@moretea-labs/forge 1.8.1 → 1.8.2

package/src/cli/github/semantic-projection.ts

@@ -0,0 +1,174 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { listRepositories } from '../repositories/registry';
+import { resolveRepoPreferredControllerHome } from '../repositories/controller-home';
+import { getWorkContract, listWorkContracts, type WorkContract } from '../../../packages/kernel/work/api/index';
+import { getPlanContract, planSemanticView } from '../../runtime/control-plane/facade/plan-contract-store';
+import { readRequirement } from '../../runtime/control-plane/persistence/requirement-store';
+import type { GitHubIssueLink } from '../controller/types';
+import { gh, createGitHubIssue, updateGitHubIssue, addProjectItem, resolveGitHubRepository } from './github';
+
+interface RemoteIssue { number: number; url: string; title: string; body: string }
+export interface SemanticReleaseProjectionInput {
+  releaseWorkId: string;
+  repository?: string;
+  projectOwner?: string;
+  projectNumber?: number;
+}
+export interface SemanticReleaseProjectionResult {
+  releaseIssue: string;
+  children: Array<{ workId: string; issue: string }>;
+  created: number;
+  updated: number;
+  unchanged: number;
+}
+
+function safeIdentity(value: string): string {
+  if (!/^[A-Za-z0-9_.:-]{1,200}$/.test(value)) throw new Error('GITHUB_SEMANTIC_ID_INVALID');
+  return value;
+}
+
+function marker(workId: string): string {
+  return '<!-- forge-semantic-work:' + safeIdentity(workId) + ' -->';
+}
+
+function lines(values: readonly string[] | undefined, prefix = '- '): string {
+  return values?.length ? values.map((line) => prefix + line).join('\n') : '- 尚无记录';
+}
+
+function workDisplayTitle(work: WorkContract, home: string): string {
+  const requirement = work.requirementId
+    ? readRequirement({ controllerHome: home }, work.requirementId)?.value
+    : undefined;
+  return (requirement?.title || work.objective).replace(/\s+/g, ' ').slice(0, 96);
+}
+
+function semanticWorkText(work: WorkContract, home: string): string {
+  const requirement = work.requirementId
+    ? readRequirement({ controllerHome: home }, work.requirementId)?.value
+    : undefined;
+  const plan = work.planId
+    ? getPlanContract({ controllerHome: home, repoId: work.repoId }, work.planId)
+    : undefined;
+  const planView = plan ? planSemanticView(plan) : undefined;
+  const text = [
+    marker(work.workId),
+    '> Forge 生成视图（单向投影）。Requirement / Plan / Work 的正式状态只由 Forge 持有。GitHub 上的勾选或评论不改变执行授权。',
+    '',
+    '## 工作目标', work.objective,
+    '',
+    '## Forge 当前事实',
+    '- Work: `' + work.workId + '`',
+    '- 语义状态: `' + work.semanticState + '`',
+    '- Requirement: `' + (work.requirementId || '未绑定') + '`',
+    '- Plan: `' + (work.planId || '未绑定') + '`',
+    '- 父 Work: `' + (work.semanticParentWorkId || '无') + '`',
+    '- 最近语义更新: ' + (work.semanticUpdatedAt || work.updatedAt),
+    '',
+    '## 已选择的交付结果引用',
+    lines(work.semanticResultRefs),
+  ];
+  if (requirement) {
+    text.push('', '## 原始需求：' + requirement.title, requirement.outcomeStatement, '',
+      '### 验收标准', lines(requirement.acceptanceCriteria));
+    if (requirement.needsAttention && requirement.attentionSummary) {
+      text.push('', '### Forge 记录的需关注事项', requirement.attentionSummary);
+    }
+  }
+  if (planView) {
+    text.push('', '## 当前方案', planView.goal, '',
+      '### 方案决定', lines(planView.resolvedDecisions), '',
+      '### 方案项（描述性工作记忆，不是自动审批状态）',
+      lines(planView.items.map((item) => item.id + ' — ' + item.objective)));
+  }
+  text.push('', '> 未明确记录的用户产品审批、测试、发布均不能推断为通过。');
+  return text.join('\n') + '\n';
+}
+
+export function syncGitHubSemanticRelease(
+  repoRoot: string,
+  input: SemanticReleaseProjectionInput,
+): SemanticReleaseProjectionResult {
+  const home = resolveRepoPreferredControllerHome(repoRoot);
+  const repositoryRecord = listRepositories(home).find((record) =>
+    record.canonicalRoot === repoRoot || record.localRoot === repoRoot ||
+    record.checkouts.some((checkout) => checkout.canonicalRoot === repoRoot || checkout.localRoot === repoRoot));
+  if (!repositoryRecord) throw new Error('GITHUB_SEMANTIC_REPOSITORY_NOT_REGISTERED');
+  const repoId = repositoryRecord.repoId;
+  const store = { controllerHome: home, repoId };
+  const releaseWorkId = safeIdentity(input.releaseWorkId);
+  const parent = getWorkContract(store, releaseWorkId);
+  if (!parent || parent.lifecycleRole === 'execution_child') throw new Error('GITHUB_SEMANTIC_RELEASE_WORK_NOT_FOUND');
+  if (parent.semanticParentWorkId) throw new Error('GITHUB_SEMANTIC_RELEASE_MUST_BE_ROOT');
+  const all: WorkContract[] = [];
+  for (let offset = 0; offset < 10_000; offset += 100) {
+    const page = listWorkContracts({ ...store, state: 'all', limit: 100, offset });
+    all.push(...page);
+    if (page.length < 100) break;
+    if (offset + 100 >= 10_000) throw new Error('GITHUB_SEMANTIC_WORK_INVENTORY_TOO_LARGE');
+  }
+  const children = all.filter((work) => work.semanticParentWorkId === releaseWorkId &&
+    work.lifecycleRole !== 'execution_child').sort((a, b) => a.workId.localeCompare(b.workId));
+
+  // The GitHub Issue is a projection; never import remote status back into Work.
+  if (Boolean(input.projectOwner) !== Boolean(input.projectNumber)) throw new Error('GITHUB_SEMANTIC_PROJECT_CONFIG_INCOMPLETE');
+  const repo = resolveGitHubRepository(repoRoot, input.repository);
+  const inventory = gh(repoRoot,
+    ['issue', 'list', '--repo', repo.nameWithOwner, '--state', 'all', '--limit', '1000',
+      '--json', 'number,url,title,body'], undefined, 4 * 1024 * 1024);
+  if (!inventory.ok) throw new Error('GITHUB_SEMANTIC_ISSUE_INVENTORY_FAILED: ' + (inventory.error || inventory.stderr));
+  const remote = JSON.parse(inventory.stdout) as RemoteIssue[];
+  if (!Array.isArray(remote) || remote.length === 1000) {
+    throw new Error('GITHUB_SEMANTIC_ISSUE_INVENTORY_UNBOUNDED');
+  }
+  let created = 0;
+  let updated = 0;
+  let unchanged = 0;
+  const tmp = mkdtempSync(join(tmpdir(), 'forge-semantic-github-'));
+  function ensureIssue(workId: string, title: string, body: string): string {
+    const matches = remote.filter((issue) => issue.body?.includes(marker(workId)));
+    if (matches.length > 1) throw new Error('GITHUB_SEMANTIC_DUPLICATE_REMOTE_IDENTITY: ' + workId);
+    const file = join(tmp, 'issue.md');
+    writeFileSync(file, body, 'utf8');
+    let link: GitHubIssueLink;
+    if (matches.length === 1) {
+      const current = matches[0]!;
+      link = { owner: repo.owner, repo: repo.repo, number: current.number, url: current.url, syncedAt: '' };
+      if (current.title === title && current.body === body) unchanged++;
+      else { link = updateGitHubIssue(repoRoot, repo, link, title, file); updated++; }
+    } else {
+      link = createGitHubIssue(repoRoot, repo, title, file, []);
+      remote.push({ number: link.number, title, body, url: link.url });
+      created++;
+    }
+    if (input.projectOwner && input.projectNumber) {
+      addProjectItem(repoRoot, link, input.projectOwner, input.projectNumber);
+    }
+    return link.url;
+  }
+  try {
+    const linked = children.map((work) => ({
+      workId: work.workId,
+      title: workDisplayTitle(work, home),
+      issue: ensureIssue(work.workId, workDisplayTitle(work, home),
+        semanticWorkText(work, home)),
+    }));
+    const counts = {
+      open: children.filter((work) => work.semanticState === 'open').length,
+      completed: children.filter((work) => work.semanticState === 'completed').length,
+      cancelled: children.filter((work) => work.semanticState === 'cancelled').length,
+    };
+    const releaseBody = semanticWorkText(parent, home) + '\n## 版本关联工作\n' +
+      (linked.length
+        ? linked.map((child) => '- [' + child.title + '](' + child.issue + ') — \`' + child.workId + '\`').join('\n')
+        : '- 暂无已关联子 Work') +
+      '\n\n## 版本进度（真实 Work 事实，不是提交/发布证明）\n' +
+      '- 关联：' + linked.length + '\n- Open：' + counts.open +
+      '\n- Completed：' + counts.completed + '\n- Cancelled：' + counts.cancelled + '\n';
+    const releaseIssue = ensureIssue(releaseWorkId, workDisplayTitle(parent, home), releaseBody);
+    return { releaseIssue, children: linked, created, updated, unchanged };
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+  }
+}

package/src/cli/hook/prompt-intents.ts

@@ -465,15 +465,6 @@ export function isAgenticPackagingIntent(ctx: PromptIntentContext): boolean {
   return AGENTIC_PACKAGING.test(ctx.text);
 }
 
-const CODEGRAPH_ROUTE = re(
-  String.raw`(who calls|what calls|callers|callees|impact|impact radius|trace\s+(flow|path|call)|where\s.*(defined|definition)|definition of|symbol named|调用关系|谁调用|调用了谁|哪里定义|定义在哪|影响面|调用链|追踪(路径|调用|链)|从.*到.*怎么走)`,
-);
-
-export function isCodegraphRouteIntent(ctx: PromptIntentContext): boolean {
-  if (isTriggerQuestionPrompt(ctx)) return false;
-  return CODEGRAPH_ROUTE.test(ctx.text);
-}
-
 const GIT_STATUS_LINE = re(
   String.raw`^${SP}*(git\s+(status|log|show|diff|push|pull|commit)|status|commit|push|merge|提交|推送|合并|看状态|看看状态)(${SP}|$)`,
 );

package/src/cli/index.ts

@@ -15,7 +15,6 @@ import { CLI_VERSION, formatStatus, runStatus } from './commands/status';
 import { formatDoctor, runDoctor } from './commands/doctor';
 import { buildSetupCommand, formatInitHook, runInitHook } from './commands/init-hook';
 import { formatMigratePlan, runMigrate } from './commands/migrate';
-import { buildToolsCommand } from './commands/tools';
 import { buildPluginCommand } from './commands/plugin';
 import { buildComputerCommand } from './commands/computer';
 import { buildBrainCommand } from './commands/brain';
@@ -73,10 +72,7 @@ const VALID_LOCATIONS: readonly Location[] = ['global', 'local'];
 interface GlobalRuntimeCommandOptions {
   target: string;
   cli?: boolean;
-  syncSkill?: boolean;
   hooks?: string | false;
-  withExternalSkills?: boolean;
-  codegraph?: boolean;
   brainRoot?: string;
   json?: boolean;
 }
@@ -91,10 +87,7 @@ function runGlobalRuntimeBootstrap(commandName: 'init' | 'install', rawOpts: Glo
   const result = runGlobalRuntimeSetup({
     target: rawOpts.target as InstallTargetSpec,
     installCli: rawOpts.cli !== false,
-    syncSkill: rawOpts.syncSkill !== false,
     hostAdapters: rawOpts.hooks !== false,
-    externalSkills: rawOpts.withExternalSkills === true,
-    codegraph: rawOpts.codegraph !== false,
     brainRoot: rawOpts.brainRoot,
   });
   if (rawOpts.json === true) {
@@ -117,19 +110,14 @@ export function buildProgram(): Command {
   program
     .command('update')
     .description('Update the global Forge CLI and user-level managed runtime')
-    .option('--target <target>', `Host target for adapters and runtime skills: ${VALID_TARGETS.join('|')}`, 'both')
+    .option('--target <target>', `Host target for adapters: ${VALID_TARGETS.join('|')}`, 'both')
     .option('--version <version>', 'Install a specific Forge package version')
     .option('--channel <channel>', 'Install package channel: latest|next')
     .option('--check', 'Run the read-only setup check without refreshing runtime')
     .option('--check-updates', 'Include network-backed version update advisories in setup check output')
     .option('--no-runtime-refresh', 'Skip runtime refresh and run the read-only setup check only')
     .option('--no-cli', 'Skip installing the Forge CLI globally')
-    .option('--no-sync-skill', 'Skip refreshing Forge host skill aliases')
     .option('--no-hooks', 'Skip global hook adapter installation')
-    .option('--with-external-skills', 'Also bootstrap third-party Waza, Mermaid, and cross-review skills')
-    .option('--no-external-skills', 'Compatibility no-op; update no longer bootstraps third-party skills by default')
-    .option('--configure-codegraph', 'Also configure CodeGraph CLI/MCP during runtime refresh')
-    .option('--no-codegraph', 'Compatibility no-op; update no longer configures CodeGraph by default')
     .option('--brain-root <path>', 'Brain vault root for manifest sync')
     .option('--repo <path>', 'Deprecated: use forge adopt --repo <path>')
     .option('--dry-run', 'Deprecated: use forge adopt --dry-run for repo-level planning')
@@ -145,11 +133,7 @@ export function buildProgram(): Command {
       checkUpdates?: boolean;
       runtimeRefresh?: boolean;
       cli?: boolean;
-      syncSkill?: boolean;
       hooks?: string | false;
-      withExternalSkills?: boolean;
-      codegraph?: boolean;
-      configureCodegraph?: boolean;
       brainRoot?: string;
       interactive?: boolean;
       json?: boolean;
@@ -187,10 +171,7 @@ export function buildProgram(): Command {
         target: rawOpts.target as InstallTargetSpec,
         installCli: rawOpts.cli !== false,
         installSpec,
-        syncSkill: rawOpts.syncSkill !== false,
         hostAdapters: rawOpts.hooks !== false,
-        externalSkills: rawOpts.withExternalSkills === true,
-        codegraph: rawOpts.configureCodegraph === true,
         brainRoot: rawOpts.brainRoot,
       });
       if (rawOpts.json === true) {
@@ -210,16 +191,11 @@ export function buildProgram(): Command {
     .option('--transaction <path>', 'Adoption transaction manifest to restore when action is rollback')
     .option('--dry-run', 'Plan Forge changes without applying them')
     .option('--target <target>', `Host target for readiness checks and optional global bootstrap: ${VALID_TARGETS.join('|')}`, 'both')
-    .option('--no-sync-skill', 'Compatibility no-op; adopt never refreshes user-level skill aliases')
     .option('--no-host-adapters', 'Compatibility no-op; adopt never writes global Codex/Claude hook adapters')
-    .option('--no-external-skills', 'Compatibility no-op; adopt never bootstraps user-level external skills')
     .option('--no-verify', 'Skip repo workflow verification after apply')
-    .option('--no-codegraph', 'Skip building the CodeGraph index and MCP readiness check')
     .option('--reclaim-runtime', 'Reclaim generated repo-local hook/helper runtime copies after replacement paths verify')
     .option('--compact', 'Compact repo surface; includes --reclaim-runtime plus package script rewrite')
     .option('--mode <mode>', 'Adoption mode: minimal|standard|self-host', 'standard')
-    .option('--configure-codegraph', 'Deprecated: user-level MCP config belongs to Forge update/setup')
-    .option('--sync-codegraph', 'Sync the CodeGraph index after ensure')
     .option('--brain-root <path>', 'Deprecated: user-level brain config belongs to Forge update/setup')
     .option('--brain-mode <mode>', 'Deprecated: adopt does not perform user-level brain sync', 'skip')
     .option('--interactive', 'Run the numbered interactive install planner')
@@ -231,16 +207,11 @@ export function buildProgram(): Command {
       transaction?: string;
       dryRun?: boolean;
       target: string;
-      syncSkill?: boolean;
       hostAdapters?: boolean;
-      withExternalSkills?: boolean;
       verify?: boolean;
-      codegraph?: boolean;
       reclaimRuntime?: boolean;
       compact?: boolean;
       mode?: string;
-      configureCodegraph?: boolean;
-      syncCodegraph?: boolean;
       brainRoot?: string;
       brainMode?: string;
       interactive?: boolean;
@@ -294,10 +265,6 @@ export function buildProgram(): Command {
         console.error('forge adopt: invalid --mode (expected: minimal, standard, self-host)');
         process.exit(2);
       }
-      if (rawOpts.configureCodegraph === true) {
-        console.error('forge adopt: --configure-codegraph writes user-level MCP config; run forge update instead');
-        process.exit(2);
-      }
       if (rawOpts.brainRoot || rawOpts.brainMode !== 'skip') {
         console.error('forge adopt: brain configuration writes user-level state; run forge update instead');
         process.exit(2);
@@ -347,13 +314,8 @@ export function buildProgram(): Command {
         repo: rawOpts.repo,
         apply: rawOpts.dryRun !== true,
         target: rawOpts.target as InstallTargetSpec,
-        syncSkill: false,
         hostAdapters: false,
-        externalSkills: false,
         verify: rawOpts.verify !== false,
-        codegraph: rawOpts.codegraph !== false,
-        configureCodegraphMcp: false,
-        syncCodegraph: rawOpts.syncCodegraph === true,
         brainRoot: rawOpts.brainRoot,
         brainMode: rawOpts.brainMode as InitBrainMode,
       };
@@ -392,10 +354,7 @@ export function buildProgram(): Command {
     .option('--target <target>', `Target host: ${VALID_TARGETS.join('|')}`, 'both')
     .option('--location <location>', `Adapter-only install location: ${VALID_LOCATIONS.join('|')}`)
     .option('--no-cli', 'Skip installing the Forge CLI globally')
-    .option('--no-sync-skill', 'Skip refreshing Forge host skill aliases')
     .option('--no-hooks', 'Skip global hook adapter installation during full runtime install')
-    .option('--with-external-skills', 'Also install optional third-party Waza/Mermaid skills and Forge cross-review helpers')
-    .option('--no-codegraph', 'Skip CodeGraph CLI/MCP configuration')
     .option('--brain-root <path>', 'Brain vault root to persist for Forge brain commands')
     .option('--json', 'Output JSON instead of human-readable text')
     .action((rawOpts: GlobalRuntimeCommandOptions & { location?: string }) => {
@@ -509,7 +468,6 @@ export function buildProgram(): Command {
       process.exit(rawOpts.strict === true && strictFailure ? 1 : 0);
     });
 
-  program.addCommand(buildToolsCommand());
   program.addCommand(buildPluginCommand());
   program.addCommand(buildComputerCommand());
   program.addCommand(buildBrainCommand(), { hidden: true });

package/src/cli/local-bridge/connector-freshness.ts

@@ -19,7 +19,7 @@ import {
   loadMcpLocalConfig,
   loadMcpServiceLocalConfig,
 } from '../../../adapters/mcp/auth';
-import { PREFERRED_FACADE_TOOL_NAMES, DEFAULT_CONTROLLER_TOOL_NAMES } from '../../../adapters/mcp/toolset-names';
+import { PREFERRED_FACADE_TOOL_NAMES } from '../../../adapters/mcp/toolset-names';
 import { resolveRepoPreferredControllerHome } from '../repositories/controller-home';
 import type { PlainStatusTone } from './console-view-models';
 
@@ -37,8 +37,6 @@ export const OPTIONAL_INTERACTIVE_DEVELOPMENT_TOOLS = [
   'process_wait',
 ] as const;
 
-/** @deprecated Prefer ADVANCED_CONTROLLER_TOOL_NAMES; kept for import stability. */
-export const CORE_SURFACE_INTERACTIVE_TOOLS = OPTIONAL_INTERACTIVE_DEVELOPMENT_TOOLS;
 
 export type ConnectorFreshnessStatus =
   | 'local_mcp_updated'
@@ -479,15 +477,6 @@ function finalize(
   return report;
 }
 
-/**
- * Build local tool names from the in-process controller registry (not ChatGPT).
- * Uses expectedTools when provided; otherwise falls back to the stable default exposure.
- */
-export function localControllerToolNames(expectedTools?: readonly string[]): string[] {
-  if (expectedTools && expectedTools.length > 0) return uniqueSorted(expectedTools);
-  return uniqueSorted([...DEFAULT_CONTROLLER_TOOL_NAMES]);
-}
-
 export function buildLocalConnectorStatus(input: {
   expectedTools: readonly string[];
   connectorToolNames?: readonly string[] | null;

package/src/cli/local-bridge/console-automations.ts

@@ -138,7 +138,7 @@ function occurrenceHistory(occurrences: ScheduleOccurrence[]): ConsoleAutomation
 }
 
 function scheduleMode(schedule: RepositorySchedule): ConsoleAutomationMode {
-  if (schedule.action.operation === 'external_controller_wake') return 'continuation';
+  if (schedule.action.operation === 'external_controller_wake' || schedule.action.operation === 'controller_progression') return 'continuation';
   if (schedule.action.operation === 'browser_probe') return schedule.action.arguments?.keepalive_only === true ? 'browser_keepalive' : 'browser_watch';
   return 'schedule';
 }

package/src/cli/local-bridge/console-view-models.ts

@@ -243,7 +243,7 @@ export interface AccessStateViewModel {
   configuredAccessModeLabel: string;
   effectiveAccessMode: 'request' | 'full_access';
   effectiveAccessModeLabel: string;
-  effectiveToolset: 'facade' | 'core' | 'advanced' | 'full';
+  effectiveToolset: 'full';
   exposureRevision: number;
   lastAppliedAt?: string;
   source: string;

package/src/cli/local-bridge/facade-api.ts

@@ -598,8 +598,6 @@ function controllerAccessStateView(ctx: ConsoleFacadeContext): AccessStateViewMo
   const effective = resolveControllerAccessState({
     controllerHome: ctx.controllerHome,
     repoRoot: ctx.repository.canonicalRoot,
-    toolsetOverride: toolCtx.toolset,
-    toolsetLocked: toolCtx.toolsetLocked,
   });
   const repositoryPolicy = readRepositoryAccessPolicy(ctx.controllerHome, ctx.repository.repoId);
   const runtimeGeneration = readRuntimeGeneration(ctx.controllerHome);

package/src/cli/repositories/command-classifier.ts

@@ -255,11 +255,6 @@ function readOnlyGitSegment(words: string[], _segment: string): boolean {
   return isReadOnlyGitCommand(words);
 }
 
-function isReadOnlyCodegraphCommand(words: string[]): boolean {
-  const program = words[0]?.split(/[\\/]/).at(-1)?.toLowerCase();
-  return program === 'codegraph' && words[1]?.toLowerCase() === 'status';
-}
-
 function githubCliApiMethod(words: string[]): string | undefined {
   for (let index = 2; index < words.length; index += 1) {
     const word = words[index]?.toLowerCase();
@@ -315,7 +310,6 @@ function isReadOnlySegment(segment: string): boolean {
   const program = words[0]?.toLowerCase();
   if (!program) return false;
   if (program === 'git') return readOnlyGitSegment(words, segment);
-  if (isReadOnlyCodegraphCommand(words)) return true;
   if (program === 'curl') return isReadOnlyLoopbackCurl(words);
   if (program === 'sqlite3') return isSafeReadOnlySqliteSegment(segment);
   if (program === 'find') return !/(?:-delete|-exec|-execdir|-ok|-okdir)\b/.test(segment);
@@ -621,9 +615,6 @@ function classifyArgvCommand(
   if (program === 'git' && isReadOnlyGitCommand(argv)) {
     return { risk: 'readonly', confirmation: 'none', reasons: ['the argv command is a recognized repository-local read operation'] };
   }
-  if (isReadOnlyCodegraphCommand(argv)) {
-    return { risk: 'readonly', confirmation: 'none', reasons: ['CodeGraph status only observes the local semantic index'] };
-  }
   if (program === 'curl' && isReadOnlyLoopbackCurl(argv)) {
     return { risk: 'readonly', confirmation: 'none', reasons: ['curl performs a read-only loopback HTTP observation without writing response data to disk'] };
   }

package/src/cli/repositories/command-scope.ts

@@ -184,13 +184,13 @@ function assertNoUnmanagedControllerWorktreeLifecycle(command: CanonicalReposito
   };
   if (command.kind === 'argv') {
     if (isGitWorktreeAdd([command.executable!, ...(command.args ?? [])])) {
-      throw new Error('MANAGED_WORKSPACE_REQUIRED: repository_command_execute must not create an unmanaged temporary git worktree; use rh_work so Forge persists checkout/worktree ownership and terminal cleanup authority');
+      throw new Error('MANAGED_WORKSPACE_REQUIRED: execute_command must not create an unmanaged temporary git worktree; use rh_work so Forge persists checkout/worktree ownership and terminal cleanup authority');
     }
     return;
   }
   for (const segment of shellSegments(command.shellCommand ?? '')) {
     if (isGitWorktreeAdd(shellWords(segment))) {
-      throw new Error('MANAGED_WORKSPACE_REQUIRED: repository_command_execute must not create an unmanaged temporary git worktree; use rh_work so Forge persists checkout/worktree ownership and terminal cleanup authority');
+      throw new Error('MANAGED_WORKSPACE_REQUIRED: execute_command must not create an unmanaged temporary git worktree; use rh_work so Forge persists checkout/worktree ownership and terminal cleanup authority');
     }
   }
 }

package/src/cli/repositories/locks.ts

@@ -150,6 +150,26 @@ export function readControllerLock(controllerHome: string, key: ControllerLockKe
   return record;
 }
 
+export function renewControllerLock(
+  controllerHome: string,
+  key: ControllerLockKey,
+  lockId: string,
+  ttlMs: number,
+): ControllerLockRecord {
+  const current = readControllerLock(controllerHome, key);
+  if (!current) throw new Error(`LOCK_NOT_FOUND: ${lockId}`);
+  if (current.lockId !== lockId) throw new Error(`LOCK_OWNERSHIP_MISMATCH: ${current.lockId}`);
+  const normalizedTtlMs = Math.max(5_000, Math.trunc(ttlMs));
+  const heartbeatAt = new Date().toISOString();
+  const next: ControllerLockRecord = {
+    ...current,
+    heartbeatAt,
+    expiresAt: new Date(Date.now() + normalizedTtlMs).toISOString(),
+  };
+  writeFileSync(current.path, `${JSON.stringify(next, null, 2)}\n`, 'utf-8');
+  return next;
+}
+
 function metric(key: ControllerLockKey, waitedMs: number, outcome: 'success' | 'contention' | 'timeout'): void {
   recordGatewayLatency({
     repoId: key.repoId,

package/src/cli/repositories/registry.ts

@@ -93,7 +93,8 @@ function now(): string {
 
 function comparablePath(value: string): string {
   const resolved = resolve(value);
-  return process.platform === 'darwin' && resolved.startsWith('/var/')
+  // macOS /tmp and /var are symlinks into /private; compare both aliases canonically.
+  return process.platform === 'darwin' && (/^\/(?:tmp|var)(?:\/|$)/.test(resolved))
     ? `/private${resolved}`
     : resolved;
 }

package/src/cli/repositories/safe-patch.ts

@@ -4,6 +4,7 @@ import { join, relative, resolve } from 'path';
 import {
   adoptEditSessionSuccessorHead,
   applyEditOperations,
+  findOccurrence,
   beginEditSession,
   getEditSession,
   type EditSession,
@@ -11,7 +12,7 @@ import {
   type EditSessionPatchError,
 } from '../editing/edit-session';
 import { normalizeEditOperation, type EditOperation } from '../editing/edit-operation-contract';
-import { getMcpPolicy } from '../mcp/policy';
+import { getMcpPolicy } from '../../../adapters/mcp/policy';
 import type { RepositoryRecord } from './types';
 import { ensureRepositoryRuntimeStorageBinding } from './runtime-storage';
 
@@ -189,17 +190,6 @@ function snippetAround(content: string, needle: string): SafePatchFailureContext
   return { line: lineIndex + 1, before, focus, after };
 }
 
-function findOccurrence(value: string, anchor: string, occurrence: number): number {
-  let from = 0;
-  for (let current = 1; current <= occurrence; current += 1) {
-    const index = value.indexOf(anchor, from);
-    if (index < 0) return -1;
-    if (current === occurrence) return index;
-    from = index + anchor.length;
-  }
-  return -1;
-}
-
 function applyTextPreview(operation: Exclude<EditOperation, { type: 'create' | 'write' | 'delete' }>, before: string): string {
   if (operation.type === 'replace') {
     let after = before;

package/src/cli/repositories/structured-git.ts

@@ -154,7 +154,7 @@ export function resolveRepositoryGitCommitScope(
   return { source: 'staged_index', paths: repositoryGitStagedPaths(repository) };
 }
 
-function splitStatus(porcelain: string): { staged: string[]; unstaged: string[]; untracked: string[] } {
+export function splitRepositoryGitStatus(porcelain: string): { staged: string[]; unstaged: string[]; untracked: string[] } {
   const staged: string[] = [];
   const unstaged: string[] = [];
   const untracked: string[] = [];
@@ -174,7 +174,7 @@ function splitStatus(porcelain: string): { staged: string[]; unstaged: string[];
 export function repositoryGitStatus(repository: RepositoryRecord): RepositoryGitStatusSnapshot {
   const observedAt = new Date().toISOString();
   const porcelain = runGit(repository, ['status', '--porcelain=v1', '--branch', '--untracked-files=all', '--', '.', ':(exclude).ai/harness/**']).stdout;
-  const split = splitStatus(porcelain);
+  const split = splitRepositoryGitStatus(porcelain);
   return {
     repoId: repository.repoId,
     checkoutId: repository.activeCheckoutId,
@@ -185,7 +185,9 @@ export function repositoryGitStatus(repository: RepositoryRecord): RepositoryGit
     head: gitText(repository, ['rev-parse', '--verify', 'HEAD']),
     upstream: gitText(repository, ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}']),
     porcelain,
-    shortStatus: runGit(repository, ['status', '--short', '--branch', '--untracked-files=all', '--', '.', ':(exclude).ai/harness/**']).stdout,
+    // Git porcelain v1 with --branch uses the same short-status layout. Reuse
+    // the authoritative status snapshot instead of spawning Git a second time.
+    shortStatus: porcelain,
     ...split,
     clean: split.staged.length === 0 && split.unstaged.length === 0 && split.untracked.length === 0,
   };
@@ -214,6 +216,40 @@ export function repositoryGitDiff(repository: RepositoryRecord, input: { staged?
   };
 }
 
+/**
+ * One Git-index/worktree candidate view for Work inspection and check selection.
+ * Untracked paths are explicit evidence; Git cannot provide their patch before add.
+ * Keep both index slices visible while bounding the aggregate patch size.
+ */
+export function repositoryGitWorkspaceChanges(
+  repository: RepositoryRecord,
+  maxBytes = 64 * 1024,
+): {
+  status: RepositoryGitStatusSnapshot;
+  staged: RepositoryGitDiffResult;
+  unstaged: RepositoryGitDiffResult;
+  changedPaths: string[];
+  diff: { nameOnly: string[]; stat: string; patch: string; truncated: boolean };
+} {
+  const status = repositoryGitStatus(repository);
+  const sliceBytes = Math.max(1024, Math.floor(boundedOutputBytes(maxBytes) / 2));
+  const staged = repositoryGitDiff(repository, { staged: true, maxBytes: sliceBytes });
+  const unstaged = repositoryGitDiff(repository, { maxBytes: sliceBytes });
+  const changedPaths = [...new Set([...staged.nameOnly, ...unstaged.nameOnly, ...status.untracked])].sort();
+  return {
+    status,
+    staged,
+    unstaged,
+    changedPaths,
+    diff: {
+      nameOnly: changedPaths,
+      stat: [staged.stat, unstaged.stat].filter(Boolean).join('\n'),
+      patch: [staged.patch, unstaged.patch].filter(Boolean).join('\n'),
+      truncated: staged.truncated || unstaged.truncated,
+    },
+  };
+}
+
 export function repositoryGitCreateBranch(controllerHome: string, repository: RepositoryRecord, input: { branch: unknown; startPoint?: unknown; switchTo?: unknown }): { branch: string; execution: RepositoryGitExecution } {
   const branch = assertSafeBranchName(input.branch);
   const startPoint = typeof input.startPoint === 'string' && input.startPoint.trim() ? input.startPoint.trim() : undefined;