@akira-tl/forgerelay 1.1.2 → 1.2.0

package/scripts/release/release-gate.test.mjs

@@ -40,33 +40,52 @@ test("optional release:verify records proof only after the cloud-equivalent pari
   assert.equal(pkg.scripts["release:push-ready"], "node scripts/release/push-ready.mjs");
 });
 
-test("cross-platform cloud CI delegates to one shell-free verification entrypoint", async () => {
+test("Config schemas and ForgeRelay-owned runtime resources are gated in packaged verification", async () => {
+  const pkg = await readJson("package.json");
+  assert.ok(pkg.files.includes("schemas"));
+  assert.ok(pkg.files.includes("templates"));
+  assert.ok(pkg.files.includes("capabilities"));
+  assert.match(pkg.scripts.build, /config:schema:check/);
+  assert.equal(pkg.scripts["config:schema:generate"], "node --import tsx scripts/config/schema.mjs write");
+  assert.equal(pkg.scripts["config:schema:check"], "node --import tsx scripts/config/schema.mjs check");
+  assert.equal(pkg.scripts["config:product-accept"], "node scripts/ci/config-v2-product-acceptance.mjs");
+
+  const verify = await readFile(resolve(repoRoot, "scripts/ci/verify.mjs"), "utf8");
+  assert.match(verify, /\["run", "config:schema:check"\]/);
+  assert.match(verify, /\["run", "config:product-accept"\]/);
+
+  const pack = await readFile(resolve(repoRoot, "scripts/release/pack.mjs"), "utf8");
+  assert.match(pack, /schemas", "v1"/);
+  assert.match(pack, /release:pack omitted generated Config schemas/);
+  assert.match(pack, /templates/);
+  assert.match(pack, /capabilities/);
+  assert.match(pack, /release:pack omitted ForgeRelay-owned runtime resources/);
+});
+
+test("cross-platform cloud CI splits shared tests from bounded platform acceptance", async () => {
   const workflow = await readFile(resolve(repoRoot, ".github/workflows/ci.yml"), "utf8");
-  assert.match(workflow, /node-version-file:\s*\.nvmrc/);
-  assert.match(workflow, /run:\s*npm ci/);
-  assert.match(workflow, /run:\s*npm run ci:verify/);
+  assert.match(workflow, /core-contract:/);
+  assert.match(workflow, /core-tests:/);
+  for (const shard of ["runtime-config", "workspace-mcp", "lsp", "subagent-ui-cli"]) {
+    assert.match(workflow, new RegExp(`\\b${shard}\\b`));
+  }
+  assert.match(workflow, /run:\s*npm run ci:contract/);
+  assert.match(workflow, /run:\s*npm run ci:test-shard -- \$\{\{ matrix\.shard \}\}/);
+  assert.match(workflow, /macos-platform:[\s\S]*run:\s*npm run ci:platform-tests/);
+  assert.match(workflow, /windows-platform:[\s\S]*run:\s*npm run ci:platform-tests/);
+  assert.match(workflow, /windows-platform:[\s\S]*timeout-minutes:\s*25/);
+  assert.doesNotMatch(workflow, /run:\s*npm run ci:verify/);
+  assert.doesNotMatch(workflow, /run:\s*npm test/);
   assert.doesNotMatch(workflow, /shell:/);
   assert.doesNotMatch(workflow, /run:\s*\|/);
-  for (const duplicatedCommand of [
-    "npm run release:check",
-    "npm run typecheck",
-    "npm test",
-    "npm run build",
-    "npm run lsp:interop",
-    "node dist/cli.js doctor",
-  ]) {
-    assert.equal(
-      workflow.includes(`run: ${duplicatedCommand}`),
-      false,
-      `cloud CI must delegate ${duplicatedCommand} through ci:verify`,
-    );
-  }
 });
 
-test("architecture gate treats the append-only release-note archive as an explicit flat-path exception", async () => {
+test("architecture gate treats versioned public contract directories as explicit flat-path exceptions", async () => {
   const architecture = await readFile(resolve(repoRoot, "scripts/ci/architecture.mjs"), "utf8");
   assert.match(architecture, /DIRECT_FILE_LIMIT_EXEMPT_DIRS/);
   assert.match(architecture, /"docs\/releases"/);
+  assert.match(architecture, /"schemas\/v1"/);
+  assert.match(architecture, /directory !== "\." && dirs > MAX_DIRECT_DIRS/);
 });
 
 test("release parity sandbox gives architecture an isolated non-empty Git index", async () => {
@@ -111,9 +130,6 @@ test("release runtime and local parity share the checked-in Node contract", asyn
   const nodeVersion = (await readFile(resolve(repoRoot, ".nvmrc"), "utf8")).trim();
   assert.equal(nodeVersion, "22.19.0");
 
-  const pkg = await readJson("package.json");
-  assert.equal(pkg.scripts["ci:verify"], "node scripts/ci/verify.mjs");
-
   const source = await readFile(resolve(repoRoot, "scripts/release-parity.mjs"), "utf8");
   assert.match(source, /readFileSync\(join\(repoRoot, "\.nvmrc"\), "utf8"\)/);
   assert.match(source, /const NPM_VERSION = "11\.19\.1"/);
@@ -121,21 +137,67 @@ test("release runtime and local parity share the checked-in Node contract", asyn
   const ciWorkflow = await readFile(resolve(repoRoot, ".github/workflows/ci.yml"), "utf8");
   assert.match(ciWorkflow, /npm install --global npm@11\.19\.1/);
   assert.ok(source.includes('["npm", "ci", "--no-audit", "--no-fund"]'));
-  assert.ok(source.includes('["npm", "run", "ci:verify"]'));
+  assert.ok(source.includes('["npm", "run", "ci:contract"]'));
+  for (const shard of ["runtime-config", "workspace-mcp", "lsp", "subagent-ui-cli"]) {
+    assert.match(source, new RegExp(`\\"${shard}\\"`));
+  }
+  assert.ok(source.includes('["npm", "run", "build"]'));
+  assert.ok(source.includes('["npm", "run", "traffic:audit"]'));
+  assert.ok(source.includes('["npm", "run", "lsp:interop"]'));
   assert.ok(source.includes('["npm", "run", "release:pack"]'));
-  assert.doesNotMatch(source, /\["npm", "run", "typecheck"\]/);
+  assert.ok(source.includes('["npm", "run", "config:product-accept"]'));
+  assert.match(source, /FORGERELAY_ACCEPTANCE_ARTIFACT_DIR:\s*"\.release-artifacts"/);
+  assert.doesNotMatch(source, /\["npm", "run", "ci:verify"\]/);
   assert.doesNotMatch(source, /\["npm", "test"\]/);
 });
 
-test("cloud verification produces one reusable npm package on Linux", async () => {
+test("cloud verification builds one npm artifact and reuses it across platform acceptance", async () => {
   const workflow = await readFile(resolve(repoRoot, ".github/workflows/ci.yml"), "utf8");
-  assert.match(workflow, /if:\s*runner\.os == 'Linux'[\s\S]*run:\s*npm run release:pack/);
-  assert.match(workflow, /uses:\s*actions\/upload-artifact@v7/);
+  assert.match(workflow, /package:[\s\S]*needs:\s*core-contract[\s\S]*run:\s*npm run build[\s\S]*run:\s*npm run traffic:audit[\s\S]*run:\s*npm run lsp:interop[\s\S]*run:\s*npm run release:pack/);
+  assert.equal((workflow.match(/run:\s*npm run release:pack/g) ?? []).length, 1);
+  assert.equal((workflow.match(/uses:\s*actions\/upload-artifact@v7/g) ?? []).length, 1);
+  assert.equal((workflow.match(/uses:\s*actions\/download-artifact@v7/g) ?? []).length, 3);
+  assert.match(workflow, /FORGERELAY_ACCEPTANCE_ARTIFACT_DIR:\s*\.release-package/);
+  assert.match(workflow, /windows-platform:[\s\S]*FORGERELAY_ACCEPTANCE_PREFIX:\s*\.release-installed/);
+  assert.equal((workflow.match(/run:\s*npm run ci:prepare-windows-product/g) ?? []).length, 1);
+  assert.equal((workflow.match(/run:\s*npm run traffic:audit/g) ?? []).length, 1);
+  assert.equal((workflow.match(/run:\s*npm run lsp:interop/g) ?? []).length, 1);
   assert.match(workflow, /name:\s*npm-package/);
   assert.match(workflow, /include-hidden-files:\s*true/);
   assert.match(workflow, /overwrite:\s*true/);
 });
 
+test("packaged acceptance scripts can consume the one downloaded release artifact", async () => {
+  const helper = await readFile(resolve(repoRoot, "scripts/ci/gates/acceptance-artifact.mjs"), "utf8");
+  assert.match(helper, /FORGERELAY_ACCEPTANCE_ARTIFACT_DIR/);
+  assert.match(helper, /FORGERELAY_ACCEPTANCE_PREFIX/);
+  assert.match(helper, /exactly one \.tgz package/);
+
+  const prepareWindows = await readFile(
+    resolve(repoRoot, "scripts/ci/gates/prepare-windows-product.mjs"),
+    "utf8",
+  );
+  assert.match(prepareWindows, /resolveAcceptancePrefix/);
+  assert.match(prepareWindows, /"install", "--global", "--prefix"/);
+
+  for (const relativePath of [
+    "scripts/ci/config-v2-product-acceptance.mjs",
+    "scripts/ci/windows-product-acceptance.mjs",
+    "scripts/ci/pwsh-acceptance.mjs",
+    "scripts/ci/powershell51-acceptance.mjs",
+    "scripts/ci/cmd-acceptance.mjs",
+  ]) {
+    const source = await readFile(resolve(repoRoot, relativePath), "utf8");
+    assert.match(source, /resolveAcceptanceTarball/);
+  }
+});
+
+test("Windows product acceptance uses the supported Skills environment seam rather than a removed config key", async () => {
+  const source = await readFile(resolve(repoRoot, "scripts/ci/windows-product-acceptance.mjs"), "utf8");
+  assert.match(source, /FORGERELAY_SKILLS:\s*"0"/);
+  assert.doesNotMatch(source, /skillsEnabled\s*:/);
+});
+
 test("release workflow is tag-only and promotes the verified npm artifact without rebuilding", async () => {
   const workflow = await readFile(resolve(repoRoot, ".github/workflows/release.yml"), "utf8");
   assert.doesNotMatch(workflow, /workflow_dispatch:/);
@@ -157,6 +219,10 @@ test("manual Windows shell acceptance can never publish a release", async () =>
   );
   assert.match(workflow, /workflow_dispatch:/);
   assert.match(workflow, /runs-on:\s*windows-2022/);
+  assert.match(workflow, /FORGERELAY_ACCEPTANCE_ARTIFACT_DIR:\s*\.release-artifacts/);
+  assert.match(workflow, /FORGERELAY_ACCEPTANCE_PREFIX:\s*\.release-installed/);
+  assert.equal((workflow.match(/run:\s*npm run release:pack/g) ?? []).length, 1);
+  assert.equal((workflow.match(/run:\s*npm run ci:prepare-windows-product/g) ?? []).length, 1);
   assert.match(workflow, /run:\s*npm run pwsh:accept/);
   assert.doesNotMatch(workflow, /release:publish/);
   assert.doesNotMatch(workflow, /npm publish/);

package/scripts/release-parity.mjs

@@ -28,11 +28,28 @@ try {
     ["npm", "ci", "--no-audit", "--no-fund"],
     `Node ${NODE_VERSION} / npm ${NPM_VERSION} install`,
   );
-  runNodeNpm(sandbox, env, ["npm", "run", "ci:verify"], "Cloud verification entrypoint");
+  runNodeNpm(sandbox, env, ["npm", "run", "ci:contract"], "Cloud core contract");
+  for (const shard of ["runtime-config", "workspace-mcp", "lsp", "subagent-ui-cli"]) {
+    runNodeNpm(
+      sandbox,
+      env,
+      ["npm", "run", "ci:test-shard", "--", shard],
+      `Cloud core test shard: ${shard}`,
+    );
+  }
+  runNodeNpm(sandbox, env, ["npm", "run", "build"], "Cloud package build");
+  runNodeNpm(sandbox, env, ["npm", "run", "traffic:audit"], "Cloud traffic audit");
+  runNodeNpm(sandbox, env, ["npm", "run", "lsp:interop"], "Cloud LSP interoperability");
   runNodeNpm(sandbox, env, ["npm", "run", "release:pack"], "Cloud release packaging");
+  runNodeNpm(
+    sandbox,
+    { ...env, FORGERELAY_ACCEPTANCE_ARTIFACT_DIR: ".release-artifacts" },
+    ["npm", "run", "config:product-accept"],
+    "Cloud Linux packaged product acceptance",
+  );
 
   console.log(
-    `Release parity passed through ci:verify and release:pack on Node ${NODE_VERSION} / npm ${NPM_VERSION}.`,
+    `Release parity passed through the split Linux cloud gates and release artifact acceptance on Node ${NODE_VERSION} / npm ${NPM_VERSION}.`,
   );
 } finally {
   rmSync(sandbox, {

package/templates/instructions/cmd.md

@@ -0,0 +1,12 @@
+# ForgeRelay cmd.exe Instructions
+
+ForgeRelay executes Agent commands and Hooks with `cmd.exe` for this runtime. Write cmd syntax, not PowerShell or Bash syntax.
+
+- Environment variables use `%NAME%`; mutate them with cmd syntax such as `set NAME=value`.
+- Preserve and inspect native process status with `%ERRORLEVEL%` when correctness depends on success.
+- Command chaining, redirection, `%` expansion, `^` escaping, and parentheses are cmd-specific. Do not reuse Bash or PowerShell escaping rules.
+- In compound or parenthesized command blocks, `%NAME%` may be expanded before later commands run. Use delayed expansion (`setlocal EnableDelayedExpansion` with `!NAME!`) only when needed, and remember that enabling it changes how literal `!` characters are handled.
+- Quote executable paths and arguments using cmd semantics, especially when paths contain spaces or metacharacters.
+- Do not emit PowerShell cmdlets such as `Get-ChildItem`, `$env:NAME`, or `&` unless explicitly launching PowerShell as a child process.
+- Do not assume Unix aliases or utilities exist. Cross-platform executables such as `git`, `node`, `npm`, or `rg` may be invoked directly when installed.
+- Do not silently switch to another shell merely because a command is easier there. The effective ForgeRelay command language remains cmd unless the owner changes the runtime configuration.

package/templates/instructions/fish.md

@@ -0,0 +1,11 @@
+# ForgeRelay fish Instructions
+
+ForgeRelay executes Agent commands and Hooks with fish for this runtime. Write fish syntax, not Bash or zsh syntax.
+
+- Set shell variables with `set NAME value`; export environment variables with `set -gx NAME value` or another scope appropriate to the command.
+- Inspect the previous command status with `$status`. Save it before another command runs if later logic depends on it.
+- fish does not use Bash-style `VAR=value command`, `export NAME=value`, `$(...)`, or `[[ ... ]]` syntax. Use fish-native variable assignment, command substitution `(command)`, and conditionals.
+- Use `and` / `or` or fish control flow deliberately; do not emit Bash-only chaining syntax when compatibility with the selected fish runtime matters.
+- fish list variables and expansions differ from Bash arrays. Do not copy Bash array syntax.
+- Quote paths and expansions when whitespace or wildcard interpretation would change the intended argument boundaries.
+- ForgeRelay already inherits the server process environment. Do not source the user's interactive fish configuration, prompt, or plugins merely to recover PATH, aliases, or abbreviations.

package/templates/instructions/powershell.md

@@ -0,0 +1,14 @@
+# ForgeRelay Windows PowerShell 5.1 Instructions
+
+ForgeRelay executes Agent commands and Hooks with Windows PowerShell 5.1 (`powershell.exe`) for this runtime. Use Windows PowerShell syntax, not Bash syntax and not PowerShell 7-only syntax.
+
+- Environment variables use `$env:NAME`; do not use `export NAME=...`.
+- Prefer explicit PowerShell cmdlets when semantics matter. Do not pass Unix flags to aliases such as `rm`, `ls`, or `cat`.
+- Use `Get-Command` for command discovery and an explicit `.exe` name when native executable semantics matter.
+- Use the call operator `&` for an executable stored in a variable or a quoted executable path.
+- Windows PowerShell 5.1 does **not** support PowerShell 7 pipeline-chain operators `&&` and `||`. Use explicit control flow and inspect status instead.
+- Native process success/failure is represented by `$LASTEXITCODE`; cmdlet errors use PowerShell error semantics. Do not conflate them.
+- When cmdlet failure must stop execution, use terminating-error behavior deliberately rather than assuming every error terminates.
+- Windows PowerShell 5.1 native argument parsing differs from modern PowerShell. Quote Windows paths and native arguments deliberately; do not copy Bash escaping rules.
+- PowerShell pipelines pass objects between cmdlets. Be explicit when crossing into native executables.
+- ForgeRelay inherits the server environment. Do not source the user's PowerShell profile merely to recover PATH, aliases, modules, or prompt configuration.

package/templates/instructions/pwsh.md

@@ -0,0 +1,14 @@
+# ForgeRelay PowerShell 7 Instructions
+
+ForgeRelay executes Agent commands and Hooks with PowerShell 7 (`pwsh`) for this runtime. Use PowerShell syntax, not Bash syntax.
+
+- Environment variables use `$env:NAME`; do not use `export NAME=...`.
+- Prefer explicit PowerShell cmdlets when semantics matter. Do not pass Unix flags to aliases such as `rm`, `ls`, or `cat`.
+- Use `Get-Command` to discover commands. Use an explicit `.exe` name when native executable semantics matter.
+- Use the call operator `&` for an executable stored in a variable or for a quoted executable path.
+- Quote Windows paths deliberately. Do not copy Bash escaping rules into PowerShell native-command arguments.
+- Native program success/failure is represented by `$LASTEXITCODE`; PowerShell cmdlet errors use PowerShell error semantics. Do not conflate the two.
+- When cmdlet failure must stop the command, use terminating-error behavior deliberately rather than assuming every error terminates execution.
+- PowerShell pipelines pass objects between cmdlets. Be explicit when crossing between object pipelines and native executables.
+- PowerShell 7 supports pipeline-chain operators such as `&&` and `||`, but use them only when the reported runtime version supports them.
+- ForgeRelay already inherits the server process environment. Do not source the user's PowerShell profile merely to recover PATH, aliases, modules, or prompt configuration.

package/templates/instructions/zsh.md

@@ -0,0 +1,11 @@
+# ForgeRelay zsh Instructions
+
+ForgeRelay executes Agent commands and Hooks with zsh for this runtime. Use zsh syntax deliberately rather than assuming every Bash-specific construct behaves identically.
+
+- Environment variables are exported with zsh/POSIX syntax such as `export NAME=value`; shell-local variables do not need `export`.
+- Inspect command success with `$?` when it is needed, and preserve the relevant status before running another command.
+- Quote parameter expansions unless zsh-specific splitting or globbing is intentionally required. Do not depend on Bash-only word-splitting behavior.
+- zsh arrays are 1-indexed by default and have zsh-specific expansion semantics. Do not copy Bash array expressions without checking them.
+- Use zsh conditionals, glob qualifiers, and parameter-expansion features only when they make the command clearer; prefer portable command-line tools when shell-specific syntax is unnecessary.
+- Do not assume Bash-only builtins or options such as `shopt` exist.
+- ForgeRelay already inherits the server process environment. Do not source the user's `.zshrc`, Oh My Zsh, prompt theme, plugins, or interactive profile merely to recover PATH or aliases.

package/dist/runtime/instructions/powershell-skill.js

@@ -1,65 +0,0 @@
-import { constants as fsConstants } from "node:fs";
-import { access, mkdir, writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
-const TEMPLATE_REPOSITORY_RAW = "https://raw.githubusercontent.com/Akira-TL/forgerelay";
-const POWERSHELL_SKILL_PATH = "templates/skills/powershell/SKILL.md";
-export function powerShellSkillPath(configDir) {
-    return join(resolve(configDir), "skills", "powershell", "SKILL.md");
-}
-export function powerShellSkillTemplateUrl(version) {
-    const normalizedVersion = version.trim().replace(/^v/, "");
-    if (!normalizedVersion)
-        throw new Error("ForgeRelay version is required to fetch the PowerShell Skill.");
-    return `${TEMPLATE_REPOSITORY_RAW}/v${encodeURIComponent(normalizedVersion)}/${POWERSHELL_SKILL_PATH}`;
-}
-export async function seedPowerShellSkill(options) {
-    const path = powerShellSkillPath(options.configDir);
-    const sourceUrl = powerShellSkillTemplateUrl(options.version);
-    if (!options.reset && await fileExists(path)) {
-        return { path, status: "preserved", sourceUrl };
-    }
-    await mkdir(join(resolve(options.configDir), "skills", "powershell"), {
-        recursive: true,
-        mode: 0o700,
-    });
-    const fetchText = options.fetchText ?? fetchSkillText;
-    try {
-        const content = await fetchText(sourceUrl);
-        if (!content.trim())
-            throw new Error("template response was empty");
-        await writeFile(path, content.endsWith("\n") ? content : `${content}\n`, {
-            encoding: "utf8",
-            mode: 0o600,
-            flag: options.reset ? "w" : "wx",
-        });
-        return { path, status: "created", sourceUrl };
-    }
-    catch (error) {
-        if (!options.reset && await fileExists(path)) {
-            return { path, status: "preserved", sourceUrl };
-        }
-        return {
-            path,
-            status: "failed",
-            sourceUrl,
-            error: error instanceof Error ? error.message : String(error),
-        };
-    }
-}
-async function fetchSkillText(url) {
-    const response = await fetch(url, {
-        headers: { "user-agent": "forgerelay-powershell-skill" },
-    });
-    if (!response.ok)
-        throw new Error(`HTTP ${response.status} while fetching ${url}`);
-    return response.text();
-}
-async function fileExists(path) {
-    try {
-        await access(path, fsConstants.F_OK);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}