@akira-tl/forgerelay 0.5.6 → 0.6.0

package/dist/db/migrations.js

@@ -59,6 +59,11 @@ const migrations = [
         name: "bash-output-audit-columns",
         up: migrateBashOutputAuditColumns,
     },
+    {
+        version: 13,
+        name: "activity-host-turn-workspace",
+        up: migrateActivityHostTurnWorkspace,
+    },
 ];
 export function migrateDatabase(sqlite) {
     const migrate = sqlite.transaction(() => {
@@ -339,6 +344,31 @@ function migrateBashOutputAuditColumns(sqlite) {
     addColumnIfMissing(sqlite, "bash_output_streams", "returned", "integer not null default 0");
     addColumnIfMissing(sqlite, "bash_output_streams", "completion_claimed_at", "text");
 }
+function migrateActivityHostTurnWorkspace(sqlite) {
+    migrateActivityHostTurns(sqlite);
+    addColumnIfMissing(sqlite, "activity_host_turns", "workspace_id", "text");
+    if (tableExists(sqlite, "activity_audit_events")) {
+        sqlite.exec(`
+      update activity_host_turns
+         set workspace_id = (
+           select workspace_id
+             from activity_audit_events
+            where activity_audit_events.turn_id = activity_host_turns.turn_id
+              and workspace_id is not null
+            order by created_at asc
+            limit 1
+         )
+       where workspace_id is null;
+    `);
+    }
+    sqlite.exec(`
+    create index if not exists activity_host_turns_conversation_workspace_idx
+      on activity_host_turns(conversation_scope_id, workspace_id, created_at desc);
+  `);
+}
+function tableExists(sqlite, table) {
+    return Boolean(sqlite.prepare("select 1 from sqlite_master where type = 'table' and name = ?").get(table));
+}
 function addColumnIfMissing(sqlite, table, column, definition) {
     const columns = sqlite.prepare(`pragma table_info(${table})`).all();
     if (columns.some((existingColumn) => existingColumn.name === column))

package/dist/db/schema.js

@@ -100,9 +100,11 @@ export const activityAuditEvents = sqliteTable("activity_audit_events", {
 export const activityHostTurns = sqliteTable("activity_host_turns", {
     turnId: text("turn_id").primaryKey(),
     conversationScopeId: text("conversation_scope_id"),
+    workspaceId: text("workspace_id"),
     createdAt: text("created_at").notNull(),
 }, (table) => [
     index("activity_host_turns_conversation_idx").on(table.conversationScopeId, table.createdAt),
+    index("activity_host_turns_conversation_workspace_idx").on(table.conversationScopeId, table.workspaceId, table.createdAt),
     index("activity_host_turns_created_idx").on(table.createdAt),
 ]);
 export const bashOutputStreams = sqliteTable("bash_output_streams", {

package/dist/logger.js

@@ -59,10 +59,7 @@ export function transportSessionIdPrefix(transportSessionId) {
 /** @deprecated Use transportSessionIdPrefix. */
 export const sessionIdPrefix = transportSessionIdPrefix;
 export function workspaceLogLabel(root, workspaceId) {
-    const shortWorkspaceId = workspaceId.startsWith("ws_")
-        ? `ws_${workspaceId.slice(3, 11)}`
-        : workspaceId.slice(0, 8);
-    return `${basename(root)}/${shortWorkspaceId}`;
+    return `${basename(root)}/${workspaceId}`;
 }
 export function commandPreview(command) {
     const normalized = command.replace(/\s+/g, " ").trim();
@@ -181,7 +178,11 @@ function formatHttpMessage(entry, options) {
 function formatMcpRequestMessage(entry) {
     const method = stringField(entry.rpcMethod) ?? stringField(entry.httpMethod) ?? "request";
     const target = stringField(entry.rpcTarget);
-    return target ? `mcp ${method} ${target}` : `mcp ${method}`;
+    const metaKeys = Array.isArray(entry.rpcMetaKeys)
+        ? entry.rpcMetaKeys.filter((value) => typeof value === "string" && value.length > 0)
+        : [];
+    const operation = target ? `mcp ${method} ${target}` : `mcp ${method}`;
+    return metaKeys.length > 0 ? `${operation} meta=[${metaKeys.join(",")}]` : operation;
 }
 function formatAppTemplateMessage(entry, options, failed) {
     const requestedUri = stringField(entry.requestedUri) ?? "unknown";

package/dist/lsp/test-support/server-fixture.js

@@ -43,7 +43,7 @@ export async function createCodeIntelligenceServerFixture(t, options = {}) {
     const activityQueries = new ActivityQueryService(hostTurnStore, auditStore, bashOutputStore);
     const processSessions = new ProcessManager({ outputAudit: bashOutputStore });
     const activityLifecycle = new ActivityLifecycle(auditStore, {
-        turnIdForConversation: (conversationScopeId) => activityQueries.currentTurnId(conversationScopeId),
+        turnIdForConversation: (conversationScopeId, workspaceId) => activityQueries.currentTurnId(conversationScopeId, workspaceId),
     });
     const codeIntelligence = new CodeIntelligenceManager(config, options.codeIntelligenceOptions);
     const server = createMcpServer(config, workspaces, createReviewCheckpointManager(), processSessions, [], [], codeIntelligence, activityLifecycle, bashOutputStore, activityQueries);

package/dist/mcp/server-instructions.js

@@ -18,7 +18,7 @@ export function buildServerInstructions(config) {
 }
 export function buildToolDescriptions(config) {
     const skillCapability = config.skillsEnabled
-        ? " Advertised skill paths may also be outside the workspace."
+        ? " Available skills are loaded through the virtual skills://<name> namespace; after loading a skill, files inside it may be read with skills://<name>/<relative-path>."
         : "";
     const shellSurface = config.toolMode === "codex"
         ? ""
@@ -37,16 +37,17 @@ export function buildToolDescriptions(config) {
 function capabilityContractInstructions(config) {
     const staleWorkspacePolicy = config.toolMode === "codex"
         ? ""
-        : ` If ${toolNames.openWorkspace} reports logical workspaces idle for more than two days, let the user choose whether to resume or close them with ${toolNames.closeWorkspace}; never close them automatically.`;
-    const workspaceLifecycle = `Use ForgeRelay as a local coding workspace. Default to the user's existing checkout. Reuse the workspaceId from ${toolNames.openWorkspace}; resume or create another logical workspace only when the user asks.${staleWorkspacePolicy} Only open mode=\"worktree\" when the user explicitly asks for isolated or parallel Git work. ${toolNames.closeWorkspace} releases checkout-backed workspaces or safely finalizes managed-worktree-backed ones; managed close requires commitMessage. Read the managed-worktrees capability guide for advanced failure semantics.`;
+        : ` If ${toolNames.openWorkspace} reports stale workspaces, let the user choose resume or ${toolNames.closeWorkspace}; never auto-close.`;
+    const workspaceLifecycle = `Use ForgeRelay as a local coding workspace. Default to the user's existing checkout. Reuse workspaceId from ${toolNames.openWorkspace}; change it only when asked.${staleWorkspacePolicy} Only open mode=\"worktree\" when the user explicitly asks for isolated or parallel Git work. ${toolNames.closeWorkspace} releases checkout workspaces or finalizes managed worktrees; managed close requires commitMessage.`;
+    const activityPanel = `Project-work order: ${toolNames.openWorkspace} if needed → activity_panel(workspaceId) once → work tools. activity_panel is the single ForgeRelay UI render tool: Workspace above Activity. A new workspaceId creates a new card. Never call activity_panel before needed ${toolNames.openWorkspace}.`;
     const agents = `Follow instructions returned by ${toolNames.openWorkspace}. Read an availableAgentsFiles path before working under it.`;
     const capabilityGuides = `For optional capabilities from ${toolNames.openWorkspace}, use ${toolNames.capability}; if unfamiliar, describe first and read its advertised capability guide with ${toolNames.read}.`;
     const skills = config.skillsEnabled
-        ? `When a task matches an available skill from ${toolNames.openWorkspace}, read its advertised path before proceeding. Outside normal file roots, ${toolNames.read} permits only advertised entry files and files under already-loaded advertised directories.`
+        ? `For a matching skill from ${toolNames.openWorkspace}, load ${toolNames.read}(path="skills://<name>") first. Skill paths stay internal; loaded skill files use skills://<name>/<relative-path>.`
         : "";
     const shellMutationPolicy = buildShellMutationPolicy();
     const hooks = "When a ForgeRelay tool result reports Hook results, tell the user which meaningful hooks ran and whether they passed or blocked the operation. Do not claim the requested operation succeeded when a blocking hook prevented it.";
-    return joinInstructions(workspaceLifecycle, agents, capabilityGuides, skills, shellMutationPolicy, hooks);
+    return joinInstructions(workspaceLifecycle, activityPanel, agents, capabilityGuides, skills, shellMutationPolicy, hooks);
 }
 function selectedWorkflowInstructions(config) {
     if (config.workflowInstructions === false)
@@ -60,7 +61,7 @@ function defaultWorkflowInstructions(config) {
         return `Use ${toolNames.read} for direct file reads, ${toolNames.rename} and ${toolNames.delete} for direct path moves or removals, apply_patch for content modifications, exec_command for inspection, tests, builds, and other commands, and ${toolNames.writeStdin} to poll or interact with running processes.`;
     }
     const inspection = `Use ${toolNames.shell} with command-line tools such as grep, rg, find, ls, and tree for search and directory inspection.`;
-    return joinInstructions(inspection, `Prefer ${toolNames.edit} for targeted content modifications, ${toolNames.write} only for new files or complete rewrites, ${toolNames.rename} for path moves, ${toolNames.delete} for removals, and ${toolNames.shell} for tests, builds, git inspection, package scripts, generators, formatters, and commands that are better executed by the shell. If ${toolNames.shell} returns a running process with a processId, call ${toolNames.shell} again with action=\"process\" when you need to poll, wait, interact, resize, or interrupt it; otherwise you may continue other work and consume its completion notice from a later tool result.`);
+    return joinInstructions(inspection, `Prefer ${toolNames.edit} for targeted content modifications, ${toolNames.write} only for new files or complete rewrites, ${toolNames.rename} for path moves, ${toolNames.delete} for removals, and ${toolNames.shell} for tests, builds, Git/package scripts, generators, formatters, and shell-suited commands. If ${toolNames.shell} returns a running processId, use action=\"process\" to poll/wait/interact/resize/interrupt it. When only waiting, set yieldTimeMs instead of short polling; reuse processId if still running. Otherwise keep working and consume its later completion notice.`);
 }
 function joinInstructions(...parts) {
     return parts

package/dist/mcp-app-template.js

@@ -1,22 +1,88 @@
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 export const WORKSPACE_APP_MANIFEST_ENTRY = "workspace-app.html";
+export const WORKSPACE_LIFECYCLE_APP_MANIFEST_ENTRY = "workspace-lifecycle-app.html";
+export const ACTIVITY_PANEL_APP_MANIFEST_ENTRY = "activity-panel-app.html";
+// Host caches are keyed by the ui:// resource URI, so the revision must cover
+// both bundle assets and the HTML/resource contract that serves them. Bump this
+// when the MCP App HTML shell or resource-to-entry mapping changes.
+export const MCP_APP_RESOURCE_TEMPLATE_REVISION = "4";
+// Historical mixed-widget resource. Keep serving it so existing ChatGPT Web
+// conversations can still render cards created before the UI split.
 export const WORKSPACE_APP_LEGACY_URI = "ui://forgerelay/workspace-app.html";
 export const WORKSPACE_APP_URI_TEMPLATE = "ui://forgerelay/workspace-app-{revision}.html";
+export const WORKSPACE_LIFECYCLE_APP_LEGACY_URI = "ui://forgerelay/workspace-lifecycle-app.html";
+export const WORKSPACE_LIFECYCLE_APP_URI_TEMPLATE = "ui://forgerelay/workspace-lifecycle-app-{revision}.html";
+export const ACTIVITY_PANEL_APP_LEGACY_URI = "ui://forgerelay/activity-panel-app.html";
+export const ACTIVITY_PANEL_APP_URI_TEMPLATE = "ui://forgerelay/activity-panel-app-{revision}.html";
 export function workspaceAppUriForRevision(revision) {
     return `ui://forgerelay/workspace-app-${encodeURIComponent(revision)}.html`;
 }
-export function readWorkspaceAppManifestEntry(manifestUrl) {
+export function workspaceLifecycleAppUriForRevision(revision) {
+    return `ui://forgerelay/workspace-lifecycle-app-${encodeURIComponent(revision)}.html`;
+}
+export function activityPanelAppUriForRevision(revision) {
+    return `ui://forgerelay/activity-panel-app-${encodeURIComponent(revision)}.html`;
+}
+export function readMcpAppManifestEntry(manifestUrl, manifestEntry) {
     const manifest = JSON.parse(readFileSync(manifestUrl, "utf8"));
-    const entry = manifest[WORKSPACE_APP_MANIFEST_ENTRY];
+    const entry = manifest[manifestEntry];
     if (!entry?.file) {
-        throw new Error(`Missing ${WORKSPACE_APP_MANIFEST_ENTRY} in UI manifest.`);
+        throw new Error(`Missing ${manifestEntry} in UI manifest.`);
     }
-    return entry;
+    const css = [];
+    const dependencies = [];
+    const seenCss = new Set();
+    const seenDependencies = new Set();
+    const visitedEntries = new Set();
+    const visit = (key, root = false) => {
+        if (visitedEntries.has(key))
+            return;
+        visitedEntries.add(key);
+        const current = manifest[key];
+        if (!current?.file) {
+            throw new Error(`Missing imported UI manifest entry ${key}.`);
+        }
+        if (!root && !seenDependencies.has(current.file)) {
+            dependencies.push(current.file);
+            seenDependencies.add(current.file);
+        }
+        for (const stylesheet of current.css ?? []) {
+            if (seenCss.has(stylesheet))
+                continue;
+            css.push(stylesheet);
+            seenCss.add(stylesheet);
+        }
+        for (const imported of current.imports ?? [])
+            visit(imported);
+    };
+    visit(manifestEntry, true);
+    return {
+        file: entry.file,
+        ...(css.length > 0 ? { css } : {}),
+        ...(dependencies.length > 0 ? { dependencies } : {}),
+        ...(entry.isEntry !== undefined ? { isEntry: entry.isEntry } : {}),
+    };
+}
+export function readWorkspaceAppManifestEntry(manifestUrl) {
+    return readMcpAppManifestEntry(manifestUrl, WORKSPACE_APP_MANIFEST_ENTRY);
+}
+export function readWorkspaceLifecycleAppManifestEntry(manifestUrl) {
+    return readMcpAppManifestEntry(manifestUrl, WORKSPACE_LIFECYCLE_APP_MANIFEST_ENTRY);
+}
+export function readActivityPanelAppManifestEntry(manifestUrl) {
+    return readMcpAppManifestEntry(manifestUrl, ACTIVITY_PANEL_APP_MANIFEST_ENTRY);
 }
-export function workspaceAppBundleRevision(entry, buildDirectoryUrl) {
+export function workspaceAppBundleRevision(entry, buildDirectoryUrl, resourceTemplateRevision = MCP_APP_RESOURCE_TEMPLATE_REVISION) {
     const hash = createHash("sha256");
-    const assetPaths = [entry.file, ...(entry.css ?? [])];
+    hash.update("resource-template\0");
+    hash.update(resourceTemplateRevision);
+    hash.update("\0");
+    const assetPaths = [
+        entry.file,
+        ...(entry.dependencies ?? []),
+        ...(entry.css ?? []),
+    ];
     for (const assetPath of assetPaths) {
         hash.update(assetPath);
         hash.update("\0");
@@ -25,21 +91,51 @@ export function workspaceAppBundleRevision(entry, buildDirectoryUrl) {
     }
     return hash.digest("hex").slice(0, 12);
 }
-export function resolveWorkspaceAppIdentity(options) {
+function resolveAppIdentity(options) {
     try {
-        const entry = readWorkspaceAppManifestEntry(options.manifestUrl);
-        const revision = workspaceAppBundleRevision(entry, options.buildDirectoryUrl);
+        const entry = readMcpAppManifestEntry(options.manifestUrl, options.manifestEntry);
+        const revision = workspaceAppBundleRevision(entry, options.buildDirectoryUrl, options.resourceTemplateRevision);
         return {
             revision,
-            uri: workspaceAppUriForRevision(revision),
+            uri: options.uriForRevision(revision),
             source: "bundle",
         };
     }
     catch {
+        const revision = options.resourceTemplateRevision
+            ? createHash("sha256")
+                .update("fallback\0")
+                .update(options.fallbackRevision)
+                .update("\0resource-template\0")
+                .update(options.resourceTemplateRevision)
+                .digest("hex")
+                .slice(0, 12)
+            : options.fallbackRevision;
         return {
-            revision: options.fallbackRevision,
-            uri: workspaceAppUriForRevision(options.fallbackRevision),
+            revision,
+            uri: options.uriForRevision(revision),
             source: "fallback",
         };
     }
 }
+export function resolveWorkspaceAppIdentity(options) {
+    return resolveAppIdentity({
+        ...options,
+        manifestEntry: WORKSPACE_APP_MANIFEST_ENTRY,
+        uriForRevision: workspaceAppUriForRevision,
+    });
+}
+export function resolveWorkspaceLifecycleAppIdentity(options) {
+    return resolveAppIdentity({
+        ...options,
+        manifestEntry: WORKSPACE_LIFECYCLE_APP_MANIFEST_ENTRY,
+        uriForRevision: workspaceLifecycleAppUriForRevision,
+    });
+}
+export function resolveActivityPanelAppIdentity(options) {
+    return resolveAppIdentity({
+        ...options,
+        manifestEntry: ACTIVITY_PANEL_APP_MANIFEST_ENTRY,
+        uriForRevision: activityPanelAppUriForRevision,
+    });
+}

package/dist/oauth/public-url.js

@@ -0,0 +1,14 @@
+export function publicEndpointUrl(baseUrl, suffix) {
+    const url = new URL(baseUrl instanceof URL ? baseUrl.href : baseUrl);
+    const basePath = url.pathname.replace(/\/+$/, "");
+    const childPath = suffix.replace(/^\/+/, "");
+    url.pathname = `${basePath}/${childPath}` || "/";
+    url.search = "";
+    url.hash = "";
+    return url;
+}
+export function oauthAuthorizationServerMetadataPath(issuerUrl) {
+    const issuer = new URL(issuerUrl instanceof URL ? issuerUrl.href : issuerUrl);
+    const issuerPath = issuer.pathname === "/" ? "" : issuer.pathname.replace(/\/+$/, "");
+    return `/.well-known/oauth-authorization-server${issuerPath}`;
+}

package/dist/oauth/router.js

@@ -0,0 +1,49 @@
+import express from "express";
+import { createOAuthMetadata, getOAuthProtectedResourceMetadataUrl, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { authorizationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/authorize.js";
+import { tokenHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/token.js";
+import { clientRegistrationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/register.js";
+import { revocationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/revoke.js";
+import { metadataHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/metadata.js";
+import { oauthAuthorizationServerMetadataPath, publicEndpointUrl, } from "./public-url.js";
+export function createForgeRelayAuthRouter(options) {
+    const { provider, issuerUrl, resourceServerUrl, scopesSupported, resourceName } = options;
+    const authorizationEndpoint = publicEndpointUrl(issuerUrl, "authorize");
+    const tokenEndpoint = publicEndpointUrl(issuerUrl, "token");
+    const registrationEndpoint = provider.clientsStore.registerClient
+        ? publicEndpointUrl(issuerUrl, "register")
+        : undefined;
+    const revocationEndpoint = provider.revokeToken
+        ? publicEndpointUrl(issuerUrl, "revoke")
+        : undefined;
+    const oauthMetadata = {
+        ...createOAuthMetadata({
+            provider,
+            issuerUrl,
+            baseUrl: issuerUrl,
+            scopesSupported,
+        }),
+        authorization_endpoint: authorizationEndpoint.href,
+        token_endpoint: tokenEndpoint.href,
+        registration_endpoint: registrationEndpoint?.href,
+        revocation_endpoint: revocationEndpoint?.href,
+    };
+    const protectedResourceMetadata = {
+        resource: resourceServerUrl.href,
+        authorization_servers: [issuerUrl.href],
+        scopes_supported: scopesSupported,
+        resource_name: resourceName,
+    };
+    const router = express.Router();
+    router.use("/authorize", authorizationHandler({ provider }));
+    router.use("/token", tokenHandler({ provider }));
+    if (provider.clientsStore.registerClient) {
+        router.use("/register", clientRegistrationHandler({ clientsStore: provider.clientsStore }));
+    }
+    if (provider.revokeToken) {
+        router.use("/revoke", revocationHandler({ provider }));
+    }
+    router.use(oauthAuthorizationServerMetadataPath(issuerUrl), metadataHandler(oauthMetadata));
+    router.use(new URL(getOAuthProtectedResourceMetadataUrl(resourceServerUrl)).pathname, metadataHandler(protectedResourceMetadata));
+    return router;
+}

package/dist/process-sessions.js

@@ -290,7 +290,8 @@ export class ProcessManager {
         const writableChars = chars.replaceAll("\u0003", "");
         if (writableChars && processEntry.running)
             processEntry.process?.write(writableChars);
-        if ((interactionRequested || !processEntry.buffer.hasOutput()) && processEntry.running) {
+        const explicitWaitRequested = input.yieldTimeMs !== undefined;
+        if ((explicitWaitRequested || interactionRequested || !processEntry.buffer.hasOutput()) && processEntry.running) {
             const fallback = interactionRequested ? DEFAULT_INTERACTIVE_YIELD_MS : DEFAULT_POLL_YIELD_MS;
             const maximum = interactionRequested ? MAX_COMMAND_YIELD_MS : MAX_POLL_YIELD_MS;
             const yieldTimeMs = boundedInteger(input.yieldTimeMs, fallback, maximum);

package/dist/request-meta.js

@@ -7,3 +7,7 @@ function metadataString(meta, key) {
 export function openAiConversationScopeId(meta) {
     return metadataString(meta, "openai/session");
 }
+export function hostConversationScopeId(meta, transportSessionId, connectionScopeId) {
+    return openAiConversationScopeId(meta)
+        ?? (transportSessionId ? `mcp-session:${transportSessionId}` : connectionScopeId);
+}