@akira-tl/forgerelay 1.1.0 → 1.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akira-tl/forgerelay",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Local development control plane for MCP coding agents.",
   "type": "module",
   "homepage": "https://github.com/Akira-TL/forgerelay#readme",
@@ -40,6 +40,7 @@
     "debug:serve": "node scripts/debug/serve.mjs",
     "debug:accept": "node scripts/debug/accept.mjs",
     "debug:accept:media": "node scripts/debug/accept/media.mjs",
+    "debug:accept:modern": "node scripts/debug/accept/modern-http.mjs",
     "debug:accept:relay": "node scripts/debug/relay-accept.mjs",
     "traffic:audit": "node --import tsx scripts/debug/traffic/traffic-audit.mjs",
     "lsp:interop": "node scripts/lsp/interop.mjs",
@@ -57,7 +58,7 @@
     "release:push-ready": "node scripts/release/push-ready.mjs",
     "postinstall": "node scripts/fix-node-pty-permissions.mjs",
     "start": "node dist/cli.js serve",
-    "test": "node --test scripts/debug/runtime.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/workspaces/relay/tests/recovery.test.ts && tsx src/workspaces/relay/tests/checkpoint.test.ts && tsx src/runtime/config/config.test.ts && tsx src/runtime/shell/command-shell-runtime.test.ts && tsx src/runtime/instructions/shell-instructions.test.ts && tsx src/runtime/instructions/powershell-skill.test.ts && tsx src/cli/shell/setup.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/runtime/managed-language-servers.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/runtime/state/runtime-lease.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/mcp/server/operations/mutation-diagnostics.test.ts && tsx src/mcp/server/operations/hooks.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/git/worktree-recovery.test.ts && tsx src/mcp/server/workspace/workspace-inventory.test.ts && tsx src/mcp/server/workspace/workspace-recovery.test.ts && tsx src/mcp/server/workspace/workspace-checkpoint.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/maintenance.test.ts && tsx src/cli/maintenance-prune.test.ts && tsx src/cli/cli.test.ts",
+    "test": "node --test scripts/debug/runtime.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/workspaces/relay/tests/recovery.test.ts && tsx src/workspaces/relay/tests/checkpoint.test.ts && tsx src/runtime/config/config.test.ts && tsx src/runtime/config/external-mcp-registry.test.ts && tsx src/runtime/config/external-mcp-auth-store.test.ts && tsx src/mcp/operations/external-mcp/external-mcp-oauth.test.ts && tsx src/cli/mcp/status.test.ts && tsx src/cli/mcp/diagnostics.test.ts && tsx src/cli/mcp/external-mcp.test.ts && tsx src/runtime/shell/command-shell-runtime.test.ts && tsx src/runtime/instructions/shell-instructions.test.ts && tsx src/runtime/instructions/powershell-skill.test.ts && tsx src/cli/shell/setup.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/runtime/managed-language-servers.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/runtime/state/runtime-lease.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-context.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/mcp/server/operations/mutation-diagnostics.test.ts && tsx src/mcp/server/operations/hooks.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/git/worktree-recovery.test.ts && tsx src/mcp/server/workspace/workspace-inventory.test.ts && tsx src/mcp/server/workspace/workspace-recovery.test.ts && tsx src/mcp/server/workspace/workspace-checkpoint.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/maintenance.test.ts && tsx src/cli/maintenance-prune.test.ts && tsx src/cli/cli.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "release:check": "node scripts/release-version.mjs check",
     "release:tag-check": "node scripts/release-version.mjs tag",
@@ -80,13 +81,18 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.1.0",
     "@clack/prompts": "^1.5.1",
-    "@modelcontextprotocol/ext-apps": "^1.7.2",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/client": "^2.0.0",
+    "@modelcontextprotocol/core": "^2.0.0",
+    "@modelcontextprotocol/express": "^2.0.0",
+    "@modelcontextprotocol/ext-apps": "^2.0.0",
+    "@modelcontextprotocol/node": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "@pierre/diffs": "^1.2.5",
     "better-sqlite3": "^13.0.3",
     "diff": "^8.0.3",
     "drizzle-orm": "^0.45.2",
     "express": "^5.2.1",
+    "express-rate-limit": "8.5.2",
     "lucide": "^1.24.0",
     "react": "^19.2.6",
     "react-dom": "^19.2.6",
@@ -97,6 +103,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0",
     "@types/better-sqlite3": "^7.6.13",
     "@types/express": "^5.0.6",
     "@types/node": "^25.9.1",

package/scripts/debug/accept/bootstrap.mjs

@@ -195,6 +195,7 @@ export async function runBootstrapAcceptance({ server, packageJson, ownerToken,
       "workspace.recovery",
       "workspace.checkpoint",
       "batch.execute",
+      "mcp.external",
       ...(process.platform === "linux" ? ["artifact.native-download"] : []),
       "ui.mcp-app",
       "review.changes",
@@ -207,6 +208,7 @@ export async function runBootstrapAcceptance({ server, packageJson, ownerToken,
     "code.intelligence",
     "workspace.checkpoint",
     "workspace.tasks",
+    "mcp.external",
     "batch.execute",
     ...(process.platform === "linux" ? ["artifact.download"] : []),
   ]);

package/scripts/debug/accept/harness.mjs

@@ -6,6 +6,7 @@ import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import {
   createDebugEnvironment,
+  debugConfigDir,
   debugRoot,
   repoRoot,
 } from "../runtime.mjs";
@@ -19,6 +20,7 @@ import { assertCurlAvailable, assertDebugPortFree, pass, setupGitProject } from
 export async function createAcceptanceHarness() {
   const packageJson = JSON.parse(readFileSync(join(repoRoot, "package.json"), "utf8"));
   const acceptanceRoot = resolve(debugRoot, "acceptance");
+  const configDir = resolve(acceptanceRoot, "config");
   const stateDir = resolve(acceptanceRoot, "state");
   const worktreeRoot = resolve(acceptanceRoot, "worktrees");
   const hookLog = resolve(acceptanceRoot, "hooks.jsonl");
@@ -35,7 +37,11 @@ export async function createAcceptanceHarness() {
   assertCurlAvailable();
   await assertDebugPortFree();
   rmSync(acceptanceRoot, { recursive: true, force: true });
-  mkdirSync(acceptanceRoot, { recursive: true });
+  mkdirSync(configDir, { recursive: true });
+  writeFileSync(
+    join(configDir, "config.json"),
+    readFileSync(join(debugConfigDir, "config.json"), "utf8"),
+  );
   setupGitProject(checkoutWorkspace);
   setupGitProject(lifecycleDeleteWorkspace);
   writeFileSync(join(lifecycleDeleteWorkspace, "keep.txt"), "keep checkout files\n");
@@ -44,6 +50,7 @@ export async function createAcceptanceHarness() {
 
   const { env } = createDebugEnvironment({
     ownerToken,
+    configDir,
     stateDir,
     worktreeRoot,
     hookLog,
@@ -69,7 +76,7 @@ export async function createAcceptanceHarness() {
   });
 
   return {
-    packageJson, acceptanceRoot, stateDir, worktreeRoot, hookLog, checkoutWorkspace,
+    packageJson, acceptanceRoot, configDir, stateDir, worktreeRoot, hookLog, checkoutWorkspace,
     lifecycleDeleteWorkspace, codeIntelligenceLog, fakeLanguageServer, gitProject, releaseProject,
     releaseRemote, ownerToken, tempAcceptanceRoot, env, server,
   };

package/scripts/debug/accept/modern-http.mjs

@@ -0,0 +1,169 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+import { debugRoot, repoRoot } from "../runtime.mjs";
+import { assertPortFree, pass, stopServer, waitForHealth } from "./support.mjs";
+
+const port = 7678;
+const baseUrl = `http://127.0.0.1:${port}`;
+const mcpUrl = `${baseUrl}/mcp`;
+const acceptanceRoot = resolve(debugRoot, "modern-http-acceptance");
+const configDir = join(acceptanceRoot, "config");
+const stateDir = join(acceptanceRoot, "state");
+const worktreeRoot = join(acceptanceRoot, "worktrees");
+const workspaceRoot = join(acceptanceRoot, "workspace");
+const ownerToken = randomBytes(32).toString("base64url");
+
+await assertPortFree(port);
+rmSync(acceptanceRoot, { recursive: true, force: true });
+mkdirSync(configDir, { recursive: true });
+mkdirSync(stateDir, { recursive: true });
+mkdirSync(workspaceRoot, { recursive: true });
+writeFileSync(join(workspaceRoot, "README.md"), "modern MCP acceptance workspace\n");
+writeFileSync(join(configDir, "config.json"), `${JSON.stringify({
+  host: "127.0.0.1",
+  port,
+  allowedRoots: [workspaceRoot],
+  publicBaseUrl: baseUrl,
+  allowedHosts: ["localhost", "127.0.0.1", "::1"],
+  stateDir,
+  worktreeRoot,
+}, null, 2)}\n`);
+writeFileSync(join(configDir, "auth.json"), `${JSON.stringify({
+  ownerToken,
+  instanceId: "modern-http-acceptance-7678",
+}, null, 2)}\n`, { mode: 0o600 });
+
+const cleanEnv = Object.fromEntries(
+  Object.entries(process.env).filter(([name]) =>
+    name !== "HOST" && name !== "PORT" && !name.startsWith("FORGERELAY_")
+  ),
+);
+const env = {
+  ...cleanEnv,
+  HOST: "127.0.0.1",
+  PORT: String(port),
+  FORGERELAY_CONFIG_DIR: configDir,
+  FORGERELAY_OAUTH_OWNER_TOKEN: ownerToken,
+  FORGERELAY_PUBLIC_BASE_URL: baseUrl,
+  FORGERELAY_TOOL_MODE: "full",
+  FORGERELAY_WIDGETS: "off",
+  FORGERELAY_LOG_LEVEL: "debug",
+  FORGERELAY_LOG_FORMAT: "json",
+};
+
+let serverLogs = "";
+const server = spawn(process.execPath, ["--import", "tsx", "src/cli.ts", "serve"], {
+  cwd: repoRoot,
+  env,
+  stdio: ["ignore", "pipe", "pipe"],
+});
+server.stdout?.on("data", (chunk) => { serverLogs += chunk.toString(); });
+server.stderr?.on("data", (chunk) => { serverLogs += chunk.toString(); });
+
+let client;
+try {
+  await waitForHealth(server, baseUrl);
+  pass("modern HTTP health", baseUrl);
+
+  const unauthorized = await fetch(mcpUrl, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+    },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "server/discover", params: {} }),
+  });
+  assert.equal(unauthorized.status, 401);
+  assert.match(unauthorized.headers.get("www-authenticate") ?? "", /Bearer .*resource_metadata=/i);
+  pass("modern HTTP bearer challenge", "unauthenticated MCP request advertises protected-resource metadata");
+
+  const tokenResponse = await fetch(`${baseUrl}/auth/cli`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ owner_token: ownerToken }),
+  });
+  const tokenBody = await tokenResponse.text();
+  assert.equal(tokenResponse.status, 200, tokenBody);
+  const tokens = JSON.parse(tokenBody);
+  assert.equal(tokens.token_type, "bearer");
+  assert.ok(tokens.access_token);
+  pass("modern HTTP auth", "real ForgeRelay bearer token issued on 7678");
+
+  const transport = new StreamableHTTPClientTransport(new URL(mcpUrl), {
+    requestInit: {
+      headers: { authorization: `Bearer ${tokens.access_token}` },
+    },
+  });
+  client = new Client(
+    { name: "forgerelay-modern-http-acceptance", version: "1.0.0" },
+    { versionNegotiation: { mode: { pin: "2026-07-28" } } },
+  );
+  await client.connect(transport);
+  assert.equal(client.getProtocolEra(), "modern");
+  assert.equal(client.getNegotiatedProtocolVersion(), "2026-07-28");
+  assert.equal(transport.sessionId, undefined);
+  pass("modern protocol negotiation", "2026-07-28 connected without Mcp-Session-Id");
+
+  const listed = await client.listTools();
+  assert.ok(listed.tools.some((tool) => tool.name === "open_workspace"));
+  const opened = await client.callTool({
+    name: "open_workspace",
+    arguments: { path: workspaceRoot, context: "none" },
+  });
+  assert.notEqual(opened.isError, true);
+  const workspaceId = String(opened.structuredContent?.workspaceId ?? "");
+  assert.match(workspaceId, /^ws_/);
+  pass("modern tools call", "tools/list and open_workspace completed over stateless HTTP");
+
+  const conversationMeta = { "dev.forgerelay/conversation": "modern-http-acceptance-conversation" };
+  const panel = await client.callTool({
+    name: "activity_panel",
+    arguments: { workspaceId },
+    _meta: conversationMeta,
+  });
+  assert.notEqual(panel.isError, true);
+  const turnId = String(panel.structuredContent?.turnId ?? "");
+  assert.match(turnId, /^turn_/);
+  const restored = await client.callTool({
+    name: "activity_snapshot",
+    arguments: { workspaceId },
+    _meta: conversationMeta,
+  });
+  assert.notEqual(restored.isError, true);
+  assert.equal(restored.structuredContent?.turnId, turnId);
+  pass("modern vendor conversation continuity", "stable ForgeRelay metadata restored the Host Turn across stateless requests");
+
+  const requestScopedPanel = await client.callTool({
+    name: "activity_panel",
+    arguments: { workspaceId },
+  });
+  assert.notEqual(requestScopedPanel.isError, true);
+  const requestScopedSnapshot = await client.callTool({
+    name: "activity_snapshot",
+    arguments: { workspaceId },
+  });
+  assert.equal(requestScopedSnapshot.isError, true);
+  assert.match(
+    requestScopedSnapshot.content?.map((entry) => entry.type === "text" ? entry.text : "").join("\n") ?? "",
+    /could not resolve the current Host Turn/i,
+  );
+  pass("modern request scope isolation", "requests without stable metadata do not share Host Turn state");
+
+  assert.equal(serverLogs.includes("\"protocolEra\":\"modern\""), true);
+  pass("modern routing observability", "ForgeRelay classified the accepted request as modern");
+
+  console.log("Modern HTTP acceptance passed.");
+} catch (error) {
+  if (serverLogs) process.stderr.write(`\n--- ForgeRelay 7678 logs ---\n${serverLogs}`);
+  throw error;
+} finally {
+  try {
+    await client?.close();
+  } finally {
+    await stopServer(server);
+  }
+}

package/scripts/debug/accept/support.mjs

@@ -198,20 +198,20 @@ export function curlRequest({ method = "GET", url, headers = {}, body }) {
   return { status, headers: responseHeaders, body: responseBody };
 }
 
-export async function waitForHealth(child) {
+export async function waitForHealth(child, baseUrl = debugBaseUrl) {
   for (let attempt = 0; attempt < 60; attempt += 1) {
     if (child.exitCode !== null) {
       throw new Error(`debug server exited before health check: ${child.exitCode}`);
     }
     try {
-      const response = jsonRequest(`${debugBaseUrl}/healthz`);
+      const response = jsonRequest(`${baseUrl}/healthz`);
       if (response.status === 200) return response.json;
     } catch {
       // Server is still starting.
     }
     await delay(100);
   }
-  throw new Error("debug server did not become healthy on 127.0.0.1:7677");
+  throw new Error(`debug server did not become healthy at ${baseUrl}`);
 }
 
 export async function stopServer(child) {
@@ -397,13 +397,13 @@ export function readHookEntries(path) {
     .map((line) => JSON.parse(line));
 }
 
-export async function assertDebugPortFree() {
+export async function assertPortFree(port) {
   await new Promise((resolvePromise, rejectPromise) => {
-    const socket = connect({ host: "127.0.0.1", port: 7677 });
+    const socket = connect({ host: "127.0.0.1", port });
     socket.setTimeout(500);
     socket.once("connect", () => {
       socket.destroy();
-      rejectPromise(new Error("debug port 7677 is already in use; stop the existing debug server first"));
+      rejectPromise(new Error(`debug port ${port} is already in use; stop the existing debug server first`));
     });
     socket.once("error", (error) => {
       socket.destroy();
@@ -420,6 +420,10 @@ export async function assertDebugPortFree() {
   });
 }
 
+export async function assertDebugPortFree() {
+  await assertPortFree(7677);
+}
+
 export function assertCurlAvailable() {
   const result = spawnSync("curl", ["--version"], { encoding: "utf8" });
   if (result.status !== 0) {

package/scripts/debug/accept.mjs

@@ -320,6 +320,7 @@ try {
     "host-integration",
     "shell-processes",
     "code-intelligence",
+    "external-mcp",
     "workspace-tasks",
     "workspace-checkpoints",
     "batch-execution",

package/scripts/debug/runtime.mjs

@@ -90,21 +90,24 @@ export function createInteractiveDebugEnvironment({
 
 export function createDebugEnvironment({
   ownerToken,
+  configDir = debugConfigDir,
   stateDir = resolve(debugRoot, "state"),
   worktreeRoot = resolve(debugRoot, "worktrees"),
   hookLog = debugHookLog,
   widgets = process.env.FORGERELAY_DEBUG_WIDGETS ?? "off",
 } = {}) {
   const token = ownerToken ?? process.env.FORGERELAY_DEBUG_OWNER_TOKEN ?? createDebugOwnerToken();
+  const resolvedConfigDir = resolve(configDir);
   mkdirSync(debugRoot, { recursive: true });
 
   return {
     ownerToken: token,
+    configDir: resolvedConfigDir,
     env: {
       ...process.env,
       HOST: "127.0.0.1",
       PORT: "7677",
-      FORGERELAY_CONFIG_DIR: debugConfigDir,
+      FORGERELAY_CONFIG_DIR: resolvedConfigDir,
       FORGERELAY_PUBLIC_BASE_URL: debugBaseUrl,
       FORGERELAY_ALLOWED_ROOTS: repoRoot,
       FORGERELAY_STATE_DIR: stateDir,

package/scripts/debug/runtime.test.mjs

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import test from "node:test";
 
 import {
+  createDebugEnvironment,
   createInteractiveDebugEnvironment,
   interactiveDebugConfigDir,
   interactiveDebugUrls,
@@ -64,6 +65,14 @@ test("interactive debug uses one dedicated persisted config under ~/.forgerelay/
   assert.equal(result.env.FORGERELAY_LOG_LEVEL, "debug");
 });
 
+test("acceptance debug environment may isolate its writable config directory", () => {
+  const isolatedConfigDir = join(tmpdir(), "forgerelay-acceptance-config");
+  const result = createDebugEnvironment({ configDir: isolatedConfigDir });
+
+  assert.equal(result.configDir, isolatedConfigDir);
+  assert.equal(result.env.FORGERELAY_CONFIG_DIR, isolatedConfigDir);
+});
+
 test("interactive debug config directory may be explicitly relocated without falling back to product config", async (t) => {
   const { home } = await withDebugConfig(t);
   const customDir = join(home, "custom-debug-config");

package/scripts/release/parity-sandbox.mjs

@@ -0,0 +1,35 @@
+import { execFileSync } from "node:child_process";
+import { cpSync, mkdirSync, mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+
+export function createParitySandbox(repoRoot) {
+  const sandbox = mkdtempSync(join(tmpdir(), "forgerelay-release-parity-node22-"));
+  copyTrackedTree(repoRoot, sandbox);
+  initializeGitIndex(sandbox);
+  return sandbox;
+}
+
+function initializeGitIndex(sandbox) {
+  execFileSync("git", ["init", "--quiet"], {
+    cwd: sandbox,
+    stdio: "ignore",
+  });
+  execFileSync("git", ["add", "--force", "--all", "--", "."], {
+    cwd: sandbox,
+    stdio: "ignore",
+  });
+}
+
+function copyTrackedTree(repoRoot, destinationRoot) {
+  const files = execFileSync("git", ["ls-files", "-z"], {
+    cwd: repoRoot,
+    encoding: "utf8",
+  }).split("\0").filter(Boolean);
+  for (const relativePath of files) {
+    const source = join(repoRoot, relativePath);
+    const destination = join(destinationRoot, relativePath);
+    mkdirSync(dirname(destination), { recursive: true });
+    cpSync(source, destination, { recursive: true, force: true });
+  }
+}

package/scripts/release/release-gate.test.mjs

@@ -1,8 +1,10 @@
 import assert from "node:assert/strict";
-import { readFile } from "node:fs/promises";
+import { execFileSync, spawnSync } from "node:child_process";
+import { readFile, realpath, rm } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
+import { createParitySandbox } from "./parity-sandbox.mjs";
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 
@@ -67,6 +69,44 @@ test("architecture gate treats the append-only release-note archive as an explic
   assert.match(architecture, /"docs\/releases"/);
 });
 
+test("release parity sandbox gives architecture an isolated non-empty Git index", async () => {
+  const sandbox = createParitySandbox(repoRoot);
+  try {
+    const architecture = spawnSync(process.execPath, ["scripts/ci/architecture.mjs"], {
+      cwd: sandbox,
+      encoding: "utf8",
+      windowsHide: true,
+      shell: false,
+    });
+    assert.equal(
+      architecture.status,
+      0,
+      architecture.stderr || architecture.stdout || "architecture check did not exit cleanly",
+    );
+    assert.doesNotMatch(architecture.stdout, /Architecture check passed: 0 tracked files;/);
+
+    const gitRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd: sandbox,
+      encoding: "utf8",
+    }).trim();
+    const [canonicalGitRoot, canonicalSandbox, canonicalRepoRoot] = await Promise.all([
+      realpath(gitRoot),
+      realpath(sandbox),
+      realpath(repoRoot),
+    ]);
+    assert.equal(canonicalGitRoot, canonicalSandbox);
+    assert.notEqual(canonicalGitRoot, canonicalRepoRoot);
+
+    const tracked = execFileSync("git", ["ls-files", "-z"], {
+      cwd: sandbox,
+      encoding: "utf8",
+    }).split("\0").filter(Boolean);
+    assert.ok(tracked.length > 0, "parity sandbox must expose copied tracked files through its own Git index");
+  } finally {
+    await rm(sandbox, { recursive: true, force: true });
+  }
+});
+
 test("release runtime and local parity share the checked-in Node contract", async () => {
   const nodeVersion = (await readFile(resolve(repoRoot, ".nvmrc"), "utf8")).trim();
   assert.equal(nodeVersion, "22.19.0");
@@ -77,6 +117,7 @@ test("release runtime and local parity share the checked-in Node contract", asyn
   const source = await readFile(resolve(repoRoot, "scripts/release-parity.mjs"), "utf8");
   assert.match(source, /readFileSync\(join\(repoRoot, "\.nvmrc"\), "utf8"\)/);
   assert.match(source, /const NPM_VERSION = "11\.19\.1"/);
+  assert.match(source, /const sandbox = createParitySandbox\(repoRoot\)/);
   const ciWorkflow = await readFile(resolve(repoRoot, ".github/workflows/ci.yml"), "utf8");
   assert.match(ciWorkflow, /npm install --global npm@11\.19\.1/);
   assert.ok(source.includes('["npm", "ci", "--no-audit", "--no-fund"]'));

package/scripts/release-parity.mjs

@@ -1,21 +1,20 @@
 #!/usr/bin/env node
 
 import { execFileSync, spawnSync } from "node:child_process";
-import { cpSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { readFileSync, rmSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { createParitySandbox } from "./release/parity-sandbox.mjs";
 
 const NPM_VERSION = "11.19.1";
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const NODE_VERSION = readFileSync(join(repoRoot, ".nvmrc"), "utf8").trim();
-const debugRoot = join(repoRoot, ".forgerelay-debug");
-const sandbox = mkdtempSync(join(ensureDirectory(debugRoot), "release-parity-node22-"));
 const npx = process.platform === "win32" ? "npx.cmd" : "npx";
 
 assertCleanReleaseHead();
+const sandbox = createParitySandbox(repoRoot);
 
 try {
-  copyTrackedTree(sandbox);
   const env = {
     ...process.env,
     FORGERELAY_ALLOWED_ROOTS: sandbox,
@@ -61,24 +60,6 @@ function assertCleanReleaseHead() {
   }
 }
 
-function ensureDirectory(path) {
-  mkdirSync(path, { recursive: true });
-  return `${path}/`;
-}
-
-function copyTrackedTree(destinationRoot) {
-  const files = execFileSync("git", ["ls-files", "-z"], {
-    cwd: repoRoot,
-    encoding: "utf8",
-  }).split("\0").filter(Boolean);
-  for (const relativePath of files) {
-    const source = join(repoRoot, relativePath);
-    const destination = join(destinationRoot, relativePath);
-    mkdirSync(dirname(destination), { recursive: true });
-    cpSync(source, destination, { recursive: true, force: true });
-  }
-}
-
 function runNodeNpm(cwd, env, command, label) {
   run(
     cwd,

package/scripts/release-proof.mjs

@@ -164,6 +164,29 @@ function testEndpoint(name, fallback) {
   return fallback;
 }
 
+function githubAuthHeaders() {
+  const token = process.env.GH_TOKEN?.trim()
+    || process.env.GITHUB_TOKEN?.trim()
+    || localGhToken();
+  return {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "ForgeRelay-release-tag-gate",
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+  };
+}
+
+function localGhToken() {
+  if (process.env.NODE_ENV === "test") return "";
+  try {
+    return execFileSync("gh", ["auth", "token", "--hostname", "github.com"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+
 async function artifactExists(label, url, headers = {}) {
   let response;
   try {
@@ -195,10 +218,7 @@ async function assertReleaseTagMutable(tag, version) {
   ).toString();
   const [npmPublished, githubReleased] = await Promise.all([
     artifactExists(`npm package ${pkg.name}@${version}`, npmUrl),
-    artifactExists(`GitHub Release ${tag}`, githubUrl, {
-      Accept: "application/vnd.github+json",
-      "User-Agent": "ForgeRelay-release-tag-gate",
-    }),
+    artifactExists(`GitHub Release ${tag}`, githubUrl, githubAuthHeaders()),
   ]);
   if (npmPublished) {
     throw new Error(`npm package ${pkg.name}@${version} already exists; release tag ${tag} is immutable`);

package/scripts/release-proof.test.mjs

@@ -22,11 +22,18 @@ async function runProof(cwd, action, env = {}) {
   });
 }
 
-async function artifactApiEnv(t, { npmStatus = 404, githubStatus = 404 } = {}) {
+async function artifactApiEnv(
+  t,
+  { npmStatus = 404, githubStatus = 404, githubRequiredToken } = {},
+) {
   const server = createServer((request, response) => {
     if (request.url?.startsWith("/npm/")) response.statusCode = npmStatus;
-    else if (request.url?.startsWith("/github/")) response.statusCode = githubStatus;
-    else response.statusCode = 500;
+    else if (request.url?.startsWith("/github/")) {
+      response.statusCode = githubRequiredToken
+        && request.headers.authorization !== `Bearer ${githubRequiredToken}`
+        ? 403
+        : githubStatus;
+    } else response.statusCode = 500;
     response.end();
   });
   await new Promise((resolve, reject) => {
@@ -41,6 +48,7 @@ async function artifactApiEnv(t, { npmStatus = 404, githubStatus = 404 } = {}) {
     NODE_ENV: "test",
     FORGERELAY_TEST_NPM_REGISTRY_URL: `${base}/npm/`,
     FORGERELAY_TEST_GITHUB_API_URL: `${base}/github/`,
+    ...(githubRequiredToken ? { GH_TOKEN: githubRequiredToken } : {}),
   };
 }
 
@@ -121,7 +129,7 @@ test("release tag hook gate uses repository facts instead of requiring a local p
   await git(root, ["add", "tracked.txt"]);
   await git(root, ["commit", "--allow-empty", "-m", "new head"]);
   await runProof(root, "write");
-  const mutableEnv = await artifactApiEnv(t);
+  const mutableEnv = await artifactApiEnv(t, { githubRequiredToken: "release-test-token" });
   const deletion = await runProof(root, "check-hook", {
     ...mutableEnv,
     FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push --delete origin v1.2.3" }),