forgedock 1.43.0 → 1.44.0

package/bin/engine/outcome-codes.mjs

@@ -45,6 +45,7 @@ export const OUTCOME_CODES = Object.freeze({
   RUN_INTERRUPTED: "run.interrupted", // forge#4179: SIGTERM/SIGINT on a core run; teardown ran from the ledger, lane requeued
   PATH_SWITCH_CONFLICT: "path.switch_conflict",
   ENGINE_ERROR: "engine.error",
+  ENGINE_DCO_REWRITE: "engine.dco_rewrite", // forge#4997: the DCO sign-off rewrite of unpushed commits failed (git filter-branch); mechanical engine-error (not needs-human), relaunched by the batch runner
   ENGINE_VALIDATE_RESULT_LOST: "engine.validate_result_lost", // forge#4708: a validate result recorded before a CI fix round is missing after it and could not be carried forward
   INFRA_DISK_QUOTA: "infra.disk_quota",
   INFRA_CLI_SPAWN_TRANSIENT: "infra.cli_spawn_transient",
@@ -198,13 +199,13 @@ export const ENV_VALIDATE_TIMEOUT = "env.validate_timeout";
  * Batch recovery classes of a lane result (forge#4267). The batch runner recovers `recoverable` rows once
  * (`orchestration.recovery.max_attempts`) and re-queues them; only `human` rows are escalations.
  */
-export const RECOVERABLE_CODES = Object.freeze([OUTCOME_CODES.CI_RED, OUTCOME_CODES.BASE_CONFLICT, OUTCOME_CODES.BUILDER_BLOCK_UNTYPED, OUTCOME_CODES.CONTRACT_INVALID, OUTCOME_CODES.CONTRACT_INVALID_COMMAND, OUTCOME_CODES.ENV_TOOL_MISSING, OUTCOME_CODES.ENV_REPRO_UNRUNNABLE, ENV_VALIDATE_TIMEOUT, OUTCOME_CODES.ENV_CAPABILITY_REMOTE, OUTCOME_CODES.BUDGET_EXCEEDED]);
+export const RECOVERABLE_CODES = Object.freeze([OUTCOME_CODES.CI_RED, OUTCOME_CODES.BASE_CONFLICT, OUTCOME_CODES.BUILDER_BLOCK_UNTYPED, OUTCOME_CODES.CONTRACT_INVALID, OUTCOME_CODES.CONTRACT_INVALID_COMMAND, OUTCOME_CODES.ENV_TOOL_MISSING, OUTCOME_CODES.ENV_REPRO_UNRUNNABLE, ENV_VALIDATE_TIMEOUT, OUTCOME_CODES.ENV_CAPABILITY_REMOTE, OUTCOME_CODES.BUDGET_EXCEEDED, OUTCOME_CODES.CONFORMANCE_UNIMPLEMENTED, OUTCOME_CODES.CONFORMANCE_OMISSION, OUTCOME_CODES.CONFORMANCE_UNJUSTIFIED_DEFERRAL]);
 /** `builder.blocked` is only reached by a typed human block: credentials, spend, promotion, customer, product-decision. */
 export const HUMAN_CODES = Object.freeze([OUTCOME_CODES.BUILDER_BLOCKED]);
 
 /**
  * `recoverable` | `human` | `terminal` for a lane result row ({outcome|terminalReason, code, issueEdited?, conflicting?}).
- * Recoverable: needs-human `ci.red`, `base.conflict`, `builder.block_untyped`, `env.tool_missing`, `env.repro_unrunnable`, `env.validate_timeout`, `env.capability_remote`, `budget.exceeded`, `contract.invalid` after a mid-run issue
+ * Recoverable: needs-human `ci.red`, `base.conflict`, `builder.block_untyped`, `env.tool_missing`, `env.repro_unrunnable`, `env.validate_timeout`, `env.capability_remote`, `budget.exceeded`, `conformance.unimplemented` / `conformance.omission` / `conformance.unjustified_deferral` (#5035; regression, guard_broken, scope_creep and e2e_unverified stay terminal), `contract.invalid` after a mid-run issue
  * edit (`issueEdited`) or when every problem was an unmatched quote (`quoteMismatch`), `ci-pending` on a conflicting PR (`conflicting`), and the non-human `budget-exceeded` turn-overrun end (forge#4505). Human: `builder.blocked`. Anything else
  * (another code, or not a needs-human/ci-pending row) is terminal. Pure, never throws.
  */

package/bin/engine/telemetry-seam.mjs

@@ -8,7 +8,7 @@
  *   RUN_TERMINAL        -> `run_terminal`  (reason, code, wall_ms; lean adds milestone, conformance_mode, shadow_would, the pr and
  *                          builder_tier/class/model/escalated 0|1, forge#4394)
  *   SANDBOX_USAGE       -> `sandbox_usage` (provider, sandbox_id, minutes, cost_usd, batch; one per settled remote lane, forge#4255)
- *   DECISION_ENGINE     -> `decision_engine` (decided, escalated, vetoed, reversed, mode, needs_human_before/after; forge#4766)
+ *   DECISION_ENGINE     -> `decision_engine` (decided, escalated, vetoed, reversed, mode, needs_human_before/after; forge#4766; emitted once the engine is wired)
  *   PRODWATCH_METRICS   -> `prodwatch_metrics` (source, sample, invalid, fp_rate, fix_ineffective_rate, recurrence_rate, signal_to_issue/merge/verified_ms; forge#4837)
  *   STRUCTURE_DELTA     -> `structure_delta` (edges_added/removed, import_files_added/removed, boundary_changed/loosened 0|1; forge#4159)
  *                          lean's merge-time record (forge#4165) adds milestone, the pr and string lists: deps_added and

package/bin/engine-cli.mjs

@@ -21,7 +21,7 @@ import { parseForgeYaml } from "./forge-utils.mjs";
 import { makeEmitTelemetry } from "./engine/telemetry-seam.mjs";
 import { makeEventEmitter, probeSweepEvents, experimentEvent } from "./engine/events.mjs";
 import { readExperiment } from "./experiment.mjs";
-import { readBranches, resolveLane, isDefaultLane } from "./lean/lane.mjs";
+import { readBranches, resolveLane, isDefaultLane, makeLaneCache } from "./lean/lane.mjs";
 import { parseVerify } from "./lean/verify.mjs";
 import { normalizeKindModes } from "./lean/conformance.mjs";
 import { viewIssue } from "./lean/gh-assoc.mjs";
@@ -1283,6 +1283,11 @@ async function addedEdges({ added, records, io, repo }) {
  * state`): skipped `closed` (`unreadable` when the read fails); the rest go to the batch's `add` file, through the daemon
  * when `viaDaemon(issues)` answers (non-null), else written here (batch.mjs `addIssues` skips issues already in the batch).
  */
+/** #5000: what happened to the batch after an add/requeue; never implies a run when no daemon hosts it. */
+const hostedLine = (id, res) => res.reopened ? `batch ${id}: finished batch reopened and hosted by the schedd`
+  : res.hosted ? `batch ${id}: hosted by the schedd; the runner picks it up on its next pass`
+  : `batch ${id}: queued but NOT hosted (no schedd hosts it); run: forgedock orchestrate --resume ${id}`;
+
 async function addToBatch({ id, tokens, root, io, viaDaemon = null, print = (l) => console.log(l) }) {
   const batchMod = await import("./lean/batch.mjs");
   const b = batchMod.openBatch(root, id);
@@ -1308,11 +1313,13 @@ async function addToBatch({ id, tokens, root, io, viaDaemon = null, print = (l)
   let res = { added: [], skipped: [], requeued: [] };
   if (open.length) {
     res = (viaDaemon ? await viaDaemon(open) : null) ?? b.addIssues(open);
-    if (res.reopened === undefined && res.requeued?.length && b.readReport()) b.clearReport(); // #4687: no daemon: the next --resume reruns it
+    if (res.reopened === undefined && (res.added?.length || res.requeued?.length) && b.readReport()) b.clearReport(); // #4687/#5000: no daemon: the next --resume reruns it
   }
   const out = { ok: true, batch: id, added: res.added ?? [], requeued: res.requeued ?? [], skipped: [...(res.skipped ?? []), ...skipped] };
+  if (res.hosted !== undefined) { out.hosted = !!res.hosted; out.reopened = !!res.reopened; }
   out.edges = await addedEdges({ added: out.added, records, io, repo }); // #4773
   print(`batch ${id}: added ${out.added.map((n) => `#${n}`).join(" ") || (out.requeued.length ? "" : "(none)")}${out.requeued.length ? `${out.added.length ? " " : ""}${out.requeued.map((n) => `requeued #${n}`).join(" ")}` : ""}${out.skipped.length ? `; skipped ${out.skipped.map((x) => `${/^\d+$/.test(String(x.issue)) ? "#" : ""}${x.issue} (${x.reason})`).join(", ")}` : ""}`);
+  if (out.added.length || out.requeued.length) print(hostedLine(id, res));
   if (out.edges.length) print(`batch ${id}: edges ${out.edges.map((e) => `#${e.from} blocked by #${e.to}`).join(", ")}`);
   return out;
 }
@@ -1320,6 +1327,26 @@ async function addToBatch({ id, tokens, root, io, viaDaemon = null, print = (l)
 /** #4592: a resume's release line, only when it freed something. */
 const onlyReleased = (l, out = (t) => console.log(t)) => { if (!l.endsWith("(none)")) out(l); };
 
+/**
+ * #5031: the `baseWait` seam of `orchestrate` for issues admitted while a dependency's merge commit was not yet on their base:
+ * a detail string until every awaited commit is an ancestor of origin/<base> (fetched at most every 30s per base), else null.
+ */
+function baseWaitOf(waits, { io, leanIo, cwd, now = () => Date.now() }) {
+  const fetched = new Map();
+  return async (n) => {
+    const l = waits.get(n);
+    if (!l) return null;
+    const missing = [];
+    for (const w of l) {
+      if (now() - (fetched.get(w.base) ?? -Infinity) > 30000) { fetched.set(w.base, now()); try { await leanIo.git(["fetch", "origin", w.base], { cwd }); } catch { /* offline: the local ref */ } }
+      let on = false;
+      for (const ref of [`origin/${w.base}`, w.base]) if (!on) on = await io.git?.(["-C", cwd, "merge-base", "--is-ancestor", w.sha, ref]).then(() => true, () => false);
+      if (!on) missing.push(w);
+    }
+    return missing.length ? `waiting for ${missing.map((w) => `#${w.dep} (${w.sha.slice(0, 10)})`).join(", ")} on ${missing[0].base}` : null;
+  };
+}
+
 /**
  * `--hold <id> N...` / `--release <id> N...` (#4592): the batch's `hold` file, through the daemon (`viaDaemon(op, issues)`, null
  * when none runs) or directly. A held issue is not admitted (a running lane is not stopped); `--release` (or a `--resume` that
@@ -1371,7 +1398,9 @@ async function requeueBatch({ id, tokens, reason, root, io, viaDaemon = null, pr
     if (res.reopened === undefined && res.requeued?.length && b.readReport()) b.clearReport(); // no daemon: the next --resume reruns it
   }
   const out = { ok: true, batch: id, requeued: res.requeued ?? [], refused: [...(res.refused ?? []), ...refused] };
+  if (res.hosted !== undefined) { out.hosted = !!res.hosted; out.reopened = !!res.reopened; }
   print(`batch ${id}: ${out.requeued.map((n) => `requeued #${n}`).join(" ") || "requeued (none)"}${out.refused.length ? `; refused ${out.refused.map((x) => `${/^\d+$/.test(String(x.issue)) ? "#" : ""}${x.issue} (${x.reason})`).join(", ")}` : ""}`);
+  if (out.requeued.length) print(hostedLine(id, res));
   return out;
 }
 
@@ -1560,12 +1589,15 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
     await holdBatch({ op: "release", id: resumeId, tokens: resumeExtra, root, print: (l) => onlyReleased(l, (t) => sink.line(t)) }); // #4592
   }
   let batch, plan = null;
+  const baseWaits = new Map(); // #5031: issue -> [{dep, sha, base}] merge commits not yet on its base at start
   if (resumeId) {
     batch = batchMod.openBatch(root, resumeId);
     batch.scrubPlan(); // #4787: a pre-fix plan.json keeps no secret; the lanes re-read it from the environment
     plan = batch.readPlan();
     if (!plan) throw new Error(`no batch ${resumeId} in ${root}`);
     argv = plan.argv;
+    // #5031: a resume (operator or schedd restart) keeps the base waits recorded at start; a landed commit releases on the first check
+    for (const [n, l] of Object.entries(plan.baseWaits ?? {})) if (Array.isArray(l) && l.length) baseWaits.set(Number(n), l.filter((w) => w && typeof w.sha === "string" && typeof w.base === "string"));
   }
   const issues = issuesOf(argv);
   if (!issues.length) throw new Error(ORCH_USAGE);
@@ -1593,16 +1625,26 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
       const { unmetDependencies } = await import("../scripts/plan-validate-live.mjs");
       const gateBranches = readBranches(cwd);
       const gateIo = deps.leanIo ?? (await import("./lean/effects.mjs")).makeLeanIo({ repo });
-      const unmet = await unmetDependencies({ issues, repo, gh: io.gh, baseOf: async (n) => {
+      const isAncestor = async (sha, b) => {
+        for (const ref of [`origin/${b}`, b]) if (await io.git?.(["-C", cwd, "merge-base", "--is-ancestor", sha, ref]).then(() => true, () => false)) return true;
+        return false;
+      };
+      let unmet = await unmetDependencies({ issues, repo, gh: io.gh, isAncestor, baseOf: async (n) => {
         const r = await resolveLane({ issue: n, repo, io: gateIo, cwd, branches: gateBranches, requested: lane, override: laneOverride });
         return r.ok ? r.lane : null;
       } });
+      // #5031: a dependency merged but not yet on the base is admitted and held until its commit lands; any other unmet edge still refuses
+      for (const u of unmet.filter((x) => x.kind === "commit")) {
+        const list = baseWaits.get(u.issue) ?? []; list.push({ dep: u.dep, sha: u.sha, base: u.base }); baseWaits.set(u.issue, list);
+      }
+      for (const [n, l] of baseWaits) sink.line(`held: #${n} waits for ${l.map((w) => `#${w.dep} (${w.sha.slice(0, 10)}) on ${w.base}`).join(", ")}; admitted once the commit lands`);
+      unmet = unmet.filter((x) => x.kind !== "commit");
       if (unmet.length) throw new Error(`parallel milestone start refused: ${unmet.map((u) => `#${u.issue} depends on #${u.dep} (${u.why}; base ${u.base})`).join("; ")}. Merge the dependencies first, or pass --force "<reason>".`);
     }
     const base = deps.batchId ?? batchMod.newBatchId();
     batch = batchMod.openBatch(root, base);
     for (let i = 2; batch.exists(); i++) batch = batchMod.openBatch(root, `${base}.${i}`); // never resume by accident
-    plan = { v: 1, id: batch.id, argv: [...argv], repo, cwd, created: new Date().toISOString(), ...(force ? { forced: force } : {}), ...(daemon ? { daemon: true, env: kept } : {}) };
+    plan = { v: 1, id: batch.id, argv: [...argv], repo, cwd, created: new Date().toISOString(), ...(force ? { forced: force } : {}), ...(baseWaits.size ? { baseWaits: Object.fromEntries(baseWaits) } : {}), ...(daemon ? { daemon: true, env: kept } : {}) };
     batch.writePlan(plan);
     batch.setParallel(parallel);
   } else {
@@ -1635,8 +1677,10 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
   const prefilter = argv.includes("--no-prefilter") ? null
     : makePrefilter({ repo, cwd, io: leanIo, ...prefilterModel(argv), defaultBranch: lazyDefaultBranch({ io: leanIo, repo, cwd, configured: branches.default }), preconditionCmd: readPreconditionCmd(cwd), minAge: await readPostDeployMinAge(cwd) });
   const fetched = new Set();
+  const laneCache = makeLaneCache(), milestoneOf = new Map(); // #4963: shared default-branch / ls-remote reads; the milestone readBody already fetched
   const laneOf = async (n) => {
-    const r = await resolveLane({ issue: n, repo, io: leanIo, cwd, branches, requested: lane, override: laneOverride });
+    const known = milestoneOf.get(n); milestoneOf.delete(n); // used once: a later retry re-reads the live milestone
+    const r = await resolveLane({ issue: n, repo, io: leanIo, cwd, branches, requested: lane, override: laneOverride, cache: laneCache, milestone: known });
     if (r.ok && prefilter && !fetched.has(r.lane)) { fetched.add(r.lane); try { await leanIo.git(["fetch", "origin", r.lane], { cwd }); } catch { /* offline: use the local ref */ } }
     return r;
   };
@@ -1877,7 +1921,7 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
       trusted: (n) => trustedOf.get(n) === true,
       autoChildren,
       ...(autoMod.addsEpicChildren(autoChildren.mode) ? { getChildren: async () => ({ list: await autoMod.readChildList({ gh: (a) => leanIo.gh(a), repo, fields: childFields ??= await autoMod.hostListFields((a) => leanIo.gh(a)) }), elsewhere: autoMod.liveElsewhere({ batchMod, root, self: batch.id, repo }) }) } : {}),
-      issues, parallel, prefilter, resolveLane: laneOf, store: batch.store, getParallel: batch.readParallel, getAdded: batch.readAdded, getRequeued: batch.readRequeued, getCancelled: batch.readCancel, getHeld: batch.readHeld, getGates: batch.readGates, ...lanes,
+      issues, parallel, prefilter, resolveLane: laneOf, store: batch.store, getParallel: batch.readParallel, getAdded: batch.readAdded, getRequeued: batch.readRequeued, getCancelled: batch.readCancel, getHeld: batch.readHeld, getGates: batch.readGates, baseWait: baseWaits.size ? baseWaitOf(baseWaits, { io, leanIo, cwd }) : null, ...lanes,
       breaker: orch.breaker, maxDeferrals: orch.maxDeferrals, ...(deps.pollMs ? { pollMs: deps.pollMs } : {}), ...budget, limits, identity, batchId: batch.id, drift, lifecycle, integration,
       ...(registry ? { sched: { registry, batch: batch.id, repo, cap: liveLaneCap(orch.globalParallel ?? null, { cfg: readAdmission(cwd) }), exclusive: true }, priorityOf: async (n) => schedMod.priorityFromLabels(await labelNames(n)) } : {}),
       ...(remote ? { remote } : {}),
@@ -1919,8 +1963,8 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
         sink.line(`cross-lane: #${e.issue} (${e.lane}) depends on #${e.dependency} (${e.dependencyLane}); its fix will not be on ${e.lane}: re-milestone #${e.dependency} or wait for a milestone sync`);
       },
       readBody: maint || registry || hybrid
-        ? async (n) => { const v = await viewIssue(leanIo.gh, repo, n, "body,labels,comments,author"); trustedOf.set(n, bodyTrusted(v)); labelsOf.set(n, (v.labels ?? []).map((x) => x.name)); needsOf.set(n, detectNeeds(placementText(v), execForNeeds)); if (execForNeeds?.relay) prefetchOf.set(n, relayPrefetchCommands(v, execForNeeds.relay)); return v.body; }
-        : async (n) => { const v = await viewIssue(leanIo.gh, repo, n, "body,comments,author"); trustedOf.set(n, bodyTrusted(v)); needsOf.set(n, detectNeeds(placementText(v), execForNeeds)); if (execForNeeds?.relay) prefetchOf.set(n, relayPrefetchCommands(v, execForNeeds.relay)); return v.body; }, // #4785: decisions and the frozen contract's validate commands too
+        ? async (n) => { const v = await viewIssue(leanIo.gh, repo, n, "body,labels,comments,author,milestone"); if ("milestone" in v) milestoneOf.set(n, v.milestone?.title ?? null); trustedOf.set(n, bodyTrusted(v)); labelsOf.set(n, (v.labels ?? []).map((x) => x.name)); needsOf.set(n, detectNeeds(placementText(v), execForNeeds)); if (execForNeeds?.relay) prefetchOf.set(n, relayPrefetchCommands(v, execForNeeds.relay)); return v.body; }
+        : async (n) => { const v = await viewIssue(leanIo.gh, repo, n, "body,comments,author,milestone"); if ("milestone" in v) milestoneOf.set(n, v.milestone?.title ?? null); trustedOf.set(n, bodyTrusted(v)); needsOf.set(n, detectNeeds(placementText(v), execForNeeds)); if (execForNeeds?.relay) prefetchOf.set(n, relayPrefetchCommands(v, execForNeeds.relay)); return v.body; }, // #4785: decisions and the frozen contract's validate commands too
       onUpdate: (r) => sink.row(r),
     });
   } finally { for (const [sig, f] of Object.entries(handlers)) off(sig, f); }
@@ -1962,7 +2006,10 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
   } catch { /* alerts never fail a batch */ }
   for (const l of report) sink.line(l);
   const ok = rows.every((r) => ["merged", "invalid", "decomposed"].includes(r.outcome));
-  try { batch.writeReport({ rows, crossLane, ok, reclaimed, report: report.join("\n") }); } catch { /* the report is a cache of the rows */ }
+  // #4917: a batch with any pending issue is not finished: no report, so a resume or the daemon picks it up
+  let unfinished = false;
+  try { unfinished = batch.pendingIssues().length > 0 && !batch.readCancel(); } catch { unfinished = false; } // a cancel ends the batch for good
+  if (!unfinished) try { batch.writeReport({ rows, crossLane, ok, reclaimed, report: report.join("\n") }); } catch { /* the report is a cache of the rows */ }
   return { rows, crossLane, batch: batch.id, reclaimed, ok };
 }
 
@@ -2106,6 +2153,7 @@ export async function scheddFromCli(argv, deps = {}) {
       const pend = b.pendingAdds?.length ? `, pending adds: ${b.pendingAdds.map((n) => `#${n}`).join(" ")}` : "";
       console.log(`  ${b.id}${b.running ? "" : " (not hosted)"}: ${age}${pend}`);
     }
+    for (const u of st.unhosted ?? []) console.log(`schedd: batch ${u.id} is not hosted but has ${u.pending.length} pending: ${u.pending.map((n) => `#${n}`).join(" ")} (forgedock orchestrate --resume ${u.id})`);
     return { running: true, ...st };
   }
   if (argv[0] === "watchdog") { // #4780: run by the schedd watchdog timer; signals a live daemon whose heartbeat went stale
@@ -2288,11 +2336,12 @@ export async function schedFromCli(argv, deps = {}) {
     const st = reg.list();
     const who = (e) => `#${e.issue} ${e.repo ?? "-"} batch ${e.batch ?? "-"} P${e.priority}`;
     console.log(deps.tick ?? health.tickText(health.stallCheck({ dir: schedMod.schedDir() })));
-    console.log(`host cap: ${st.cap ?? "none set here (each batch's orchestration.global_parallel applies)"}; running ${st.slots.length}, queued ${st.queue.length}`);
+    console.log(`host cap: ${st.cap ?? "none set here (each batch's orchestration.global_parallel applies)"}; running ${st.slots.length}, queued ${st.queue.length}, remote ${(st.remote ?? []).length}`);
     const ws = Object.entries(st.weights ?? {});
     console.log(`repo weights: ${ws.length ? ws.map(([r, n]) => `${r}=${n}`).join(", ") : "equal (none set)"}`);
     for (const e of st.slots) console.log(`  running ${who(e)}  dispatcher ${e.pid}${e.lanePid ? ` lane ${e.lanePid}` : ""}`);
     for (const e of st.queue) console.log(`  queued  ${who(e)}  dispatcher ${e.pid}`);
+    for (const l of schedMod.remoteLines(st)) console.log(l); // #4964
     return st;
   }
   if (sub === "cap") {

package/bin/forgedock.mjs

@@ -221,6 +221,19 @@ function detectInstallPaths() {
 
 const SCRIPTS_DIR = join(FORGE_HOME, "scripts");
 
+/**
+ * True when a link at ~/.claude/<kind>/<rel> points at a ForgeDock-owned
+ * source: the package file, or its copy in the persisted ~/.forge home
+ * (persistHome(), #1943, makes npm installs link there). Path-only, so links
+ * left dangling after ~/.forge is deleted still count as ours (#4962).
+ */
+function isOwnedLinkTarget(dest, src, kind, rel) {
+  return (
+    dest === src ||
+    resolve(dest) === resolve(join(HOME, ".forge", kind, rel))
+  );
+}
+
 // PIPELINE_SCRIPTS (the allowlist of universal pipeline-agent scripts linked
 // to ~/.claude/scripts/) is defined in journey.mjs — forge()'s
 // linkPipelineScripts() step is what writes them there (forge#1885,
@@ -1183,7 +1196,7 @@ async function uninstall() {
       const stats = await lstat(target);
       if (stats.isSymbolicLink()) {
         const current = await readlink(target);
-        if (current === file) {
+        if (isOwnedLinkTarget(current, file, "commands", rel)) {
           await unlink(target);
           console.log(`  ${RED}Removed${RESET}: ${rel}`);
           removed++;
@@ -1259,7 +1272,7 @@ async function uninstall() {
       const stats = await lstat(target);
       if (stats.isSymbolicLink()) {
         const current = await readlink(target);
-        if (current === file) {
+        if (isOwnedLinkTarget(current, file, "scripts", rel)) {
           await unlink(target);
           console.log(`  ${RED}Removed${RESET}: scripts/${rel}`);
           scriptsRemoved++;
@@ -2507,10 +2520,16 @@ async function doctor(fix = false) {
             const lstats = await lstat(tgt);
             if (lstats.isSymbolicLink()) {
               const dest = await readlink(tgt);
-              if (dest !== src) {
+              if (dest !== src && !isOwnedLinkTarget(dest, src, "commands", rel)) {
                 broken++;
                 brokenLinks.push(rel);
                 symlinkOk = false;
+              } else if (dest !== src && readFileSync(tgt, "utf-8") !== readFileSync(src, "utf-8")) {
+                // Linked into the persisted ~/.forge home: valid only while
+                // that copy matches the package source (#4962).
+                broken++;
+                brokenLinks.push(`${rel} (stale ~/.forge copy)`);
+                symlinkOk = false;
               } else {
                 try {
                   // readlink() only validates the stored target. Opening the
@@ -3111,34 +3130,41 @@ async function doctor(fix = false) {
   // server presence is orthogonal to the core ForgeDock install — but missing
   // it causes /qa-sweep to silently fail mid-sweep.
   {
+    // Claude Code registers servers in ~/.claude.json (user + per-project) and
+    // project .mcp.json; the legacy mcp_servers.json is still honoured (#4962).
     const mcpServersPath = join(GLOBAL_CLAUDE_DIR, "mcp_servers.json");
     let playwrightFound = false;
     let fileReadable = false;
     let hasMcpServers = false;
-
-    try {
-      const mcpRaw = readFileSync(mcpServersPath, "utf-8");
-      const mcpConfig = JSON.parse(mcpRaw);
-      // Read + parse succeeded — the file exists and contains valid JSON.
+    const readJson = (p) => {
+      try {
+        return JSON.parse(readFileSync(p, "utf-8"));
+      } catch {
+        return null;
+      }
+    };
+    const userCfg = readJson(join(HOME, ".claude.json"));
+    const sources = [
+      readJson(mcpServersPath),
+      userCfg,
+      userCfg?.projects?.[process.cwd()],
+      readJson(join(process.cwd(), ".mcp.json")),
+    ];
+    for (const cfg of sources) {
+      if (!cfg || typeof cfg !== "object") continue;
       fileReadable = true;
-      const servers = mcpConfig?.mcpServers;
-      if (servers && typeof servers === "object") {
-        hasMcpServers = true;
-        // Search for a registered server whose name or command references playwright
-        for (const [name, entry] of Object.entries(servers)) {
-          const nameLower = name.toLowerCase();
-          const cmdStr = [
-            entry?.command ?? "",
-            ...(Array.isArray(entry?.args) ? entry.args : []),
-          ].join(" ").toLowerCase();
-          if (nameLower.includes("playwright") || cmdStr.includes("playwright")) {
-            playwrightFound = true;
-            break;
-          }
+      const servers = cfg.mcpServers;
+      if (!servers || typeof servers !== "object") continue;
+      hasMcpServers = true;
+      for (const [name, entry] of Object.entries(servers)) {
+        const cmdStr = [
+          entry?.command ?? "",
+          ...(Array.isArray(entry?.args) ? entry.args : []),
+        ].join(" ").toLowerCase();
+        if (name.toLowerCase().includes("playwright") || cmdStr.includes("playwright")) {
+          playwrightFound = true;
         }
       }
-    } catch {
-      // File absent or unreadable — treat as no MCP servers configured
     }
 
     if (!fileReadable) {

package/bin/gc.mjs

@@ -600,7 +600,9 @@ export function hygieneCheck(plan, { applied = null, ttlMs = plan?.ttlMs ?? hygi
     if (owned.length) parts.push(`${owned.length} ${t}${owned.length === 1 ? "" : "s"} ${fmtSize(owned.reduce((s, i) => s + (i.sizeBytes ?? 0), 0))}`);
   }
   const reclaimable = items.filter((i) => i.owned && i.action === "reclaim").length;
-  const stale = items.filter((i) => !i.owned && i.ageMs != null && i.ageMs >= (ttlMs?.[i.type] ?? LEDGER_TTL_MS)).length;
+  // Unrelated docker projects (compose etc.) are not ours to nag about (#4962): only ForgeDock-named docker resources count.
+  const forgeNamed = (i) => (i.type !== "container" && i.type !== "volume") || /^(forgedock|forge-|fdrsbx)/i.test(String(i.id));
+  const stale = items.filter((i) => !i.owned && forgeNamed(i) && i.ageMs != null && i.ageMs >= (ttlMs?.[i.type] ?? LEDGER_TTL_MS)).length;
   const bits = [`owned: ${parts.length ? parts.join(", ") : "none"}`];
   if (applied) bits.push(`reclaimed ${applied.reclaimed.length} of ${reclaimable}${applied.failed.length ? ` (${applied.failed.length} failed)` : ""}${applied.deferred?.length ? ` (${applied.deferred.length} deferred)` : ""}`);
   else bits.push(`${reclaimable} reclaimable`);

package/bin/hooks/pre-tool-use.mjs

@@ -602,7 +602,7 @@ async function main() {
   if (!(await isForgeDockManagedCwd())) { process.exit(0); return; }
 
   // --- Rule 1: PR branch target validation ---
-  const prViolation = checkPrTarget(command);
+  const prViolation = await checkPrTarget(command);
   if (prViolation) {
     process.stderr.write(prViolation);
     process.exit(2);
@@ -749,6 +749,51 @@ async function isForgeDockManagedCwd() {
 // Rule 1: PR branch target validation
 // ---------------------------------------------------------------------------
 
+/**
+ * Resolve the `owner/repo` a `gh pr create` command targets: `-R`/`--repo`,
+ * else the cwd's `origin` remote. Lower-cased; null when unresolvable.
+ *
+ * @param {string} command
+ * @returns {string|null}
+ */
+function resolvePrTargetRepo(command) {
+  const slug = (v) => {
+    const m = String(v || "").trim().match(/([^/:\s]+)\/([^/\s]+?)(?:\.git)?\/?$/);
+    return m ? `${m[1]}/${m[2]}`.toLowerCase() : null;
+  };
+  const flagged = extractFlag(command, "--repo") || extractFlag(command, "-R");
+  if (flagged) return slug(flagged);
+  try {
+    const { execFileSync: exec } = _require("child_process");
+    return slug(exec("git", ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5000,
+    }));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * `owner/repo` of the forge.yaml in cwd (project.owner / project.repo),
+ * lower-cased; null when absent or unreadable.
+ *
+ * @returns {Promise<string|null>}
+ */
+async function configuredRepoSlug() {
+  try {
+    const raw = _require("fs").readFileSync(join(process.cwd(), "forge.yaml"), "utf-8");
+    const { parseForgeYaml } = await import(
+      pathToFileURL(join(FORGE_HOME, "bin", "forge-utils.mjs")).href
+    );
+    const { owner, repo } = parseForgeYaml(raw)?.project ?? {};
+    return owner && repo ? `${owner}/${repo}`.toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Check whether a gh pr create command targets a forbidden base branch.
  *
@@ -757,9 +802,9 @@ async function isForgeDockManagedCwd() {
  * main are still hard-blocked.
  *
  * @param {string} command
- * @returns {string|null} Error message to show, or null if allowed.
+ * @returns {Promise<string|null>} Error message to show, or null if allowed.
  */
-function checkPrTarget(command) {
+async function checkPrTarget(command) {
   // Only check gh pr create commands.
   if (!/gh\s+pr\s+create/.test(command)) return null;
 
@@ -767,6 +812,12 @@ function checkPrTarget(command) {
   if (!base) return null; // no --base flag — gh will use the default
 
   if (FORBIDDEN_PR_BASES.includes(base.toLowerCase())) {
+    // The staging/milestone rule only governs the configured forge repo; a PR
+    // to a positively-identified other repo may legitimately target main.
+    const target = resolvePrTargetRepo(command);
+    const configured = await configuredRepoSlug();
+    if (target && configured && target !== configured) return null;
+
     // Allow staging → main (the deploy path, not a pipeline violation).
     const head = extractFlag(command, "--head") || extractFlag(command, "-H") || currentGitBranch();
     if (head && /^staging$/.test(head)) {

package/bin/journey.mjs

@@ -642,9 +642,9 @@ export function openUrl(url) {
     if (process.platform === "win32") {
       spawnSync("cmd", ["/c", "start", "", url], { stdio: "ignore", windowsHide: true });
     } else if (process.platform === "darwin") {
-      spawnSync("open", [url], { detached: true, stdio: "ignore" });
+      spawnSync("open", [url], { detached: true, windowsHide: true, stdio: "ignore" });
     } else {
-      spawnSync("xdg-open", [url], { detached: true, stdio: "ignore" });
+      spawnSync("xdg-open", [url], { detached: true, windowsHide: true, stdio: "ignore" });
     }
   } catch {
     // Best-effort — if the browser can't be opened, the journey continues.

package/bin/lean/autochildren.mjs

@@ -4,6 +4,8 @@
 // Pure and deterministic: the child scan reads one open-issue list per pass; no LLM call.
 import { parentOf } from "./context.mjs";
 import { parseHelpFields } from "./selftest-static.mjs";
+import { listAssociations } from "./gh-assoc.mjs";
+import { isTrustedActor } from "../engine/phases.mjs";
 
 export const AUTO_MODES = ["off", "decomposed", "epic", "all"];
 export const DEFAULT_AUTO_MODE = "decomposed";
@@ -41,9 +43,11 @@ const labelsOf = (it) => nodesOf(it?.labels).map((l) => String(l?.name ?? l));
  * @param {Iterable<number>} roots the batch issues plus the `--epic N` epics
  * @param {Iterable<number>} skip issues the batch already holds
  * @returns {number[]} open children of a root, ascending: `**Parent**: #P` line, `parent` field, or the root's `subIssues`;
- *   an issue labelled `needs-human` is left out.
+ *   an issue labelled `needs-human` is left out. #4982: so is a child whose author is not trusted (the `Blocked by` edge
+ *   rule, `isTrustedActor`; a missing association fails closed), reported through `onSkip({number, reason})`.
+ * @param {(s:{number:number, reason:string})=>void} [onSkip]
  */
-export function selectChildren({ list, roots, skip = [] }) {
+export function selectChildren({ list, roots, skip = [], onSkip }) {
   const rootSet = new Set(roots), skipSet = new Set(skip), open = new Set(), out = new Set();
   for (const it of list ?? []) if (Number.isSafeInteger(it?.number)) open.add(it.number);
   for (const it of list ?? []) {
@@ -54,10 +58,12 @@ export function selectChildren({ list, roots, skip = [] }) {
     if (p != null && rootSet.has(p)) out.add(n);
   }
   const byNum = new Map((list ?? []).map((it) => [it.number, it]));
-  return [...out].filter((n) => !skipSet.has(n) && !labelsOf(byNum.get(n)).includes("needs-human")).sort((a, b) => a - b);
+  const trusted = (it) => isTrustedActor({ association: it?.authorAssociation, type: it?.author?.is_bot ? "Bot" : "User", login: it?.author?.login });
+  return [...out].filter((n) => !skipSet.has(n) && !labelsOf(byNum.get(n)).includes("needs-human")).sort((a, b) => a - b)
+    .filter((n) => trusted(byNum.get(n)) || (onSkip?.({ number: n, reason: "untrusted author" }), false));
 }
 
-const REQUIRED_FIELDS = ["number", "body", "labels"], OPTIONAL_FIELDS = ["parent", "subIssues"];
+const REQUIRED_FIELDS = ["number", "body", "labels", "author"], OPTIONAL_FIELDS = ["parent", "subIssues"];
 
 /** The `--json` list this host's `gh issue list` accepts (read from its `--help`, K4): the required fields plus whichever sub-issue fields it advertises. */
 export async function hostListFields(gh) {
@@ -74,7 +80,9 @@ export async function readChildList({ gh, repo, limit = 1000, fields = null }) {
   const f = fields ?? (await hostListFields(gh));
   const raw = await gh(["issue", "list", "-R", repo, "--state", "open", "--limit", String(limit), "--json", f.join(",")]);
   const v = JSON.parse(raw);
-  return Array.isArray(v) ? v : [];
+  if (!Array.isArray(v)) return [];
+  const assoc = await listAssociations(gh, repo); // #4982: not a `gh issue list` field (#4859); unreadable = every author untrusted
+  return v.map((it) => ({ ...it, authorAssociation: assoc.get(it?.number) }));
 }
 
 /**

package/bin/lean/autochildren.test.mjs

@@ -26,12 +26,12 @@ describe("#4965 modes", () => {
 describe("#4965 selectChildren", () => {
   const list = [
     { number: 1, body: "epic", labels: [], subIssues: { nodes: [{ number: 5 }, { number: 9 }] } },
-    { number: 2, body: "x\n\n**Parent**: #1", labels: [] },
-    { number: 3, body: "", labels: [], parent: { number: 1 } },
-    { number: 4, body: "**Parent**: #1", labels: [{ name: "needs-human" }] },
-    { number: 5, body: "", labels: [] },
-    { number: 6, body: "**Parent**: #77", labels: [] },
-    { number: 7, body: "**Parent**: #1", labels: [] },
+    { number: 2, body: "x\n\n**Parent**: #1", labels: [], authorAssociation: "MEMBER" },
+    { number: 3, body: "", labels: [], parent: { number: 1 }, authorAssociation: "MEMBER" },
+    { number: 4, body: "**Parent**: #1", labels: [{ name: "needs-human" }], authorAssociation: "MEMBER" },
+    { number: 5, body: "", labels: [], authorAssociation: "MEMBER" },
+    { number: 6, body: "**Parent**: #77", labels: [], authorAssociation: "MEMBER" },
+    { number: 7, body: "**Parent**: #1", labels: [], authorAssociation: "MEMBER" },
   ];
   it("finds children by Parent line, parent field and sub-issues; skips needs-human, closed sub-issues and unrelated", () => {
     assert.deepEqual(selectChildren({ list, roots: [1], skip: [1] }), [2, 3, 5, 7]);
@@ -42,8 +42,25 @@ describe("#4965 selectChildren", () => {
   it("an --epic root outside the batch yields its children", () => {
     assert.deepEqual(selectChildren({ list, roots: [77] }), [6]);
   });
+  it("#4982 selectChildren drops children of an untrusted author and reports each", () => {
+    const l = [
+      { number: 1, body: "", labels: [], authorAssociation: "OWNER", subIssues: { nodes: [{ number: 5 }] } },
+      { number: 2, body: "**Parent**: #1", labels: [], authorAssociation: "NONE", author: { login: "eve" } },
+      { number: 3, body: "**Parent**: #1", labels: [], authorAssociation: "MEMBER" },
+      { number: 4, body: "**Parent**: #1", labels: [], author: { login: "app", is_bot: true } },
+      { number: 5, body: "", labels: [] },
+      { number: 6, body: "", labels: [], parent: { number: 1 } },
+    ];
+    const skipped = [];
+    assert.deepEqual(selectChildren({ list: l, roots: [1], skip: [1], onSkip: (s) => skipped.push(s) }), [3, 4]);
+    assert.deepEqual(skipped, [2, 5, 6].map((number) => ({ number, reason: "untrusted author" })));
+  });
+  it("#4982 readChildList merges the REST author association per issue", async () => {
+    const gh = async (a) => a[0] === "api" ? "1\tMEMBER\n" : a.includes("--help") ? "JSON FIELDS\n  number, body, labels, author\n\nEXAMPLES\n" : "[{\"number\":1},{\"number\":2}]";
+    assert.deepEqual(await readChildList({ gh, repo: "o/r" }), [{ number: 1, authorAssociation: "MEMBER" }, { number: 2, authorAssociation: undefined }]);
+  });
   it("children filed later appear on a later list", () => {
-    assert.deepEqual(selectChildren({ list: [...list, { number: 8, body: "**Parent**: #1", labels: [] }], roots: [1], skip: [1, 2, 3, 5, 7] }), [8]);
+    assert.deepEqual(selectChildren({ list: [...list, { number: 8, body: "**Parent**: #1", labels: [], authorAssociation: "MEMBER" }], roots: [1], skip: [1, 2, 3, 5, 7] }), [8]);
   });
 });
 
@@ -59,17 +76,17 @@ describe("#4965 readers", () => {
   };
   it("readChildList asks the host gh for its fields, then makes one list call", async () => {
     const calls = [];
-    const r = await readChildList({ gh: fakeGh(["number", "body", "labels", "parent", "subIssues", "title"], calls), repo: "o/r" });
-    assert.equal(calls.filter((a) => !a.includes("--help")).length, 1);
-    assert.equal(calls.at(-1)[calls.at(-1).indexOf("--json") + 1], "number,body,labels,parent,subIssues");
-    assert.deepEqual(r, [{ number: 1 }]);
+    const r = await readChildList({ gh: fakeGh(["number", "body", "labels", "author", "parent", "subIssues", "title"], calls), repo: "o/r" });
+    assert.equal(calls.filter((a) => a.includes("--json")).length, 1);
+    assert.equal(calls.findLast((a) => a.includes("--json"))[calls.findLast((a) => a.includes("--json")).indexOf("--json") + 1], "number,body,labels,author,parent,subIssues");
+    assert.deepEqual(r, [{ number: 1, authorAssociation: undefined }]);
   });
   it("a host gh without parent/subIssues still lists, with the fields it has (children found by Parent line)", async () => {
     const calls = [];
-    const gh = fakeGh(["number", "body", "labels", "title"], calls);
-    assert.deepEqual(await hostListFields(gh), ["number", "body", "labels"]);
-    assert.deepEqual(await readChildList({ gh, repo: "o/r" }), [{ number: 1 }]);
-    assert.equal(calls.at(-1)[calls.at(-1).indexOf("--json") + 1], "number,body,labels");
+    const gh = fakeGh(["number", "body", "labels", "author", "title"], calls);
+    assert.deepEqual(await hostListFields(gh), ["number", "body", "labels", "author"]);
+    assert.deepEqual(await readChildList({ gh, repo: "o/r" }), [{ number: 1, authorAssociation: undefined }]);
+    assert.equal(calls.findLast((a) => a.includes("--json"))[calls.findLast((a) => a.includes("--json")).indexOf("--json") + 1], "number,body,labels,author");
   });
   it("liveElsewhere holds the unsettled issues of other live batches of the repo only", () => {
     const mk = (o) => ({ readReport: () => o.report ?? null, readPlan: () => ({ repo: o.repo ?? "o/r" }), store: { load: () => ({ order: o.order, results: o.results ?? {} }) } });
@@ -109,11 +126,12 @@ appendFileSync(${JSON.stringify(launches)}, a[1] + "\\n"); writeFileSync(rf, JSO
     b.setParallel(2);
     const lists = [];
     const gh = async (a) => {
-      if (a[0] === "issue" && a[1] === "list" && a.includes("--help")) return "JSON FIELDS\n  number, body, labels, parent, subIssues\n\nEXAMPLES\n";
-      if (a[0] === "issue" && a[1] === "list" && a.includes("--state") && a.includes("number,body,labels,parent,subIssues")) { lists.push(a); return JSON.stringify([{ number: 9, body: "", labels: [] }, { number: 51, body: "**Parent**: #9", labels: [] }]); }
+      if (a[0] === "issue" && a[1] === "list" && a.includes("--help")) return "JSON FIELDS\n  number, body, labels, author, parent, subIssues\n\nEXAMPLES\n";
+      if (a[0] === "issue" && a[1] === "list" && a.includes("--state") && a.includes("number,body,labels,author,parent,subIssues")) { lists.push(a); return JSON.stringify([{ number: 9, body: "", labels: [], authorAssociation: "MEMBER" }, { number: 51, body: "**Parent**: #9", labels: [], authorAssociation: "MEMBER" }]); }
+      if (a[0] === "api" && /issues\?state=open/.test(a[1])) return "9\tMEMBER\n51\tMEMBER\n";
       if (a.includes("milestone")) return JSON.stringify({ milestone: null });
       if (a[0] === "repo") return "main\n";
-      return JSON.stringify({ body: "", state: "OPEN", labels: [] });
+      return JSON.stringify({ body: "", state: "OPEN", labels: [], authorAssociation: "MEMBER" });
     };
     const deps = { batchRoot: root, allowTmpfs: true, laneScript: stub, pollMs: 20, orchestration: { breaker: null, maxDeferrals: 3 }, io: { gh: async () => "o/r\n" },
       leanIo: { gh, git: async (a) => (a[0] === "ls-remote" ? "abc\trefs/heads/staging\n" : "") } };

package/bin/lean/batch.mjs

@@ -191,6 +191,8 @@ export function openBatch(root, id) {
       }
       return { requeued, refused };
     },
+    /** #4917: the issues still `pending` in state.json (deferred or requeued included); [] when none or unreadable. */
+    pendingIssues: () => { const p = readJson(f("state.json"))?.pending; return Array.isArray(p) ? p.filter((n) => Number.isSafeInteger(n)) : []; },
     /** Every `--requeue` entry, in order; [] when missing or invalid. */
     readRequeued: () => readRequeueFile(f("requeue")),
     /** Entries the runner has not applied yet (a finished or unhosted batch with a pending requeue). */
@@ -265,7 +267,7 @@ export function launchLane({ batch, issue, args = [], bin = process.execPath, sc
   const out = openSync(batch.logFile(issue), "a", 0o600);
   try {
     // FORGEDOCK_BATCH_ID names the lane's resource ledger dir (~/.forge/ledger/<batch>/, #4179).
-    const child = spawnFn(bin, [script, "run-issue", String(issue), ...args, "--result-file", rf], { cwd, env: { ...env, FORGEDOCK_BATCH_ID: batch.id }, detached: true, stdio: ["ignore", out, out] });
+    const child = spawnFn(bin, [script, "run-issue", String(issue), ...args, "--result-file", rf], { cwd, env: { ...env, FORGEDOCK_BATCH_ID: batch.id }, detached: true, windowsHide: true, stdio: ["ignore", out, out] });
     child.on?.("error", () => { /* surfaces as a dead pid without a result */ });
     child.unref?.();
     return { pid: child.pid };