@akira-tl/forgerelay 1.1.2 → 1.2.0

package/dist/runtime/config/runtime/source-refresh.js

@@ -0,0 +1,263 @@
+import { createHash } from "node:crypto";
+import { readFileSync, readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+const MISSING_FINGERPRINT = "missing";
+export class ConfigSourceRuntime {
+    units = new Map();
+    directories = new Map();
+    refreshFile(input) {
+        return this.refreshUnit({
+            ...input,
+            path: resolve(input.path),
+        });
+    }
+    refreshDirectory(input) {
+        const directory = resolve(input.directory);
+        const previousDirectory = this.directories.get(input.key);
+        let names;
+        try {
+            names = readdirSync(directory, { withFileTypes: true })
+                .filter((entry) => entry.isFile() && input.include(entry.name))
+                .map((entry) => entry.name)
+                .sort((left, right) => left.localeCompare(right));
+        }
+        catch (error) {
+            if (isMissingDirectory(error)) {
+                this.clearDeletedDirectoryUnits(input.key, previousDirectory, directory, new Set());
+                this.directories.set(input.key, {
+                    names: new Set(),
+                    observedFingerprint: MISSING_FINGERPRINT,
+                });
+                return {
+                    directory,
+                    state: "missing",
+                    observedFingerprint: MISSING_FINGERPRINT,
+                    effectiveFingerprint: fingerprintSourceUnits([]),
+                    units: [],
+                    diagnosticChanged: false,
+                };
+            }
+            const issue = {
+                code: "invalid_source",
+                message: "Configuration directory could not be read.",
+            };
+            const issueFingerprint = `directory-read-error:${errorCode(error)}`;
+            const diagnosticChanged = previousDirectory?.issueFingerprint !== issueFingerprint;
+            const units = this.previousDirectoryUnits(input.key, previousDirectory, directory, issue, issueFingerprint);
+            const observedFingerprint = fingerprintSourceUnits(units.map((unit) => ({ name: unit.name, fingerprint: unit.status.observedFingerprint })));
+            const effectiveFingerprint = fingerprintSourceUnits(units.flatMap((unit) => unit.status.effectiveFingerprint
+                ? [{ name: unit.name, fingerprint: unit.status.effectiveFingerprint }]
+                : []));
+            this.directories.set(input.key, {
+                names: new Set(units.map((unit) => unit.name)),
+                observedFingerprint,
+                issueFingerprint,
+            });
+            return {
+                directory,
+                state: "invalid",
+                observedFingerprint,
+                effectiveFingerprint,
+                units,
+                issue,
+                diagnosticChanged,
+            };
+        }
+        const currentNames = new Set(names);
+        this.clearDeletedDirectoryUnits(input.key, previousDirectory, directory, currentNames);
+        const units = names.map((name) => {
+            const path = join(directory, name);
+            const result = this.refreshUnit({
+                key: directoryUnitKey(input.key, name),
+                path,
+                parse: (content) => input.parse(name, content, path),
+                validate: input.validate ? (value) => input.validate(value, name, path) : undefined,
+                parseIssue: input.parseIssue
+                    ? (error) => resolveDirectoryIssue(input.parseIssue, error, name, path, "Configuration source is invalid.")
+                    : undefined,
+                readIssue: input.readIssue
+                    ? (error) => resolveDirectoryIssue(input.readIssue, error, name, path, "Configuration source could not be read.")
+                    : undefined,
+            });
+            return { name, ...result };
+        });
+        const observedFingerprint = fingerprintSourceUnits(units.map((unit) => ({ name: unit.name, fingerprint: unit.status.observedFingerprint })));
+        const effectiveFingerprint = fingerprintSourceUnits(units.flatMap((unit) => unit.status.effectiveFingerprint
+            ? [{ name: unit.name, fingerprint: unit.status.effectiveFingerprint }]
+            : []));
+        this.directories.set(input.key, {
+            names: currentNames,
+            observedFingerprint,
+        });
+        return {
+            directory,
+            state: units.some((unit) => unit.status.state === "invalid") ? "invalid" : "valid",
+            observedFingerprint,
+            effectiveFingerprint,
+            units,
+            diagnosticChanged: units.some((unit) => unit.status.diagnosticChanged),
+        };
+    }
+    refreshUnit(input) {
+        const path = resolve(input.path);
+        const previous = this.units.get(input.key);
+        let content;
+        try {
+            content = readFileSync(path, "utf8");
+        }
+        catch (error) {
+            if (isMissingFile(error)) {
+                const changed = previous?.observedFingerprint !== MISSING_FINGERPRINT || previous?.state !== "missing";
+                const missing = {
+                    observedFingerprint: MISSING_FINGERPRINT,
+                    state: "missing",
+                };
+                this.units.set(input.key, missing);
+                return {
+                    status: {
+                        key: input.key,
+                        path,
+                        state: "missing",
+                        observedFingerprint: MISSING_FINGERPRINT,
+                        usingLastKnownGood: false,
+                        changed,
+                        diagnosticChanged: false,
+                    },
+                };
+            }
+            const fingerprint = `read-error:${errorCode(error)}`;
+            const issue = resolveIssue(input.readIssue, error, "Configuration source could not be read.");
+            return this.invalidUnit(input.key, path, fingerprint, previous, issue);
+        }
+        const fingerprint = contentFingerprint(content);
+        if (previous?.observedFingerprint === fingerprint) {
+            return storedResult(input.key, path, previous, false, false);
+        }
+        let value;
+        try {
+            value = input.parse(content);
+        }
+        catch (error) {
+            const issue = resolveIssue(input.parseIssue, error, "Configuration source is invalid.");
+            return this.invalidUnit(input.key, path, fingerprint, previous, issue);
+        }
+        const validationIssue = input.validate?.(value);
+        if (validationIssue) {
+            return this.invalidUnit(input.key, path, fingerprint, previous, validationIssue);
+        }
+        const valid = {
+            observedFingerprint: fingerprint,
+            effectiveFingerprint: fingerprint,
+            state: "valid",
+            value,
+        };
+        this.units.set(input.key, valid);
+        return storedResult(input.key, path, valid, true, false);
+    }
+    invalidUnit(key, path, observedFingerprint, previous, issue) {
+        if (previous?.observedFingerprint === observedFingerprint && previous.state === "invalid") {
+            return storedResult(key, path, previous, false, false);
+        }
+        const keepLastKnownGood = previous?.effectiveFingerprint !== undefined && previous.value !== undefined;
+        const invalid = {
+            observedFingerprint,
+            ...(keepLastKnownGood ? {
+                effectiveFingerprint: previous.effectiveFingerprint,
+                value: previous.value,
+            } : {}),
+            state: "invalid",
+            issue,
+        };
+        this.units.set(key, invalid);
+        return storedResult(key, path, invalid, true, true);
+    }
+    clearDeletedDirectoryUnits(directoryKey, previous, directory, currentNames) {
+        if (!previous)
+            return;
+        for (const name of previous.names) {
+            if (currentNames.has(name))
+                continue;
+            const key = directoryUnitKey(directoryKey, name);
+            this.units.set(key, {
+                observedFingerprint: MISSING_FINGERPRINT,
+                state: "missing",
+            });
+        }
+    }
+    previousDirectoryUnits(directoryKey, previous, directory, issue, observedFingerprint) {
+        if (!previous)
+            return [];
+        return [...previous.names].sort((left, right) => left.localeCompare(right)).map((name) => {
+            const key = directoryUnitKey(directoryKey, name);
+            const prior = this.units.get(key);
+            const invalid = {
+                observedFingerprint,
+                ...(prior?.effectiveFingerprint && prior.value !== undefined ? {
+                    effectiveFingerprint: prior.effectiveFingerprint,
+                    value: prior.value,
+                } : {}),
+                state: "invalid",
+                issue,
+            };
+            const diagnosticChanged = prior?.observedFingerprint !== observedFingerprint || prior.state !== "invalid";
+            this.units.set(key, invalid);
+            return {
+                name,
+                ...storedResult(key, join(directory, name), invalid, diagnosticChanged, diagnosticChanged),
+            };
+        });
+    }
+}
+export function fingerprintSourceUnits(units) {
+    const sorted = [...units]
+        .sort((left, right) => left.name.localeCompare(right.name))
+        .map(({ name, fingerprint }) => [name, fingerprint]);
+    return createHash("sha256").update(JSON.stringify(sorted)).digest("base64url");
+}
+function contentFingerprint(content) {
+    return createHash("sha256").update(content).digest("base64url");
+}
+function directoryUnitKey(directoryKey, name) {
+    return `${directoryKey}\0${name}`;
+}
+function storedResult(key, path, stored, changed, diagnosticChanged) {
+    return {
+        ...(stored.value !== undefined ? { value: stored.value } : {}),
+        status: {
+            key,
+            path,
+            state: stored.state,
+            observedFingerprint: stored.observedFingerprint,
+            ...(stored.effectiveFingerprint ? { effectiveFingerprint: stored.effectiveFingerprint } : {}),
+            usingLastKnownGood: stored.state === "invalid" && stored.effectiveFingerprint !== undefined && stored.value !== undefined,
+            changed,
+            diagnosticChanged,
+        },
+        ...(stored.issue ? { issue: stored.issue } : {}),
+    };
+}
+function resolveIssue(configured, error, fallbackMessage) {
+    if (typeof configured === "function")
+        return configured(error);
+    return configured ?? { code: "invalid_source", message: fallbackMessage };
+}
+function resolveDirectoryIssue(configured, error, name, path, fallbackMessage) {
+    if (typeof configured === "function")
+        return configured(error, name, path);
+    return configured ?? { code: "invalid_source", message: fallbackMessage };
+}
+function isMissingFile(error) {
+    return errorCode(error) === "ENOENT";
+}
+function isMissingDirectory(error) {
+    const code = errorCode(error);
+    return code === "ENOENT" || code === "ENOTDIR";
+}
+function errorCode(error) {
+    if (typeof error === "object" && error !== null && "code" in error) {
+        const code = error.code;
+        if (typeof code === "string" && code)
+            return code;
+    }
+    return "UNKNOWN";
+}

package/dist/runtime/config/user-config.js

@@ -1,10 +1,10 @@
 import { randomBytes, randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { rename as renameAsync, rm as rmAsync, writeFile as writeFileAsync, } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { withFileLock } from "../state/lock/file-lock.js";
 import { expandHomePath } from "../../mcp/filesystem/roots.js";
-import { mergeHookConfigs, parseHookFile, } from "../../mcp/hooks/hooks.js";
 export function forgerelayConfigDir(env = process.env) {
     const explicit = env.FORGERELAY_CONFIG_DIR;
     if (explicit)
@@ -26,10 +26,7 @@ export function forgerelayHooksDir(env = process.env) {
 export function forgerelaySkillsDir(env = process.env) {
     return join(forgerelayConfigDir(env), "skills");
 }
-export function forgerelayAgentsDir(env = process.env) {
-    return join(forgerelayConfigDir(env), "agents");
-}
-export function loadForgeRelayFiles(env = process.env) {
+export function loadForgeRelayFiles(env = process.env, options = {}) {
     const dir = forgerelayConfigDir(env);
     const configPath = join(dir, "config.json");
     const authPath = join(dir, "auth.json");
@@ -47,8 +44,7 @@ export function loadForgeRelayFiles(env = process.env) {
         hooksExists,
         config: configExists ? readJsonFile(configPath) : {},
         auth: authExists ? readJsonFile(authPath) : {},
-        hooks: hooksExists ? readJsonFile(hooksPath) : {},
-        hookFiles: readHookFiles(join(dir, "hooks")),
+        hooks: options.readLegacyHooks && hooksExists ? readJsonFile(hooksPath) : {},
     };
 }
 export function writeForgeRelayConfig(config, env = process.env) {
@@ -60,8 +56,8 @@ export function writeForgeRelayConfig(config, env = process.env) {
 export async function writeForgeRelayAuth(auth, env = process.env) {
     const filePath = forgerelayAuthPath(env);
     mkdirSync(forgerelayConfigDir(env), { recursive: true });
-    return withFileLock(`${filePath}.lock`, () => {
-        writeJsonFile(filePath, auth, 0o600);
+    return withFileLock(`${filePath}.lock`, async () => {
+        await writeAuthJsonFile(filePath, auth, 0o600);
         return filePath;
     });
 }
@@ -141,25 +137,6 @@ export function resolveSubagentsFlag(config, env = process.env) {
         return config.subagents;
     return ["1", "true", "yes", "on"].includes(value.toLowerCase());
 }
-function readHookFiles(directory) {
-    if (!existsSync(directory))
-        return {};
-    let hooks = {};
-    const entries = readdirSync(directory, { withFileTypes: true })
-        .filter((entry) => entry.isFile() && entry.name.endsWith(".json"))
-        .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
-    for (const entry of entries) {
-        const filePath = join(directory, entry.name);
-        try {
-            hooks = mergeHookConfigs(hooks, parseHookFile(readJsonFile(filePath), entry.name.slice(0, -5)));
-        }
-        catch (error) {
-            const reason = error instanceof Error ? error.message : String(error);
-            throw new Error(`Unable to load hook file ${filePath}: ${reason}`);
-        }
-    }
-    return hooks;
-}
 function readJsonFile(filePath) {
     try {
         return JSON.parse(readFileSync(filePath, "utf8"));
@@ -172,12 +149,42 @@ function readJsonFile(filePath) {
 async function updateForgeRelayAuth(update, env) {
     const filePath = forgerelayAuthPath(env);
     mkdirSync(forgerelayConfigDir(env), { recursive: true });
-    return withFileLock(`${filePath}.lock`, () => {
+    return withFileLock(`${filePath}.lock`, async () => {
         const auth = existsSync(filePath) ? readJsonFile(filePath) : {};
-        writeJsonFile(filePath, update(auth), 0o600);
+        await writeAuthJsonFile(filePath, update(auth), 0o600);
         return filePath;
     });
 }
+async function writeAuthJsonFile(filePath, value, mode) {
+    const tempPath = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        await writeFileAsync(tempPath, JSON.stringify(value, null, 2) + "\n", { mode });
+        await replaceAuthFile(tempPath, filePath);
+    }
+    finally {
+        await rmAsync(tempPath, { force: true });
+    }
+}
+async function replaceAuthFile(tempPath, filePath) {
+    const maxAttempts = process.platform === "win32" ? 40 : 1;
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        try {
+            await renameAsync(tempPath, filePath);
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            const retryable = process.platform === "win32"
+                && ["EACCES", "EBUSY", "EEXIST", "EPERM"].includes(code ?? "");
+            if (!retryable || attempt === maxAttempts)
+                throw error;
+            await delay(25);
+        }
+    }
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 function writeJsonFile(filePath, value, mode) {
     const tempPath = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
     try {

package/dist/runtime/security/project-execution-trust.js

@@ -0,0 +1,34 @@
+export const compatibilityAllowProjectExecutionTrustPolicy = {
+    async authorize(requirement) {
+        return {
+            policy: "compatibility-allow",
+            decision: "allow",
+            projectId: requirement.projectId,
+            executableConfigFingerprint: requirement.executableConfigFingerprint,
+        };
+    },
+};
+export function projectExecutionRequirement(input) {
+    const entry = input.resolution.entries[input.entryKey];
+    if (!entry
+        || entry.effective.source.scope !== "project"
+        || entry.effective.executionEffect !== "process"
+        || entry.tombstone === true) {
+        return undefined;
+    }
+    const executionFingerprint = entry.effective.executionFingerprint;
+    if (!executionFingerprint) {
+        throw new Error(`Project execution metadata is missing a fingerprint for ${entry.logicalPath}.`);
+    }
+    return {
+        projectId: input.projectId,
+        domain: input.resolution.domain,
+        logicalPath: entry.logicalPath,
+        source: {
+            id: entry.effective.source.id,
+            ...(entry.effective.source.location ? { location: entry.effective.source.location } : {}),
+        },
+        display: { ...input.display },
+        executableConfigFingerprint: executionFingerprint,
+    };
+}

package/dist/runtime/testing/server-fixture.js

@@ -11,7 +11,6 @@ import { HostTurnStore } from "../../activity/history/host-turn-store.js";
 import { ActivityLifecycle } from "../../activity/runtime/lifecycle.js";
 import { ActivityQueryService } from "../../activity/history/query-service.js";
 import { loadConfig } from "../config/config.js";
-import { parseHookConfig } from "../../mcp/hooks/hooks.js";
 import { CodeIntelligenceManager } from "../../lsp/runtime/manager.js";
 import { ProcessManager } from "../../mcp/process/process-sessions.js";
 import { createReviewCheckpointManager } from "../../workspaces/review/review-checkpoints.js";
@@ -30,15 +29,19 @@ export async function fixture(t, options = {}) {
     const agentDir = join(root, "agent");
     const stateDir = join(root, ".state");
     const configDir = join(root, ".config");
-    await mkdir(join(project, ".forgerelay", "agents"), { recursive: true });
+    await mkdir(join(project, ".forgerelay", "subagents"), { recursive: true });
     await mkdir(configDir, { recursive: true });
-    if (options.userConfig) {
-        await writeFile(join(configDir, "config.json"), JSON.stringify(options.userConfig, null, 2) + "\n");
+    const userConfig = {
+        ...(options.userConfig ?? {}),
+        ...(options.hooks ? { hooks: options.hooks } : {}),
+    };
+    if (Object.keys(userConfig).length > 0) {
+        await writeFile(join(configDir, "config.json"), JSON.stringify(userConfig, null, 2) + "\n");
     }
     await mkdir(agentDir, { recursive: true });
     await writeFile(join(agentDir, "AGENTS.md"), "global instructions\n");
     await writeFile(join(project, "AGENTS.md"), "project instructions\n");
-    await writeFile(join(project, ".forgerelay", "agents", "reviewer.md"), [
+    await writeFile(join(project, ".forgerelay", "subagents", "reviewer.md"), [
         "---",
         "name: reviewer",
         "description: Reviews project changes.",
@@ -66,9 +69,7 @@ export async function fixture(t, options = {}) {
         PORT: "1",
         ...options.env,
     });
-    const config = options.hooks
-        ? { ...loadedConfig, hooks: parseHookConfig(options.hooks) }
-        : loadedConfig;
+    const config = loadedConfig;
     const store = new SqliteWorkspaceStore(stateDir);
     const workspaces = new WorkspaceRegistry(config, store);
     const auditStore = new ActivityAuditStore(stateDir);

package/dist/server.js

@@ -9,6 +9,7 @@ import { CapabilityError, createCapabilityRegistry } from "./mcp/server/core/cap
 import { downloadIncomingArtifact, isArtifactDownloadSupportedPlatform } from "./mcp/artifacts/artifact-tools.js";
 import { ArtifactError } from "./mcp/artifacts/artifact-error.js";
 import { loadConfig } from "./runtime/config/config.js";
+import { liveWorkspaceConfigPanelState } from "./runtime/config/inspection/live.js";
 import { CodeIntelligenceError } from "./lsp/code-intelligence.js";
 import { installManagedLanguageServers, installedManagedLanguageServers, supportedManagedLanguageServers, } from "./lsp/runtime/managed-language-servers.js";
 import { HookRunner } from "./mcp/hooks/hooks.js";
@@ -130,7 +131,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         };
     };
     const toolDescriptions = buildToolDescriptions(config);
-    const hooks = new HookRunner(config.hooks, config.logging, process.env, (workspaceId, result) => attachCompletedProcessNotices(processSessions, workspaceId, result, (snapshot) => recordBashCompletion(activityLifecycle, bashOutputStore, snapshot.outputId)), config.commandShellRuntime);
+    const hooks = new HookRunner({}, config.logging, process.env, (workspaceId, result) => attachCompletedProcessNotices(processSessions, workspaceId, result, (snapshot) => recordBashCompletion(activityLifecycle, bashOutputStore, snapshot.outputId)), config.commandShellRuntime, config.configDir, config.configRuntime.sources);
     const incomingArtifactRegistry = new IncomingArtifactAdapterRegistry(incomingArtifactAdapters);
     const artifactDownloadAvailable = config.artifactsEnabled && isArtifactDownloadSupportedPlatform();
     const reviewChangesAvailable = config.widgets === "changes";
@@ -138,7 +139,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
     let batchExecutor;
     const batchExecuteAvailable = config.toolMode !== "codex";
     const capabilityRegistry = createCapabilityRegistry({
-        inspectHooks: (workspaceRoot) => checkHookConfiguration(workspaceRoot, config.hooks),
+        inspectHooks: (workspaceRoot) => checkHookConfiguration(workspaceRoot, {}, config.configDir, config.configRuntime.sources),
         ...subagentMcp.registryDependencies,
         externalMcp: externalMcpCapability,
         workspaceRecovery: {
@@ -215,7 +216,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                 }
                 if (input.operation === "managed.install") {
                     if (!config.allowAgentLanguageServerInstall) {
-                        throw new CapabilityError("code.managed_install_disabled", "Agent-managed Language Server installation is disabled. Enable it explicitly with forgerelay init --force.");
+                        throw new CapabilityError("code.managed_install_disabled", "Agent-managed Language Server installation is disabled. Enable it explicitly with forgerelay init --advanced.");
                     }
                     const install = options.managedLanguageServerInstaller ?? installManagedLanguageServers;
                     const installed = await install(input.servers, config.configDir);
@@ -439,14 +440,17 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             },
         });
     };
-    const workspacePanelState = (workspaceId) => {
+    const workspacePanelState = async (workspaceId) => {
         const remembered = workspacePanelStates.get(workspaceId);
         if (remoteWorkspaces.has(workspaceId) || compositeWorkspaces.has(workspaceId)) {
             return remembered;
         }
         try {
-            const live = liveWorkspacePanelState(workspaces.getWorkspace(workspaceId));
-            return remembered ? { ...live, ...remembered } : live;
+            const workspace = workspaces.getWorkspace(workspaceId);
+            const live = liveWorkspacePanelState(workspace);
+            const presentation = remembered ? { ...live, ...remembered } : live;
+            const configuration = await liveWorkspaceConfigPanelState(config, workspace.root);
+            return configuration ? { ...presentation, configuration } : presentation;
         }
         catch {
             return undefined;