@moretea-labs/forge 1.8.1 → 1.8.2

package/src/runtime/evidence/sensitive-output.ts

@@ -59,8 +59,8 @@ const SENSITIVE_PATTERNS: readonly SensitivePattern[] = [
   },
   {
     type: 'secret_assignment',
-    pattern: /((?:^|[^\w]))(["']?)([A-Za-z0-9_.-]*(?:api[_-]?key|access[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key|password|passwd|secret|credentials?|auth[_-]?token|token|cookie)[A-Za-z0-9_.-]*)\2(\s*(?:=>|:=|=|:)\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,}\r\n]+)/gim,
-    replacement: '$1$2$3$2$4[REDACTED]',
+    pattern: /((?:^|[^\w]))(["']?)([A-Za-z0-9_.-]*(?:api[_-]?key|access[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|private[_-]?key|password|passwd|secret|credentials?|auth[_-]?token|token|cookie)[A-Za-z0-9_.-]*)\2(\s*(?:=>|:=|=|:)\s*)((?:[A-Z][A-Za-z0-9_]*(?:[?!])?\s*=\s*)?)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,}\r\n]+)/gim,
+    replacement: '$1$2$3$2$4$5[REDACTED]',
   },
   {
     type: 'database_url_assignment',
@@ -136,6 +136,26 @@ export function redactSensitiveText(input: string): SensitiveTextRedactionResult
   let text = input;
   const counts = new Map<string, number>();
   for (const entry of SENSITIVE_PATTERNS) {
+    if (entry.type === 'secret_assignment') {
+      let redactions = 0;
+      text = text.replace(entry.pattern, (matched, boundary: string, quote: string, key: string, separator: string, typeDefault: string) => {
+        // Preserve non-credential data flow even when a source symbol ends in "Token".
+        // An unquoted floating-point counter or a reference to the local token
+        // variable is not a secret literal. Keep unknown opaque/quoted token values
+        // redacted, including compound token keys, rather than whitelisting names.
+        const prefix = `${boundary}${quote}${key}${quote}${separator}${typeDefault}`;
+        const rhs = matched.slice(prefix.length);
+        const genericToken = /token$/i.test(key) && !/^(?:token|(?:api|access|refresh|auth|session|bearer|csrf|id|jwt|oauth)[_-]?token)$/i.test(key);
+        const sourceCounter = /^[+-]?(?:\d+\.\d*|\.\d+)(?:e[+-]?\d+)?[;)]?$/i.test(rhs);
+        const sourceReference = /^token[;)]?$/.test(rhs);
+        const sourceType = separator.trim() === ':' && !typeDefault && /^(?:Double|Float|Int|Int8|Int16|Int32|Int64|Bool|String|Character|CGFloat|Date|UUID)[?!]?[),{;]?$/.test(rhs);
+        if (genericToken && (sourceCounter || sourceReference || sourceType)) return matched;
+        redactions += 1;
+        return `${prefix}[REDACTED]`;
+      });
+      if (redactions) counts.set(entry.type, (counts.get(entry.type) ?? 0) + redactions);
+      continue;
+    }
     const matches = text.match(entry.pattern);
     if (!matches?.length) continue;
     counts.set(entry.type, (counts.get(entry.type) ?? 0) + matches.length);

package/src/runtime/execution/jobs/child-reference.ts

@@ -38,6 +38,17 @@ export function isAgentDelegationLocalAction(action: string | undefined): boolea
   return AGENT_DELEGATION_LOCAL_ACTIONS.has(action);
 }
 
+/** Shared delegation classification for Scheduler replay and durable receipt recovery. */
+export function isAgentDelegationJob(job: ExecutionJob): boolean {
+  return isAgentDelegationOperation(job.payload.operation)
+    || job.type === 'agent-run'
+    || job.type === 'dispatch-task'
+    || job.payload.arguments?.agentDelegation === true
+    || (job.payload.operation === 'legacy-local-job'
+      && typeof job.payload.arguments?.localAction === 'string'
+      && isAgentDelegationLocalAction(job.payload.arguments.localAction));
+}
+
 function stringField(value: unknown): string | undefined {
   if (typeof value !== 'string') return undefined;
   const trimmed = value.trim();

package/src/runtime/execution/jobs/receipt-recovery.ts

@@ -4,7 +4,7 @@ import {
   childReferenceFromJob,
   childReferenceFromReceipt,
   hasDurableChildReference,
-  isAgentDelegationOperation,
+  isAgentDelegationJob,
   mergeChildReferences,
 } from './child-reference';
 import { operationReceiptMatchesJobOwnership, readOperationReceipt } from './receipt-store';
@@ -18,16 +18,6 @@ export type RecoveredReceiptOutcome = {
   outcome: 'succeeded' | 'failed' | 'delegated';
 };
 
-function isAgentDelegationJob(job: ExecutionJob): boolean {
-  return isAgentDelegationOperation(job.payload.operation)
-    || job.type === 'agent-run'
-    || job.type === 'dispatch-task'
-    || job.payload.arguments?.agentDelegation === true
-    || (job.payload.operation === 'legacy-local-job'
-      && typeof job.payload.arguments?.localAction === 'string'
-      && ['launch-task', 'quick-agent-session'].includes(String(job.payload.arguments.localAction)));
-}
-
 /**
  * Recover a running Job from a matching completed/delegated Worker receipt.
  *

package/src/runtime/execution/process-runtime/command-facade.ts

@@ -1,5 +1,5 @@
 /**
- * repository_command_execute → three explicit execution lanes.
+ * execute_command → three explicit execution lanes.
  *
  * - Ephemeral Direct: bounded ordinary reads and commands that finish inside
  *   the interactive budget.
@@ -345,7 +345,7 @@ export async function executeRepositoryCommandViaProcessRuntime(
       durableSideEffects: emptyEffects,
       suggestedOperation: decision.reason === 'standalone_recovery_lifecycle_required'
         ? 'Use the standalone Forge Recovery connector for canonical Runtime/connector lifecycle operations.'
-        : 'repository_command_execute via Durable Work / Local Job',
+        : 'execute_command via Durable Work / Local Job',
       externalEffect: decision.route === 'durable'
         ? {
             outcome: 'not_started',
@@ -550,7 +550,7 @@ export async function executeRepositoryCommandViaProcessRuntime(
     resourceClaims: toProcessClaims(claims),
     origin: {
       surface: 'command',
-      toolName: 'repository_command_execute',
+      toolName: 'execute_command',
       requestId: input.requestId,
       correlationId: input.workId,
     },

package/src/runtime/execution/process-runtime/runtime.ts

@@ -1584,17 +1584,19 @@ export async function spawnManagedProcess(input: SpawnManagedProcessInput): Prom
   }
 
   const completed = await new Promise<ManagedProcessRecord | 'timeout'>((resolve) => {
-    const timer = setTimeout(() => resolve('timeout'), interactiveWaitMs);
-    timer.unref?.();
-    monitor.waiters.push((done) => {
+    const finish = (done: ManagedProcessRecord | 'timeout') => {
       clearTimeout(timer);
+      const index = monitor.waiters.indexOf(finish);
+      if (index >= 0) monitor.waiters.splice(index, 1);
       resolve(done);
-    });
+    };
+    const timer = setTimeout(() => finish('timeout'), interactiveWaitMs);
+    timer.unref?.();
+    monitor.waiters.push(finish);
     if (monitor.settled) {
       const current = getProcessRecord(input.controllerHome, input.repoId, processId);
       if (current?.terminalWritten) {
-        clearTimeout(timer);
-        resolve(current);
+        finish(current);
       }
     }
   });
@@ -1693,27 +1695,29 @@ export async function waitForProcess(
   if (monitor) {
     const waitMs = options.timeoutMs ?? existing.timeoutMs;
     const done = await new Promise<ManagedProcessRecord | 'timeout'>((resolve) => {
-      const timer = setTimeout(() => resolve('timeout'), Math.max(1, waitMs));
+      const finish = (record: ManagedProcessRecord | 'timeout') => {
+        clearTimeout(timer);
+        options.signal?.removeEventListener('abort', onAbort);
+        const index = monitor.waiters.indexOf(finish);
+        if (index >= 0) monitor.waiters.splice(index, 1);
+        resolve(record);
+      };
+      const timer = setTimeout(() => finish('timeout'), Math.max(1, waitMs));
       timer.unref?.();
       const onAbort = () => {
         clearTimeout(timer);
         void cancelProcess(controllerHome, repoId, processId).then(() => {
           const current = getProcessRecord(controllerHome, repoId, processId);
-          if (current) resolve(current);
-          else resolve('timeout');
+          if (current) finish(current);
+          else finish('timeout');
         });
       };
       options.signal?.addEventListener('abort', onAbort, { once: true });
-      monitor.waiters.push((record) => {
-        clearTimeout(timer);
-        options.signal?.removeEventListener('abort', onAbort);
-        resolve(record);
-      });
+      monitor.waiters.push(finish);
       if (monitor.settled) {
         const current = getProcessRecord(controllerHome, repoId, processId);
         if (current?.terminalWritten) {
-          clearTimeout(timer);
-          resolve(current);
+          finish(current);
         }
       }
     });

package/src/runtime/execution/thin-harness/execution-router.ts

@@ -317,7 +317,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
   }
 
   if (commandLooksDestructive(input.command) || operation.includes('destructive')) {
-    if (input.approvalContinuation === true && operation === 'repository_command_execute') {
+    if (input.approvalContinuation === true && operation === 'execute_command') {
       return decisionBase({
         mode: 'durable',
         reasons: ['destructive_approval_continuation'],
@@ -325,7 +325,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
         estimatedClass: 'unknown',
         requiresIsolation: true,
         requiresRecovery: false,
-        suggestedOperation: 'repository_command_execute through Durable Work / Local Job',
+        suggestedOperation: 'execute_command through Durable Work / Local Job',
         effects: {
           readsWorkspace: true,
           mutatesWorkspace: true,
@@ -342,7 +342,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
       requiresIsolation: true,
       requiresRecovery: false,
       rejectCode: 'DESTRUCTIVE_REJECTED',
-      suggestedOperation: 'repository_command_preview + explicit strong confirmation via Durable Work',
+      suggestedOperation: 'execute_command(dry_run=true) + explicit strong confirmation via Durable Work',
       effects: {
         readsWorkspace: true,
         mutatesWorkspace: true,
@@ -381,7 +381,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
 
   let commandEffectsValue: ExecutionEffects | undefined;
 
-  if (operation === 'repository_command_execute' || operation === 'run_short_command' || operation === 'run_focused_check') {
+  if (operation === 'execute_command' || operation === 'run_short_command' || operation === 'run_focused_check') {
     if (input.command !== undefined) {
       const classification = classifyRepositoryCommand(input.command, input.defaultBranch);
       const canonical = normalizeRepositoryCommand(input.command);
@@ -401,7 +401,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
           requiresIsolation: true,
           requiresRecovery: false,
           rejectCode: 'UNSAFE_SHELL',
-          suggestedOperation: 'repository_command_preview',
+          suggestedOperation: 'execute_command(dry_run=true)',
           effects: commandEffectsValue,
         }, operation);
       }
@@ -411,7 +411,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
       }
       if (classification.risk === 'remote_write') reasons.push('command_classified_remote_write');
       if (classification.risk === 'destructive') {
-        if (input.approvalContinuation === true && operation === 'repository_command_execute') {
+        if (input.approvalContinuation === true && operation === 'execute_command') {
           return decisionBase({
             mode: 'durable',
             reasons: ['destructive_approval_continuation', ...classification.reasons],
@@ -419,7 +419,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
             estimatedClass: 'unknown',
             requiresIsolation: true,
             requiresRecovery: false,
-            suggestedOperation: 'repository_command_execute through Durable Work / Local Job',
+            suggestedOperation: 'execute_command through Durable Work / Local Job',
             effects: commandEffectsValue,
           }, operation);
         }
@@ -431,7 +431,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
           requiresIsolation: true,
           requiresRecovery: false,
           rejectCode: 'DESTRUCTIVE_COMMAND',
-          suggestedOperation: 'repository_command_preview',
+          suggestedOperation: 'execute_command(dry_run=true)',
           effects: commandEffectsValue,
         }, operation);
       }
@@ -440,14 +440,14 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
         reasons.push('not_a_strict_focused_check');
       }
       if (classification.risk === 'workspace_write' && !focused && !safeShellCombo) {
-        if (operation === 'repository_command_execute' || operation === 'run_short_command' || operation === 'run_focused_check') {
+        if (operation === 'execute_command' || operation === 'run_short_command' || operation === 'run_focused_check') {
           reasons.push('mutating_or_unfocused_command');
         }
       }
       if (classification.risk !== 'readonly' && !focused && !safeShellCombo && !FAST_OPERATIONS.has(operation)) {
         reasons.push('untrusted_or_unclassified_command');
       }
-    } else if (operation === 'repository_command_execute' || operation === 'run_focused_check') {
+    } else if (operation === 'execute_command' || operation === 'run_focused_check') {
       reasons.push('missing_command');
     }
   }
@@ -564,7 +564,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
     }, operation);
   }
 
-  if (!FAST_OPERATIONS.has(operation) && operation !== 'repository_command_execute') {
+  if (!FAST_OPERATIONS.has(operation) && operation !== 'execute_command') {
     return decisionBase({
       mode: 'durable',
       reasons: ['operation_not_in_fast_allowlist'],
@@ -576,7 +576,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
     }, operation);
   }
 
-  if (operation === 'repository_command_execute' || operation === 'run_short_command' || operation === 'run_focused_check') {
+  if (operation === 'execute_command' || operation === 'run_short_command' || operation === 'run_focused_check') {
     if (input.command === undefined) {
       return decisionBase({
         mode: 'durable',
@@ -585,7 +585,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
         estimatedClass: 'unknown',
         requiresIsolation: false,
         requiresRecovery: false,
-        suggestedOperation: 'repository_command_execute via Durable Work',
+        suggestedOperation: 'execute_command via Durable Work',
       }, operation);
     }
     const classification = classifyRepositoryCommand(input.command, input.defaultBranch);
@@ -602,7 +602,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
         estimatedClass: 'long',
         requiresIsolation: false,
         requiresRecovery: false,
-        suggestedOperation: 'repository_command_execute via Durable Work / Local Job',
+        suggestedOperation: 'execute_command via Durable Work / Local Job',
         effects,
       }, operation);
     }
@@ -632,7 +632,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
       estimatedClass: 'long',
       requiresIsolation: false,
       requiresRecovery: false,
-      suggestedOperation: 'repository_command_execute via Durable Work / Local Job',
+      suggestedOperation: 'execute_command via Durable Work / Local Job',
       effects,
     }, operation);
   }
@@ -673,7 +673,7 @@ export function routeExecution(input: RouteExecutionInput): ExecutionDecision {
 function durableSuggestion(operation: string): string {
   if (operation === 'run_check' || operation === 'run_focused_check') return 'run_check through Durable Work';
   if (operation.includes('patch')) return 'repository_safe_patch_apply with apply_mode=async or Durable Work';
-  if (operation.includes('command')) return 'repository_command_execute through Durable Work / Local Job';
+  if (operation.includes('command')) return 'execute_command through Durable Work / Local Job';
   if (operation.includes('agent') || operation === 'quick_agent_session') return 'quick_agent_session / dispatch_task';
   return 'Durable Work (ExecutionJob path)';
 }

package/src/runtime/execution/thin-harness/fast-executor.ts

@@ -6,7 +6,7 @@ import {
   previewRepositoryCommandExecutionAsync,
   type RepositoryCommandSnapshot,
 } from '../../../cli/repositories/command-executor';
-import { getMcpPolicy } from '../../../cli/mcp/policy';
+import { getMcpPolicy } from '../../../../adapters/mcp/policy';
 import { readRepositoryRange } from '../../../cli/repository/inspector';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import { getLeaseSideEffectMetrics } from '../../resources/leases/store';
@@ -878,7 +878,7 @@ export async function executeFast(
       } else if (
         operation === 'run_short_command'
         || operation === 'run_focused_check'
-        || operation === 'repository_command_execute'
+        || operation === 'execute_command'
       ) {
         const command = request.input.command as string | string[];
         const preview = await trace.measure('policyMs', async () => previewRepositoryCommandExecutionAsync(ctx.repository, {

package/src/runtime/execution/thin-harness/search-worker.ts

@@ -4,8 +4,8 @@
  */
 import { isMainThread, parentPort, workerData, Worker } from 'worker_threads';
 import { fileURLToPath } from 'url';
-import { getMcpPolicy } from '../../../cli/mcp/policy';
-import type { McpPolicy } from '../../../cli/mcp/types';
+import { getMcpPolicy } from '../../../../adapters/mcp/policy';
+import type { McpPolicy } from '../../../../adapters/mcp/types';
 import {
   searchRepository,
   searchRepositoryMany,

package/src/runtime/execution/workers/executor.ts

@@ -518,8 +518,7 @@ export async function executeExecutionJob(controllerHome: string, job: Execution
       ...context,
       controllerHome,
       explicitRepository: repository,
-      toolset: job.payload.toolset === 'core' || job.payload.toolset === 'full' ? job.payload.toolset : 'advanced',
-      toolsetLocked: true,
+      toolset: 'full',
     };
     // Durable Work mutations execute through control-plane application services.
     // The Worker must never import MCP transport to obtain Work semantics.

package/src/runtime/maintenance/cleanup.ts

@@ -88,12 +88,42 @@ function isSafeForgeTemp(path: string): boolean {
   const name = basename(path);
   if (!name.startsWith('forge')) return false;
   const parent = dirname(path);
-  const allowedParents = new Set([resolve(tmpdir()), '/private/tmp', '/tmp']);
-  return allowedParents.has(resolve(parent));
+  const allowedParents = new Set([tmpdir(), '/private/tmp', '/tmp'].filter((root) => existsSync(root)).map((root) => realpathSync(root)));
+  try { return allowedParents.has(realpathSync(parent)); } catch { return false; }
+}
+
+// Temp cleanup cannot dispose of a Git worktree just because its directory
+// begins with "forge". Bounded traversal fails closed on nested repositories,
+// symlinks and uninspectable or high-cardinality source.
+function protectsGitSource(root: string): boolean {
+  const pending: Array<{ path: string; depth: number }> = [{ path: root, depth: 0 }];
+  let visited = 0;
+  while (pending.length > 0) {
+    const current = pending.pop()!;
+    if (++visited > 256) return true;
+    try {
+      const stat = lstatSync(current.path);
+      if (stat.isSymbolicLink()) return true;
+      if (!stat.isDirectory()) continue;
+      if (existsSync(join(current.path, '.git'))
+        || (existsSync(join(current.path, 'HEAD')) && existsSync(join(current.path, 'objects')) && existsSync(join(current.path, 'refs')))) return true;
+      const entries = readdirSync(current.path, { withFileTypes: true });
+      if (entries.length + visited > 256) return true;
+      for (const entry of entries) {
+        if (entry.isSymbolicLink()) return true;
+        if (!entry.isDirectory()) continue;
+        if (current.depth >= 5) return true;
+        pending.push({ path: join(current.path, entry.name), depth: current.depth + 1 });
+      }
+    } catch {
+      return true;
+    }
+  }
+  return false;
 }
 
 function scanTempDirs(minAgeMinutes: number, limit: number): RuntimeCleanupCandidate[] {
-  const roots = Array.from(new Set([tmpdir(), '/private/tmp', '/tmp'].filter((root) => existsSync(root)).map((root) => resolve(root))));
+  const roots = Array.from(new Set([tmpdir(), '/private/tmp', '/tmp'].filter((root) => existsSync(root)).map((root) => realpathSync(root))));
   const processes = processCommands();
   const at = Date.now();
   const candidates: RuntimeCleanupCandidate[] = [];
@@ -108,11 +138,14 @@ function scanTempDirs(minAgeMinutes: number, limit: number): RuntimeCleanupCandi
         if (!stat.isDirectory()) continue;
         const occupied = processes.find((process) => process.command.includes(path));
         const ageMinutes = Math.max(0, Math.round((at - stat.mtimeMs) / 60_000));
-        const safe = !occupied && ageMinutes >= minAgeMinutes;
+        const gitSourceProtected = protectsGitSource(path);
+        const safe = !occupied && ageMinutes >= minAgeMinutes && !gitSourceProtected;
         candidates.push({
           kind: 'temp_dir',
           path,
-          reason: safe
+          reason: gitSourceProtected
+            ? 'Git worktree, repository, symlink or uninspectable source is protected; use its Work/Git owner.'
+            : safe
             ? `Forge temp directory is older than ${minAgeMinutes} minutes and not referenced by a running process.`
             : 'Temp directory is too new or still referenced by a running process.',
           ageMinutes,
@@ -368,6 +401,9 @@ export function applyRuntimeCleanup(repoRoot: string, options: RuntimeCleanupOpt
   const applied: Array<RuntimeCleanupCandidate & { applied: boolean; error?: string }> = eligible.slice(0, normalized.maxRemovals).map((candidate) => {
     try {
       if (candidate.kind === 'temp_dir' && candidate.path && isSafeForgeTemp(candidate.path)) {
+        // A preview is not a mutation lease. Recheck source and liveness.
+        if (protectsGitSource(candidate.path)) throw new Error('RUNTIME_CLEANUP_GIT_SOURCE_PROTECTED');
+        if (processCommands().some((process) => process.command.includes(candidate.path!))) throw new Error('RUNTIME_CLEANUP_TEMP_PROCESS_OCCUPIED');
         rmSync(candidate.path, { recursive: true, force: true });
         return { ...candidate, applied: true };
       }

package/src/runtime/plugins/action-application.ts

@@ -16,6 +16,8 @@ import {
   getControllerPluginManifest,
   isDirectNonPersistentPluginAction,
   isDirectPluginReadAction,
+  preflightPluginActionWorkBinding,
+  readPluginActionReceiptForRequest,
   submitAssistantPluginAction,
   submitControllerPluginAction,
 } from './store';
@@ -112,6 +114,12 @@ export async function executeAssistantPluginActionApplication(input: {
     };
   }
 
+  // Reject an invalid Work binding before allocating an immutable Process request ID.
+  // Reattach any existing authoritative provider receipt without fresh preflight.
+  if (action && input.request.workId && !readPluginActionReceiptForRequest(input.controllerHome, input.request.requestId)) {
+    preflightPluginActionWorkBinding(input.controllerHome, input.scope, action, input.request);
+  }
+
   if (action?.executionMode === 'runtime') {
     // Stateful providers may own in-memory resources whose identity is valid only
     // inside the canonical Runtime process. Keep the normal durable request/effect
@@ -169,7 +177,10 @@ export async function executeAssistantPluginActionApplication(input: {
         process: handle,
       };
     }
-    if (!handle.ok) {
+    // Provider settlement remains authoritative across a sidecar failure.
+    // Re-enter the store below to validate exact args/scope/Work before reading
+    // any recorded outcome; process failure alone never authorizes redispatch.
+    if (!handle.ok && !readPluginActionReceiptForRequest(input.controllerHome, input.request.requestId)) {
       return {
         kind: 'managed_failed',
         manifest,