessEnv } from "./provider-cli.runtime.js";
+import { isTransientCodexProviderNotFoundFailure, recoveringProviderProcessRunner, StreamingProviderProcessRunner } from "./provider-cli.process.js";
+import { emitProviderUsageEvent, prePublicationValidationEnv, providerProcessEnv } from "./provider-cli.runtime.js";
 import { clip, createProviderOutputState, parseJsonLine } from "./provider-output-state.js";
 import { writeCiRepairReadinessManifest } from "./ci-repair-readiness.js";
+import { assertRepairHeadEpoch } from "./provider-cli.repair-epoch.js";
+import { PrePublicationValidationError, PrePublicationValidator, } from "../pre-publication-validation.js";
+const maxPrePublicationRepairTurns = 2;
+const maxQaCompletionRecoveryTurns = 2;
+function assertCommentRepairArtifactMatchesDispatch(dispatch, artifact) {
+    const pullRequest = dispatch.pullRequest;
+    if (!pullRequest)
+        throw new Error("Comment repair completion is missing pull-request context.");
+    const payload = JSON.parse(artifact.verdictJson);
+    if (payload.repair_head_sha !== pullRequest.headSha || payload.repair_issue_key !== pullRequest.reviewIssueKey) {
+        throw new Error("Comment repair completion head or issue key does not match the immutable dispatch snapshot.");
+    }
+    const expected = new Map(pullRequest.reviewFindings
+        .filter(finding => finding.actionable)
+        .map(finding => [`${finding.kind}:${finding.claimId}:${finding.bodySha256.toLowerCase()}`, finding]));
+    const dispositions = Array.isArray(payload.dispositions) ? payload.dispositions : [];
+    const actual = new Set();
+    for (const value of dispositions) {
+        const record = value;
+        const identity = `${String(record.kind ?? "")}:${String(record.claim_id ?? "")}:${String(record.body_sha256 ?? "").toLowerCase()}`;
+        if (actual.has(identity))
+            throw new Error("Comment repair completion contains a duplicate finding disposition.");
+        actual.add(identity);
+        const finding = expected.get(identity);
+        if (finding && !finding.contentAvailable && record.disposition !== "needs_decision") {
+            throw new Error("Comment repair completion cannot resolve or reject a finding whose content was unavailable.");
+        }
+        if (record.disposition === "owned_elsewhere") {
+            const owner = (record.owned_elsewhere ?? {});
+            if (!(pullRequest.openWorkOrderStories ?? []).some(story => story.workItemId.toLowerCase() === String(owner.target_work_item_id ?? "").toLowerCase())) {
+                throw new Error("Comment repair completion names an owned_elsewhere owner that is not an open Story in this Work Order.");
+            }
+        }
+    }
+    if (expected.size !== actual.size || [...expected.keys()].some(identity => !actual.has(identity))) {
+        throw new Error("Comment repair completion must disposition every actionable dispatch finding exactly once and no other finding.");
+    }
+}
+function assertCommentRepairArtifactMatchesChanges(artifact, actualChangedFiles) {
+    const payload = JSON.parse(artifact.verdictJson);
+    const dispositions = Array.isArray(payload.dispositions) ? payload.dispositions : [];
+    const hasFixedDisposition = dispositions.some(value => {
+        const record = value;
+        return record.disposition === "fixed";
+    });
+    const claimedChangedFiles = Array.isArray(payload.changed_files)
+        ? payload.changed_files.map(value => {
+            const record = value;
+            return String(record.path ?? "").trim().replaceAll("\\", "/");
+        })
+        : [];
+    const normalizedActual = actualChangedFiles.map(value => value.trim().replaceAll("\\", "/"));
+    const claimed = [...new Set(claimedChangedFiles)].sort();
+    const actual = [...new Set(normalizedActual)].sort();
+    if (hasFixedDisposition && actual.length === 0) {
+        throw new Error("Comment repair fixed dispositions require an actual publishable source diff.");
+    }
+    if (claimed.length !== actual.length || claimed.some((value, index) => value !== actual[index])) {
+        throw new Error("Comment repair changed_files must exactly match the publishable staged source diff.");
+    }
+}
+async function finalizeCommentRepairChangedFiles(artifact, baselineChangedFiles, actualChangedFiles) {
+    const payload = JSON.parse(artifact.verdictJson);
+    const claimedRecords = Array.isArray(payload.changed_files)
+        ? payload.changed_files.map(value => value)
+        : [];
+    const claimedByPath = new Map(claimedRecords.map(record => [
+        String(record.path ?? "").trim().replaceAll("\\", "/"),
+        record,
+    ]));
+    const authoritativePaths = [...new Set(actualChangedFiles
+            .map(value => value.trim().replaceAll("\\", "/"))
+            .filter(Boolean))].sort();
+    const authoritative = new Set(authoritativePaths);
+    const dispositions = Array.isArray(payload.dispositions) ? payload.dispositions : [];
+    const hasFixedDisposition = dispositions.some(value => value.disposition === "fixed");
+    if (hasFixedDisposition && authoritativePaths.length === 0) {
+        throw new Error("Comment repair fixed dispositions require an actual publishable source diff.");
+    }
+    for (const baselinePath of baselineChangedFiles.map(value => value.trim().replaceAll("\\", "/"))) {
+        if (baselinePath && !authoritative.has(baselinePath)) {
+            throw new Error(`Comment repair pre-publication repair removed '${baselinePath}' from the publishable staged source diff.`);
+        }
+    }
+    payload.changed_files = authoritativePaths.map(filePath => {
+        const claimed = claimedByPath.get(filePath);
+        return claimed
+            ? { ...claimed, path: filePath }
+            : {
+                path: filePath,
+                summary: "Updated during bounded Forge pre-publication repair.",
+            };
+    });
+    const verdictJson = `${JSON.stringify(payload, null, 2)}\n`;
+    const finalized = { ...artifact, verdictJson };
+    assertCommentRepairArtifactMatchesChanges(finalized, authoritativePaths);
+    await fs.writeFile(artifact.path, verdictJson, "utf8");
+    return finalized;
+}
+export { parseClaudeMcpToolName } from "./provider-output-state.js";
 export { DeterministicProviderCliService } from "./provider-cli.deterministic.js";
 export { buildProviderCliCommand, codexSandboxModeForPlatform, formatProviderCliCommand, formatProviderCliCommandForCheckpoint } from "./provider-cli.prompts.js";
-export { buildProviderChildEnvironment, chooseWindowsCommandCandidate, resolveCodexNpmDirectLaunch, resolvePackageManagerDirectLaunch, resolveWindowsCommandFromPath, StreamingProviderProcessRunner } from "./provider-cli.process.js";
+export { buildProviderChildEnvironment, chooseWindowsCommandCandidate, resolveCodexNpmDirectLaunch, resolveClaudeNpmDirectLaunch, resolvePackageManagerDirectLaunch, resolveWindowsCommandFromPath, PROVIDER_OUTPUT_CAPTURE_LIMIT_CHARS, CodexModelsCacheRecoveringProcessRunner, CodexResumeRecoveringProcessRunner, isTransientCodexProviderNotFoundFailure, StreamingProviderProcessRunner } from "./provider-cli.process.js";
 export { buildWindowsLaunchCommand } from "../../shared/process/windows-launch.js";
-async function pushWorktreeBranch(git, worktreePath, branchName, emit) {
-    try {
-        await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
-        return;
-    }
-    catch (err) {
-        if (!isNonFastForwardPushError(err)) {
-            throw err;
+async function pushWorktreeBranch(git, worktreePath, branchName, repoPath, coordinator, signal, emit, expectedRemoteHeadSha) {
+    return await coordinator.withLock(repoPath, async () => {
+        if (expectedRemoteHeadSha) {
+            const expected = expectedRemoteHeadSha.trim().toLowerCase();
+            const remoteListing = await git.run(worktreePath, ["ls-remote", "--heads", "origin", `refs/heads/${branchName}`]);
+            const observed = remoteListing.trim().split(/\s+/u)[0]?.toLowerCase() ?? "";
+            if (observed !== expected) {
+                throw new Error(`stale_head: repair publication expected remote ${branchName} at ${expected}, but observed ${observed || "no branch"}; refresh provider state before retrying.`);
+            }
+            try {
+                await git.run(worktreePath, [
+                    "push",
+                    "--porcelain",
+                    "origin",
+                    `HEAD:refs/heads/${branchName}`,
+                    `--force-with-lease=refs/heads/${branchName}:${expected}`,
+                ]);
+            }
+            catch (error) {
+                throw new Error(`stale_head: repair publication for ${branchName} lost its expected-head lease; Forge did not rebase or publish the stale repair: ${errorMessage(error)}`, { cause: error });
+            }
+            return (await git.run(worktreePath, ["rev-parse", "HEAD"])).trim();
         }
-        await emit?.({
-            role: "runner",
-            kind: "checkpoint",
-            content: `Remote branch ${branchName} moved before push; fetching latest and rebasing local changes.`,
-            eventType: "worktree_branch_push_rebase"
-        });
         try {
-            await git.run(worktreePath, ["fetch", "origin", remoteTrackingRefspec(branchName)]);
-            await git.run(worktreePath, ["rebase", `refs/remotes/origin/${branchName}`]);
             await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
+            return (await git.run(worktreePath, ["rev-parse", "HEAD"])).trim();
         }
-        catch (retryErr) {
-            throw new Error(`git push origin HEAD:${branchName} was rejected because the remote branch moved, and automatic fetch/rebase failed: ${errorMessage(retryErr)}`, { cause: retryErr });
+        catch (err) {
+            if (!isNonFastForwardPushError(err)) {
+                throw err;
+            }
+            await emit?.({
+                role: "runner",
+                kind: "checkpoint",
+                content: `Remote branch ${branchName} moved before push; fetching latest and rebasing local changes.`,
+                eventType: "worktree_branch_push_rebase"
+            });
+            try {
+                await git.run(worktreePath, ["fetch", "origin", remoteTrackingRefspec(branchName)]);
+                await git.run(worktreePath, ["rebase", `refs/remotes/origin/${branchName}`]);
+                await git.run(worktreePath, ["push", "origin", `HEAD:${branchName}`]);
+            }
+            catch (retryErr) {
+                throw new Error(`worktree_branch_integration_conflict: git push origin HEAD:${branchName} was rejected because the remote branch moved, and automatic fetch/rebase failed: ${errorMessage(retryErr)}`, { cause: retryErr });
+            }
         }
-    }
+        return (await git.run(worktreePath, ["rev-parse", "HEAD"])).trim();
+    }, signal);
 }
 function providerOwnsBranchPublication(context) {
     return context.dispatch.sandbox?.executionMode !== "docker";
 }
+function prePublicationExecution(context, environment, defaultRunner, baselineRevision) {
+    if (context.processRunner)
+        return { baselineRevision, environment, processRunner: context.processRunner };
+    if (context.dispatch.sandbox?.executionMode !== "docker")
+        return { baselineRevision, environment };
+    const expectedSandboxId = context.dispatch.sandbox.dispatchAttemptId;
+    const observedSandboxId = context.runtimeEnvironment?.FORGE_SANDBOX_ID ?? process.env.FORGE_SANDBOX_ID;
+    if (observedSandboxId !== expectedSandboxId) {
+        throw new ForgeFailureError("prepublication_execution_scope_invalid", `prepublication_execution_scope_invalid: Docker attempt ${expectedSandboxId} has no runner proven to execute inside that sandbox.`, "bridge");
+    }
+    return { baselineRevision, environment, processRunner: defaultRunner };
+}
 function remoteTrackingRefspec(branchName) {
     return `refs/heads/${branchName}:refs/remotes/origin/${branchName}`;
 }
@@ -56,14 +195,111 @@ function isNonFastForwardPushError(err) {
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
+function providerCliExitFailure(command, result) {
+    const output = [result.stderr.trim(), result.stdout.trim()]
+        .filter(value => value.length > 0)
+        .join("\n");
+    const detail = clipTail(output, 1200);
+    const suffix = detail ? `: ${detail}` : "";
+    if (isProviderConfigurationFailure(command, result)) {
+        return new ForgeFailureError("provider_configuration_invalid", `${command} rejected its model configuration; correct the configuration before retrying${suffix}`, "provider");
+    }
+    if (isTransientCodexProviderNotFoundFailure(command, result)) {
+        return new ForgeFailureError("provider_request_not_found", `${command} received a transient not-found response from its provider service${suffix}`, "provider");
+    }
+    if (isProviderCapacityFailure(result)) {
+        return new ForgeFailureError("provider_capacity_unavailable", `${command} was deferred because the selected provider model is temporarily at capacity${suffix}`, "provider");
+    }
+    if (isProviderContextWindowExhausted(command, result)) {
+        return new ForgeFailureError("provider_context_window_exhausted", `${command} exhausted the provider context window and must continue in a fresh session${suffix}`, "provider");
+    }
+    return new Error(`${command} exited ${result.exitCode}${suffix}`);
+}
+function clipTail(value, maximumLength) {
+    if (value.length <= maximumLength)
+        return value;
+    return `...${value.slice(-(maximumLength - 3))}`;
+}
+/**
+ * Capacity is trusted only when a nonzero provider process writes one of the
+ * narrow service-level messages to stderr. Stdout can contain arbitrary agent
+ * command output and account usage-limit messages remain ordinary failures.
+ */
+export function isProviderCapacityFailure(result) {
+    if (result.exitCode === 0)
+        return false;
+    const capacityMessages = new Set([
+        "the selected model is at capacity. please try again later.",
+        "the selected model is currently at capacity. please try again later.",
+        "the model is currently overloaded. please try again later.",
+        "the provider is currently overloaded. please try again later.",
+    ]);
+    return result.stderr
+        .split(/\r?\n/u)
+        .map(line => line.trim().toLowerCase().replace(/^error:\s*/u, ""))
+        .some(line => capacityMessages.has(line));
+}
+/** Only a nonzero Codex service diagnostic can classify a configuration rejection.
+ * JSONL turn.failed is a provider envelope; item/tool output is not retry authority. */
+export function isProviderConfigurationFailure(command, result) {
+    const names = [path.posix.parse(command).name, path.win32.parse(command).name];
+    if (result.exitCode === 0 || !names.some(name => name.toLowerCase() === "codex"))
+        return false;
+    const reasoningRejected = /Unsupported value: '[^'\r\n]+' is not supported with the '[^'\r\n]+' model\./u.test(result.stderr)
+        && result.stderr.includes("reasoning.effort")
+        && result.stderr.includes("invalid_request_error")
+        && result.stderr.includes("unsupported_value");
+    if (reasoningRejected)
+        return true;
+    return [result.stderr, result.stdout].some(output => output.split(/\r?\n/u).some(line => {
+        try {
+            const event = JSON.parse(line);
+            if (event.type !== "turn.failed")
+                return false;
+            const error = event.error;
+            if (typeof error?.message !== "string")
+                return false;
+            const service = JSON.parse(error.message);
+            return service.type === "error" && service.status === 400
+                && service.error?.type === "invalid_request_error"
+                && typeof service.error.message === "string"
+                && /^The '[^'\r\n]+' model is not supported when using Codex with a ChatGPT account\.$/u.test(service.error.message);
+        }
+        catch {
+            return false;
+        }
+    }));
+}
+/**
+ * A context limit is trusted only at the provider process boundary. The exact
+ * Codex message can be embedded in its JSONL stderr envelope, so substring
+ * matching is intentional but remains narrow and stderr-only.
+ */
+export function isProviderContextWindowExhausted(command, result) {
+    const executableNames = [path.posix.parse(command).name, path.win32.parse(command).name]
+        .map(name => name.toLowerCase());
+    if (result.exitCode === 0 || !executableNames.includes("codex"))
+        return false;
+    return result.stderr.toLowerCase().includes("codex ran out of room in the model's context window");
+}
 const defaultProviderToolHeartbeatIntervalMs = 60_000;
 const defaultManagedVerificationProgressIntervalMs = 30_000;
+function compareManagedVerificationSnapshots(left, right) {
+    const leftOrder = managedVerificationStartedAt(left.startedAt) ?? Number.MAX_SAFE_INTEGER;
+    const rightOrder = managedVerificationStartedAt(right.startedAt) ?? Number.MAX_SAFE_INTEGER;
+    return leftOrder - rightOrder || left.commandId.localeCompare(right.commandId);
+}
+function managedVerificationStartedAt(value) {
+    const parsed = Date.parse(value ?? "");
+    return Number.isFinite(parsed) ? parsed : null;
+}
 export class ManagedVerificationProgressEmitter {
     logDirectory;
     emit;
     intervalMs;
     timer = null;
-    lastSignature = null;
+    observedStatuses = new Map();
+    completedCommands = new Set();
     constructor(logDirectory, emit, intervalMs = defaultManagedVerificationProgressIntervalMs) {
         this.logDirectory = logDirectory;
         this.emit = emit;
@@ -94,40 +330,67 @@ export class ManagedVerificationProgressEmitter {
             .map(async (name) => parseManagedVerificationSnapshot(path.join(directory, name))));
         const current = snapshots
             .filter((entry) => entry !== null)
-            .sort((left, right) => right.elapsedMs - left.elapsedMs)[0];
-        if (!current)
+            .sort(compareManagedVerificationSnapshots);
+        if (current.some(snapshot => isManagedVerificationNonterminal(snapshot.status))) {
+            // Durable managed-command receipts are authoritative evidence that Forge
+            // still supervises work even when the provider is not inside an MCP tool
+            // call. Refresh the API idle deadline without inflating the transcript.
+            await this.emit({
+                role: "runner",
+                kind: "status",
+                content: "A supervised managed verification command is still running.",
+                eventType: "provider_tool_heartbeat",
+            });
+        }
+        for (const snapshot of current) {
+            await this.emitTransition(snapshot);
+        }
+    }
+    async emitTransition(current) {
+        const terminal = ["pass", "fail", "timed_out", "timeout_termination_failed", "runner_error"].includes(current.status);
+        if (terminal && this.completedCommands.has(current.commandId))
             return;
-        const elapsedMs = current.startedAt
-            ? Math.max(current.elapsedMs ?? 0, Date.now() - Date.parse(current.startedAt))
-            : current.elapsedMs;
-        const progressBucket = elapsedMs === null ? "none" : Math.floor(elapsedMs / this.intervalMs);
-        const signature = `${current.commandId}:${current.status}:${current.outputRevision ?? "none"}:${progressBucket}`;
-        if (signature === this.lastSignature)
+        const previousStatus = this.observedStatuses.get(current.commandId);
+        if (previousStatus === current.status)
             return;
-        const firstObservation = this.lastSignature === null;
-        this.lastSignature = signature;
-        const terminal = ["pass", "fail", "timed_out", "timeout_termination_failed", "runner_error"].includes(current.status);
+        this.observedStatuses.set(current.commandId, current.status);
+        if (terminal)
+            this.completedCommands.add(current.commandId);
+        // Starting and running are one externally meaningful state. The receipt is
+        // still refreshed on disk for UI telemetry, but repeated output/elapsed
+        // changes must not inflate the provider transcript or session history.
+        if (!terminal && previousStatus === "starting" && current.status === "running")
+            return;
+        const startedAt = managedVerificationStartedAt(current.startedAt);
+        const elapsedMs = startedAt !== null
+            ? Math.max(current.elapsedMs ?? 0, Date.now() - startedAt)
+            : current.elapsedMs;
         const elapsed = elapsedMs === null ? "an unknown duration" : formatElapsed(elapsedMs);
-        const outputTail = current.stderrTail || current.stdoutTail;
+        const outputTail = current.lastOutputStream === "stderr"
+            ? current.stderrTail || current.stdoutTail
+            : current.stdoutTail || current.stderrTail;
+        const recovered = previousStatus === undefined && terminal;
         await this.emit({
             role: "runner",
             kind: terminal && current.status !== "pass" ? "error" : "status",
             content: terminal
-                ? `Managed verification ${current.status} after ${elapsed}${outputTail ? `: ${clip(outputTail, 600)}` : "."}`
-                : firstObservation
-                    ? `QA is waiting on managed verification ${current.commandId}; Forge will keep supervising it while the provider waits.`
-                    : `Managed verification is still running after ${elapsed}${outputTail ? `: ${clip(outputTail, 600)}` : "."}`,
-            eventType: terminal ? "verification_completed" : firstObservation ? "verification_waiting" : "verification_progress",
+                ? `Managed verification ${current.status} after ${elapsed}${recovered ? " (recovered from its durable receipt)" : ""}${outputTail ? `: ${clip(outputTail, 600)}` : "."}`
+                : `QA started managed verification ${current.commandId}. Forge is supervising it; durable progress remains available in the UI while the provider continues independent work.`,
+            eventType: terminal ? "verification_completed" : "verification_waiting",
             data: JSON.stringify({
                 command_id: current.commandId,
                 status: current.status,
                 elapsed_ms: elapsedMs,
                 output_revision: current.outputRevision,
                 last_output_at: current.lastOutputAt,
+                recovered,
             }),
         });
     }
 }
+function isManagedVerificationNonterminal(status) {
+    return status === "starting" || status === "running" || status === "waiting_for_build_slot";
+}
 async function parseManagedVerificationSnapshot(receiptPath) {
     try {
         const receipt = JSON.parse(await fs.readFile(receiptPath, "utf8"));
@@ -142,6 +405,9 @@ async function parseManagedVerificationSnapshot(receiptPath) {
             startedAt: typeof receipt.started_at === "string" ? receipt.started_at : null,
             outputRevision: typeof receipt.output_revision === "number" ? receipt.output_revision : null,
             lastOutputAt: typeof receipt.last_output_at === "string" ? receipt.last_output_at : null,
+            lastOutputStream: receipt.last_output_stream === "stdout" || receipt.last_output_stream === "stderr"
+                ? receipt.last_output_stream
+                : null,
             stdoutTail: tail(typeof receipt.stdout === "string" ? receipt.stdout : ""),
             stderrTail: tail(typeof receipt.stderr === "string" ? receipt.stderr : ""),
         };
@@ -246,10 +512,14 @@ export class ProcessBackedProviderCliService {
     processRunner;
     git;
     providerToolHeartbeatIntervalMs;
-    constructor(processRunner = new StreamingProviderProcessRunner(), git = new GitClient(), providerToolHeartbeatIntervalMs = defaultProviderToolHeartbeatIntervalMs) {
+    publicationCoordinator;
+    prePublicationValidator;
+    constructor(processRunner = new StreamingProviderProcessRunner(), git = new GitClient(), providerToolHeartbeatIntervalMs = defaultProviderToolHeartbeatIntervalMs, publicationCoordinator = new RepositoryCoordinatorLock(defaultWorktreeCoordinatorStateRoot()), prePublicationValidator = new PrePublicationValidator()) {
         this.processRunner = processRunner;
         this.git = git;
         this.providerToolHeartbeatIntervalMs = providerToolHeartbeatIntervalMs;
+        this.publicationCoordinator = publicationCoordinator;
+        this.prePublicationValidator = prePublicationValidator;
     }
     async runDraft(context) {
         const { dispatch } = context;
@@ -311,7 +581,7 @@ export class ProcessBackedProviderCliService {
                 context.signal?.addEventListener("abort", abortProvider, { once: true });
             }
             try {
-                const runPromise = (context.processRunner ?? this.processRunner).run({
+                const runPromise = recoveringProviderProcessRunner(context.processRunner ?? this.processRunner).run({
                     command: command.command,
                     args: command.args,
                     cwd: worktree.worktreePath,
@@ -362,7 +632,7 @@ export class ProcessBackedProviderCliService {
                     context.signal?.removeEventListener("abort", abortArtifactWait);
                 }
                 if (result.exitCode !== 0 && !earlyProposalArtifact) {
-                    throw new Error(`Provider CLI exited with code ${result.exitCode}${summarizeStderr(result.stderr)}.`);
+                    throw providerCliExitFailure(command.command, result);
                 }
                 await context.emit({
                     role: "runner",
@@ -429,6 +699,7 @@ export class ProcessBackedProviderCliService {
     }
     async runImplementation(context) {
         const { dispatch, worktree } = context;
+        const validationBaselineRevision = (await this.git.run(worktree.worktreePath, ["rev-parse", "HEAD"])).trim();
         const phase = completionPhaseFromDispatch(dispatch);
         const developCycle = usesDevelopCycleCompletion(dispatch);
         const debugCycle = usesDebugCycleCompletion(dispatch);
@@ -479,7 +750,7 @@ export class ProcessBackedProviderCliService {
         let result;
         try {
             liveCompletionEvents.start();
-            result = await (context.processRunner ?? this.processRunner).run({
+            result = await recoveringProviderProcessRunner(context.processRunner ?? this.processRunner).run({
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
@@ -505,8 +776,7 @@ export class ProcessBackedProviderCliService {
             await cleanupCompletionTools(completionTools, context.emit);
         }
         if (result.exitCode !== 0) {
-            const stderr = clip(result.stderr.trim() || result.stdout.trim(), 1200);
-            throw new Error(`${command.command} exited ${result.exitCode}${stderr ? `: ${stderr}` : ""}`);
+            throw providerCliExitFailure(command.command, result);
         }
         await context.emit({
             role: "runner",
@@ -515,9 +785,20 @@ export class ProcessBackedProviderCliService {
             eventType: "provider_cli_completed"
         });
         await emitProviderUsageEvent(context.emit, dispatch, outputState);
+        if (developCycle || phase === "implementation") {
+            await this.validatePrePublicationWithRecovery({
+                context,
+                validationProfile: "implementation",
+                repairEnvironment: context.runtimeEnvironment,
+                outputState,
+                preparedHeadSha: validationBaselineRevision,
+                repairScope: "implementation",
+            });
+        }
         const committed = await commitWorktreeChanges(this.git, worktree.worktreePath, dispatch.workItem.id);
+        let publishedCommitSha = null;
         if ((developCycle || debugCycle || phase === "implementation") && providerOwnsBranchPublication(context)) {
-            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, context.emit);
+            publishedCommitSha = await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, worktree.repoPath, this.publicationCoordinator, context.signal, context.emit);
             await context.emit({
                 role: "runner",
                 kind: "checkpoint",
@@ -551,7 +832,9 @@ export class ProcessBackedProviderCliService {
             });
         }
         return {
-            summary: `${dispatch.execution.provider} CLI completed ${worktree.branchName} (${debugCycle ? "debug cycle" : developCycle ? "develop cycle" : phase}, ${committed.commitSha.slice(0, 12)}).`,
+            summary: `${dispatch.execution.provider} CLI completed ${worktree.branchName} (${debugCycle ? "debug cycle" : developCycle ? "develop cycle" : phase}, ${(publishedCommitSha ?? committed.commitSha).slice(0, 12)}).`,
+            resultCommitSha: publishedCommitSha ?? committed.commitSha,
+            publishedCommitSha: publishedCommitSha ?? undefined,
             spec: {
                 repoPath: worktree.worktreePath,
                 path: specPath,
@@ -605,7 +888,7 @@ export class ProcessBackedProviderCliService {
         let result;
         try {
             liveArchitectEvents.start();
-            result = await (context.processRunner ?? this.processRunner).run({
+            result = await recoveringProviderProcessRunner(context.processRunner ?? this.processRunner).run({
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
@@ -629,8 +912,7 @@ export class ProcessBackedProviderCliService {
             await cleanupCompletionTools(completionTools, context.emit);
         }
         if (result.exitCode !== 0) {
-            const stderr = clip(result.stderr.trim() || result.stdout.trim(), 1200);
-            throw new Error(`${command.command} exited ${result.exitCode}${stderr ? `: ${stderr}` : ""}`);
+            throw providerCliExitFailure(command.command, result);
         }
         await context.emit({
             role: "runner",
@@ -710,7 +992,7 @@ export class ProcessBackedProviderCliService {
         try {
             liveQaEvents.start();
             verificationProgress.start();
-            result = await (context.processRunner ?? this.processRunner).run({
+            result = await recoveringProviderProcessRunner(context.processRunner ?? this.processRunner).run({
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
@@ -735,8 +1017,7 @@ export class ProcessBackedProviderCliService {
             await cleanupCompletionTools(completionTools, context.emit);
         }
         if (result.exitCode !== 0) {
-            const stderr = clip(result.stderr.trim() || result.stdout.trim(), 1200);
-            throw new Error(`${command.command} exited ${result.exitCode}${stderr ? `: ${stderr}` : ""}`);
+            throw providerCliExitFailure(command.command, result);
         }
         await context.emit({
             role: "runner",
@@ -745,7 +1026,12 @@ export class ProcessBackedProviderCliService {
             eventType: "provider_cli_completed"
         });
         await emitProviderUsageEvent(context.emit, dispatch, outputState);
-        const qaArtifact = await readQaCompletionArtifactBundle(worktree.worktreePath, dispatch.workItem.id, dispatch.cycleRun.ownerType, dispatch.cycleRun.ownerId);
+        let qaArtifact = await readQaCompletionArtifactBundle(worktree.worktreePath, dispatch.workItem.id, dispatch.cycleRun.ownerType, dispatch.cycleRun.ownerId);
+        if (!qaArtifact && !(await readCompletionArtifact(worktree.worktreePath, dispatch.workItem.id, "qa"))) {
+            // A headless provider that ends its turn to "wait for a background watcher"
+            // exits for good. Resume the same thread instead of failing the session.
+            qaArtifact = await this.recoverMissingQaCompletion({ context, outputState });
+        }
         if (!qaArtifact) {
             const verdictOnly = await readCompletionArtifact(worktree.worktreePath, dispatch.workItem.id, "qa");
             throw new Error(verdictOnly
@@ -784,6 +1070,7 @@ export class ProcessBackedProviderCliService {
     }
     async runPullRequestRepair(context, route) {
         const { dispatch, worktree } = context;
+        const { expectedRepairHeadSha, preparedHeadSha } = await assertRepairHeadEpoch(context, this.git);
         const repairChecks = route === "ci_repair" || isPullRequestCheckRepairDispatch(dispatch);
         const addressComments = !repairChecks && isPullRequestCommentsDispatch(dispatch);
         let repairSpec = null;
@@ -823,6 +1110,15 @@ export class ProcessBackedProviderCliService {
                 eventType: "completion_tools_configured",
             });
         }
+        if (addressComments) {
+            completionTools = await prepareCompletionToolRuntime({ dispatch, worktree, phase: "comment_repair", runtimeEnvironment: repairEnvironment });
+            await context.emit({
+                role: "runner",
+                kind: "checkpoint",
+                content: "Forge comment-repair completion tool configured; provider must record an evidence-backed disposition for every actionable snapshot finding.",
+                eventType: "completion_tools_configured",
+            });
+        }
         const repairPrompt = repairChecks
             ? buildPullRequestCheckRepairPrompt(dispatch, worktree.branchName)
             : addressComments
@@ -846,8 +1142,9 @@ export class ProcessBackedProviderCliService {
         const outputState = createProviderOutputState(dispatch.execution.provider);
         const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
         let result;
+        let providerStarted = false;
         try {
-            result = await (context.processRunner ?? this.processRunner).run({
+            result = await recoveringProviderProcessRunner(context.processRunner ?? this.processRunner).run({
                 command: command.command,
                 args: command.args,
                 cwd: worktree.worktreePath,
@@ -861,6 +1158,7 @@ export class ProcessBackedProviderCliService {
                         content: `Provider CLI ${repairChecks ? "CI repair" : addressComments ? "PR comment address" : "conflict resolve"} is supervised and ready.`,
                         eventType: "provider_cli_started"
                     });
+                    providerStarted = true;
                 },
                 onStdoutLine: async (line) => {
                     await toolHeartbeat.consume(line);
@@ -869,13 +1167,28 @@ export class ProcessBackedProviderCliService {
         }
         finally {
             toolHeartbeat.stop();
-            if (completionTools) {
-                await cleanupCompletionTools(completionTools, context.emit);
+            try {
+                if (providerStarted) {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: `Provider CLI ${repairChecks ? "CI repair" : addressComments ? "PR comment address" : "conflict resolve"} turn exited.`,
+                        eventType: "provider_cli_completed"
+                    });
+                }
+            }
+            finally {
+                if (completionTools) {
+                    await cleanupCompletionTools(completionTools, context.emit);
+                }
             }
         }
         if (result.exitCode !== 0) {
-            const stderr = clip(result.stderr.trim() || result.stdout.trim(), 1200);
-            throw new Error(`${command.command} exited ${result.exitCode}${stderr ? `: ${stderr}` : ""}`);
+            throw providerCliExitFailure(command.command, result);
+        }
+        const postProviderHeadSha = (await this.git.run(worktree.worktreePath, ["rev-parse", "HEAD"])).trim();
+        if (postProviderHeadSha.toLowerCase() !== preparedHeadSha.toLowerCase()) {
+            throw new Error(`provider_publication_boundary_violation: PR repair changed HEAD from ${preparedHeadSha} to ${postProviderHeadSha}; Forge requires provider changes to remain uncommitted and unpushed until validation passes.`);
         }
         let repairArtifact = null;
         if (repairChecks) {
@@ -886,14 +1199,57 @@ export class ProcessBackedProviderCliService {
             if ((repairArtifact.status ?? "").trim().toLowerCase() !== "pass") {
                 throw new Error(`CI repair completion gate recorded ${repairArtifact.status}; Forge did not commit or push the repair.`);
             }
+        }
+        if (addressComments) {
+            repairArtifact = await readCompletionArtifact(worktree.worktreePath, dispatch.workItem.id, "comment_repair");
+            if (!repairArtifact) {
+                repairArtifact = await this.recoverMissingCommentRepairCompletion({
+                    context,
+                    repairEnvironment,
+                    outputState,
+                    preparedHeadSha,
+                });
+            }
+            if (!repairArtifact) {
+                throw new Error("Provider CLI completed but did not call forge.complete_comment_repair. Forge did not publish or resolve review findings.");
+            }
+            if ((repairArtifact.status ?? "").trim().toLowerCase() !== "pass") {
+                throw new Error(`Comment repair completion gate recorded ${repairArtifact.status}; Forge did not publish or resolve review findings.`);
+            }
+            assertCommentRepairArtifactMatchesDispatch(dispatch, repairArtifact);
+        }
+        let commentRepairBaselineChangedFiles = null;
+        if (addressComments && repairArtifact) {
+            commentRepairBaselineChangedFiles = await stagePublishableWorktreeChanges(this.git, worktree.worktreePath);
+            assertCommentRepairArtifactMatchesChanges(repairArtifact, commentRepairBaselineChangedFiles);
+        }
+        const validationProfile = repairChecks
+            ? "ci_repair"
+            : addressComments
+                ? "comment_repair"
+                : "conflict_repair";
+        await this.validatePrePublicationWithRecovery({
+            context,
+            validationProfile,
+            repairEnvironment,
+            outputState,
+            preparedHeadSha,
+            repairScope: "pull_request",
+        });
+        const stagedChangedFiles = await stagePublishableWorktreeChanges(this.git, worktree.worktreePath);
+        if (addressComments && repairArtifact && commentRepairBaselineChangedFiles) {
+            repairArtifact = await finalizeCommentRepairChangedFiles(repairArtifact, commentRepairBaselineChangedFiles, stagedChangedFiles);
+        }
+        const committed = await commitWorktreeChanges(this.git, worktree.worktreePath, dispatch.workItem.id, stagedChangedFiles);
+        const publishedByProvider = providerOwnsBranchPublication(context);
+        const publishedCommitSha = publishedByProvider
+            ? await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, worktree.repoPath, this.publicationCoordinator, context.signal, context.emit, expectedRepairHeadSha)
+            : null;
+        if (repairArtifact) {
             await emitCompletionArtifactRecorded(context.emit, worktree.worktreePath, repairArtifact);
             await emitPhaseCompletionEvent(context.emit, repairArtifact);
             await emitPhaseGateEvents(context.emit, repairArtifact);
         }
-        const committed = await commitWorktreeChanges(this.git, worktree.worktreePath, dispatch.workItem.id);
-        if (providerOwnsBranchPublication(context)) {
-            await pushWorktreeBranch(this.git, worktree.worktreePath, worktree.branchName, context.emit);
-        }
         await emitProviderUsageEvent(context.emit, dispatch, outputState);
         await context.emit({
             role: "assistant",
@@ -907,15 +1263,359 @@ export class ProcessBackedProviderCliService {
         });
         return {
             summary: repairChecks
-                ? `${dispatch.execution.provider} CLI repaired PR checks on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
+                ? `${dispatch.execution.provider} CLI repaired PR checks on ${worktree.branchName} (${(publishedCommitSha ?? committed.commitSha).slice(0, 12)}).`
                 : addressComments
-                    ? `${dispatch.execution.provider} CLI addressed PR comments on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`
-                    : `${dispatch.execution.provider} CLI resolved conflicts on ${worktree.branchName} (${committed.commitSha.slice(0, 12)}).`,
+                    ? `${dispatch.execution.provider} CLI addressed PR comments on ${worktree.branchName} (${(publishedCommitSha ?? committed.commitSha).slice(0, 12)}).`
+                    : `${dispatch.execution.provider} CLI resolved conflicts on ${worktree.branchName} (${(publishedCommitSha ?? committed.commitSha).slice(0, 12)}).`,
+            resultCommitSha: publishedCommitSha ?? committed.commitSha,
+            publishedCommitSha,
             spec: repairSpec,
             artifact: repairArtifact,
             artifacts: repairArtifact ? [repairArtifact] : [],
         };
     }
+    async recoverMissingQaCompletion(options) {
+        const { context, outputState } = options;
+        const { dispatch, worktree } = context;
+        const normalizedProvider = dispatch.execution.provider.trim().toLowerCase();
+        const providerThreadId = outputState.providerThreadId?.trim();
+        if ((normalizedProvider !== "codex" && normalizedProvider !== "cursor" && normalizedProvider !== "claude")
+            || !providerThreadId) {
+            await context.emit({
+                role: "runner",
+                kind: "error",
+                content: `Forge could not resume QA for the missing verdict because provider '${dispatch.execution.provider}' did not report a resumable thread.`,
+                eventType: "completion_tool_recovery_unavailable",
+                data: JSON.stringify({ phase: "qa", provider: normalizedProvider }),
+            });
+            return null;
+        }
+        const recoveryDispatch = {
+            ...dispatch,
+            session: { ...dispatch.session, resumeProviderThreadId: providerThreadId },
+        };
+        const recoveryPrompt = [
+            "Your previous turn ended before Forge received the QA verdict, so the provider process exited.",
+            "Background watchers, monitors and notifications from that turn did not survive and will never report back.",
+            "Resume QA exactly where it stopped. Do not repeat gates you already recorded.",
+            "Check each managed command with forge.get_managed_command, restart any that were interrupted,",
+            "and block on long commands with forge.wait_managed_command, calling it again while command_continues is true.",
+            "Do not end your turn until you have called every remaining QA gate through forge.complete_qa_verdict.",
+            "If a gate cannot get evidence, record it as blocked with the reason instead of ending the turn.",
+        ].join(" ");
+        for (let turn = 1; turn <= maxQaCompletionRecoveryTurns; turn += 1) {
+            const providerPrompt = buildProviderCliPrompt(recoveryDispatch, recoveryPrompt, context.runtimeEnvironment);
+            const pipePromptToStdin = shouldPipePromptToStdin(recoveryDispatch.execution.provider, providerPrompt, usesManagedWindowsHost(recoveryDispatch));
+            const completionTools = await prepareCompletionToolRuntime({
+                dispatch: recoveryDispatch,
+                worktree,
+                phase: "qa",
+                runtimeEnvironment: context.runtimeEnvironment,
+            });
+            const command = buildProviderCliCommand(recoveryDispatch, {
+                worktreePath: worktree.worktreePath,
+                prompt: recoveryPrompt,
+                promptFromStdin: pipePromptToStdin,
+                completionTools,
+                runtimeEnvironment: context.runtimeEnvironment,
+            });
+            await context.emit({
+                role: "runner",
+                kind: "checkpoint",
+                content: `QA ended without a verdict. Resuming ${dispatch.execution.provider} ${outputState.sessionLabel ?? "provider thread"} (turn ${turn}/${maxQaCompletionRecoveryTurns}) to finish the remaining QA gates.`,
+                eventType: "completion_tool_recovery_started",
+                data: JSON.stringify({ phase: "qa", providerThreadId, turn }),
+            });
+            const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
+            let result;
+            try {
+                result = await recoveringProviderProcessRunner(context.processRunner ?? this.processRunner).run({
+                    command: command.command,
+                    args: command.args,
+                    cwd: worktree.worktreePath,
+                    env: providerProcessEnv(recoveryDispatch, context.runtimeEnvironment),
+                    stdin: pipePromptToStdin ? providerPrompt : undefined,
+                }, { onStdoutLine: async (line) => await toolHeartbeat.consume(line) }, context.signal);
+            }
+            finally {
+                toolHeartbeat.stop();
+                await cleanupCompletionTools(completionTools, context.emit);
+            }
+            if (result.exitCode !== 0)
+                throw providerCliExitFailure(command.command, result);
+            const artifact = await readQaCompletionArtifactBundle(worktree.worktreePath, dispatch.workItem.id, dispatch.cycleRun.ownerType, dispatch.cycleRun.ownerId);
+            if (artifact || await readCompletionArtifact(worktree.worktreePath, dispatch.workItem.id, "qa")) {
+                await context.emit({
+                    role: "runner",
+                    kind: "checkpoint",
+                    content: `Forge resumed the QA thread and received its completion record on recovery turn ${turn}.`,
+                    eventType: "completion_tool_recovery_completed",
+                    data: JSON.stringify({ phase: "qa", providerThreadId, turn }),
+                });
+                return artifact;
+            }
+        }
+        await context.emit({
+            role: "runner",
+            kind: "error",
+            content: `The resumed QA thread still did not call the Forge QA completion tool after ${maxQaCompletionRecoveryTurns} recovery turns.`,
+            eventType: "completion_tool_recovery_exhausted",
+            data: JSON.stringify({ phase: "qa", providerThreadId }),
+        });
+        return null;
+    }
+    async recoverMissingCommentRepairCompletion(options) {
+        const { context, repairEnvironment, outputState, preparedHeadSha } = options;
+        const { dispatch, worktree } = context;
+        const normalizedProvider = dispatch.execution.provider.trim().toLowerCase();
+        if (normalizedProvider !== "codex" && normalizedProvider !== "cursor" && normalizedProvider !== "claude") {
+            await context.emit({
+                role: "runner",
+                kind: "error",
+                content: `Forge could not recover the missing comment-repair completion record because provider '${dispatch.execution.provider}' has no declared thread-resume contract. The dirty worktree remains preserved.`,
+                eventType: "completion_tool_recovery_unavailable",
+                data: JSON.stringify({
+                    phase: "comment_repair",
+                    provider: normalizedProvider,
+                    reason: "thread_resume_unsupported",
+                }),
+            });
+            return null;
+        }
+        const providerThreadId = outputState.providerThreadId?.trim();
+        if (!providerThreadId) {
+            await context.emit({
+                role: "runner",
+                kind: "error",
+                content: "Forge could not recover the missing comment-repair completion record because the provider did not report a resumable thread id. The dirty worktree remains preserved.",
+                eventType: "completion_tool_recovery_unavailable",
+            });
+            return null;
+        }
+        const recoveryDispatch = {
+            ...dispatch,
+            session: { ...dispatch.session, resumeProviderThreadId: providerThreadId },
+        };
+        const recoveryPrompt = [
+            "Forge did not receive the required forge.complete_comment_repair call from your previous turn.",
+            "Resume the existing work exactly where it is. Do not reimplement or discard the prepared changes.",
+            "Review the current diff and the durable review snapshot, preserve the validation evidence already gathered,",
+            "then call forge.complete_comment_repair with an evidence-backed disposition for every actionable finding.",
+            "Do not commit or push; Forge owns publication after the completion gate succeeds.",
+        ].join(" ");
+        const providerPrompt = buildProviderCliPrompt(recoveryDispatch, recoveryPrompt, repairEnvironment);
+        const pipePromptToStdin = shouldPipePromptToStdin(recoveryDispatch.execution.provider, providerPrompt, usesManagedWindowsHost(recoveryDispatch));
+        const completionTools = await prepareCompletionToolRuntime({
+            dispatch: recoveryDispatch,
+            worktree,
+            phase: "comment_repair",
+            runtimeEnvironment: repairEnvironment,
+        });
+        const command = buildProviderCliCommand(recoveryDispatch, {
+            worktreePath: worktree.worktreePath,
+            prompt: recoveryPrompt,
+            promptFromStdin: pipePromptToStdin,
+            completionTools,
+            runtimeEnvironment: repairEnvironment,
+        });
+        await context.emit({
+            role: "runner",
+            kind: "checkpoint",
+            content: `Resuming ${dispatch.execution.provider} ${outputState.sessionLabel ?? "provider thread"} once to record the missing comment-repair completion artifact without repeating implementation work.`,
+            eventType: "completion_tool_recovery_started",
+            data: JSON.stringify({ phase: "comment_repair", providerThreadId }),
+        });
+        const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
+        let result;
+        let providerStarted = false;
+        try {
+            result = await recoveringProviderProcessRunner(context.processRunner ?? this.processRunner).run({
+                command: command.command,
+                args: command.args,
+                cwd: worktree.worktreePath,
+                env: providerProcessEnv(recoveryDispatch, repairEnvironment),
+                stdin: pipePromptToStdin ? providerPrompt : undefined,
+            }, {
+                onStarted: async () => {
+                    providerStarted = true;
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: "Provider completion-tool recovery turn is supervised and ready.",
+                        eventType: "provider_cli_started",
+                    });
+                },
+                onStdoutLine: async (line) => {
+                    await toolHeartbeat.consume(line);
+                },
+            }, context.signal);
+        }
+        finally {
+            toolHeartbeat.stop();
+            try {
+                if (providerStarted) {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: "Provider completion-tool recovery turn exited.",
+                        eventType: "provider_cli_completed",
+                    });
+                }
+            }
+            finally {
+                await cleanupCompletionTools(completionTools, context.emit);
+            }
+        }
+        if (result.exitCode !== 0)
+            throw providerCliExitFailure(command.command, result);
+        const postRecoveryHeadSha = (await this.git.run(worktree.worktreePath, ["rev-parse", "HEAD"])).trim();
+        if (postRecoveryHeadSha.toLowerCase() !== preparedHeadSha.toLowerCase()) {
+            throw new Error(`provider_publication_boundary_violation: completion-tool recovery changed HEAD from ${preparedHeadSha} to ${postRecoveryHeadSha}; Forge requires provider changes to remain uncommitted and unpushed until validation passes.`);
+        }
+        const artifact = await readCompletionArtifact(worktree.worktreePath, dispatch.workItem.id, "comment_repair");
+        await context.emit({
+            role: "runner",
+            kind: artifact ? "checkpoint" : "error",
+            content: artifact
+                ? "Forge recovered the missing comment-repair completion artifact from the same provider thread."
+                : "The resumed provider thread still did not call forge.complete_comment_repair. The dirty worktree remains preserved and unpublished.",
+            eventType: artifact ? "completion_tool_recovery_completed" : "completion_tool_recovery_exhausted",
+            data: JSON.stringify({ phase: "comment_repair", providerThreadId }),
+        });
+        return artifact;
+    }
+    async validatePrePublicationWithRecovery(options) {
+        const { context, validationProfile, repairEnvironment, outputState, preparedHeadSha, repairScope } = options;
+        const { dispatch, worktree } = context;
+        const processRunner = recoveringProviderProcessRunner(context.processRunner ?? this.processRunner);
+        const environment = providerProcessEnv(dispatch, repairEnvironment);
+        const validationEnvironment = prePublicationValidationEnv(dispatch, repairEnvironment);
+        for (let repairTurn = 0;; repairTurn += 1) {
+            try {
+                await this.prePublicationValidator.validate(worktree.worktreePath, validationProfile, publicationCapabilities(context, repairEnvironment), context.emit, context.signal, prePublicationExecution(context, validationEnvironment, this.processRunner, preparedHeadSha));
+                if (repairTurn > 0) {
+                    await context.emit({
+                        role: "runner",
+                        kind: "checkpoint",
+                        content: `Pre-publication validation passed after ${repairTurn} in-place repair turn${repairTurn === 1 ? "" : "s"}.`,
+                        eventType: "prepublication_repair_completed",
+                        data: JSON.stringify({ repairTurn, maxRepairTurns: maxPrePublicationRepairTurns }),
+                    });
+                }
+                return;
+            }
+            catch (error) {
+                if (!(error instanceof PrePublicationValidationError))
+                    throw error;
+                if (repairTurn >= maxPrePublicationRepairTurns) {
+                    await context.emit({
+                        role: "runner",
+                        kind: "error",
+                        content: `Pre-publication validation still fails after ${maxPrePublicationRepairTurns} in-place repair turns: ${clip(error.message, 4000)}`,
+                        eventType: "prepublication_repair_exhausted",
+                        data: JSON.stringify({ checkId: error.checkId, repairTurns: repairTurn, maxRepairTurns: maxPrePublicationRepairTurns }),
+                    });
+                    throw error;
+                }
+                const providerThreadId = outputState.providerThreadId?.trim();
+                if (!providerThreadId) {
+                    throw new Error(`prepublication_repair_unavailable: ${error.message}; provider did not report a resumable thread id, so Forge preserved the dirty worktree without starting a blind replacement run.`, { cause: error });
+                }
+                const nextRepairTurn = repairTurn + 1;
+                const focusedPrompt = buildPrePublicationRepairPrompt(error, nextRepairTurn, repairScope);
+                const repairDispatch = {
+                    ...dispatch,
+                    session: { ...dispatch.session, resumeProviderThreadId: providerThreadId },
+                };
+                const providerPrompt = buildProviderCliPrompt(repairDispatch, focusedPrompt, repairEnvironment);
+                const pipePromptToStdin = shouldPipePromptToStdin(repairDispatch.execution.provider, providerPrompt, usesManagedWindowsHost(repairDispatch));
+                const command = buildProviderCliCommand(repairDispatch, {
+                    worktreePath: worktree.worktreePath,
+                    prompt: focusedPrompt,
+                    promptFromStdin: pipePromptToStdin,
+                    runtimeEnvironment: repairEnvironment,
+                });
+                await context.emit({
+                    role: "runner",
+                    kind: "checkpoint",
+                    content: `Resuming ${dispatch.execution.provider} ${outputState.sessionLabel ?? "provider thread"} for bounded pre-publication repair ${nextRepairTurn}/${maxPrePublicationRepairTurns} after '${error.checkId}' failed.`,
+                    eventType: "prepublication_repair_started",
+                    data: JSON.stringify({ checkId: error.checkId, repairTurn: nextRepairTurn, maxRepairTurns: maxPrePublicationRepairTurns }),
+                });
+                const toolHeartbeat = new ProviderToolActivityHeartbeat(outputState, context.emit, this.providerToolHeartbeatIntervalMs);
+                let result;
+                let providerStarted = false;
+                try {
+                    result = await processRunner.run({
+                        command: command.command,
+                        args: command.args,
+                        cwd: worktree.worktreePath,
+                        env: environment,
+                        stdin: pipePromptToStdin ? providerPrompt : undefined,
+                    }, {
+                        onStarted: async () => {
+                            await context.emit({
+                                role: "runner",
+                                kind: "checkpoint",
+                                content: `Provider pre-publication repair turn ${nextRepairTurn}/${maxPrePublicationRepairTurns} is supervised and ready.`,
+                                eventType: "provider_cli_started",
+                            });
+                            providerStarted = true;
+                        },
+                        onStdoutLine: async (line) => {
+                            await toolHeartbeat.consume(line);
+                        },
+                    }, context.signal);
+                }
+                finally {
+                    toolHeartbeat.stop();
+                    if (providerStarted) {
+                        await context.emit({
+                            role: "runner",
+                            kind: "checkpoint",
+                            content: `Provider pre-publication repair turn ${nextRepairTurn}/${maxPrePublicationRepairTurns} exited.`,
+                            eventType: "provider_cli_completed",
+                        });
+                    }
+                }
+                if (result.exitCode !== 0)
+                    throw providerCliExitFailure(command.command, result);
+                const postRepairHeadSha = (await this.git.run(worktree.worktreePath, ["rev-parse", "HEAD"])).trim();
+                if (postRepairHeadSha.toLowerCase() !== preparedHeadSha.toLowerCase()) {
+                    throw new Error(`provider_publication_boundary_violation: pre-publication repair changed HEAD from ${preparedHeadSha} to ${postRepairHeadSha}; Forge requires provider changes to remain uncommitted and unpushed until validation passes.`, { cause: error });
+                }
+            }
+        }
+    }
+}
+function buildPrePublicationRepairPrompt(error, repairTurn, repairScope) {
+    const invocation = [error.command, ...error.args].join(" ");
+    const priorWork = repairScope === "implementation"
+        ? "Keep the completed implementation and its Forge-owned completion artifacts intact."
+        : "Keep the existing PR-comment or CI repairs intact.";
+    return [
+        `Forge pre-publication validation failed after your ${repairScope === "implementation" ? "implementation" : "PR repair"} turn.`,
+        `This is bounded in-place repair turn ${repairTurn}/${maxPrePublicationRepairTurns}.`,
+        `Failed check: ${error.checkId}`,
+        `Command: ${invocation}`,
+        `Exit code: ${error.exitCode}`,
+        "Diagnostics:",
+        error.detail || "The validation command returned no diagnostic output.",
+        "Fix the root cause in the current worktree and run the focused failing check.",
+        `${priorWork} Do not commit, push, rebase, or modify Forge-owned protocol artifacts.`,
+        "When the focused check passes, stop; Bridge will rerun the complete required pre-publication profile and owns commit/push.",
+    ].join("\n\n");
+}
+function publicationCapabilities(context, runtimeEnvironment) {
+    const capabilities = new Set();
+    const launchTarget = context.dispatch.qaBrowser?.launchTarget;
+    if (runtimeEnvironment?.FORGE_PLAYWRIGHT_CONFIG
+        || launchTarget?.url
+        || launchTarget?.command
+        || launchTarget?.managed_runtime_port) {
+        capabilities.add("browser_launch");
+    }
+    return capabilities;
 }
 async function stageDraftAttachments(dispatch, metadataRoot) {
     const attachments = dispatch.draft?.attachments ?? [];
@@ -980,7 +1680,11 @@ function clipFileName(fileName, maxLength) {
 }
 const providerPromptStdinThreshold = 8_000;
 function shouldPipePromptToStdin(provider, prompt, force = false) {
-    return provider.trim().toLowerCase() === "codex"
+    const normalized = provider.trim().toLowerCase();
+    if (normalized === "claude") {
+        return true;
+    }
+    return normalized === "codex"
         && (force || Buffer.byteLength(prompt, "utf8") > providerPromptStdinThreshold);
 }
 function usesManagedWindowsHost(dispatch) {