@moretea-labs/forge 1.8.0 → 1.8.2

package/src/cli/commands/mcp.ts

@@ -28,7 +28,6 @@ export interface McpServeOptions {
   devRunnerAgents?: string;
   devRunnerTimeoutMs?: string;
   devRunnerMaxTimeoutMs?: string;
-  toolset?: 'facade' | 'core' | 'advanced' | 'full';
 }
 
 interface McpAccessOptions {
@@ -105,7 +104,6 @@ async function runRepositoryAccessCommand(
     repo: rawOpts.repo ?? '.',
     controllerHome: rawOpts.controllerHome,
     profile: 'controller',
-    toolset: 'core',
   });
   const result = callAccessTool(ctx, toolName, {
     repo_id: rawOpts.repoId,
@@ -170,7 +168,6 @@ export function buildMcpCommand(): Command {
     .option('--host <host>', 'HTTP bind host', '127.0.0.1')
     .option('--port <port>', 'HTTP bind port', '8765')
     .option('--profile <profile>', 'MCP profile: planner|executor|orchestrator|controller', 'controller')
-    .option('--toolset <toolset>', 'Controller toolset: facade|core|advanced|full (default advanced; facade is an explicit five-tool ChatGPT surface)')
     .option('--auth <mode>', 'HTTP auth mode: oauth|bearer|none', 'oauth')
     .option('--enable-chatgpt-browser', 'Expose tools that operate the user logged-in ChatGPT Web browser session')
     .option('--enable-dev-runner', 'Enable local Codex/Claude task runners for controller or orchestrator profiles')
@@ -191,7 +188,6 @@ export function buildMcpCommand(): Command {
             repo: rawOpts.repo ?? '.',
             controllerHome: rawOpts.controllerHome,
             profile: rawOpts.profile,
-            toolset: rawOpts.toolset,
             enableChatgptBrowser: rawOpts.enableChatgptBrowser === true,
             enableDevRunner: rawOpts.enableDevRunner,
             devRunnerAgents: rawOpts.devRunnerAgents,
@@ -206,7 +202,6 @@ export function buildMcpCommand(): Command {
             repo: rawOpts.repo,
             controllerHome: rawOpts.controllerHome,
             profile: rawOpts.profile,
-            toolset: rawOpts.toolset,
             host: rawOpts.host,
             port: parsePort(rawOpts.port),
             auth: rawOpts.auth,

package/src/cli/commands/prompt-guard-decision.ts

@@ -18,7 +18,6 @@ import {
   isAgenticPackagingIntent,
   isBugFixIntent,
   isBugOrHuntIntent,
-  isCodegraphRouteIntent,
   isDoneIntent,
   isEmbeddedApprovedPlanIntent,
   isExecutionApprovalIntent,
@@ -185,7 +184,6 @@ export function runPromptGuardVerdictFromPrompt(prompt: string): PromptGuardVerd
       plan_discussion_continuation: bit(decisionFacts.planningDiscussion),
       trigger_question: bit(isTriggerQuestionPrompt(ctx)),
       agentic_packaging: bit(isAgenticPackagingIntent(ctx)),
-      codegraph_route: bit(isCodegraphRouteIntent(ctx)),
       nontrivial_code_task: bit(isNontrivialCodeTaskIntent(ctx)),
       health_route: bit(isHealthRouteIntent(ctx)),
       spa_day: bit(isSpaDayIntent(ctx)),

package/src/cli/commands/recovery.ts

@@ -19,8 +19,7 @@ import {
 } from '../repositories/controller-home';
 import { FORGE_VERSION } from '../../version';
 import {
-  RECOVERY_GATEWAY_LABEL,
-  RECOVERY_WATCHDOG_LABEL,
+  RECOVERY_DAEMON_LABEL,
   inspectRecoveryTunnelLaunchdContract,
   installStandaloneRecovery,
   recoveryLaunchdPid,
@@ -37,6 +36,7 @@ import {
   activateRuntimeRelease,
   defaultPrimaryRuntimeServiceConfig,
   loadRecoveryConfig,
+  normalizeRecoveryInstallProfile,
   recoverPrimaryRuntime,
   recoveryMachineIdentity,
   restartPrimaryConnector,
@@ -61,7 +61,6 @@ import {
   scheduleLinuxControllerHomeMigration,
   type RecoveryControllerHomeMigrationPreflight,
 } from '../../runtime/standalone-recovery/controller-home-migration';
-import { configureCodegraph, ensureCodegraph } from '../tools/codegraph';
 import { isProcessAlive } from '../../runtime/shared/process-tree';
 import { systemdUserServicePid, systemdUserUnitName, systemdUserUnitPath } from '../controller/systemd-user';
 import { installWindowsHostRecoveryPlugin } from '../../runtime/plugins/windows-host-recovery-install';
@@ -149,12 +148,57 @@ export type { RecoveryControllerHomeMigrationPreflight };
 export interface RecoveryConnectorDependencies {
   platform?: NodeJS.Platform;
   pathExists?: (path: string) => boolean;
-  launchdPid?: (role: 'gateway' | 'watchdog') => number | undefined;
-  systemdPid?: (role: 'gateway' | 'watchdog') => number | undefined;
+  launchdPid?: (role: 'daemon') => number | undefined;
+  systemdPid?: (role: 'daemon') => number | undefined;
   tunnelLaunchdPid?: (label: string) => number | undefined;
   tunnelSystemdPid?: (unitName: string) => number | undefined;
   openAiTunnelStatus?: (service: OpenAiSecureTunnelServiceConfig) => OpenAiSecureTunnelRuntimeObservation;
   processAlive?: (pid: number) => boolean;
+  processParentPid?: (pid: number) => number | undefined;
+}
+
+function recoveryProcessParentPid(pid: number): number | undefined {
+  if (process.platform === 'win32' || !Number.isInteger(pid) || pid <= 1) return undefined;
+  const result = spawnSync('ps', ['-o', 'ppid=', '-p', String(pid)], {
+    encoding: 'utf8',
+    timeout: 2_000,
+    maxBuffer: 8 * 1024,
+  });
+  if (result.status !== 0) return undefined;
+  const parent = Number.parseInt((result.stdout ?? '').trim(), 10);
+  return Number.isInteger(parent) && parent > 0 ? parent : undefined;
+}
+
+/**
+ * launchd may own a tiny wrapper (/usr/bin/env) while Recovery records the
+ * compiled child PID in its runtime identity. Treat only that bounded process
+ * lineage as the same managed service; unrelated live PIDs still fail closed.
+ */
+export function recoveryManagedServiceOwnsRuntimeProcess(
+  managedPid: number | undefined,
+  runtimePid: number | undefined,
+  dependencies: {
+    processAlive?: (pid: number) => boolean;
+    processParentPid?: (pid: number) => number | undefined;
+    maxDepth?: number;
+  } = {},
+): boolean {
+  if (!managedPid || !runtimePid || managedPid <= 0 || runtimePid <= 0) return false;
+  const processAlive = dependencies.processAlive ?? isProcessAlive;
+  if (!processAlive(managedPid) || !processAlive(runtimePid)) return false;
+  if (managedPid === runtimePid) return true;
+  const parentPid = dependencies.processParentPid ?? recoveryProcessParentPid;
+  const maxDepth = Math.max(1, Math.min(Math.trunc(dependencies.maxDepth ?? 8), 32));
+  const visited = new Set<number>([runtimePid]);
+  let current = runtimePid;
+  for (let depth = 0; depth < maxDepth; depth += 1) {
+    const parent = parentPid(current);
+    if (!parent || parent <= 0 || visited.has(parent)) return false;
+    if (parent === managedPid) return true;
+    visited.add(parent);
+    current = parent;
+  }
+  return false;
 }
 
 export interface RecoveryConnectorDescriptor {
@@ -174,8 +218,7 @@ export interface RecoveryConnectorDescriptor {
   };
   healthUrl: string;
   services: {
-    gateway: { label: string; platform: 'launchd' | 'systemd-user'; serviceInstalled: boolean; plistInstalled: boolean; running: boolean; pid?: number };
-    watchdog: { label: string; platform: 'launchd' | 'systemd-user'; serviceInstalled: boolean; plistInstalled: boolean; running: boolean; pid?: number };
+    recovery: { label: string; platform: 'launchd' | 'systemd-user'; serviceInstalled: boolean; plistInstalled: boolean; running: boolean; pid?: number };
     tunnel: {
       configured: boolean;
       platform?: 'launchd' | 'systemd-user' | 'openai-secure-tunnel';
@@ -208,15 +251,19 @@ export function recoveryConnectorDescriptor(
   const url = configuredUrl ?? `${localOrigin}/recovery/mcp`;
   const origin = new URL(url).origin;
   const passphraseConfigured = Boolean(readMcpServiceOAuthPassphrase(home));
-  const gatewayIdentity = readRecoveryRuntimeIdentity(home, 'gateway');
-  const watchdogIdentity = readRecoveryRuntimeIdentity(home, 'watchdog');
+  const recoveryIdentity = readRecoveryRuntimeIdentity(home, 'daemon');
   const platform = dependencies.platform ?? process.platform;
   const servicePlatform: 'launchd' | 'systemd-user' = platform === 'linux' ? 'systemd-user' : 'launchd';
   const pathExists = dependencies.pathExists ?? existsSync;
   const launchdPid = dependencies.launchdPid ?? recoveryLaunchdPid;
-  const systemdPid = dependencies.systemdPid ?? ((role: 'gateway' | 'watchdog') => systemdUserServicePid(role === 'gateway' ? RECOVERY_GATEWAY_LABEL : RECOVERY_WATCHDOG_LABEL));
-  const managedPid = (role: 'gateway' | 'watchdog') => servicePlatform === 'systemd-user' ? systemdPid(role) : launchdPid(role);
+  const systemdPid = dependencies.systemdPid ?? ((_role: 'daemon') => systemdUserServicePid(RECOVERY_DAEMON_LABEL));
+  const managedPid = () => servicePlatform === 'systemd-user' ? systemdPid('daemon') : launchdPid('daemon');
   const processAlive = dependencies.processAlive ?? isProcessAlive;
+  const serviceOwnsRuntimeProcess = (managedPid: number | undefined, runtimePid: number | undefined) =>
+    recoveryManagedServiceOwnsRuntimeProcess(managedPid, runtimePid, {
+      processAlive,
+      processParentPid: dependencies.processParentPid,
+    });
   const configuredTunnel = config.recoveryTunnelService;
   const tunnelService = configuredTunnel?.platform === 'launchd' ? configuredTunnel : undefined;
   const systemdTunnelService = configuredTunnel?.platform === 'systemd-user' ? configuredTunnel : undefined;
@@ -256,40 +303,24 @@ export function recoveryConnectorDescriptor(
       : Boolean(tunnelLaunchdPid && processAlive(tunnelLaunchdPid));
   const tunnelHealthy = openAiTunnelService ? openAiTunnelStatus?.healthy === true : tunnelRunning;
   const tunnelReady = openAiTunnelService ? openAiTunnelStatus?.ok === true : tunnelRestartSafe && tunnelRunning;
-  const gatewayPlistInstalled = pathExists(authority.gatewayLaunchAgent);
-  const watchdogPlistInstalled = pathExists(authority.watchdogLaunchAgent);
-  const gatewayServiceInstalled = servicePlatform === 'systemd-user'
-    ? pathExists(systemdUserUnitPath(RECOVERY_GATEWAY_LABEL))
-    : gatewayPlistInstalled;
-  const watchdogServiceInstalled = servicePlatform === 'systemd-user'
-    ? pathExists(systemdUserUnitPath(RECOVERY_WATCHDOG_LABEL))
-    : watchdogPlistInstalled;
-  const gatewayManagedPid = managedPid('gateway');
-  const watchdogManagedPid = managedPid('watchdog');
-  const gatewayRunning = Boolean(
-    gatewayIdentity
-    && gatewayManagedPid
-    && gatewayIdentity.pid === gatewayManagedPid
-    && processAlive(gatewayIdentity.pid)
-    && authority.current
-    && gatewayIdentity.releaseRevision === authority.current.releaseRevision
-    && gatewayIdentity.manifestSha256 === authority.current.manifestSha256,
-  );
-  const watchdogRunning = Boolean(
-    watchdogIdentity
-    && watchdogManagedPid
-    && watchdogIdentity.pid === watchdogManagedPid
-    && processAlive(watchdogIdentity.pid)
+  const recoveryPlistInstalled = pathExists(authority.daemonLaunchAgent);
+  const recoveryServiceInstalled = servicePlatform === 'systemd-user'
+    ? pathExists(systemdUserUnitPath(RECOVERY_DAEMON_LABEL))
+    : recoveryPlistInstalled;
+  const recoveryManagedPid = managedPid();
+  const recoveryRunning = Boolean(
+    recoveryIdentity
+    && serviceOwnsRuntimeProcess(recoveryManagedPid, recoveryIdentity.pid)
     && authority.current
-    && watchdogIdentity.releaseRevision === authority.current.releaseRevision
-    && watchdogIdentity.manifestSha256 === authority.current.manifestSha256,
+    && recoveryIdentity.releaseRevision === authority.current.releaseRevision
+    && recoveryIdentity.manifestSha256 === authority.current.manifestSha256,
   );
-  const installed = Boolean(authority.current && gatewayServiceInstalled && watchdogServiceInstalled);
+  const installed = Boolean(authority.current && recoveryServiceInstalled);
   const publicEndpoint = Boolean(configuredUrl?.startsWith('https://'));
   const warnings: string[] = [];
   if (!authority.current) warnings.push('No current immutable Forge Recovery release is installed. Run forge recovery install.');
-  if (!gatewayServiceInstalled || !watchdogServiceInstalled) warnings.push(`Forge Recovery ${servicePlatform} services are not fully installed. Run forge recovery install.`);
-  if (!gatewayRunning || !watchdogRunning) warnings.push('Forge Recovery Gateway or Watchdog is not running on the current Recovery release.');
+  if (!recoveryServiceInstalled) warnings.push(`Forge Recovery ${servicePlatform} service is not installed. Run forge recovery install.`);
+  if (!recoveryRunning) warnings.push('Forge Recovery service is not running on the current Recovery release.');
   if (!configuredTunnel) warnings.push('Recovery is loopback-only. Configure a dedicated OpenAI Secure MCP Tunnel or an HTTPS tunnel service before adding it to ChatGPT.');
   else if (openAiTunnelService) {
     if (!tunnelRestartSafe) warnings.push('The dedicated OpenAI Recovery tunnel must use a valid alias, tunnel id, loopback MCP endpoint, and env:/file: runtime API key reference.');
@@ -310,7 +341,7 @@ export function recoveryConnectorDescriptor(
     transport: 'streamable_http',
     url,
     public: publicEndpoint,
-    readyForChatGPT: installed && gatewayRunning && watchdogRunning && tunnelReady && (openAiTunnelService ? true : publicEndpoint) && passphraseConfigured,
+    readyForChatGPT: installed && recoveryRunning && tunnelReady && (openAiTunnelService ? true : publicEndpoint) && passphraseConfigured,
     installed,
     currentRelease: authority.current?.releaseRevision,
     previousRelease: authority.previous?.releaseRevision,
@@ -321,21 +352,13 @@ export function recoveryConnectorDescriptor(
     },
     healthUrl: `${origin}/recovery/health`,
     services: {
-      gateway: {
-        label: RECOVERY_GATEWAY_LABEL,
-        platform: servicePlatform,
-        serviceInstalled: gatewayServiceInstalled,
-        plistInstalled: gatewayPlistInstalled,
-        running: gatewayRunning,
-        ...(gatewayIdentity ? { pid: gatewayIdentity.pid } : {}),
-      },
-      watchdog: {
-        label: RECOVERY_WATCHDOG_LABEL,
+      recovery: {
+        label: RECOVERY_DAEMON_LABEL,
         platform: servicePlatform,
-        serviceInstalled: watchdogServiceInstalled,
-        plistInstalled: watchdogPlistInstalled,
-        running: watchdogRunning,
-        ...(watchdogIdentity ? { pid: watchdogIdentity.pid } : {}),
+        serviceInstalled: recoveryServiceInstalled,
+        plistInstalled: recoveryPlistInstalled,
+        running: recoveryRunning,
+        ...(recoveryIdentity ? { pid: recoveryIdentity.pid } : {}),
       },
       tunnel: {
         configured: Boolean(configuredTunnel),
@@ -603,7 +626,6 @@ export async function verifyRecoveryConnector(
         credentialRetirement: 'shared_recovery_token_not_individually_revocable',
       };
 
-      let mcpSessionId: string | undefined;
       const rpc = async (id: number | undefined, method: string, params?: Record<string, unknown>) => {
         const response = await request(connector.url, {
           method: 'POST',
@@ -612,10 +634,12 @@ export async function verifyRecoveryConnector(
             accept: 'application/json, text/event-stream',
             'content-type': 'application/json',
             'mcp-protocol-version': '2025-06-18',
-            ...(mcpSessionId ? { 'mcp-session-id': mcpSessionId } : {}),
           },
           body: JSON.stringify({ jsonrpc: '2.0', ...(id === undefined ? {} : { id }), method, ...(params ? { params } : {}) }),
         });
+        if (response.headers.get('mcp-session-id')?.trim()) {
+          throw new Error(`${method} unexpectedly established transport session state`);
+        }
         if (method === 'notifications/initialized') {
           if (response.status !== 202) throw new Error(`${method} HTTP ${response.status}`);
           return { response, result: {} as Record<string, unknown> };
@@ -625,71 +649,44 @@ export async function verifyRecoveryConnector(
         if (response.status !== 200 || Object.keys(rpcError).length > 0) {
           throw new Error(`${method} HTTP ${response.status}${typeof rpcError.message === 'string' ? `: ${rpcError.message}` : ''}`);
         }
-        if (method === 'initialize') {
-          const returnedSessionId = response.headers.get('mcp-session-id')?.trim();
-          if (!returnedSessionId) throw new Error('initialize HTTP 200: Mcp-Session-Id missing');
-          mcpSessionId = returnedSessionId;
-        }
         return { response, result: jsonObject(body.result) };
       };
-      const closeMcpSession = async (): Promise<void> => {
-        const sessionId = mcpSessionId;
-        if (!sessionId) return;
-        mcpSessionId = undefined;
-        try {
-          await request(connector.url, {
-            method: 'DELETE',
-            headers: {
-              authorization: `Bearer ${accessToken}`,
-              accept: 'application/json, text/event-stream',
-              'mcp-protocol-version': '2025-06-18',
-              'mcp-session-id': sessionId,
-            },
-          });
-        } catch {
-          // Session cleanup is best-effort and must not hide the verifier result.
-        }
-      };
 
-      try {
-        const initialized = await rpc(11, 'initialize', {
-          protocolVersion: '2025-06-18',
-          capabilities: {},
-          clientInfo: { name: 'forge-recovery-verifier', version: FORGE_VERSION },
-        });
-        const initializedNotification = await rpc(undefined, 'notifications/initialized');
-        const listed = await rpc(12, 'tools/list');
-        const tools = Array.isArray(listed.result.tools)
-          ? listed.result.tools.map((tool) => jsonObject(tool).name).filter((name): name is string => typeof name === 'string')
-          : [];
-        const expectedTools = RECOVERY_TOOLS.map((tool) => tool.name);
-        const runtimeStatusCall = await rpc(13, 'tools/call', { name: 'runtime_status', arguments: {} });
-        const listReleasesCall = await rpc(14, 'tools/call', { name: 'list_releases', arguments: {} });
-        const initializedResult = initialized.result;
-        const serverInfo = jsonObject(initializedResult.serverInfo);
-        const mcpOk = initialized.response.status === 200
-          && initializedNotification.response.status === 202
-          && initializedResult.protocolVersion === '2025-06-18'
-          && serverInfo.name === 'forge-standalone-recovery'
-          && serverInfo.version === FORGE_VERSION
-          && JSON.stringify(tools) === JSON.stringify(expectedTools)
-          && runtimeStatusCall.response.status === 200
-          && listReleasesCall.response.status === 200;
-        probes.mcp = {
-          ok: mcpOk,
-          initializeStatus: initialized.response.status,
-          initializedNotificationStatus: initializedNotification.response.status,
-          protocolVersion: typeof initializedResult.protocolVersion === 'string' ? initializedResult.protocolVersion : undefined,
-          serverName: typeof serverInfo.name === 'string' ? serverInfo.name : undefined,
-          serverVersion: typeof serverInfo.version === 'string' ? serverInfo.version : undefined,
-          tools,
-          runtimeStatusCall: runtimeStatusCall.response.status === 200,
-          listReleasesCall: listReleasesCall.response.status === 200,
-        };
-        if (!mcpOk) failures.push('mcp: initialize, Forge version, tool surface, or read-only calls did not match the Recovery contract.');
-      } finally {
-        await closeMcpSession();
-      }
+      const initialized = await rpc(11, 'initialize', {
+        protocolVersion: '2025-06-18',
+        capabilities: {},
+        clientInfo: { name: 'forge-recovery-verifier', version: FORGE_VERSION },
+      });
+      const initializedNotification = await rpc(undefined, 'notifications/initialized');
+      const listed = await rpc(12, 'tools/list');
+      const tools = Array.isArray(listed.result.tools)
+        ? listed.result.tools.map((tool) => jsonObject(tool).name).filter((name): name is string => typeof name === 'string')
+        : [];
+      const expectedTools = RECOVERY_TOOLS.map((tool) => tool.name);
+      const runtimeStatusCall = await rpc(13, 'tools/call', { name: 'runtime_status', arguments: {} });
+      const listReleasesCall = await rpc(14, 'tools/call', { name: 'list_releases', arguments: {} });
+      const initializedResult = initialized.result;
+      const serverInfo = jsonObject(initializedResult.serverInfo);
+      const mcpOk = initialized.response.status === 200
+        && initializedNotification.response.status === 202
+        && initializedResult.protocolVersion === '2025-06-18'
+        && serverInfo.name === 'forge-standalone-recovery'
+        && serverInfo.version === FORGE_VERSION
+        && JSON.stringify(tools) === JSON.stringify(expectedTools)
+        && runtimeStatusCall.response.status === 200
+        && listReleasesCall.response.status === 200;
+      probes.mcp = {
+        ok: mcpOk,
+        initializeStatus: initialized.response.status,
+        initializedNotificationStatus: initializedNotification.response.status,
+        protocolVersion: typeof initializedResult.protocolVersion === 'string' ? initializedResult.protocolVersion : undefined,
+        serverName: typeof serverInfo.name === 'string' ? serverInfo.name : undefined,
+        serverVersion: typeof serverInfo.version === 'string' ? serverInfo.version : undefined,
+        tools,
+        runtimeStatusCall: runtimeStatusCall.response.status === 200,
+        listReleasesCall: listReleasesCall.response.status === 200,
+      };
+      if (!mcpOk) failures.push('mcp: stateless initialize, Forge version, tool surface, or read-only calls did not match the Recovery contract.');
     } catch (error) {
       failures.push(`oauthPkce/mcp: ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -751,16 +748,18 @@ export function buildRecoveryCommand(): Command {
     .requiredOption('--repo <path>', 'Forge source repository root used for Recovery and Runtime immutable releases')
     .requiredOption('--primary-connector-service-label <label>', 'Primary OAuth/Connector launchd label')
     .option('--primary-connector-service-plist <path>', 'Absolute primary OAuth/Connector launchd plist path')
-    .option('--configure-codegraph', 'Initialize/sync CodeGraph and configure repository-scoped MCP for Codex and Claude during the bootstrap')
     .action(async (opts: {
       controllerHome: string;
       repo: string;
       primaryConnectorServiceLabel: string;
       primaryConnectorServicePlist?: string;
-      configureCodegraph?: boolean;
     }) => {
       const home = resolveControllerHome(opts.controllerHome);
       const repoRoot = resolve(opts.repo);
+      const primaryRuntimeSourceRepository = findRegisteredRepositoryByCheckoutRoot(repoRoot, home);
+      if (!primaryRuntimeSourceRepository) {
+        throw new Error(`RECOVERY_PRIMARY_RUNTIME_SOURCE_REPOSITORY_NOT_REGISTERED: ${repoRoot}`);
+      }
       const current = loadRecoveryConfig(home);
       const primaryConnectorBase = launchdService(
         opts.primaryConnectorServiceLabel,
@@ -774,6 +773,7 @@ export function buildRecoveryCommand(): Command {
       const installed = await installStandaloneRecovery({
         controllerHome: home,
         repoRoot,
+        primaryRuntimeSourceRepositoryId: primaryRuntimeSourceRepository.repoId,
         port: current.gateway?.port ?? 8787,
         publicMcpUrl: current.publicMcpUrl,
         recoveryPublicUrl: current.recoveryPublicUrl,
@@ -781,6 +781,7 @@ export function buildRecoveryCommand(): Command {
         primaryPublicTunnelService: current.primaryPublicTunnelService,
         primaryRuntimeService: current.primaryRuntimeService ?? defaultPrimaryRuntimeServiceConfig(),
         primaryConnectorService,
+        profile: 'self-healing',
       });
       const refreshed = loadRecoveryConfig(home);
       const runtime = await stageAndActivateConfiguredRuntimeRelease(refreshed);
@@ -789,18 +790,9 @@ export function buildRecoveryCommand(): Command {
         process.exitCode = 1;
         return;
       }
-      let codegraph: Record<string, unknown> | undefined;
-      let codegraphOk = true;
-      if (opts.configureCodegraph === true) {
-        const ensured = ensureCodegraph({ repoRoot, init: true, sync: true, host: 'both' });
-        const configured = configureCodegraph({ repoRoot, target: 'both', location: 'global' });
-        codegraphOk = !ensured.actions.some((entry) => entry.status === 'failed')
-          && !configured.actions.some((entry) => entry.status === 'failed');
-        codegraph = { ensured, configured };
-      }
       const connector = await restartPrimaryConnector(refreshed);
-      const ok = connector.ok && codegraphOk;
-      output({ ok, phase: !connector.ok ? 'connector_restart' : !codegraphOk ? 'codegraph_configuration' : 'complete', recovery: installed, runtime, ...(codegraph ? { codegraph } : {}), connector });
+      const ok = connector.ok;
+      output({ ok, phase: !connector.ok ? 'connector_restart' : 'complete', recovery: installed, runtime, connector });
       if (!ok) process.exitCode = 1;
     });
 
@@ -952,8 +944,9 @@ export function buildRecoveryCommand(): Command {
     });
 
   command.command('install')
-    .description('Build and activate the independent Forge Recovery Gateway and Watchdog release')
+    .description('Build Forge Recovery artifacts and activate only the explicitly selected persistent Recovery profile')
     .requiredOption('--controller-home <path>', 'Explicit Controller Home')
+    .option('--profile <profile>', 'Recovery install profile: manual, gateway, or self-healing', 'manual')
     .option('--port <port>', 'Loopback Recovery Gateway port', '8787')
     .option('--public-mcp-url <url>', 'Primary Forge MCP public URL')
     .option('--recovery-public-url <url>', 'Dedicated Forge Recovery MCP public URL')
@@ -978,7 +971,7 @@ export function buildRecoveryCommand(): Command {
     .option('--primary-openai-profile-dir <path>', 'Optional absolute tunnel-client profile directory for primary Forge')
     .option('--primary-openai-admin-profile <profile>', 'Optional tunnel-client admin profile used for primary runtime connect')
     .option('--primary-runtime-source-root <path>', 'Stable canonical/package source used by Recovery for future Runtime staging')
-    .option('--stage-only', 'Build and canary the Recovery release without activating services')
+    .option('--stage-only', 'Compatibility alias: build/canary only and do not mutate installed Recovery config or services')
     .action(async (opts: {
       controllerHome: string;
       port: string;
@@ -1005,9 +998,12 @@ export function buildRecoveryCommand(): Command {
       primaryOpenaiProfileDir?: string;
       primaryOpenaiAdminProfile?: string;
       primaryRuntimeSourceRoot?: string;
+      profile: string;
       stageOnly?: boolean;
     }) => {
       const home = resolveControllerHome(opts.controllerHome);
+      const profile = normalizeRecoveryInstallProfile(opts.stageOnly ? 'manual' : opts.profile, 'manual');
+      if (opts.stageOnly && opts.profile !== 'manual') throw new Error('RECOVERY_STAGE_ONLY_PROFILE_CONFLICT');
       const port = Number(opts.port);
       if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error('RECOVERY_PORT_INVALID');
       const recoveryLaunchdTunnel = launchdService(opts.recoveryTunnelServiceLabel, opts.recoveryTunnelServicePlist, 'RECOVERY_TUNNEL') as PublicTunnelServiceConfig | undefined;
@@ -1063,6 +1059,7 @@ export function buildRecoveryCommand(): Command {
       assertDistinctRecoveryOpenAiTunnelIdentity(recoveryTunnelService, primaryPublicTunnelService);
 
       const recoveryPublicUrl = endpoint(opts.recoveryPublicUrl, 'RECOVERY_PUBLIC_URL');
+      if (profile === 'manual' && (recoveryTunnelService || recoveryPublicUrl)) throw new Error('RECOVERY_PROFILE_GATEWAY_REQUIRED');
       if (recoveryOpenAiTunnel && recoveryPublicUrl) throw new Error('RECOVERY_OPENAI_TUNNEL_PUBLIC_URL_CONFLICT');
       if ((recoveryLaunchdTunnel || recoverySystemdTunnel) && !recoveryPublicUrl) throw new Error('RECOVERY_PUBLIC_URL_AND_TUNNEL_SERVICE_MUST_BE_CONFIGURED_TOGETHER');
       if (!recoveryTunnelService && recoveryPublicUrl) throw new Error('RECOVERY_PUBLIC_URL_AND_TUNNEL_SERVICE_MUST_BE_CONFIGURED_TOGETHER');
@@ -1080,8 +1077,12 @@ export function buildRecoveryCommand(): Command {
         controllerHome: home,
         repoRoot: primaryRuntimeSourceRoot,
         ...(primaryRuntimeSourceRepository ? { primaryRuntimeSourceRepositoryId: primaryRuntimeSourceRepository.repoId } : {}),
-        sourceRoot: packageRoot,
+        // The package root is only the CLI's location. A package installation
+        // is not a Git checkout, while the explicitly registered primary
+        // Runtime source is the immutable Recovery release's provenance.
+        sourceRoot: primaryRuntimeSourceRoot,
         port,
+        profile,
         stageOnly: opts.stageOnly === true,
         primaryRuntimeService: defaultPrimaryRuntimeServiceConfig(),
         publicMcpUrl: endpoint(opts.publicMcpUrl, 'PUBLIC_MCP_URL'),
@@ -1092,6 +1093,7 @@ export function buildRecoveryCommand(): Command {
       });
       output({
         status: opts.stageOnly ? 'staged' : 'installed',
+        profile: result.profile,
         staged: result.staged.release,
         activation: result.activated,
         connector: recoveryConnectorDescriptor(home),

package/src/cli/commands/repository.ts

@@ -106,7 +106,23 @@ export function buildRepositoryCommand(): Command {
     .argument('<repo-id>', 'Stable repository ID'))
     .action((repoId: string, opts: { controllerHome?: string; json?: boolean }) => {
       const repository = getRepository(repoId, opts.controllerHome, { includeRemoved: true });
-      output({ validation: validateRepository(repoId, opts.controllerHome), ...initializeRepository(repository, opts.controllerHome) }, opts.json === true);
+      const validation = validateRepository(repoId, opts.controllerHome);
+      if (opts.json === true) {
+        output({ validation, ...initializeRepository(repository, opts.controllerHome) }, true);
+        return;
+      }
+      // The default validation view is bounded even when the repository has
+      // thousands of historical checkout records. Full audit data is opt-in.
+      output({
+        validation,
+        repository: repositorySummary(repository),
+        checkouts: {
+          total: repository.checkouts.length,
+          active: repository.checkouts.filter((checkout) => !checkout.lifecycle || checkout.lifecycle === 'active').length,
+          archived: repository.checkouts.filter((checkout) => checkout.lifecycle === 'archived').length,
+          removed: repository.checkouts.filter((checkout) => checkout.lifecycle === 'removed').length,
+        },
+      }, false);
     });
 
   common(command.command('command')

package/src/cli/commands/runtime.ts

@@ -12,6 +12,7 @@ import { listOccurrences, listSchedules } from '../../../packages/kernel/schedul
 import { observeRuntimeStatus } from '../../runtime/root/status';
 import { readMcpServiceBearerToken } from '../../../adapters/mcp/auth';
 import { createSetupBootstrapControlApi } from './bootstrap-control';
+import { readSetupProfile, runtimeDeploymentTopologyForSetupProfile } from './setup-profile';
 import { publishRuntimeRelease } from '../../runtime/root/release-store';
 import { installForgeRuntimeService } from '../../runtime/root/service';
 import { activateScheduledPackageRuntimeServiceFromPath, installPackageRuntimeService, readPackageRuntimeActivationReceipt } from '../../runtime/root/package-runtime-service';
@@ -73,12 +74,14 @@ export function buildRuntimeCommand(): Command {
         writeFileSync(tokenPath, `${token}\n`, { mode: 0o600 });
       }
       const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+      const setupProfile = readSetupProfile();
       const result = await installPackageRuntimeService({
         controllerHome: home,
         packageRoot,
         host: opts.host,
         port,
         authTokenFile: tokenPath,
+        ...(setupProfile ? { topology: runtimeDeploymentTopologyForSetupProfile(setupProfile) } : {}),
         forcePortable: opts.portable === true,
         refreshConnector: opts.refreshConnector === true,
       });
@@ -116,7 +119,6 @@ export function buildRuntimeCommand(): Command {
     .option('--port <port>', 'MCP listener port', '8765')
     .option('--stage-only', 'Build and validate the immutable Runtime release without publishing or activating it')
     .option('--auth-token-file <path>', 'Raw bearer token file (defaults to controllerHome/mcp/runtime-token, created from the MCP bearer token when missing)')
-    .option('--exclusive-work-id <id>', 'Persistently admit only this P0 Work while migration is active')
     .option('--node-executable <path>', 'Executable launchd uses to run the Forge Runtime service runner', process.execPath)
     .option('--runner-path <path>', 'Forge Runtime service runner entry', join(resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..'), 'bin', 'forge-runtime-service.mjs'))
     .action(async (opts: {
@@ -125,7 +127,6 @@ export function buildRuntimeCommand(): Command {
       host: string;
       port: string;
       authTokenFile?: string;
-      exclusiveWorkId?: string;
       nodeExecutable: string;
       runnerPath: string;
       stageOnly?: boolean;
@@ -171,7 +172,6 @@ export function buildRuntimeCommand(): Command {
           host: opts.host,
           port,
           authTokenFile: tokenPath,
-          ...(opts.exclusiveWorkId?.trim() ? { exclusiveWorkId: opts.exclusiveWorkId.trim() } : {}),
         },
         runnerPath: resolve(opts.runnerPath),
         nodeExecutable: resolve(opts.nodeExecutable),

package/src/cli/commands/setup-execution.ts

@@ -0,0 +1,41 @@
+/** Shared synchronous setup/adoption command execution; no Runtime or Work authority. */
+import { runProcess as runBoundedProcess } from '../../effects/process-runner';
+
+export interface SetupExecutionStep {
+  step: string;
+  status: "ok" | "skipped" | "failed";
+  command?: string[];
+  detail?: string;
+  stdout?: string;
+  stderr?: string;
+}
+
+export function runSetupProcess(command: string, args: string[], cwd: string, env?: NodeJS.ProcessEnv): SetupExecutionStep {
+  const result = runBoundedProcess(command, args, { cwd, env });
+
+  return {
+    step: "",
+    status: result.ok ? "ok" : "failed",
+    command: [...result.command],
+    stdout: result.stdout,
+    stderr: result.stderr || result.error,
+  };
+}
+
+export function withProcessEnv<T>(env: NodeJS.ProcessEnv | undefined, fn: () => T): T {
+  if (!env) return fn();
+  const previous = new Map<string, string | undefined>();
+  for (const [key, value] of Object.entries(env)) {
+    previous.set(key, process.env[key]);
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+  try {
+    return fn();
+  } finally {
+    for (const [key, value] of previous) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  }
+}