@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/root/write-fence.ts

@@ -1,7 +1,7 @@
 import { resolve } from 'path';
 import { resolveControllerHome } from '../../cli/repositories/controller-home';
 import { isProcessAlive } from '../shared/process-tree';
-import { readRuntimeOwner, type RuntimeOwnerRecord } from './ownership';
+import { readRuntimeIncarnation, readRuntimeOwner, type RuntimeOwnerRecord } from './ownership';
 import {
   readRuntimeReleaseAuthority,
   type RuntimeReleaseAuthority,
@@ -29,6 +29,7 @@ export type RuntimeWriteAction = (typeof RUNTIME_WRITE_ACTIONS)[number];
 export interface RuntimeWriteClaim {
   controllerHome: string;
   runtimeInstanceId: string;
+  fencingGeneration: number;
   ownerPid: number;
   releaseAuthorityRevision: number;
   releaseFencingToken: string;
@@ -50,6 +51,7 @@ export interface RuntimeWriteFenceCheck {
 export const RUNTIME_WRITE_CLAIM_ENV = {
   controllerHome: 'FORGE_CONTROLLER_HOME',
   runtimeInstanceId: 'FORGE_RUNTIME_INSTANCE_ID',
+  fencingGeneration: 'FORGE_RUNTIME_INCARNATION_GENERATION',
   ownerPid: 'FORGE_RUNTIME_OWNER_PID',
   releaseAuthorityRevision: 'FORGE_RELEASE_AUTHORITY_REVISION',
   releaseFencingToken: 'FORGE_RELEASE_FENCING_TOKEN',
@@ -75,6 +77,7 @@ function claimFromAuthority(
   return {
     controllerHome: resolveControllerHome(controllerHome),
     runtimeInstanceId: owner.runtimeInstanceId,
+    fencingGeneration: owner.fencingGeneration ?? 0,
     ownerPid: owner.pid,
     releaseAuthorityRevision: authority.revision,
     releaseFencingToken: authority.fencingToken,
@@ -85,11 +88,22 @@ function claimFromAuthority(
   };
 }
 
+export function currentRuntimeWriteClaimEnvironment(controllerHome: string): Record<string, string> {
+  const home = resolveControllerHome(controllerHome);
+  const owner = readRuntimeOwner(home);
+  const authority = readRuntimeReleaseAuthority(home);
+  if (!owner || !authority) {
+    throw new Error('RUNTIME_WRITE_CLAIM_BIND_FAILED: Runtime owner or release authority is missing');
+  }
+  return runtimeWriteClaimEnvironment(claimFromAuthority(home, owner, authority));
+}
+
 export function runtimeWriteClaimEnvironment(claim: RuntimeWriteClaim): Record<string, string> {
   if (claim.unmanaged) return {};
   return {
     [RUNTIME_WRITE_CLAIM_ENV.controllerHome]: claim.controllerHome,
     [RUNTIME_WRITE_CLAIM_ENV.runtimeInstanceId]: claim.runtimeInstanceId,
+    [RUNTIME_WRITE_CLAIM_ENV.fencingGeneration]: String(claim.fencingGeneration),
     [RUNTIME_WRITE_CLAIM_ENV.ownerPid]: String(claim.ownerPid),
     [RUNTIME_WRITE_CLAIM_ENV.releaseAuthorityRevision]: String(claim.releaseAuthorityRevision),
     [RUNTIME_WRITE_CLAIM_ENV.releaseFencingToken]: claim.releaseFencingToken,
@@ -130,6 +144,7 @@ export const clearRuntimeWriteClaimForTests = clearRuntimeWriteClaim;
 export function bindRuntimeWriteClaim(input: {
   controllerHome: string;
   runtimeInstanceId?: string;
+  fencingGeneration?: number;
   ownerPid?: number;
   releaseAuthorityRevision?: number;
   releaseFencingToken?: string;
@@ -146,6 +161,7 @@ export function bindRuntimeWriteClaim(input: {
 
   const explicit = {
     runtimeInstanceId: input.runtimeInstanceId?.trim(),
+    fencingGeneration: input.fencingGeneration,
     ownerPid: input.ownerPid,
     releaseAuthorityRevision: input.releaseAuthorityRevision,
     releaseFencingToken: input.releaseFencingToken?.trim(),
@@ -157,6 +173,7 @@ export function bindRuntimeWriteClaim(input: {
   const hasAnyExplicit = explicitValues.some((value) => value !== undefined && value !== '');
   const hasFullExplicit = Boolean(
     explicit.runtimeInstanceId
+    && Number.isInteger(explicit.fencingGeneration) && explicit.fencingGeneration! > 0
     && Number.isInteger(explicit.ownerPid) && explicit.ownerPid! > 0
     && Number.isInteger(explicit.releaseAuthorityRevision) && explicit.releaseAuthorityRevision! > 0
     && explicit.releaseFencingToken
@@ -169,6 +186,7 @@ export function bindRuntimeWriteClaim(input: {
     return installClaim({
       controllerHome: home,
       runtimeInstanceId: explicit.runtimeInstanceId!,
+      fencingGeneration: explicit.fencingGeneration!,
       ownerPid: explicit.ownerPid!,
       releaseAuthorityRevision: explicit.releaseAuthorityRevision!,
       releaseFencingToken: explicit.releaseFencingToken!,
@@ -190,6 +208,7 @@ export function bindRuntimeWriteClaim(input: {
     return installClaim({
       controllerHome: home,
       runtimeInstanceId: `unmanaged-${process.pid}`,
+      fencingGeneration: 0,
       ownerPid: process.pid,
       releaseAuthorityRevision: 0,
       releaseFencingToken: 'unmanaged',
@@ -220,6 +239,7 @@ export function bindInheritedRuntimeWriteClaimFromEnvironment(
   return bindRuntimeWriteClaim({
     controllerHome,
     runtimeInstanceId,
+    fencingGeneration: positiveInteger(env[RUNTIME_WRITE_CLAIM_ENV.fencingGeneration]),
     ownerPid: positiveInteger(env[RUNTIME_WRITE_CLAIM_ENV.ownerPid]),
     releaseAuthorityRevision: positiveInteger(env[RUNTIME_WRITE_CLAIM_ENV.releaseAuthorityRevision]),
     releaseFencingToken: env[RUNTIME_WRITE_CLAIM_ENV.releaseFencingToken]?.trim(),
@@ -256,6 +276,7 @@ export function assertRuntimeMayWrite(
   const home = explicitHome ?? claim?.controllerHome;
   if (!home) return { allowed: true, reason: 'unbound_no_controller_home' };
   const owner = readRuntimeOwner(home);
+  const incarnation = readRuntimeIncarnation(home);
   const authority = readRuntimeReleaseAuthority(home);
   if (!claim) {
     if (!owner && !authority) return { allowed: true, reason: 'unbound_no_runtime_authority' };
@@ -276,9 +297,18 @@ export function assertRuntimeMayWrite(
   }
   if (!owner) return { allowed: false, reason: 'runtime_owner_missing', authority };
   if (!isProcessAlive(owner.pid)) return { allowed: false, reason: 'runtime_owner_dead', owner, authority };
+  if (!incarnation) return { allowed: false, reason: 'runtime_incarnation_missing', owner, authority };
+  if (
+    incarnation.runtimeInstanceId !== owner.runtimeInstanceId
+    || incarnation.pid !== owner.pid
+    || incarnation.fencingGeneration !== (owner.fencingGeneration ?? 0)
+  ) return { allowed: false, reason: 'runtime_incarnation_authority_mismatch', owner, authority };
   if (owner.runtimeInstanceId !== claim.runtimeInstanceId) {
     return { allowed: false, reason: 'runtime_instance_fenced', owner, authority };
   }
+  if (incarnation.fencingGeneration !== claim.fencingGeneration) {
+    return { allowed: false, reason: 'runtime_incarnation_generation_fenced', owner, authority };
+  }
   if (owner.pid !== claim.ownerPid) return { allowed: false, reason: 'runtime_owner_pid_fenced', owner, authority };
   if (!authority) return { allowed: false, reason: 'runtime_release_authority_missing', owner };
   if (authority.revision !== claim.releaseAuthorityRevision) {
@@ -299,11 +329,29 @@ export function assertRuntimeMayWrite(
   return { allowed: true, owner, authority };
 }
 
+export class RuntimeWriteFenceError extends Error {
+  readonly code = 'WRITER_FENCED' as const;
+
+  constructor(
+    readonly action: RuntimeWriteAction,
+    readonly reason: string,
+  ) {
+    super(`WRITER_FENCED:${action}:${reason}`);
+    this.name = 'RuntimeWriteFenceError';
+  }
+}
+
+export function isRuntimeWriteFenceError(error: unknown): error is RuntimeWriteFenceError {
+  return Boolean(error
+    && typeof error === 'object'
+    && (error as { code?: unknown }).code === 'WRITER_FENCED');
+}
+
 export function assertRuntimeMayWriteOrThrow(
   action: RuntimeWriteAction,
   controllerHomeOverride?: string,
 ): RuntimeReleaseAuthority | undefined {
   const check = assertRuntimeMayWrite(action, controllerHomeOverride);
-  if (!check.allowed) throw new Error(`WRITER_FENCED:${action}:${check.reason ?? 'denied'}`);
+  if (!check.allowed) throw new RuntimeWriteFenceError(action, check.reason ?? 'denied');
   return check.authority;
 }

package/src/runtime/safe-tooling/google-credential-store.ts

@@ -1,16 +1,19 @@
 import { execFileSync } from 'child_process';
 
 export type StoredGoogleService = 'gmail' | 'calendar' | 'tasks' | 'google-workspace';
+export type StoredGoogleCredentialKind = 'refresh-token' | 'client-secret';
 
 export interface GoogleCredentialStoreAdapter {
   available(): boolean;
-  read(service: StoredGoogleService): string | undefined;
-  write(service: StoredGoogleService, refreshToken: string): void;
+  read(service: StoredGoogleService, kind?: StoredGoogleCredentialKind): string | undefined;
+  write(service: StoredGoogleService, value: string, kind?: StoredGoogleCredentialKind): void;
 }
 
 const KEYCHAIN_SERVICE_PREFIX = 'forge.google-oauth';
-const KEYCHAIN_ACCOUNT = 'refresh-token';
-const memoryCache = new Map<StoredGoogleService, string>();
+const KEYCHAIN_ACCOUNT: Record<StoredGoogleCredentialKind, string> = {
+  'refresh-token': 'refresh-token',
+  'client-secret': 'client-secret',
+};
 
 function keychainService(service: StoredGoogleService): string {
   return `${KEYCHAIN_SERVICE_PREFIX}.${service}`;
@@ -18,13 +21,13 @@ function keychainService(service: StoredGoogleService): string {
 
 const macKeychainAdapter: GoogleCredentialStoreAdapter = {
   available: () => process.platform === 'darwin',
-  read(service) {
+  read(service, kind = 'refresh-token') {
     if (process.platform !== 'darwin') return undefined;
     try {
       const value = execFileSync('/usr/bin/security', [
         'find-generic-password',
         '-s', keychainService(service),
-        '-a', KEYCHAIN_ACCOUNT,
+        '-a', KEYCHAIN_ACCOUNT[kind],
         '-w',
       ], {
         encoding: 'utf-8',
@@ -36,7 +39,7 @@ const macKeychainAdapter: GoogleCredentialStoreAdapter = {
       return undefined;
     }
   },
-  write(service, refreshToken) {
+  write(service, value, kind = 'refresh-token') {
     if (process.platform !== 'darwin') {
       throw new Error('GOOGLE_CREDENTIAL_STORE_UNAVAILABLE: macOS Keychain is required for local OAuth credential persistence');
     }
@@ -44,8 +47,8 @@ const macKeychainAdapter: GoogleCredentialStoreAdapter = {
       'add-generic-password',
       '-U',
       '-s', keychainService(service),
-      '-a', KEYCHAIN_ACCOUNT,
-      '-w', refreshToken,
+      '-a', KEYCHAIN_ACCOUNT[kind],
+      '-w', value,
     ], {
       encoding: 'utf-8',
       stdio: ['ignore', 'ignore', 'pipe'],
@@ -58,7 +61,6 @@ let adapter: GoogleCredentialStoreAdapter = macKeychainAdapter;
 
 export function setGoogleCredentialStoreAdapterForTest(next?: GoogleCredentialStoreAdapter): void {
   adapter = next ?? macKeychainAdapter;
-  memoryCache.clear();
 }
 
 export function googleCredentialStoreStatus(): Record<string, unknown> {
@@ -67,29 +69,72 @@ export function googleCredentialStoreStatus(): Record<string, unknown> {
     available: adapter.available(),
     repositoryPersistence: false,
     controllerStatePersistence: false,
+    credentialKinds: ['refresh-token', 'client-secret'],
   };
 }
 
-export function readStoredGoogleRefreshToken(service: StoredGoogleService): { token: string; source: string } | undefined {
+function readStoredGoogleCredential(
+  service: StoredGoogleService,
+  kind: StoredGoogleCredentialKind,
+): { value: string; source: string } | undefined {
   const candidates: StoredGoogleService[] = service === 'google-workspace'
     ? ['google-workspace']
     : [service, 'google-workspace'];
   for (const candidate of candidates) {
-    const cached = memoryCache.get(candidate);
-    if (cached) return { token: cached, source: `keychain:${candidate}` };
     if (!adapter.available()) continue;
-    const token = adapter.read(candidate)?.trim();
-    if (!token) continue;
-    memoryCache.set(candidate, token);
-    return { token, source: `keychain:${candidate}` };
+    // Keychain is the authority: another Forge process may have rotated this credential.
+    const value = adapter.read(candidate, kind)?.trim();
+    if (!value) continue;
+    return { value, source: `keychain:${candidate}:${kind}` };
   }
   return undefined;
 }
 
-export function writeStoredGoogleRefreshToken(service: StoredGoogleService, refreshToken: string): void {
-  const token = refreshToken.trim();
-  if (!token) throw new Error('GOOGLE_REFRESH_TOKEN_REQUIRED');
+function writeStoredGoogleCredential(service: StoredGoogleService, kind: StoredGoogleCredentialKind, value: string): void {
+  const normalized = value.trim();
+  if (!normalized) throw new Error(kind === 'refresh-token' ? 'GOOGLE_REFRESH_TOKEN_REQUIRED' : 'GOOGLE_CLIENT_SECRET_REQUIRED');
   if (!adapter.available()) throw new Error('GOOGLE_CREDENTIAL_STORE_UNAVAILABLE');
-  adapter.write(service, token);
-  memoryCache.set(service, token);
+  adapter.write(service, normalized, kind);
+}
+
+export function readStoredGoogleRefreshToken(service: StoredGoogleService): { token: string; source: string } | undefined {
+  const stored = readStoredGoogleCredential(service, 'refresh-token');
+  return stored ? { token: stored.value, source: stored.source } : undefined;
+}
+
+export function writeStoredGoogleRefreshToken(service: StoredGoogleService, refreshToken: string): void {
+  writeStoredGoogleCredential(service, 'refresh-token', refreshToken);
+}
+
+export function readStoredGoogleClientSecret(service: StoredGoogleService): { secret: string; source: string } | undefined {
+  const stored = readStoredGoogleCredential(service, 'client-secret');
+  return stored ? { secret: stored.value, source: stored.source } : undefined;
+}
+
+export function writeStoredGoogleClientSecret(service: StoredGoogleService, clientSecret: string): void {
+  writeStoredGoogleCredential(service, 'client-secret', clientSecret);
+}
+
+export function importStoredGoogleClientSecretFromClipboard(service: StoredGoogleService): Record<string, unknown> {
+  if (process.platform !== 'darwin' || !adapter.available()) throw new Error('GOOGLE_CREDENTIAL_STORE_UNAVAILABLE');
+  const secret = execFileSync('/usr/bin/pbpaste', [], {
+    encoding: 'utf-8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+    timeout: 2_000,
+  }).trim();
+  if (!secret || secret.length > 1024 || /\s/.test(secret)) throw new Error('GOOGLE_CLIENT_SECRET_CLIPBOARD_INVALID');
+  writeStoredGoogleClientSecret(service, secret);
+  execFileSync('/usr/bin/pbcopy', [], {
+    encoding: 'utf-8',
+    input: '',
+    stdio: ['pipe', 'ignore', 'ignore'],
+    timeout: 2_000,
+  });
+  return {
+    stored: true,
+    service,
+    backend: 'macos-keychain',
+    clipboardCleared: true,
+    credentialMaterialReturned: false,
+  };
 }

package/src/runtime/safe-tooling/google-oauth-broker.ts

@@ -5,6 +5,7 @@ import { URLSearchParams } from 'url';
 import { installGoogleAccessToken } from '../plugins/google-shared';
 import {
   googleCredentialStoreStatus,
+  readStoredGoogleClientSecret,
   type StoredGoogleService,
   writeStoredGoogleRefreshToken,
 } from './google-credential-store';
@@ -138,16 +139,33 @@ function base64Url(value: Buffer): string {
   return value.toString('base64url');
 }
 
-function clientId(): string | undefined {
-  return process.env.FORGE_GOOGLE_WORKSPACE_CLIENT_ID?.trim()
+function clientId(service: GoogleOAuthService): string | undefined {
+  const serviceSpecific = service === 'gmail'
+    ? process.env.FORGE_GMAIL_CLIENT_ID?.trim()
+    : service === 'calendar'
+      ? process.env.FORGE_GOOGLE_CALENDAR_CLIENT_ID?.trim()
+      : service === 'tasks'
+        ? process.env.FORGE_GOOGLE_TASKS_CLIENT_ID?.trim()
+        : undefined;
+  return serviceSpecific
+    || process.env.FORGE_GOOGLE_WORKSPACE_CLIENT_ID?.trim()
     || process.env.FORGE_GOOGLE_CLIENT_ID?.trim()
     || process.env.GOOGLE_CLIENT_ID?.trim();
 }
 
-function clientSecret(): string | undefined {
-  return process.env.FORGE_GOOGLE_WORKSPACE_CLIENT_SECRET?.trim()
+function clientSecret(service: GoogleOAuthService): string | undefined {
+  const serviceSpecific = service === 'gmail'
+    ? process.env.FORGE_GMAIL_CLIENT_SECRET?.trim()
+    : service === 'calendar'
+      ? process.env.FORGE_GOOGLE_CALENDAR_CLIENT_SECRET?.trim()
+      : service === 'tasks'
+        ? process.env.FORGE_GOOGLE_TASKS_CLIENT_SECRET?.trim()
+        : undefined;
+  return serviceSpecific
+    || process.env.FORGE_GOOGLE_WORKSPACE_CLIENT_SECRET?.trim()
     || process.env.FORGE_GOOGLE_CLIENT_SECRET?.trim()
-    || process.env.GOOGLE_CLIENT_SECRET?.trim();
+    || process.env.GOOGLE_CLIENT_SECRET?.trim()
+    || readStoredGoogleClientSecret(service)?.secret;
 }
 
 export function prepareGoogleOAuthLogin(
@@ -157,7 +175,7 @@ export function prepareGoogleOAuthLogin(
   pruneOAuthRequests(controllerHome);
   const redirectUri = validateRedirectUri(input.redirectUri);
   const scopes = validateScopes(input.service, input.scopes);
-  const configuredClientId = clientId();
+  const configuredClientId = clientId(input.service);
   if (!configuredClientId) {
     return {
       schemaVersion: 1,
@@ -236,7 +254,7 @@ export async function completeGoogleOAuthLogin(
   }
   const code = input.code?.trim();
   if (!code) throw new Error('GOOGLE_OAUTH_CODE_REQUIRED');
-  const configuredSecret = clientSecret();
+  const configuredSecret = clientSecret(selected.record.service);
   if (!configuredSecret) throw new Error('GOOGLE_OAUTH_CLIENT_SECRET_REQUIRED');
   const body = new URLSearchParams({
     grant_type: 'authorization_code',

package/src/runtime/safe-tooling/ios-development.ts

@@ -1,5 +1,5 @@
 import { createHash } from 'crypto';
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, utimesSync, writeFileSync } from 'fs';
 import { basename, dirname, join, relative, resolve, sep } from 'path';
 import { spawnSync } from 'child_process';
 import type { RepositoryRecord } from '../../cli/repositories/types';
@@ -155,13 +155,26 @@ function sanitize(value: string): string {
 
 function stableBuildDerivedDataPath(
   repository: RepositoryRecord,
-  input: { workspace?: string; project?: string; scheme: string; configuration: string; destination: string },
+  input: { workspace?: string; project?: string; scheme: string; configuration: string; destinationPlatform: 'ios_simulator' | 'ios' },
 ): string {
-  const identity = JSON.stringify([input.workspace ?? '', input.project ?? '', input.scheme, input.configuration, input.destination]);
+  const identity = JSON.stringify([input.workspace ?? '', input.project ?? '', input.scheme, input.configuration, input.destinationPlatform]);
   const digest = createHash('sha256').update(identity).digest('hex').slice(0, 16);
   return join(safeArtifactDir(repository, 'DerivedData'), `build-${sanitize(input.scheme)}-${digest}`);
 }
 
+// Xcode owns invalidation within this checkout-local, platform/configuration bucket.
+// Device identity and test selectors affect execution, not the reusable build cache.
+function runCachedXcodeCommand(repository: RepositoryRecord, derivedDataPath: string, args: string[], timeoutMs: number): IosCommandResult {
+  const touch = (): void => { const usedAt = now(); utimesSync(derivedDataPath, usedAt, usedAt); };
+  touch();
+  try {
+    return runCommand('xcodebuild', args, { cwd: repository.canonicalRoot, timeoutMs });
+  } finally {
+    // Reuse may only modify descendants; keep last-use grace on the bucket itself.
+    touch();
+  }
+}
+
 function boundedText(value: string, maxBytes = 20_000): { content: string; truncated: boolean } {
   const buffer = Buffer.from(value, 'utf-8');
   if (buffer.byteLength <= maxBytes) return { content: value, truncated: false };
@@ -427,7 +440,7 @@ export function iosAppBuild(repository: RepositoryRecord, input: {
     : udid
       ? `platform=iOS Simulator,id=${udid}`
       : `platform=iOS Simulator,name=${input.simulatorName ?? 'iPhone 16 Pro'}`;
-  const derivedDataPath = stableBuildDerivedDataPath(repository, { workspace, project, scheme, configuration, destination });
+  const derivedDataPath = stableBuildDerivedDataPath(repository, { workspace, project, scheme, configuration, destinationPlatform });
   const derivedDataReused = existsSync(derivedDataPath);
   mkdirSync(derivedDataPath, { recursive: true });
   const priorBuiltApps = derivedDataReused ? findBuiltApps(repository, derivedDataPath) : [];
@@ -445,7 +458,7 @@ export function iosAppBuild(repository: RepositoryRecord, input: {
       '-authenticationKeyIssuerID', authentication.issuerId,
     );
   }
-  const result = runCommand('xcodebuild', args, { cwd: repository.canonicalRoot, timeoutMs: input.timeoutMs ?? 10 * 60_000 });
+  const result = runCachedXcodeCommand(repository, derivedDataPath, args, input.timeoutMs ?? 10 * 60_000);
   const sensitiveValues = authentication
     ? [authentication.privateKeyPath, authentication.keyId, authentication.issuerId]
     : [];
@@ -509,8 +522,9 @@ export function iosXcodeTest(repository: RepositoryRecord, input: {
   if (!scheme) throw new Error('IOS_SCHEME_REQUIRED: provide scheme or share at least one Xcode scheme');
   const workspace = safeRepoRelativePath(repository.canonicalRoot, input.workspace ?? listedReady.workspace);
   const project = safeRepoRelativePath(repository.canonicalRoot, input.project ?? listedReady.project);
-  const derivedDataPath = join(safeArtifactDir(repository, 'DerivedData'), `tests-${sanitize(scheme)}`);
-  const resultBundlePath = join(safeArtifactDir(repository, 'test-results'), `${timestamp()}-${sanitize(scheme)}.xcresult`);
+  const configuration = input.configuration ?? 'Debug';
+  const derivedDataPath = stableBuildDerivedDataPath(repository, { workspace, project, scheme, configuration, destinationPlatform: 'ios_simulator' });
+  const resultBundlePath = join(safeArtifactDir(repository, 'test-results'), `${artifactStamp()}-${sanitize(scheme)}.xcresult`);
   mkdirSync(derivedDataPath, { recursive: true });
   const args = ['test'];
   if (workspace) args.push('-workspace', workspace);
@@ -531,7 +545,7 @@ export function iosXcodeTest(repository: RepositoryRecord, input: {
     if (normalized) args.push(`-only-testing:${normalized}`);
   }
   args.push('-derivedDataPath', derivedDataPath, '-resultBundlePath', resultBundlePath);
-  const result = runCommand('xcodebuild', args, { cwd: repository.canonicalRoot, timeoutMs: input.timeoutMs ?? 15 * 60_000 });
+  const result = runCachedXcodeCommand(repository, derivedDataPath, args, input.timeoutMs ?? 15 * 60_000);
   return {
     ready: result.ok,
     ok: result.ok,

package/src/runtime/safe-tooling/job-summary.ts

@@ -1,4 +1,4 @@
-import { redactMcpText } from '../../cli/mcp/redaction';
+import { redactMcpText } from '../../../adapters/mcp/redaction';
 import type { ExecutionJob } from '../execution/jobs/types';
 import { buildJobOperationDigest } from '../control-plane/facade/operation-digest';
 import {

package/src/runtime/safe-tooling/workspace-auth.ts

@@ -56,6 +56,7 @@ function pluginAuthSummary(manifest: AssistantPluginManifest): Record<string, un
     lifecycleReason: manifest.lifecycle.reason,
     healthState: manifest.health.state,
     ready: manifest.health.ready,
+    readinessMode: manifest.health.details?.readinessMode,
     authRequired: manifest.health.errors.some((error) => /access token|auth|authorization|oauth/i.test(error)),
     errors: manifest.health.errors.slice(0, 5),
     warnings: manifest.health.warnings.slice(0, 5),
@@ -74,7 +75,9 @@ export function buildWorkspaceAuthStatus(manifests: AssistantPluginManifest[]):
     actionRequired: summaries.filter((entry) => entry.authRequired === true || entry.ready !== true).map((entry) => ({
       pluginId: entry.pluginId,
       reason: entry.lifecycleReason,
-      next: 'Call workspace_auth_login_prepare and open the returned local OAuth URL. The callback stores the refresh token in macOS Keychain.',
+      next: entry.readinessMode === 'live_token_unverified'
+        ? 'Run a read-only provider action. If Google requires client_secret, restore the matching OAuth client secret in macOS Keychain; if it cannot be recovered, configure a dedicated OAuth client ID and matching secret, then reauthorize.'
+        : 'Call workspace_auth_login_prepare and open the returned local OAuth URL. The callback stores the refresh token in macOS Keychain.',
     })),
     safety: {
       credentialMaterialReturned: false,
@@ -88,10 +91,10 @@ export function prepareWorkspaceAuthLogin(
   controllerHomeOrInput: string | WorkspaceAuthLoginInput = {},
   maybeInput: WorkspaceAuthLoginInput = {},
 ): Record<string, unknown> {
-  bootstrapManagedRuntimeEnv();
   const controllerHome = typeof controllerHomeOrInput === 'string'
     ? controllerHomeOrInput
     : process.env.FORGE_CONTROLLER_HOME?.trim() || process.cwd();
+  bootstrapManagedRuntimeEnv({ controllerHome });
   const input = typeof controllerHomeOrInput === 'string' ? maybeInput : controllerHomeOrInput;
   const service = normalizeService(input.service);
   const redirectUri = input.redirectUri || process.env.FORGE_GOOGLE_REDIRECT_URI || 'http://127.0.0.1:8766/oauth/google/callback';

package/src/runtime/shared/atomic-text-file.ts

@@ -0,0 +1,21 @@
+import { randomUUID } from 'crypto';
+import { mkdirSync, renameSync, rmSync, writeFileSync } from 'fs';
+import { dirname } from 'path';
+
+/**
+ * The single atomic text writer for Forge-managed service and release files.
+ * Create private parent directories, use a collision-resistant temporary file,
+ * preserve the caller-selected target mode, and remove abandoned temp files
+ * after a failed write or rename. An atomic rename is not an fsync guarantee.
+ */
+export function writeAtomicTextFile(path: string, content: string, mode = 0o600): void {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temporary, content, { encoding: 'utf8', mode, flag: 'wx' });
+    renameSync(temporary, path);
+  } catch (error) {
+    try { rmSync(temporary, { force: true }); } catch { /* preserve original write failure */ }
+    throw error;
+  }
+}

package/src/runtime/shared/bounded-child-supervisor.ts

@@ -39,6 +39,8 @@ export interface BoundedChildRunOptions {
   env?: NodeJS.ProcessEnv;
   timeoutMs: number;
   maxOutputBytes?: number;
+  /** Optional bounded stdin payload for request/response sidecars. */
+  input?: string | Buffer;
   stdio?: 'capture' | 'inherit';
   forwardSignals?: boolean;
   onSpawn?: (pid: number) => void;
@@ -120,7 +122,7 @@ export async function runBoundedChild(
   const maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
   const stdio: StdioOptions = options.stdio === 'inherit'
     ? ['ignore', 'inherit', 'inherit']
-    : ['ignore', 'pipe', 'pipe'];
+    : [options.input === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'];
   let child: ChildProcess;
   try {
     child = spawn(command, [...args], {
@@ -147,6 +149,12 @@ export async function runBoundedChild(
 
   const pid = child.pid;
   if (pid) options.onSpawn?.(pid);
+  if (options.input !== undefined && child.stdin) {
+    // A canary or validation failure may close stdin before the parent writes.
+    // The child outcome is authoritative; a late EPIPE must not crash the host.
+    child.stdin.on('error', () => undefined);
+    child.stdin.end(options.input);
+  }
   let stdout = '';
   let stderr = '';
   child.stdout?.on('data', (chunk) => { stdout = appendBounded(stdout, chunk, maxOutputBytes); });

package/src/runtime/shared/json-files.ts

@@ -16,11 +16,16 @@ export function readJsonFile<T>(path: string, fallback?: T): T {
   }
 }
 
-export function writeJsonAtomic(path: string, value: unknown): void {
+export function writeJsonAtomic(path: string, value: unknown, options?: { mode?: number }): void {
   ensureParent(path);
   const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
-  renameSync(temporary, path);
+  try {
+    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', ...(options?.mode === undefined ? {} : { mode: options.mode }) });
+    renameSync(temporary, path);
+  } catch (error) {
+    rmSync(temporary, { force: true });
+    throw error;
+  }
 }
 
 export function appendJsonLine(path: string, value: unknown): void {

package/src/runtime/shared/process-environment.ts

@@ -22,11 +22,30 @@ const RUNTIME_PRIVATE_ENV_PREFIXES = [
 
 const RUNTIME_PRIVATE_ENV_KEYS = new Set([
   'FORGE_BUILD_VERSION',
+  'FORGE_INSTANCE_ID',
   'FORGE_MCP_INSTANCE_ID',
   'FORGE_MCP_PUBLIC_ORIGIN',
   'FORGE_STABLE_SUPERVISOR',
 ]);
 
+/**
+ * Remove the hosting Runtime's private authority before starting a service or
+ * child. Callers may then add the exact contract they own. This prevents an
+ * ambient writer slot/claim from becoming an accidental second writer.
+ */
+export function runtimeAuthorityFreeEnvironment(
+  env: NodeJS.ProcessEnv = process.env,
+): NodeJS.ProcessEnv {
+  const sanitized = { ...env };
+  for (const key of Object.keys(sanitized)) {
+    if (
+      RUNTIME_PRIVATE_ENV_KEYS.has(key)
+      || RUNTIME_PRIVATE_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))
+    ) delete sanitized[key];
+  }
+  return sanitized;
+}
+
 function appendExecutableDirectory(pathEntries: string[], candidate: string | undefined): void {
   if (!candidate || !isAbsolute(candidate) || pathEntries.includes(candidate)) return;
   pathEntries.push(candidate);
@@ -70,15 +89,7 @@ export function repositoryChildProcessEnvironment(
   env: NodeJS.ProcessEnv = process.env,
   platform: NodeJS.Platform = process.platform,
 ): NodeJS.ProcessEnv {
-  const sanitized = { ...env };
-  for (const key of Object.keys(sanitized)) {
-    if (
-      RUNTIME_PRIVATE_ENV_KEYS.has(key)
-      || RUNTIME_PRIVATE_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))
-    ) {
-      delete sanitized[key];
-    }
-  }
+  const sanitized = runtimeAuthorityFreeEnvironment(env);
 
   if (platform === 'win32') {
     let inheritedPath: string | undefined;

package/src/runtime/shared/response-budget.ts

@@ -222,9 +222,7 @@ export function artifactRef(input: {
     ...(typeof input.byteLength === 'number' ? { byteLength: input.byteLength } : {}),
     ...(input.repoId ? { repoId: input.repoId } : {}),
     ...(input.jobId ? { jobId: input.jobId } : {}),
-    next: input.repoId
-      ? `Call get_artifact with repo_id=${input.repoId} and artifact_id=${input.artifactId}.`
-      : `Call get_artifact with artifact_id=${input.artifactId}.`,
+    next: `Call get_artifact with artifact_id=${input.artifactId}.`,
   };
 }