vibe-coding-master 0.9.5 → 0.9.7

package/dist/backend/services/environment-check.js

@@ -0,0 +1,245 @@
+import { randomUUID } from "node:crypto";
+import { renderVcmHookProbeCommand } from "./harness-service.js";
+import { buildVcmNoProxyEnvironment } from "./no-proxy-environment.js";
+// Oldest Git that supports every command VCM runs (`git branch --show-current`).
+export const MIN_GIT_VERSION = [2, 22, 0];
+// Matches package.json engines; harness tools run with the `node` on PATH.
+export const MIN_NODE_MAJOR = 20;
+const CHECK_CACHE_TTL_MS = 10 * 60 * 1000;
+// A failed check is retried sooner so a fixed environment clears the warning.
+const FAILED_CHECK_TTL_MS = 30 * 1000;
+const COMMAND_TIMEOUT_MS = 10 * 1000;
+// The hook pipeline retries curl twice with a 2 s limit per attempt.
+const HOOK_PROBE_TIMEOUT_MS = 15 * 1000;
+const HOOK_PROBE_SCOPE = "__vcm_hook_probe__";
+const HOOK_PROBE_ROLE = "hook-probe";
+export function createEnvironmentCheck(deps) {
+    const now = deps.now ?? Date.now;
+    const baseEnv = deps.baseEnv ?? process.env;
+    const hookProbeTimeoutMs = deps.hookProbeTimeoutMs ?? HOOK_PROBE_TIMEOUT_MS;
+    const pendingProbes = new Map();
+    let cached;
+    let inFlight;
+    const repositoryCache = new Map();
+    const repositoryInFlight = new Map();
+    return {
+        async getWarnings(options = {}) {
+            if (!cached || options.refresh) {
+                return runOnce();
+            }
+            const ttl = cached.warnings.length > 0 ? FAILED_CHECK_TTL_MS : CHECK_CACHE_TTL_MS;
+            if (now() - cached.checkedAt >= ttl) {
+                void runOnce();
+            }
+            return cached.warnings;
+        },
+        async getRepositoryWarnings(repoRoot, options = {}) {
+            const current = repositoryCache.get(repoRoot);
+            if (!current || options.refresh) {
+                return runRepositoryOnce(repoRoot);
+            }
+            const ttl = current.warnings.length > 0 ? FAILED_CHECK_TTL_MS : CHECK_CACHE_TTL_MS;
+            if (now() - current.checkedAt >= ttl) {
+                void runRepositoryOnce(repoRoot);
+            }
+            return current.warnings;
+        },
+        probeHookDelivery,
+        receiveHookProbe(probeToken) {
+            if (typeof probeToken !== "string") {
+                return false;
+            }
+            const resolve = pendingProbes.get(probeToken);
+            if (!resolve) {
+                return false;
+            }
+            pendingProbes.delete(probeToken);
+            resolve();
+            return true;
+        }
+    };
+    function runOnce() {
+        if (inFlight) {
+            return inFlight;
+        }
+        inFlight = (async () => {
+            try {
+                const warnings = await runChecks();
+                cached = { warnings, checkedAt: now() };
+                return warnings;
+            }
+            finally {
+                inFlight = undefined;
+            }
+        })();
+        return inFlight;
+    }
+    function runRepositoryOnce(repoRoot) {
+        const running = repositoryInFlight.get(repoRoot);
+        if (running) {
+            return running;
+        }
+        const check = (async () => {
+            try {
+                const warnings = await runRepositoryChecks(repoRoot);
+                repositoryCache.set(repoRoot, { warnings, checkedAt: now() });
+                return warnings;
+            }
+            finally {
+                repositoryInFlight.delete(repoRoot);
+            }
+        })();
+        repositoryInFlight.set(repoRoot, check);
+        return check;
+    }
+    async function runRepositoryChecks(repoRoot) {
+        if (!deps.git) {
+            return [];
+        }
+        const access = await deps.git.checkRemoteAccess(repoRoot);
+        if (access.status !== "failed") {
+            return [];
+        }
+        return [
+            `Git cannot reach remote "${access.remote}": ${trimPeriod(access.detail)}. Creating a task and Pull fetch the upstream branch first, so both will fail. VCM runs Git without credential prompts; check the remote URL and set up credentials for it in the environment that runs VCM, such as an SSH key loaded in ssh-agent or a Git credential helper.`
+        ];
+    }
+    async function runChecks() {
+        const [git, sh, node, curl, gh] = await Promise.all([checkGit(), checkSh(), checkNode(), checkCurl(), checkGh()]);
+        const warnings = [git, sh, node, curl, gh].filter((warning) => Boolean(warning));
+        // A missing program already explains a failed probe; only probe when the
+        // pipeline's programs are present, to catch PATH, proxy, or network faults.
+        if (!sh && !node && !curl) {
+            const hookWarning = await probeHookDelivery();
+            if (hookWarning) {
+                warnings.push(hookWarning);
+            }
+        }
+        return warnings;
+    }
+    async function checkGit() {
+        const result = await runCommand("git", ["--version"]);
+        if (result.exitCode !== 0) {
+            return `Git is not available: ${firstLine(result.stderr)}. VCM needs Git ${formatVersion(MIN_GIT_VERSION)} or newer on PATH to read repositories and create task worktrees.`;
+        }
+        const version = parseVersion(result.stdout);
+        if (!version) {
+            return `Git version could not be parsed from "${firstLine(result.stdout)}". VCM needs Git ${formatVersion(MIN_GIT_VERSION)} or newer.`;
+        }
+        if (compareVersions(version, MIN_GIT_VERSION) < 0) {
+            return `Git ${formatVersion(version)} is older than ${formatVersion(MIN_GIT_VERSION)}, the oldest version VCM supports. Upgrade Git.`;
+        }
+        return undefined;
+    }
+    async function checkSh() {
+        const result = await runCommand("sh", ["-c", "exit 0"]);
+        return result.exitCode === 0
+            ? undefined
+            : `sh is not available: ${firstLine(result.stderr)}. Claude Code runs every VCM role hook through sh.`;
+    }
+    async function checkNode() {
+        const result = await runCommand("node", ["--version"]);
+        if (result.exitCode !== 0) {
+            return `node is not available on the PATH role sessions inherit: ${firstLine(result.stderr)}. VCM role hooks, Bash and subagent guards, and .ai/tools scripts run with node; add the Node.js bin directory to PATH before starting VCM.`;
+        }
+        const version = parseVersion(result.stdout);
+        if (version && version[0] < MIN_NODE_MAJOR) {
+            return `The node on PATH is ${formatVersion(version)}, but VCM role hooks and .ai/tools scripts need Node.js ${MIN_NODE_MAJOR} or newer. Put a newer Node.js first on PATH before starting VCM.`;
+        }
+        return undefined;
+    }
+    async function checkCurl() {
+        const result = await runCommand("curl", ["--version"]);
+        return result.exitCode === 0
+            ? undefined
+            : `curl is not available: ${firstLine(result.stderr)}. VCM role hooks use curl to report Claude Code events; without it VCM cannot see role turns start or finish. Install curl.`;
+    }
+    // VCM never runs gh, so a missing gh is not a problem; an installed but
+    // logged-out gh breaks roles that use it for pull requests or issues.
+    async function checkGh() {
+        const version = await runCommand("gh", ["--version"]);
+        if (version.exitCode !== 0) {
+            return undefined;
+        }
+        const status = await deps.runner.run("gh", ["auth", "status"], {
+            env: { ...baseEnv, GH_PROMPT_DISABLED: "1", NO_COLOR: "1" },
+            timeoutMs: COMMAND_TIMEOUT_MS
+        });
+        if (status.exitCode === 0) {
+            return undefined;
+        }
+        const detail = firstLine(status.stderr) || firstLine(status.stdout) || `gh auth status exited with ${status.exitCode}`;
+        return `GitHub CLI (gh) is installed but not logged in: ${detail}. VCM does not run gh itself, but roles that use gh for pull requests or issues will fail. Run gh auth login in the environment that runs VCM.`;
+    }
+    async function probeHookDelivery() {
+        if (!deps.apiUrl) {
+            return undefined;
+        }
+        const probeToken = randomUUID();
+        let received = false;
+        const arrived = new Promise((resolve) => {
+            pendingProbes.set(probeToken, () => {
+                received = true;
+                resolve();
+            });
+        });
+        try {
+            const run = deps.runner.run("sh", ["-c", renderVcmHookProbeCommand()], {
+                env: {
+                    ...baseEnv,
+                    ...buildVcmNoProxyEnvironment(deps.apiUrl, {}, baseEnv),
+                    VCM_API_URL: deps.apiUrl,
+                    VCM_TASK_SLUG: HOOK_PROBE_SCOPE,
+                    VCM_ROLE: HOOK_PROBE_ROLE,
+                    VCM_RUNTIME_SESSION_TOKEN: probeToken
+                },
+                input: "{}",
+                timeoutMs: hookProbeTimeoutMs
+            });
+            // The endpoint records the probe before curl exits, so the command's
+            // completion bounds the wait.
+            const result = await Promise.race([run, arrived.then(() => undefined)]);
+            if (received) {
+                return undefined;
+            }
+            const detail = firstLine(result?.stderr ?? "") || "the request did not arrive";
+            return `VCM role hooks cannot reach VCM at ${deps.apiUrl}: ${detail}. Role sessions will not report turns to VCM, so dispatches stay unconfirmed. Check that sh, node, and curl are on PATH and that any HTTP proxy excludes ${readHostname(deps.apiUrl)} through NO_PROXY.`;
+        }
+        finally {
+            pendingProbes.delete(probeToken);
+        }
+    }
+    function runCommand(command, args) {
+        return deps.runner.run(command, args, { env: baseEnv, timeoutMs: COMMAND_TIMEOUT_MS });
+    }
+}
+function parseVersion(output) {
+    const match = /(\d+)\.(\d+)(?:\.(\d+))?/.exec(output);
+    return match ? [Number(match[1]), Number(match[2]), Number(match[3] ?? 0)] : undefined;
+}
+function compareVersions(left, right) {
+    for (let index = 0; index < 3; index += 1) {
+        if (left[index] !== right[index]) {
+            return left[index] - right[index];
+        }
+    }
+    return 0;
+}
+function formatVersion(version) {
+    return version.join(".");
+}
+// Error details end the sentence they are quoted in.
+function firstLine(value) {
+    return trimPeriod(value.trim().split(/\r?\n/)[0]?.trim() ?? "");
+}
+function trimPeriod(value) {
+    return value.replace(/\.+$/, "");
+}
+function readHostname(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return url;
+    }
+}

package/dist/backend/services/gate-review-service.js

@@ -1568,10 +1568,14 @@ async function captureGateInputSnapshots(fs, taskRepoRoot, requestId, sourcePath
     return snapshots;
 }
 // The reviewer judges authorization and scope against the flow's PM route
-// messages, captured like any other immutable Gate input.
+// messages, captured like any other immutable Gate input. Tester commits are
+// part of every reviewed range, so routes to Tester are always included.
 async function captureRouteMessageSnapshot(deps, context, requestId, codeDiffSources) {
     const sourcePath = path.posix.join(context.stateRoot, "messages", `${context.taskSlug}.jsonl`);
-    const roles = new Set(codeDiffSources.map((source) => source === "coder" ? "coder" : "architect"));
+    const roles = new Set([
+        ...codeDiffSources.map((source) => source === "coder" ? "coder" : "architect"),
+        "tester"
+    ]);
     const flow = await collectFlowRouteMessages(deps.fs, deps.workflowControlService, context, roles);
     if (flow.messages.length === 0) {
         return { sourcePath, status: "missing" };

package/dist/backend/services/harness-service.js

@@ -38,8 +38,6 @@ import { renderResolveDurableDocAssignmentTool } from "../templates/harness/reso
 import { submitTerminalInput } from "../runtime/terminal-submit.js";
 import { VcmError } from "../errors.js";
 import { bumpHarnessRevision, readHarnessRevisionState } from "./harness-revision.js";
-import { createHarnessCodeIntelligenceDetector } from "./code-intelligence-service.js";
-import { lspUnavailableWarning } from "./lsp-plugin.js";
 const execFileAsync = promisify(execFile);
 const BOOTSTRAP_SESSION_PATH = ".ai/vcm/bootstrap/session.json";
 const HARNESS_ENGINEER_SESSION_PATH = ".ai/vcm/harness-engineer/session.json";
@@ -55,6 +53,17 @@ const LEGACY_CODEX_HARNESS_PATHS = [
     ".ai/tools/request-codex-review"
 ];
 const VCM_HOOK_COMMAND = `sh -c 'if [ -z "\${VCM_TASK_SLUG:-}" ] || [ -z "\${VCM_ROLE:-}" ] || [ -z "\${VCM_API_URL:-}" ]; then exit 0; fi; node -e '"'"'let s="";process.stdin.setEncoding("utf8");process.stdin.on("data",d=>s+=d);process.stdin.on("end",()=>{let event={};try{event=s.trim()?JSON.parse(s):{};}catch{event={raw:s};}process.stdout.write(JSON.stringify({taskSlug:process.env.VCM_TASK_SLUG,role:process.env.VCM_ROLE,runtimeSessionToken:process.env.VCM_RUNTIME_SESSION_TOKEN,event}));});'"'"' | curl -fsS --retry 2 --retry-delay 1 --retry-all-errors --connect-timeout 1 --max-time 2 -X POST "\${VCM_API_URL}/api/hooks/claude-code" -H "content-type: application/json" --data-binary @- >/dev/null || true'`;
+// The hook self-test runs the installed hook pipeline unchanged except for its
+// endpoint, so a passing probe proves sh, node, curl, PATH, and proxy settings
+// let role hooks reach VCM.
+export const VCM_HOOK_PROBE_PATH = "/api/hooks/probe";
+export function renderVcmHookProbeCommand() {
+    const endpoint = '"${VCM_API_URL}/api/hooks/claude-code"';
+    if (!VCM_HOOK_COMMAND.includes(endpoint)) {
+        throw new Error("VCM hook command no longer posts to /api/hooks/claude-code.");
+    }
+    return VCM_HOOK_COMMAND.replace(endpoint, () => `"\${VCM_API_URL}${VCM_HOOK_PROBE_PATH}"`);
+}
 const VCM_STOP_HOOK_COMMAND = `sh -c 'if [ -z "\${VCM_TASK_SLUG:-}" ] || [ -z "\${VCM_ROLE:-}" ] || [ -z "\${VCM_API_URL:-}" ]; then exit 0; fi; node -e '"'"'let s="";process.stdin.setEncoding("utf8");process.stdin.on("data",d=>s+=d);process.stdin.on("end",()=>{let event={};try{event=s.trim()?JSON.parse(s):{};}catch{event={raw:s};}process.stdout.write(JSON.stringify({taskSlug:process.env.VCM_TASK_SLUG,role:process.env.VCM_ROLE,runtimeSessionToken:process.env.VCM_RUNTIME_SESSION_TOKEN,event}));});'"'"' | curl -fsS --retry 2 --retry-delay 1 --retry-all-errors --connect-timeout 1 --max-time 2 -X POST "\${VCM_API_URL}/api/hooks/claude-code/stop" -H "content-type: application/json" --data-binary @- || true'`;
 const VCM_PERMISSION_REQUEST_HOOK_COMMAND = `sh -c 'if [ -z "\${VCM_TASK_SLUG:-}" ] || [ -z "\${VCM_ROLE:-}" ] || [ -z "\${VCM_API_URL:-}" ]; then exit 0; fi; node -e '"'"'let s="";process.stdin.setEncoding("utf8");process.stdin.on("data",d=>s+=d);process.stdin.on("end",()=>{let event={};try{event=s.trim()?JSON.parse(s):{};}catch{event={raw:s};}process.stdout.write(JSON.stringify({taskSlug:process.env.VCM_TASK_SLUG,role:process.env.VCM_ROLE,runtimeSessionToken:process.env.VCM_RUNTIME_SESSION_TOKEN,event}));});'"'"' | curl -fsS --max-time 5 -X POST "\${VCM_API_URL}/api/hooks/claude-code/permission-request" -H "content-type: application/json" --data-binary @- || true'`;
 const VCM_BASH_GUARD_HOOK_COMMAND = `sh -c 'if [ -z "\${VCM_TASK_SLUG:-}" ] || [ -z "\${VCM_ROLE:-}" ]; then exit 0; fi; guard=""; repo="$(git rev-parse --show-toplevel 2>/dev/null || true)"; if [ -n "$repo" ] && [ -f "$repo/.ai/tools/vcm-bash-guard" ]; then guard="$repo/.ai/tools/vcm-bash-guard"; else cwd="$(pwd -P 2>/dev/null || pwd)"; dir="$cwd"; while [ -n "$dir" ] && [ "$dir" != "/" ]; do if [ -f "$dir/.ai/tools/vcm-bash-guard" ]; then guard="$dir/.ai/tools/vcm-bash-guard"; break; fi; dir="$(dirname "$dir")"; done; if [ -z "$guard" ] && [ -n "\${CLAUDE_PROJECT_DIR:-}" ] && [ -f "\${CLAUDE_PROJECT_DIR}/.ai/tools/vcm-bash-guard" ]; then guard="\${CLAUDE_PROJECT_DIR}/.ai/tools/vcm-bash-guard"; fi; fi; [ -n "$guard" ] || exit 0; node "$guard" || exit 0'`;
@@ -369,20 +378,14 @@ export function createHarnessService(deps) {
             ? normalizeArchitectWorkerSettings(await deps.getArchitectWorkerSettings())
             : DEFAULT_ARCHITECT_WORKER_SETTINGS;
     }
-    const codeIntelligenceDetector = createHarnessCodeIntelligenceDetector(deps.fs, {
-        runner: deps.commandRunner
-    });
     return {
         async getHarnessStatus(repoRoot) {
-            const [analyses, codeIntelligence] = await Promise.all([
-                analyzeHarnessFiles(deps.fs, repoRoot, await resolveArchitectWorkerSettings()),
-                codeIntelligenceDetector.detect(repoRoot)
-            ]);
+            const analyses = await analyzeHarnessFiles(deps.fs, repoRoot, await resolveArchitectWorkerSettings());
             const legacyChanges = await analyzeLegacyCodexHarnessPaths(deps.fs, repoRoot);
             const manifestChange = deps.runFixedInstaller
                 ? await analyzeHarnessManifest(deps.fs, repoRoot, vcmVersion)
                 : undefined;
-            return renderHarnessStatus(await readHarnessRevisionValue(deps.fs, repoRoot), analyses, legacyChanges, manifestChange, codeIntelligence);
+            return renderHarnessStatus(await readHarnessRevisionValue(deps.fs, repoRoot), analyses, legacyChanges, manifestChange);
         },
         async getHarnessFileContent(repoRoot, filePath) {
             return readHarnessFileContent(deps.fs, repoRoot, filePath);
@@ -411,17 +414,14 @@ export function createHarnessService(deps) {
                 harnessCommit = (await commitHarnessVisibleChanges(deps.git, repoRoot, "[VCM Harness] Update harness file")).harnessCommit;
             }
             const file = await readHarnessFileContent(deps.fs, repoRoot, definition.path);
-            const [analyses, codeIntelligence] = await Promise.all([
-                analyzeHarnessFiles(deps.fs, repoRoot, await resolveArchitectWorkerSettings()),
-                codeIntelligenceDetector.detect(repoRoot)
-            ]);
+            const analyses = await analyzeHarnessFiles(deps.fs, repoRoot, await resolveArchitectWorkerSettings());
             const legacyChanges = await analyzeLegacyCodexHarnessPaths(deps.fs, repoRoot);
             const manifestChange = deps.runFixedInstaller
                 ? await analyzeHarnessManifest(deps.fs, repoRoot, vcmVersion)
                 : undefined;
             return {
                 file,
-                status: renderHarnessStatus(await readHarnessRevisionValue(deps.fs, repoRoot), analyses, legacyChanges, manifestChange, codeIntelligence),
+                status: renderHarnessStatus(await readHarnessRevisionValue(deps.fs, repoRoot), analyses, legacyChanges, manifestChange),
                 harnessCommit
             };
         },
@@ -1393,7 +1393,7 @@ async function removeLegacyCodexHarnessPaths(fs, repoRoot) {
     }
     return changes;
 }
-function renderHarnessStatus(harnessRevision, analyses, legacyChanges = [], manifestChange, codeIntelligence) {
+function renderHarnessStatus(harnessRevision, analyses, legacyChanges = [], manifestChange) {
     const files = analyses.map((analysis) => analysis.status);
     const plannedChanges = analyses
         .map((analysis) => analysis.plannedChange)
@@ -1419,13 +1419,7 @@ function renderHarnessStatus(harnessRevision, analyses, legacyChanges = [], mani
         files,
         needsApply: plannedChanges.length > 0,
         plannedChanges,
-        codeIntelligence,
-        warnings: [
-            ...(plannedChanges.length > 0 ? ["Review and commit VCM Harness changes before starting long-running work."] : []),
-            ...((codeIntelligence?.languages ?? [])
-                .filter((language) => language.state !== "server_runnable")
-                .map(lspUnavailableWarning))
-        ]
+        warnings: plannedChanges.length > 0 ? ["Review and commit VCM Harness changes before starting long-running work."] : []
     };
 }
 async function readHarnessRevisionValue(fs, repoRoot) {

package/dist/backend/services/message-service.js

@@ -314,7 +314,19 @@ export function createMessageService(deps) {
         if (!current || current.acceptedAt) {
             return;
         }
-        await markDispatchConfirmationFailure(input, message.id, DISPATCH_NOT_CONFIRMED_REASON);
+        await markDispatchConfirmationFailure(input, message.id, await renderDispatchNotConfirmedReason());
+    }
+    async function renderDispatchNotConfirmedReason() {
+        let hookWarning;
+        try {
+            hookWarning = await deps.probeHookDelivery?.();
+        }
+        catch {
+            hookWarning = undefined;
+        }
+        return hookWarning
+            ? `${DISPATCH_NOT_CONFIRMED_REASON} The VCM hook self-test also failed, so the role may have run without reporting: ${hookWarning}`
+            : DISPATCH_NOT_CONFIRMED_REASON;
     }
     async function readMessageById(input, messageId) {
         return withTaskLock(taskLocks, getMessagesPath(getStateRepoRoot(input), input.stateRoot, input.taskSlug), async () => {

package/dist/backend/services/no-proxy-environment.js

@@ -0,0 +1,29 @@
+import { mergeNoProxy } from "./codex-bridge-integration-service.js";
+// Role hooks, harness tools, and usage telemetry post to VCM_API_URL. curl and
+// other HTTP clients send even loopback requests through http_proxy, so a proxy
+// without a NO_PROXY entry for the VCM host would drop every hook silently.
+export function buildVcmNoProxyEnvironment(apiUrl, modelEnvironment = {}, baseEnv = process.env) {
+    const host = readUrlHostname(apiUrl);
+    if (!host) {
+        return {};
+    }
+    const current = modelEnvironment.NO_PROXY
+        ?? modelEnvironment.no_proxy
+        ?? baseEnv.NO_PROXY
+        ?? baseEnv.no_proxy;
+    const noProxy = mergeNoProxy(current, host);
+    return { NO_PROXY: noProxy, no_proxy: noProxy };
+}
+function readUrlHostname(value) {
+    if (!value) {
+        return undefined;
+    }
+    try {
+        const hostname = new URL(value).hostname;
+        // URL keeps IPv6 brackets; NO_PROXY lists the bare address.
+        return hostname.replace(/^\[(.*)\]$/, "$1") || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/backend/services/project-service.js

@@ -1,9 +1,12 @@
 import path from "node:path";
 import { CORE_VCM_ROLE_NAMES } from "../../shared/constants.js";
 import { VcmError } from "../errors.js";
+import { renderGitIdentityWarning } from "../adapters/git-adapter.js";
 const DEFAULT_HANDOFF_ROOT = ".ai/vcm/handoffs";
 const DEFAULT_STATE_ROOT = ".ai/vcm";
+const DEFAULT_ENVIRONMENT_CHECK_WAIT_MS = 5 * 1000;
 export function createProjectService(deps) {
+    const environmentCheckWaitMs = deps.environmentCheckWaitMs ?? DEFAULT_ENVIRONMENT_CHECK_WAIT_MS;
     let currentProject = null;
     return {
         async connectProject(input) {
@@ -33,7 +36,7 @@ export function createProjectService(deps) {
             await deps.fs.ensureDir(path.join(this.getProjectDataRoot(repoRoot), "tasks"));
             await deps.fs.ensureDir(path.join(repoRoot, ".claude", "worktrees"));
             await this.saveConfig(config, true);
-            currentProject = await readConnectedProjectSummary(repoRoot, config, { refreshClaudeVersion: true });
+            currentProject = await readConnectedProjectSummary(repoRoot, config, { refreshChecks: true });
             await deps.appSettings.recordRecentRepositoryPath(repoRoot);
             return currentProject;
         },
@@ -97,14 +100,58 @@ export function createProjectService(deps) {
             return path.dirname(deps.appSettings.getProjectConfigPath(repoRoot));
         }
     };
+    async function readEnvironmentWarnings(repoRoot, refresh) {
+        const [host, repository] = await Promise.all([
+            // Startup already ran the host checks; their cache retries failures
+            // after 30 s, so a connect only refreshes the repository's own checks.
+            (deps.environmentCheck?.getWarnings() ?? Promise.resolve([])).catch((caught) => [
+                `Unable to check the host environment. ${getErrorHint(caught)}`
+            ]),
+            (deps.environmentCheck?.getRepositoryWarnings(repoRoot, { refresh }) ?? Promise.resolve([])).catch((caught) => [
+                `Unable to check access to the Git remote. ${getErrorHint(caught)}`
+            ])
+        ]);
+        return { host, repository };
+    }
+    // A slow network must not stall the Repository panel: checks that outlast the
+    // wait keep running and fill the cache for the next refresh.
+    async function waitForChecks(checks) {
+        let timer;
+        const pending = new Promise((resolve) => {
+            timer = setTimeout(() => resolve({
+                host: ["VCM is still checking the host environment and Git remote access. Refresh the Repository panel to see the result."],
+                repository: []
+            }), environmentCheckWaitMs);
+        });
+        try {
+            return await Promise.race([checks, pending]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
     async function readConnectedProjectSummary(repoRoot, config, options = {}) {
         const warnings = [];
+        // Environment and remote checks reach the network (gh auth status, git
+        // ls-remote), so they run alongside the local Git reads below.
+        const environmentChecks = readEnvironmentWarnings(repoRoot, options.refreshChecks);
         const claudeVersionWarning = await deps.claudeVersionCheck?.getWarning(config.claudeCommand, {
-            refresh: options.refreshClaudeVersion
+            refresh: options.refreshChecks
         });
         if (claudeVersionWarning) {
             warnings.push(claudeVersionWarning);
         }
+        const environmentWarnings = await waitForChecks(environmentChecks);
+        warnings.push(...environmentWarnings.host);
+        try {
+            const identity = await deps.git.resolveCommitIdentity(repoRoot);
+            if (identity.defaulted.length > 0) {
+                warnings.push(renderGitIdentityWarning("this repository", identity));
+            }
+        }
+        catch (caught) {
+            warnings.push(`Unable to read the Git commit identity. ${getErrorHint(caught)}`);
+        }
         let branch = "unknown";
         let isDirty = false;
         let headCommit = "unknown";
@@ -145,6 +192,7 @@ export function createProjectService(deps) {
                 warnings.push(`Unable to read Git ahead/behind status. ${getErrorHint(caught)}`);
             }
         }
+        warnings.push(...environmentWarnings.repository);
         const pullDisabledReason = getPullDisabledReason({ isDirty, upstreamBranch });
         return {
             repoRoot,

package/dist/backend/services/session-service.js

@@ -7,7 +7,7 @@ import { resolveRepoPath } from "../adapters/filesystem.js";
 import { submitTerminalInput } from "../runtime/terminal-submit.js";
 import { readHarnessRevisionState } from "./harness-revision.js";
 import { getTaskRuntimeRepoRoot } from "./task-service.js";
-import { roleUsesLsp, prepareTaskLspPlugin, renderLspNotice, VCM_LSP_PLUGIN_DIR } from "./lsp-plugin.js";
+import { buildVcmNoProxyEnvironment } from "./no-proxy-environment.js";
 const TRANSLATOR_ROLE = "translator";
 const HARNESS_ENGINEER_ROLE = "harness-engineer";
 const TRANSLATION_DIR = ".ai/vcm/translations";
@@ -79,16 +79,8 @@ export function createSessionService(deps) {
         // Transcript paths come from Claude Code hook payloads; VCM does not derive
         // them from Claude Code's project-directory encoding.
         const transcriptPath = launchMode === "resume" ? persisted?.transcriptPath : undefined;
-        const lspStatus = roleUsesLsp(role) && deps.codeIntelligenceDetector
-            ? await deps.codeIntelligenceDetector.detect(taskRepoRoot, { refresh: true })
-            : undefined;
-        const lspPluginDirs = roleUsesLsp(role)
-            ? lspStatus ? await prepareTaskLspPlugin(deps.fs, taskRepoRoot, lspStatus) : [VCM_LSP_PLUGIN_DIR]
-            : [];
-        const appendSystemPrompt = [input.appendSystemPrompt, lspStatus && renderLspNotice(lspStatus, role)]
-            .filter(Boolean).join("\n\n") || undefined;
         const startCommand = {
-            ...deps.claude.buildRoleStartCommand(role, config.claudeCommand, permissionMode, resumeClaudeSessionId, launchMode === "resume", model, effort, modelSettingsOverride, appendSystemPrompt, lspPluginDirs),
+            ...deps.claude.buildRoleStartCommand(role, config.claudeCommand, permissionMode, resumeClaudeSessionId, launchMode === "resume", model, effort, modelSettingsOverride, input.appendSystemPrompt),
             cwd: taskRepoRoot
         };
         const runtimeSessionToken = randomUUID();
@@ -102,20 +94,13 @@ export function createSessionService(deps) {
             env: withClaudeCodeRuntimeEnv({
                 VCM_API_URL: deps.apiUrl,
                 VCM_BASE_REPO_ROOT: repoRoot,
+                ...await gitIdentityEnvironment(taskRepoRoot),
                 VCM_TASK_REPO_ROOT: taskRepoRoot,
                 VCM_TASK_SLUG: taskSlug,
                 VCM_ROLE: role,
                 VCM_SESSION_ID: claudeSessionId || undefined,
                 VCM_RUNTIME_SESSION_TOKEN: runtimeSessionToken
-            }, modelEnvironment, {
-                ...buildUsageTelemetryEnvironment(deps.apiUrl, role, model),
-                ...(lspPluginDirs.length > 0
-                    ? {
-                        ENABLE_LSP_TOOL: "true",
-                        ENABLE_TOOL_SEARCH: "false"
-                    }
-                    : {})
-            }),
+            }, modelEnvironment, buildUsageTelemetryEnvironment(deps.apiUrl, role, model)),
             cols: input.cols,
             rows: input.rows
         });
@@ -235,6 +220,7 @@ export function createSessionService(deps) {
             env: withClaudeCodeRuntimeEnv({
                 VCM_API_URL: deps.apiUrl,
                 VCM_BASE_REPO_ROOT: repoRoot,
+                ...await gitIdentityEnvironment(taskContext.taskRepoRoot),
                 VCM_TASK_REPO_ROOT: taskContext.taskRepoRoot,
                 // Project-scoped sessions report their project sentinel as VCM_TASK_SLUG so
                 // hook payloads match this session's record and cannot be attributed to the
@@ -349,6 +335,7 @@ export function createSessionService(deps) {
             env: withClaudeCodeRuntimeEnv({
                 VCM_API_URL: deps.apiUrl,
                 VCM_BASE_REPO_ROOT: repoRoot,
+                ...await gitIdentityEnvironment(taskContext.taskRepoRoot),
                 VCM_TASK_REPO_ROOT: taskContext.taskRepoRoot,
                 // Project-scoped sessions report their project sentinel as VCM_TASK_SLUG so
                 // hook payloads match this session's record and cannot be attributed to the
@@ -431,6 +418,9 @@ export function createSessionService(deps) {
     // silent) session still proceeds best-effort. Returns "exited" if the runtime
     // session is gone or no longer running, which a resume launch treats as a
     // resume-by-id failure.
+    async function gitIdentityEnvironment(repoRoot) {
+        return deps.gitIdentity ? (await deps.gitIdentity.resolveCommitIdentity(repoRoot)).env : {};
+    }
     async function waitForSessionInputReady(sessionId) {
         let sawOutput = false;
         let lastOutputAt;
@@ -547,6 +537,7 @@ export function createSessionService(deps) {
             env: withClaudeCodeRuntimeEnv({
                 VCM_API_URL: deps.apiUrl,
                 VCM_BASE_REPO_ROOT: repoRoot,
+                ...await gitIdentityEnvironment(targetCwd),
                 VCM_TASK_REPO_ROOT: targetCwd,
                 VCM_TASK_SLUG: normalizeProjectScopedRecordForPersistence(session).taskSlug,
                 VCM_ROLE: session.role,
@@ -1669,6 +1660,7 @@ function withClaudeCodeRuntimeEnv(env, modelEnvironment = {}, telemetryEnvironme
         ...env,
         ...modelEnvironment,
         ...telemetryEnvironment,
+        ...buildVcmNoProxyEnvironment(env.VCM_API_URL, modelEnvironment),
         CLAUDE_CODE_DISABLE_AUTO_MEMORY,
         CLAUDE_CODE_DISABLE_BACKGROUND_TASKS
     };

package/dist/backend/services/workflow-control-service.js

@@ -890,10 +890,16 @@ async function allowedAfterTester(fs, input, state, currentFlow, codeSource, opt
     if (test.value === "incomplete" || test.infrastructure === "repair-required")
         return [`${currentFlow}/tester`];
     const validation = await gateState(fs, input, "validation-adequacy");
+    const unapprovedFailure = test.value === "fail" && !test.hasUserApprovedCoverageGap;
     if (freshGateDecision(state, currentFlow, "tester", "validation-adequacy", validation) === "request_changes") {
-        return [`${currentFlow}/tester`];
-    }
-    if (test.value === "fail" && !test.hasUserApprovedCoverageGap) {
+        // Findings on a genuine failure may be Tester-owned (wrong tests or
+        // evidence) or need the production investigation that Tester Failure
+        // starts; PM routes by who can dispose of them.
+        return unapprovedFailure && options.testerFailureFlow
+            ? [`${currentFlow}/tester`, `${options.testerFailureFlow}/architect`]
+            : [`${currentFlow}/tester`];
+    }
+    if (unapprovedFailure) {
         return options.testerFailureFlow ? [`${options.testerFailureFlow}/architect`] : [];
     }
     if (!gatePassedForDispatch(state, currentFlow, "tester", "validation-adequacy", validation))