@moretea-labs/forge 1.7.2 → 1.8.1

package/src/runtime/root/controller-round-composition.ts

@@ -0,0 +1,126 @@
+import { createHash } from 'crypto';
+import type { AssistantContextSnapshot, ControllerRoundRelayRecord } from '../../../packages/kernel/controller/api/index';
+import { prepareAssistantWorkContext } from '../context/assistant-work-context';
+import { renderAssistantContext, type AssistantContextResolution } from '../context/assistant-context';
+import { getChatgptWorkConversationBinding } from '../../../adapters/chatgpt/work-conversation-binding-store';
+import {
+  chatgptControllerProviderBindingId,
+  upsertChatgptControllerBinding,
+  type ChatgptControllerBindingPayload,
+} from '../../../adapters/chatgpt/controller-binding-store';
+import {
+  buildChatgptControllerRoundPrompt,
+  chatgptControllerRoundBindingAuthorizesRecovery,
+} from '../../../adapters/chatgpt/controller-round-host';
+import {
+  recordChatgptControllerRoundSettlement,
+  type ChatgptControllerRoundSettlementStatus,
+} from '../../../adapters/chatgpt/controller-round-settlement-store';
+
+// Kernel V2 composition root: provider-specific adapter wiring lives here, not in transport adapters.
+export interface ControllerRoundCompositionStore {
+  controllerHome: string;
+  repoId: string;
+}
+
+export interface ChatgptControllerRoundBindingSnapshot {
+  bindingId?: string;
+  browserSessionId?: string;
+  conversationUrl?: string;
+  authorizationGrantRefs?: string[];
+}
+
+export function chatgptControllerRoundBindingId(workId: string): string {
+  return chatgptControllerProviderBindingId(workId);
+}
+
+export function upsertChatgptControllerRoundTransportBinding(
+  store: ControllerRoundCompositionStore,
+  input: Omit<ChatgptControllerBindingPayload, 'schemaVersion' | 'bindingId' | 'repoId' | 'createdAt' | 'updatedAt'>,
+) {
+  return upsertChatgptControllerBinding(store, input);
+}
+
+export function chatgptControllerRoundBinding(
+  store: ControllerRoundCompositionStore,
+  workId: string,
+): ChatgptControllerRoundBindingSnapshot | undefined {
+  const binding = getChatgptWorkConversationBinding(store, workId);
+  if (!binding) return undefined;
+  return {
+    bindingId: binding.bindingId,
+    browserSessionId: binding.latestBrowserSessionId,
+    conversationUrl: binding.conversationUrl,
+    authorizationGrantRefs: [...(binding.authorizationGrantRefs ?? [])],
+  };
+}
+
+export function chatgptControllerRoundRecoveryAuthorized(
+  store: ControllerRoundCompositionStore,
+  workId: string,
+  relay: ControllerRoundRelayRecord | undefined,
+): boolean {
+  return chatgptControllerRoundBindingAuthorizesRecovery(
+    relay,
+    getChatgptWorkConversationBinding(store, workId),
+  );
+}
+
+export function renderChatgptControllerRoundPrompt(
+  store: ControllerRoundCompositionStore,
+  relay: ControllerRoundRelayRecord,
+  options: { exactOriginWork?: boolean } = {},
+): string {
+  return buildChatgptControllerRoundPrompt({ ...store,
+    prepareAssistantContext: workId => prepareControllerAssistantContext(store, workId),
+  }, relay, options);
+}
+
+export function recordChatgptControllerRoundTabSettlement(
+  store: ControllerRoundCompositionStore,
+  input: {
+    workId: string;
+    relayScopeId: string;
+    status: ChatgptControllerRoundSettlementStatus;
+    error?: string;
+    attemptIdentity?: string;
+  },
+): void {
+  recordChatgptControllerRoundSettlement(store, input);
+}
+
+function controllerAssistantContextSnapshot(resolution: AssistantContextResolution): AssistantContextSnapshot {
+  const items = resolution.items.map((item) => ({
+    kind: item.kind,
+    itemId: item.id,
+    digest: item.provenance.digest,
+    revision: item.provenance.revision,
+    sourceRevision: item.provenance.sourceRevision,
+  }));
+  const identity = {
+    ...(resolution.projectId ? { projectId: resolution.projectId } : {}),
+    items,
+    gaps: resolution.gaps,
+    missingRequiredSources: resolution.missingRequiredSources,
+    truncated: resolution.truncated,
+  };
+  return {
+    digest: `sha256:${createHash('sha256').update(JSON.stringify(identity)).digest('hex')}`,
+    ...identity,
+  };
+}
+
+/** Resolve once at claim so rendered context and retained round evidence share one identity. */
+export function prepareControllerAssistantContextBundle(
+  store: ControllerRoundCompositionStore,
+  workId: string,
+): { rendered: string; snapshot: AssistantContextSnapshot; resolution: AssistantContextResolution } | undefined {
+  const resolution = prepareAssistantWorkContext({ controllerHome: store.controllerHome, repoId: store.repoId, workId });
+  if (!resolution) return undefined;
+  return { rendered: renderAssistantContext(resolution), snapshot: controllerAssistantContextSnapshot(resolution), resolution };
+}
+
+/** Provider-neutral context refresh used immediately after a successful claim. */
+export function prepareControllerAssistantContext(store: ControllerRoundCompositionStore, workId: string): string | undefined {
+  return prepareControllerAssistantContextBundle(store, workId)?.rendered;
+}

package/src/runtime/root/controller-services.ts

@@ -1,3 +1,4 @@
+import { initializeWorkCandidateIndex } from '../../../packages/kernel/work/api/index';
 import {
   inspectControlPlaneDatabase,
   type ControlPlaneDatabaseInspection,
@@ -21,6 +22,7 @@ export class RuntimeControllerServices {
 
   initialize(): ControlPlaneDatabaseInspection {
     this.initializedDatabase = this.inspectDatabase(this.controllerHome);
+    initializeWorkCandidateIndex(this.controllerHome);
     return this.initializedDatabase;
   }
 

package/src/runtime/root/deployment-topology.ts

@@ -0,0 +1,106 @@
+export type RuntimeRemoteControllerKind = 'chatgpt' | 'mcp';
+
+export interface RuntimeDeploymentTopology {
+  schemaVersion: 1;
+  remoteControllers: RuntimeRemoteControllerKind[];
+  capabilityIntents: string[];
+  persistentRuntimeRequired: boolean;
+  components: {
+    workflowSupervisor: boolean;
+    workflowSupervisorNativeBrowser: boolean;
+  };
+}
+
+const REMOTE_CONTROLLERS = new Set<RuntimeRemoteControllerKind>(['chatgpt', 'mcp']);
+
+function normalizeCapabilityIntent(value: string): string {
+  const normalized = value.trim().toLowerCase();
+  if (!/^[-a-z0-9_.]{3,128}$/.test(normalized)) throw new Error(`RUNTIME_TOPOLOGY_CAPABILITY_INTENT_INVALID: ${value}`);
+  return normalized;
+}
+
+function normalizedRemoteControllers(values: readonly string[] | undefined): RuntimeRemoteControllerKind[] {
+  return Array.from(new Set(
+    (values ?? [])
+      .map((value) => value.trim().toLowerCase())
+      .filter((value): value is RuntimeRemoteControllerKind => REMOTE_CONTROLLERS.has(value as RuntimeRemoteControllerKind)),
+  )).sort();
+}
+
+export function deriveRuntimeDeploymentTopology(input: {
+  controllers?: readonly string[];
+  capabilityIntents?: readonly string[];
+}): RuntimeDeploymentTopology {
+  const remoteControllers = normalizedRemoteControllers(input.controllers);
+  const capabilityIntents = Array.from(new Set(
+    (input.capabilityIntents ?? []).map(normalizeCapabilityIntent),
+  )).sort();
+  const chatgpt = remoteControllers.includes('chatgpt');
+  return {
+    schemaVersion: 1,
+    remoteControllers,
+    capabilityIntents,
+    persistentRuntimeRequired: remoteControllers.length > 0,
+    components: {
+      // Requirement-level ChatGPT continuation uses Supervisor Core as its
+      // outer-turn authority. Generic remote MCP transport does not.
+      workflowSupervisor: chatgpt,
+      // ChatGPT Work has one controlled outer-turn executor: the Supervisor's
+      // Computer adapter. It owns exact-conversation delivery and its durable
+      // effect ledger; Scheduler must never fall back to direct Browser delivery.
+      workflowSupervisorNativeBrowser: chatgpt,
+    },
+  };
+}
+
+/**
+ * Missing topology means an installation predates this contract. Preserve the
+ * complete ChatGPT Supervisor composition during upgrade.
+ */
+export function legacyRuntimeDeploymentTopology(): RuntimeDeploymentTopology {
+  return deriveRuntimeDeploymentTopology({ controllers: ['chatgpt'] });
+}
+
+export function normalizeRuntimeDeploymentTopology(value: unknown): RuntimeDeploymentTopology {
+  if (value === undefined || value === null) return legacyRuntimeDeploymentTopology();
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('RUNTIME_TOPOLOGY_INVALID');
+  const record = value as Record<string, unknown>;
+  if (record.schemaVersion !== 1) throw new Error('RUNTIME_TOPOLOGY_VERSION_UNSUPPORTED');
+  if (!Array.isArray(record.remoteControllers)
+    || record.remoteControllers.some((entry) => typeof entry !== 'string' || !REMOTE_CONTROLLERS.has(entry as RuntimeRemoteControllerKind))) {
+    throw new Error('RUNTIME_TOPOLOGY_REMOTE_CONTROLLERS_INVALID');
+  }
+  if (!Array.isArray(record.capabilityIntents)
+    || record.capabilityIntents.some((entry) => typeof entry !== 'string')) {
+    throw new Error('RUNTIME_TOPOLOGY_CAPABILITY_INTENTS_INVALID');
+  }
+  const remoteControllers = normalizedRemoteControllers(record.remoteControllers as string[]);
+  const capabilityIntents = Array.from(new Set(
+    (record.capabilityIntents as string[]).map(normalizeCapabilityIntent),
+  )).sort();
+  const canonical = deriveRuntimeDeploymentTopology({ controllers: remoteControllers, capabilityIntents });
+  const components = record.components;
+  if (!components || typeof components !== 'object' || Array.isArray(components)) throw new Error('RUNTIME_TOPOLOGY_COMPONENTS_REQUIRED');
+  const componentRecord = components as Record<string, unknown>;
+  if (typeof componentRecord.workflowSupervisor !== 'boolean'
+    || typeof componentRecord.workflowSupervisorNativeBrowser !== 'boolean') {
+    throw new Error('RUNTIME_TOPOLOGY_COMPONENTS_INVALID');
+  }
+  if (componentRecord.workflowSupervisor !== canonical.components.workflowSupervisor
+    || record.persistentRuntimeRequired !== canonical.persistentRuntimeRequired) {
+    throw new Error('RUNTIME_TOPOLOGY_DERIVATION_MISMATCH');
+  }
+  // The flag is derived, so stale persisted topology cannot disable the sole
+  // autonomous delivery owner or reintroduce an alternate Browser path.
+  return canonical;
+}
+
+export function parseRuntimeDeploymentTopologyArgument(value: string | undefined): RuntimeDeploymentTopology {
+  if (!value?.trim()) return legacyRuntimeDeploymentTopology();
+  try {
+    return normalizeRuntimeDeploymentTopology(JSON.parse(value));
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`RUNTIME_TOPOLOGY_ARGUMENT_INVALID: ${detail}`);
+  }
+}

package/src/runtime/root/entry.ts

@@ -3,15 +3,16 @@ import { resolve } from 'path';
 import { pathToFileURL } from 'url';
 import { Command } from 'commander';
 import { CanonicalForgeRuntime } from './runtime';
+import { parseRuntimeDeploymentTopologyArgument } from './deployment-topology';
 
 interface CliOptions {
   controllerHome: string;
-  repo: string;
+  repo?: string;
   releaseManifest: string;
   host: string;
   port: string;
   authTokenFile: string;
-  exclusiveWorkId?: string;
+  deploymentTopology?: string;
 }
 
 function readAuthToken(path: string): string {
@@ -24,28 +25,29 @@ export async function runCanonicalRuntimeCli(argv = process.argv): Promise<void>
   const command = new Command('forge-runtime')
     .description('Run the canonical single Forge Runtime root process')
     .requiredOption('--controller-home <path>', 'Explicit Controller Home')
-    .requiredOption('--repo <path>', 'Explicit repository root')
+    .option('--repo <path>', 'Optional default repository root for development/repository UI')
     .requiredOption('--release-manifest <path>', 'Complete immutable release manifest')
     .requiredOption('--host <host>', 'MCP listener host')
     .requiredOption('--port <port>', 'MCP listener port')
     .requiredOption('--auth-token-file <path>', 'Bearer token file')
-    .option('--exclusive-work-id <id>', 'Persistently admit only this P0 Work while migration is active');
+    .option('--deployment-topology <json>', 'Normalized product-level Runtime deployment topology');
   command.parse(argv);
   const options = command.opts<CliOptions>();
   const port = Number(options.port);
   if (!Number.isInteger(port) || port < 1 || port > 65_535) throw new Error('RUNTIME_CONFIG_INVALID: port');
   const runtime = new CanonicalForgeRuntime({
     controllerHome: resolve(options.controllerHome),
-    repositoryRoot: resolve(options.repo),
+    ...(options.repo?.trim() ? { repositoryRoot: resolve(options.repo) } : {}),
     releaseManifestPath: resolve(options.releaseManifest),
     host: options.host,
     port,
+    topology: parseRuntimeDeploymentTopologyArgument(options.deploymentTopology),
     authToken: readAuthToken(options.authTokenFile),
-    exclusiveWorkId: options.exclusiveWorkId,
   });
   await runtime.start();
   process.stderr.write(`${JSON.stringify({
     event: 'forge_runtime_started',
+    forgeInstanceId: runtime.forgeInstanceId,
     runtimeInstanceId: runtime.runtimeInstanceId,
     endpoint: runtime.endpoint(),
     readiness: runtime.readiness(),

package/src/runtime/root/gateway-adapter.ts

@@ -1,6 +1,6 @@
-import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { createForgeMcpServerFromContext, createMcpToolContext } from '../../cli/mcp/server';
-import { controllerExposureSnapshot } from '../../cli/mcp/toolset';
+import type { Server } from "@modelcontextprotocol/server";
+import { createForgeMcpServerFromContext, createMcpToolContext } from '../../../adapters/mcp/server';
+import { controllerExposureSnapshot } from '../../../adapters/mcp/toolset';
 import type { RuntimeControllerServices } from './controller-services';
 
 export interface RuntimeGatewayServerOptions {

package/src/runtime/root/known-good-recovery.ts

@@ -0,0 +1,184 @@
+import { createHash } from 'crypto';
+import { closeSync, existsSync, openSync, readFileSync, readSync, realpathSync } from 'fs';
+import { basename, dirname, join, relative, resolve } from 'path';
+import { inspectControlPlaneDatabaseFile, type ControlPlaneDatabaseInspection } from '../control-plane/persistence/sqlite-store';
+import { loadRuntimeReleaseManifest } from './release-manifest';
+import { forgeRuntimeServicePaths, validateForgeRuntimeServiceConfig, type ForgeRuntimeServiceConfig } from './service';
+
+/**
+ * A Recovery-owned, bounded restore point.  The release is immutable Runtime
+ * authority; the SQLite copy and service contract are the state and bootstrap
+ * material needed to make that release useful after the Kernel is dead.
+ */
+export interface KnownGoodRecoveryBundle {
+  schemaVersion: 1;
+  attestationId: string;
+  root: string;
+  database: {
+    path: string;
+    sha256: string;
+    schemaVersion: number;
+    recordCount: number;
+    auditEventCount: number;
+  };
+  serviceContract: {
+    path: string;
+    sha256: string;
+  };
+  createdAt: string;
+}
+
+export interface KnownGoodReleaseIdentity {
+  path: string;
+  revision: string;
+  artifactIdentity: string;
+  manifestSha256: string;
+  workerProtocolVersion: number;
+  controllerHome?: string;
+  recoveryBundle?: KnownGoodRecoveryBundle;
+}
+
+export interface InspectedKnownGoodRecoveryBundle {
+  releaseRoot: string;
+  database: ControlPlaneDatabaseInspection;
+  serviceConfig: ForgeRuntimeServiceConfig;
+}
+
+const SHA256_FILE_CHUNK_BYTES = 1024 * 1024;
+
+/** Hash arbitrarily large Recovery artifacts without allocating the whole file. */
+export function sha256FileBounded(path: string): string {
+  const descriptor = openSync(path, 'r');
+  const hash = createHash('sha256');
+  const buffer = Buffer.allocUnsafe(SHA256_FILE_CHUNK_BYTES);
+  try {
+    for (;;) {
+      const bytesRead = readSync(descriptor, buffer, 0, buffer.length, null);
+      if (bytesRead === 0) break;
+      hash.update(buffer.subarray(0, bytesRead));
+    }
+    return hash.digest('hex');
+  } finally {
+    closeSync(descriptor);
+  }
+}
+
+function canonical(path: string): string {
+  try { return realpathSync(path); }
+  catch { return resolve(path); }
+}
+
+function directChild(root: string, path: string): boolean {
+  return canonical(dirname(path)) === canonical(root);
+}
+
+function inside(root: string, path: string): boolean {
+  const value = relative(canonical(root), canonical(path));
+  return value === '' || (!value.startsWith('..') && value !== '..');
+}
+
+function requiredText(value: unknown, code: string): string {
+  if (typeof value !== 'string' || !value.trim()) throw new Error(code);
+  return value.trim();
+}
+
+function requiredPositiveInteger(value: unknown, code: string): number {
+  if (!Number.isInteger(value) || Number(value) < 1) throw new Error(code);
+  return Number(value);
+}
+
+function validateRecoveryBundleShape(entry: KnownGoodReleaseIdentity, controllerHome: string): KnownGoodRecoveryBundle {
+  const bundle = entry.recoveryBundle;
+  if (!bundle || bundle.schemaVersion !== 1) throw new Error('KNOWN_GOOD_RECOVERY_BUNDLE_MISSING');
+  const home = resolve(controllerHome);
+  const root = resolve(bundle.root);
+  const expectedBundlesRoot = resolve(home, 'recovery', 'bundles', 'known-good');
+  const attestationId = requiredText(bundle.attestationId, 'KNOWN_GOOD_RECOVERY_BUNDLE_ID_INVALID');
+  if (basename(root) !== attestationId || !directChild(expectedBundlesRoot, root)) {
+    throw new Error('KNOWN_GOOD_RECOVERY_BUNDLE_OUTSIDE_AUTHORITY');
+  }
+  if (!/^[-a-zA-Z0-9_]{8,160}$/.test(attestationId)) throw new Error('KNOWN_GOOD_RECOVERY_BUNDLE_ID_INVALID');
+  if (!inside(root, bundle.database.path) || basename(resolve(bundle.database.path)) !== 'controller.sqlite') {
+    throw new Error('KNOWN_GOOD_RECOVERY_DATABASE_PATH_INVALID');
+  }
+  if (!inside(root, bundle.serviceContract.path) || basename(resolve(bundle.serviceContract.path)) !== 'service-contract.json') {
+    throw new Error('KNOWN_GOOD_RECOVERY_SERVICE_CONTRACT_PATH_INVALID');
+  }
+  requiredText(bundle.database.sha256, 'KNOWN_GOOD_RECOVERY_DATABASE_HASH_INVALID');
+  requiredText(bundle.serviceContract.sha256, 'KNOWN_GOOD_RECOVERY_SERVICE_CONTRACT_HASH_INVALID');
+  requiredPositiveInteger(bundle.database.schemaVersion, 'KNOWN_GOOD_RECOVERY_DATABASE_SCHEMA_INVALID');
+  return {
+    ...bundle,
+    attestationId,
+    root,
+    database: { ...bundle.database, path: resolve(bundle.database.path) },
+    serviceContract: { ...bundle.serviceContract, path: resolve(bundle.serviceContract.path) },
+  };
+}
+
+/**
+ * Validate the exact three-way restore invariant used by both Recovery and
+ * release retention.  Legacy evidence without a Recovery bundle is historical
+ * audit data only: it must never be promoted to recoverable authority.
+ */
+export function inspectKnownGoodRecoveryBundle(
+  controllerHome: string,
+  entry: KnownGoodReleaseIdentity,
+): InspectedKnownGoodRecoveryBundle {
+  const home = resolve(controllerHome);
+  if (entry.controllerHome && canonical(entry.controllerHome) !== canonical(home)) {
+    throw new Error('KNOWN_GOOD_RECOVERY_CONTROLLER_HOME_MISMATCH');
+  }
+  const manifestPath = resolve(requiredText(entry.path, 'KNOWN_GOOD_RELEASE_MANIFEST_PATH_INVALID'));
+  const releasesRoot = resolve(home, 'runtime', 'releases');
+  const releaseRoot = dirname(manifestPath);
+  if (
+    basename(manifestPath) !== 'manifest.json'
+    || basename(releaseRoot) !== entry.revision
+    || !directChild(releasesRoot, releaseRoot)
+    || !existsSync(manifestPath)
+  ) throw new Error('KNOWN_GOOD_RELEASE_OUTSIDE_AUTHORITY');
+  const manifest = loadRuntimeReleaseManifest(manifestPath, home);
+  if (
+    manifest.releaseId !== entry.revision
+    || manifest.artifactIdentity !== entry.artifactIdentity
+    || manifest.workerProtocolVersion !== entry.workerProtocolVersion
+    || sha256FileBounded(manifestPath) !== entry.manifestSha256
+  ) throw new Error('KNOWN_GOOD_RELEASE_IDENTITY_MISMATCH');
+
+  const bundle = validateRecoveryBundleShape(entry, home);
+  if (!existsSync(bundle.database.path)) throw new Error('KNOWN_GOOD_RECOVERY_DATABASE_MISSING');
+  if (sha256FileBounded(bundle.database.path) !== bundle.database.sha256) throw new Error('KNOWN_GOOD_RECOVERY_DATABASE_HASH_MISMATCH');
+  const database = inspectControlPlaneDatabaseFile(bundle.database.path);
+  if (
+    database.schemaVersion !== bundle.database.schemaVersion
+    || database.recordCount !== bundle.database.recordCount
+    || database.auditEventCount !== bundle.database.auditEventCount
+  ) throw new Error('KNOWN_GOOD_RECOVERY_DATABASE_INSPECTION_MISMATCH');
+
+  if (!existsSync(bundle.serviceContract.path)) throw new Error('KNOWN_GOOD_RECOVERY_SERVICE_CONTRACT_MISSING');
+  if (sha256FileBounded(bundle.serviceContract.path) !== bundle.serviceContract.sha256) {
+    throw new Error('KNOWN_GOOD_RECOVERY_SERVICE_CONTRACT_HASH_MISMATCH');
+  }
+  let rawContract: unknown;
+  try { rawContract = JSON.parse(readFileSync(bundle.serviceContract.path, 'utf8')); }
+  catch { throw new Error('KNOWN_GOOD_RECOVERY_SERVICE_CONTRACT_INVALID'); }
+  if (!rawContract || typeof rawContract !== 'object' || Array.isArray(rawContract)) {
+    throw new Error('KNOWN_GOOD_RECOVERY_SERVICE_CONTRACT_INVALID');
+  }
+  const contract = rawContract as Record<string, unknown>;
+  if (contract.schemaVersion !== 1 || !contract.serviceConfig || typeof contract.serviceConfig !== 'object' || Array.isArray(contract.serviceConfig)) {
+    throw new Error('KNOWN_GOOD_RECOVERY_SERVICE_CONTRACT_INVALID');
+  }
+  const serviceConfig = validateForgeRuntimeServiceConfig(contract.serviceConfig as ForgeRuntimeServiceConfig);
+  if (canonical(serviceConfig.controllerHome) !== canonical(home)) throw new Error('KNOWN_GOOD_RECOVERY_SERVICE_HOME_MISMATCH');
+  const expectedConfigPath = forgeRuntimeServicePaths(home).configPath;
+  if (canonical(requiredText(contract.configPath, 'KNOWN_GOOD_RECOVERY_SERVICE_PATH_INVALID')) !== canonical(expectedConfigPath)) {
+    throw new Error('KNOWN_GOOD_RECOVERY_SERVICE_PATH_INVALID');
+  }
+  return { releaseRoot, database, serviceConfig };
+}
+
+export function knownGoodRecoveryBundleRoot(controllerHome: string): string {
+  return join(resolve(controllerHome), 'recovery', 'bundles', 'known-good');
+}

package/src/runtime/root/local-bridge.ts

@@ -2,7 +2,7 @@ import {
   loadMcpServiceLocalConfig,
   loadMcpServiceRuntimeState,
   writeMcpServiceRuntimeState,
-} from '../../cli/mcp/auth';
+} from '../../../adapters/mcp/auth';
 import { startLocalBridgeServer } from '../../cli/local-bridge/server';
 import { readRuntimeGeneration } from '../control-plane/runtime-generation';
 
@@ -18,13 +18,16 @@ export interface RuntimeLocalBridgeHandle {
  */
 export async function startConfiguredRuntimeLocalBridge(input: {
   controllerHome: string;
-  repositoryRoot: string;
+  repositoryRoot?: string;
 }): Promise<RuntimeLocalBridgeHandle | undefined> {
   const config = loadMcpServiceLocalConfig(input.controllerHome);
   const local = config?.localController;
   if (local?.enabled !== true || local.mode === 'disabled' || local.mode === 'remote' || local.mode === 'standalone') {
     return undefined;
   }
+  // Embedded Local Bridge remains repository-oriented today. Do not invent a
+  // package/source directory as a fake repository merely to start the Runtime.
+  if (!input.repositoryRoot?.trim()) return undefined;
 
   const startedAt = new Date().toISOString();
   const handle = await startLocalBridgeServer({
@@ -32,7 +35,6 @@ export async function startConfiguredRuntimeLocalBridge(input: {
     controllerHome: input.controllerHome,
     host: local.host ?? '127.0.0.1',
     port: local.port ?? 8766,
-    openBrowser: local.autoOpen === true,
     mode: 'embedded',
   });
   const generation = readRuntimeGeneration(input.controllerHome)?.generation;