@entelligentsia/forgecli 0.10.0 → 0.11.2

package/dist/extensions/forgecli/hooks/check-update.js

@@ -0,0 +1,308 @@
+// hooks/check-update.ts — Session-start Forge-awareness + project-state sync (FORGE-S23-T05).
+//
+// Port of forge/forge/hooks/check-update.js functions (1), (3), (4), (5) for the
+// pi extension context. Function (2) — version-check throttle (npm + GH dual-probe)
+// — is covered by the existing update-check.ts and is NOT duplicated here.
+//
+// Five functions ported:
+//   (1) buildForgeAwarenessMsg  — AC#1: forge-awareness context injection
+//   (3) syncForgeRootAndRef     — AC#2, AC#6: distribution-switch detection + forgeRoot/forgeRef sync
+//   (4) scanPluginInstallations — AC#3: multi-plugin scanning
+//       buildMultiPluginMsg     — AC#3: builds notification from scan results
+//   (5) buildPendingMigrationMsg — AC#4: pending-migration state surfacing
+//
+// Key differences from plugin:
+//   - No stdout hook protocol: pi has no `{"additionalContext":"..."}` stdout pipe.
+//     All surfacing is via ctx.ui.notify() — callers do the notify, this module
+//     returns strings (or null) for testability.
+//   - Config-authoritative: forge-cli uses paths.forgeRoot from .forge/config.json
+//     as truth; no CLAUDE_PLUGIN_ROOT env var.
+//   - forgeRef source: reads <paths.forgeRoot>/.claude-plugin/plugin.json at runtime
+//     (live version), not PKG_VERSIONS.bundledForgeVersion (baked at build time).
+//   - Plugin-level cache (CLAUDE_PLUGIN_DATA/update-check-cache.json): not used.
+//     Only the project-level cache (.forge/update-check-cache.json) is read/written.
+//
+// All file I/O is wrapped in try/catch — non-fatal. Session-start must never throw.
+//
+// Plugin parity reference: forge/forge/hooks/check-update.js (read-only — do NOT edit).
+//
+// Iron Laws:
+//   IL1 — code only under forge-cli/src/extensions/forgecli/.
+//   IL5 — vendored forge is read-only; check-update.js is reference only.
+//   IL6 — no shell-string interpolation; no spawn calls; only Node fs built-in.
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+// ── Distribution detection (ported verbatim from check-update.js) ─────────────
+/**
+ * Derives the distribution name from a plugin root path.
+ * Ported verbatim from forge/forge/hooks/check-update.js `detectDistribution()`.
+ *
+ * Returns "forge@skillforge" for skillforge-marketplace installs,
+ * "forge@forge" for all others (direct forge installs).
+ */
+export function detectDistribution(root) {
+    return root.includes("/cache/skillforge/forge/") || root.includes("/marketplaces/skillforge/forge/")
+        ? "forge@skillforge"
+        : "forge@forge";
+}
+// ── Project cache I/O ─────────────────────────────────────────────────────────
+/**
+ * Reads and parses the project-level update-check cache from .forge/update-check-cache.json.
+ * Returns null if the file is absent or malformed.
+ * Non-fatal — all errors are swallowed.
+ */
+export function readProjectCache(forgeDir) {
+    try {
+        const cacheFile = path.join(forgeDir, "update-check-cache.json");
+        const raw = fs.readFileSync(cacheFile, "utf8");
+        const parsed = JSON.parse(raw);
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+// ── Function (1): Forge-awareness context injection ───────────────────────────
+/**
+ * Builds a Forge-awareness message if this project has a .forge/config.json.
+ * Corresponds to the forge-awareness context injection in check-update.js.
+ *
+ * In the plugin, this is emitted as {"additionalContext":"..."} to stdout.
+ * In forge-cli, the caller does ctx.ui.notify(msg, "info") — pi has no
+ * session_start additionalContext protocol.
+ *
+ * Returns null when configPath is missing or unreadable (e.g. outside-Forge project).
+ */
+export function buildForgeAwarenessMsg(configPath) {
+    try {
+        if (!fs.existsSync(configPath))
+            return null;
+        return ("This project uses Forge AI-SDLC. Engineering knowledge base: engineering/. " +
+            "Generated workflows: .forge/workflows/. Sprint and task store: .forge/store/. " +
+            "Use the project slash commands (/plan, /implement, /sprint-plan) to drive development. " +
+            "Run /forge:health to check knowledge base currency.");
+    }
+    catch {
+        return null;
+    }
+}
+// ── Plugin enabled check (ported from check-update.js) ───────────────────────
+/**
+ * Returns true if the Forge plugin is enabled in user/project settings.
+ * Mirrors isPluginEnabled() from check-update.js.
+ */
+function isPluginEnabled(pluginPath, scope, homeDir, cwd) {
+    try {
+        const userSettingsPath = path.join(homeDir, ".claude", "settings.json");
+        if (fs.existsSync(userSettingsPath)) {
+            const userSettings = JSON.parse(fs.readFileSync(userSettingsPath, "utf8"));
+            if (userSettings.disablePlugin === true)
+                return false;
+            const plugins = userSettings.plugins;
+            if (plugins && plugins.forge === false)
+                return false;
+        }
+        const projectSettingsPath = path.join(cwd, ".claude", "settings.local.json");
+        if (fs.existsSync(projectSettingsPath)) {
+            const projectSettings = JSON.parse(fs.readFileSync(projectSettingsPath, "utf8"));
+            if (projectSettings.disablePlugin === true)
+                return false;
+            const plugins = projectSettings.plugins;
+            if (plugins && plugins.forge === false)
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return true; // Non-fatal — assume enabled if cannot read settings
+    }
+}
+// ── Function (4): Multi-plugin scanning ──────────────────────────────────────
+/**
+ * Scans known plugin locations for all Forge installations.
+ * Ported from check-update.js scanPluginInstallations() with injectable options for testing.
+ *
+ * Returns an array of installation records with version, distribution, scope, enabled status.
+ */
+export function scanPluginInstallations(opts) {
+    const installations = [];
+    const homeDir = opts?.homeDir ?? os.homedir();
+    const cwd = opts?.cwd ?? process.cwd();
+    // Candidate paths — user scope (global) and project scope (local)
+    // Also scan skillforge subdirectory variant (skillforge/forge/forge)
+    const basePaths = [path.join(homeDir, ".claude", "plugins"), path.join(cwd, ".claude", "plugins")];
+    const variants = ["cache", "marketplaces"];
+    const pluginNames = ["forge/forge", "skillforge/forge/forge"];
+    const candidates = [];
+    for (const basePath of basePaths) {
+        for (const variant of variants) {
+            for (const pluginName of pluginNames) {
+                candidates.push(path.join(basePath, variant, pluginName));
+            }
+        }
+    }
+    for (const candidate of candidates) {
+        try {
+            const pluginJsonPath = path.join(candidate, ".claude-plugin", "plugin.json");
+            if (!fs.existsSync(pluginJsonPath))
+                continue;
+            const manifest = JSON.parse(fs.readFileSync(pluginJsonPath, "utf8"));
+            // Determine scope: project-scope paths start with cwd/.claude (check first to avoid
+            // false positives when cwd is a subdirectory of homeDir)
+            const isProjectScope = candidate.startsWith(path.join(cwd, ".claude"));
+            const isUserScope = candidate.startsWith(path.join(homeDir, ".claude"));
+            const scope = isProjectScope ? "project" : isUserScope ? "user" : "unknown";
+            const enabled = isPluginEnabled(candidate, scope, homeDir, cwd);
+            // Avoid duplicates
+            if (installations.some((i) => i.path === candidate))
+                continue;
+            installations.push({
+                path: candidate,
+                version: manifest.version ?? "unknown",
+                distribution: detectDistribution(candidate),
+                scope,
+                enabled,
+            });
+        }
+        catch {
+            // Non-fatal — skip broken installations silently
+        }
+    }
+    return installations;
+}
+/**
+ * Builds a multi-plugin awareness message if multiple Forge installations are detected.
+ * Returns null if only one (or zero) installations found.
+ */
+export function buildMultiPluginMsg(opts) {
+    try {
+        const cwd = opts.cwd ?? process.cwd();
+        const homeDir = opts.homeDir ?? os.homedir();
+        const allInstallations = scanPluginInstallations({ homeDir, cwd });
+        if (allInstallations.length < 2)
+            return null;
+        const activeInst = allInstallations.find((i) => i.path === opts.forgeRoot) ?? allInstallations[0];
+        if (!activeInst)
+            return null;
+        const otherInsts = allInstallations.filter((i) => i.path !== activeInst.path);
+        if (otherInsts.length === 0)
+            return null;
+        const otherDesc = otherInsts.map((i) => `${i.version} (${i.distribution}, ${i.scope})`).join(", ");
+        return `Forge: also installed: ${otherDesc}.`;
+    }
+    catch {
+        return null;
+    }
+}
+// ── Function (3): Distribution-switch detection + forgeRoot/forgeRef sync ─────
+/**
+ * Syncs paths.forgeRoot and paths.forgeRef in .forge/config.json if they drift.
+ * Detects distribution switches (forge@forge ↔ forge@skillforge) and returns a
+ * notification message if the distribution changed; returns null otherwise.
+ *
+ * Also updates the project-level cache (.forge/update-check-cache.json) with
+ * current distribution, forgeRoot, and forgeRef (preserving updateStatus, pendingMigrations).
+ *
+ * Corresponds to the "Distribution + forgeRoot/forgeRef sync" section in check-update.js.
+ */
+export function syncForgeRootAndRef(opts) {
+    try {
+        const forgeDir = path.dirname(opts.configPath);
+        const currentDistribution = detectDistribution(opts.forgeRoot);
+        // Read current local version from the live plugin.json (faithful port of check-update.js §4.2)
+        let localVersion = "unknown";
+        try {
+            const pluginJsonPath = path.join(opts.forgeRoot, ".claude-plugin", "plugin.json");
+            const manifest = JSON.parse(fs.readFileSync(pluginJsonPath, "utf8"));
+            localVersion = manifest.version ?? "unknown";
+        }
+        catch {
+            // Non-fatal — version sync skipped if plugin.json unreadable
+        }
+        // Sync config.json paths.forgeRoot and paths.forgeRef
+        try {
+            const cfg = JSON.parse(fs.readFileSync(opts.configPath, "utf8"));
+            if (!cfg.paths)
+                cfg.paths = {};
+            let configChanged = false;
+            if (cfg.paths.forgeRoot !== opts.forgeRoot) {
+                cfg.paths.forgeRoot = opts.forgeRoot;
+                configChanged = true;
+            }
+            if (localVersion !== "unknown" && cfg.paths.forgeRef !== localVersion) {
+                cfg.paths.forgeRef = localVersion;
+                configChanged = true;
+            }
+            if (configChanged) {
+                fs.writeFileSync(opts.configPath, JSON.stringify(cfg, null, 2) + "\n");
+            }
+        }
+        catch {
+            // Non-fatal — config sync skipped
+        }
+        // Read project cache for distribution-switch detection
+        const projectCache = readProjectCache(forgeDir);
+        if (!projectCache)
+            return null;
+        const storedRoot = projectCache.forgeRoot;
+        const storedDist = projectCache.distribution;
+        const switched = storedRoot !== undefined && storedRoot !== opts.forgeRoot;
+        let distributionSwitchMsg = null;
+        if (switched && storedDist !== undefined && storedDist !== currentDistribution) {
+            const versionNote = projectCache.localVersion !== undefined && projectCache.localVersion !== localVersion
+                ? ` Version: ${projectCache.localVersion} → ${localVersion}.`
+                : "";
+            distributionSwitchMsg =
+                `Forge: plugin distribution switched from ${storedDist} to ${currentDistribution}.${versionNote}` +
+                    ` paths.forgeRoot updated. Run /forge:update to verify migration state.`;
+        }
+        // Sync distribution + forgeRoot + forgeRef into the project cache whenever they drift.
+        // Preserve updateStatus, pendingReason, pendingMigrations via spread (FR-002 parity).
+        if (storedRoot !== opts.forgeRoot || storedDist !== currentDistribution) {
+            try {
+                const updated = {
+                    ...projectCache,
+                    distribution: currentDistribution,
+                    forgeRoot: opts.forgeRoot,
+                    forgeRef: localVersion,
+                };
+                const cacheFile = path.join(forgeDir, "update-check-cache.json");
+                fs.writeFileSync(cacheFile, JSON.stringify(updated, null, 2) + "\n");
+            }
+            catch {
+                // Non-fatal
+            }
+        }
+        return distributionSwitchMsg;
+    }
+    catch {
+        return null;
+    }
+}
+// ── Function (5): Pending-migration state surfacing ───────────────────────────
+/**
+ * Surfaces a pending-migration warning if the project cache shows updateStatus === "pending".
+ * Returns the warning message string, or null if no pending state or cache absent.
+ *
+ * Corresponds to FR-002 pending-state surfacing in check-update.js.
+ */
+export function buildPendingMigrationMsg(configPath) {
+    try {
+        const forgeDir = path.dirname(configPath);
+        const projectCache = readProjectCache(forgeDir);
+        if (!projectCache)
+            return null;
+        if (projectCache.updateStatus !== "pending")
+            return null;
+        const pendingMigrations = Array.isArray(projectCache.pendingMigrations)
+            ? projectCache.pendingMigrations.join(", ")
+            : "(unknown)";
+        return (`Forge update is incomplete — pending migration(s): ${pendingMigrations}. ` +
+            `Run /forge:update to continue or /forge:migrate to complete.`);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=check-update.js.map

package/dist/extensions/forgecli/hooks/check-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-update.js","sourceRoot":"","sources":["../../../../src/extensions/forgecli/hooks/check-update.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,EAAE;AACF,iFAAiF;AACjF,oFAAoF;AACpF,2EAA2E;AAC3E,EAAE;AACF,yBAAyB;AACzB,0EAA0E;AAC1E,sGAAsG;AACtG,8DAA8D;AAC9D,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,+BAA+B;AAC/B,oFAAoF;AACpF,gFAAgF;AAChF,iDAAiD;AACjD,mFAAmF;AACnF,+CAA+C;AAC/C,qFAAqF;AACrF,kFAAkF;AAClF,iFAAiF;AACjF,qFAAqF;AACrF,EAAE;AACF,oFAAoF;AACpF,EAAE;AACF,wFAAwF;AACxF,EAAE;AACF,aAAa;AACb,8DAA8D;AAC9D,0EAA0E;AAC1E,gFAAgF;AAEhF,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AA8BlC,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC;QACnG,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,aAAa,CAAC;AAClB,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAChD,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;QAC/C,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACxD,IAAI,CAAC;QACJ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,CACN,6EAA6E;YAC7E,gFAAgF;YAChF,yFAAyF;YACzF,qDAAqD,CACrD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,eAAe,CAAC,UAAkB,EAAE,KAAa,EAAE,OAAe,EAAE,GAAW;IACvF,IAAI,CAAC;QACJ,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QACxE,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAA4B,CAAC;YACtG,IAAI,YAAY,CAAC,aAAa,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACtD,MAAM,OAAO,GAAG,YAAY,CAAC,OAA8C,CAAC;YAC5E,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;QACtD,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;QAC7E,IAAI,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACxC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAG9E,CAAC;YACF,IAAI,eAAe,CAAC,aAAa,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACzD,MAAM,OAAO,GAAG,eAAe,CAAC,OAA8C,CAAC;YAC/E,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC,CAAC,qDAAqD;IACnE,CAAC;AACF,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAyC;IAChF,MAAM,aAAa,GAAoB,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEvC,kEAAkE;IAClE,qEAAqE;IACrE,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;IAE9D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;YAC3D,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC;YACJ,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC7E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC;gBAAE,SAAS;YAE7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAyB,CAAC;YAC7F,oFAAoF;YACpF,yDAAyD;YACzD,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YACvE,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YACxE,MAAM,KAAK,GAAmC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5G,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAEhE,mBAAmB;YACnB,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;gBAAE,SAAS;YAE9D,aAAa,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,SAAS;gBACtC,YAAY,EAAE,kBAAkB,CAAC,SAAS,CAAC;gBAC3C,KAAK;gBACL,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACR,iDAAiD;QAClD,CAAC;IACF,CAAC;IAED,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAwB;IAC3D,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAEnE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE7C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnG,OAAO,0BAA0B,SAAS,GAAG,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAwB;IAC3D,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE/D,+FAA+F;QAC/F,IAAI,YAAY,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC;YACJ,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAyB,CAAC;YAC7F,YAAY,GAAG,QAAQ,CAAC,OAAO,IAAI,SAAS,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;QAC9D,CAAC;QAED,sDAAsD;QACtD,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAE9D,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/B,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC5C,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;gBACrC,aAAa,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,IAAI,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACvE,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,YAAY,CAAC;gBAClC,aAAa,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBACnB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACxE,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,kCAAkC;QACnC,CAAC;QAED,uDAAuD;QACvD,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAE/B,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC;QAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,CAAC;QAC7C,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,CAAC,SAAS,CAAC;QAE3E,IAAI,qBAAqB,GAAkB,IAAI,CAAC;QAEhD,IAAI,QAAQ,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,mBAAmB,EAAE,CAAC;YAChF,MAAM,WAAW,GAChB,YAAY,CAAC,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,YAAY,KAAK,YAAY;gBACpF,CAAC,CAAC,aAAa,YAAY,CAAC,YAAY,MAAM,YAAY,GAAG;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACP,qBAAqB;gBACpB,4CAA4C,UAAU,OAAO,mBAAmB,IAAI,WAAW,EAAE;oBACjG,wEAAwE,CAAC;QAC3E,CAAC;QAED,uFAAuF;QACvF,sFAAsF;QACtF,IAAI,UAAU,KAAK,IAAI,CAAC,SAAS,IAAI,UAAU,KAAK,mBAAmB,EAAE,CAAC;YACzE,IAAI,CAAC;gBACJ,MAAM,OAAO,GAAiB;oBAC7B,GAAG,YAAY;oBACf,YAAY,EAAE,mBAAmB;oBACjC,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,QAAQ,EAAE,YAAY;iBACtB,CAAC;gBACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;gBACjE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACR,YAAY;YACb,CAAC;QACF,CAAC;QAED,OAAO,qBAAqB,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IAC1D,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC/B,IAAI,YAAY,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAEzD,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC;YACtE,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3C,CAAC,CAAC,WAAW,CAAC;QAEf,OAAO,CACN,sDAAsD,iBAAiB,IAAI;YAC3E,8DAA8D,CAC9D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC"}

package/dist/extensions/forgecli/hooks/forge-permissions.d.ts

@@ -0,0 +1,32 @@
+/** A single pattern entry in the permission registry. */
+interface PermissionPattern {
+    /** Regex tested against the tool input string. */
+    pattern: RegExp;
+    /**
+     * Human-readable rule string — kept for audit-log display only.
+     * NOT persisted: pi has no PermissionRequest event.
+     */
+    rule: string;
+}
+/** Bash command patterns that are auto-allowed. */
+export declare const BASH_PATTERNS: PermissionPattern[];
+/** Write tool path patterns that are auto-allowed. */
+export declare const WRITE_PATTERNS: PermissionPattern[];
+/** Edit tool path patterns that are auto-allowed. */
+export declare const EDIT_PATTERNS: PermissionPattern[];
+/**
+ * Check whether a pi tool_call matches a known Forge auto-allow pattern.
+ *
+ * @param toolName   The pi tool name ("bash", "write", "edit", etc.)
+ * @param toolInput  The tool's input object (toolCallEvent.input)
+ * @returns The matched rule string for audit logging, or null if no match.
+ *          A non-null return is the "silently allow" signal — the caller
+ *          should return undefined from the tool_call handler (no block).
+ *
+ * Input fields tested per tool type (mirrors plugin matchTool):
+ *   bash   → toolInput.command   (string)
+ *   write  → toolInput.path      (string; pi uses `path`, not `file_path`)
+ *   edit   → toolInput.path      (string)
+ */
+export declare function matchForgePermission(toolName: string, toolInput: Record<string, unknown>): string | null;
+export {};

package/dist/extensions/forgecli/hooks/forge-permissions.js

@@ -0,0 +1,119 @@
+// Forge permission pattern registry — FORGE-S23-T04.
+//
+// Port of forge/forge/hooks/forge-permissions.js pattern-match auto-allow logic.
+// Pi has no PermissionRequest event, so "auto-allow" means: when the tool_call
+// matches a known Forge pattern, silently return undefined (no block) from the
+// tool_call handler, bypassing the two-layer-guard boundary check.
+//
+// Key differences from the plugin:
+//   - No updatedPermissions / localSettings.json persistence: pi has no
+//     PermissionRequest event or persistent allow-rule protocol. The rule
+//     string is kept for audit-log display only.
+//   - WEBFETCH_PATTERNS omitted: pi's @earendil-works/pi-coding-agent has no
+//     WebFetchToolCallEvent type in its exported union. Adding dead code that
+//     could never fire would be misleading.
+//   - MultiEdit patterns omitted: pi has no MultiEdit event.
+//   - node -e / node -p remain excluded: arbitrary code execution must not
+//     be auto-approved. (Security decision from the original plugin, preserved.)
+//
+// File placement rationale: task prompt suggested "into two-layer-guard.ts",
+// but that file has a tight single-responsibility scope. The T02 (write-guard.ts)
+// and T03 (triage-error.ts) siblings establish the pattern: one concern per file.
+// This file follows that convention per forge-cli-engineer Iron Law 8 (prefer
+// architectural symmetry over literal prompt when prior art exists in the codebase).
+// ── Pattern registries — ported verbatim from forge-permissions.js ──────────
+/** Bash command patterns that are auto-allowed. */
+export const BASH_PATTERNS = [
+    // Node tool invocations — covers $FORGE_ROOT/tools/*.cjs and $CLAUDE_PLUGIN_ROOT
+    { pattern: /^node\s+.*\/tools\/[\w-]+\.(cjs|js)\b/, rule: "node ~/.claude/plugins/cache/forge/forge/*/tools/*" },
+    // NOTE: node -e and node -p are intentionally excluded — arbitrary code
+    // execution must not be auto-approved. Forge workflows use node .../tools/*.cjs
+    // for tool invocations; inline node -e/p requires explicit user approval.
+    // Shell commands used by Forge workflows
+    { pattern: /^mkdir\s+-p\s+/, rule: "mkdir -p .forge/*" },
+    { pattern: /^mkdir\s+-p\s+\S+/, rule: "mkdir -p .forge/*" },
+    { pattern: /^cp\s+/, rule: "cp */schemas/*.schema.json .forge/schemas/" },
+    { pattern: /^ls\s+/, rule: "ls *" },
+    { pattern: /^cat\s+/, rule: "cat .forge/*" },
+    { pattern: /^date\s+-u\s+/, rule: "date -u *" },
+    { pattern: /^date\s+/, rule: "date -u *" },
+    { pattern: /^jq\s+/, rule: "jq *" },
+    { pattern: /^touch\s+/, rule: "touch .forge/*" },
+    { pattern: /^uname\s+/, rule: "uname *" },
+    { pattern: /^rm\s+\.forge/, rule: "rm .forge/*" },
+    { pattern: /^rm\s+-rf\s+\.forge/, rule: "rm -rf .forge/*" },
+    { pattern: /^rmdir\s+/, rule: "rmdir .forge/*" },
+    { pattern: /^gh\s+auth\s+/, rule: "gh auth status *" },
+    { pattern: /^gh\s+issue\s+/, rule: "gh issue create *" },
+    // git read-only commands (already auto-approved by Claude Code, but belt-and-suspenders)
+    { pattern: /^git\s+status\b/, rule: "git status *" },
+    { pattern: /^git\s+log\b/, rule: "git log *" },
+    { pattern: /^git\s+diff\b/, rule: "git diff *" },
+    { pattern: /^git\s+add\s+/, rule: "git add *" },
+    { pattern: /^git\s+commit\s+-m\s+/, rule: "git commit -m *" },
+    { pattern: /^git\s+push\b/, rule: "git push *" },
+    { pattern: /^git\s+checkout\s+/, rule: "git checkout *" },
+    { pattern: /^git\s+branch\s+/, rule: "git branch *" },
+    { pattern: /^git\s+stash\b/, rule: "git stash *" },
+    { pattern: /^git\s+worktree\s+/, rule: "git worktree *" },
+];
+/** Write tool path patterns that are auto-allowed. */
+export const WRITE_PATTERNS = [
+    { pattern: /^\.forge\//, rule: ".forge/**" },
+    { pattern: /^\.claude\/commands\//, rule: ".claude/commands/**" },
+    { pattern: /^engineering\//, rule: "engineering/**" },
+    { pattern: /^CLAUDE\.md$/i, rule: "CLAUDE.md" },
+    { pattern: /^AGENTS\.md$/i, rule: "AGENTS.md" },
+    { pattern: /^\.gitignore$/, rule: ".gitignore" },
+];
+/** Edit tool path patterns that are auto-allowed. */
+export const EDIT_PATTERNS = [
+    { pattern: /^\.forge\//, rule: ".forge/**" },
+    { pattern: /^\.claude\/commands\//, rule: ".claude/commands/**" },
+    { pattern: /^engineering\//, rule: "engineering/**" },
+    { pattern: /^CLAUDE\.md$/i, rule: "CLAUDE.md" },
+    { pattern: /^AGENTS\.md$/i, rule: "AGENTS.md" },
+];
+// Map from pi tool name to its pattern list.
+// NOTE: "multiedit" is omitted — pi has no MultiEdit event in its tool_call union.
+// NOTE: "webfetch" is omitted — pi has no WebFetchToolCallEvent type.
+const PATTERN_MAP = {
+    bash: BASH_PATTERNS,
+    write: WRITE_PATTERNS,
+    edit: EDIT_PATTERNS,
+};
+/**
+ * Check whether a pi tool_call matches a known Forge auto-allow pattern.
+ *
+ * @param toolName   The pi tool name ("bash", "write", "edit", etc.)
+ * @param toolInput  The tool's input object (toolCallEvent.input)
+ * @returns The matched rule string for audit logging, or null if no match.
+ *          A non-null return is the "silently allow" signal — the caller
+ *          should return undefined from the tool_call handler (no block).
+ *
+ * Input fields tested per tool type (mirrors plugin matchTool):
+ *   bash   → toolInput.command   (string)
+ *   write  → toolInput.path      (string; pi uses `path`, not `file_path`)
+ *   edit   → toolInput.path      (string)
+ */
+export function matchForgePermission(toolName, toolInput) {
+    const patterns = PATTERN_MAP[toolName];
+    if (!patterns)
+        return null;
+    let input;
+    if (toolName === "bash") {
+        input = typeof toolInput.command === "string" ? toolInput.command : "";
+    }
+    else if (toolName === "write" || toolName === "edit") {
+        input = typeof toolInput.path === "string" ? toolInput.path : "";
+    }
+    else {
+        return null;
+    }
+    for (const { pattern, rule } of patterns) {
+        if (pattern.test(input))
+            return rule;
+    }
+    return null;
+}
+//# sourceMappingURL=forge-permissions.js.map

package/dist/extensions/forgecli/hooks/forge-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge-permissions.js","sourceRoot":"","sources":["../../../../src/extensions/forgecli/hooks/forge-permissions.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,mEAAmE;AACnE,EAAE;AACF,mCAAmC;AACnC,wEAAwE;AACxE,0EAA0E;AAC1E,iDAAiD;AACjD,6EAA6E;AAC7E,8EAA8E;AAC9E,4CAA4C;AAC5C,6DAA6D;AAC7D,2EAA2E;AAC3E,iFAAiF;AACjF,EAAE;AACF,6EAA6E;AAC7E,kFAAkF;AAClF,kFAAkF;AAClF,8EAA8E;AAC9E,qFAAqF;AAarF,+EAA+E;AAE/E,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAwB;IACjD,iFAAiF;IACjF,EAAE,OAAO,EAAE,uCAAuC,EAAE,IAAI,EAAE,oDAAoD,EAAE;IAChH,wEAAwE;IACxE,gFAAgF;IAChF,0EAA0E;IAC1E,yCAAyC;IACzC,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACxD,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC3D,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,4CAA4C,EAAE;IACzE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;IACnC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE;IAC5C,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE;IAC/C,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE;IAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;IACnC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAChD,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;IACzC,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE;IACjD,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC3D,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAChD,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACtD,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACxD,yFAAyF;IACzF,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE;IACpD,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE;IAC9C,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE;IAChD,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE;IAC/C,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC7D,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE;IAChD,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACzD,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE;IACrD,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE;IAClD,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,gBAAgB,EAAE;CACzD,CAAC;AAEF,sDAAsD;AACtD,MAAM,CAAC,MAAM,cAAc,GAAwB;IAClD,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE;IAC5C,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACjE,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACrD,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE;IAC/C,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE;IAC/C,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE;CAChD,CAAC;AAEF,qDAAqD;AACrD,MAAM,CAAC,MAAM,aAAa,GAAwB;IACjD,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE;IAC5C,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACjE,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACrD,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE;IAC/C,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE;CAC/C,CAAC;AAEF,6CAA6C;AAC7C,mFAAmF;AACnF,sEAAsE;AACtE,MAAM,WAAW,GAAwC;IACxD,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,cAAc;IACrB,IAAI,EAAE,aAAa;CACnB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CACnC,QAAgB,EAChB,SAAkC;IAElC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,KAAa,CAAC;IAClB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,KAAK,GAAG,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxD,KAAK,GAAG,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;SAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/extensions/forgecli/hooks/triage-error.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Regex patterns that identify Forge-related Bash commands.
+ * Ported verbatim from forge/forge/hooks/triage-error.js lines 10–20.
+ * Exported as `readonly` so tests can verify count and identity.
+ */
+export declare const FORGE_PATTERNS: readonly RegExp[];
+/**
+ * Returns true if the command matches any Forge-related pattern.
+ * Mirrors `isForgeRelated()` from triage-error.js.
+ */
+export declare function isForgeRelated(command: string): boolean;
+/**
+ * Build the ctx.ui.notify message for a failed Forge-related command.
+ *
+ * Format (condensed for notification surface):
+ *   FORGE_ERROR_TRIAGE: A Forge command just failed. [First error line: "...". ]
+ *   Would you like to file a bug? Run /forge:report-bug
+ *
+ * @param command     The original bash command string (unused in message body; kept for future use).
+ * @param outputSnippet  First few lines of tool output, already joined to a single string.
+ *                       Empty string if no output is available.
+ */
+export declare function buildTriageMessage(_command: string, outputSnippet: string): string;

package/dist/extensions/forgecli/hooks/triage-error.js

@@ -0,0 +1,62 @@
+// hooks/triage-error.ts — Post-Bash-failure Forge error triage (FORGE-S23-T03).
+//
+// Port of forge/forge/hooks/triage-error.js (71 lines) for the pi extension context.
+//
+// When a Bash tool call exits non-zero and the command matches a Forge-related
+// pattern, the hook-dispatcher calls isForgeRelated() and, on a match, uses
+// buildTriageMessage() to build a ctx.ui.notify message suggesting the user
+// run /forge:report-bug.
+//
+// This module is a pure helper — no pi imports, no side effects. All logic is
+// exported so tests can exercise it in isolation.
+//
+// Plugin parity reference: forge/forge/hooks/triage-error.js (read-only — do NOT edit).
+//
+// Iron Laws:
+//   IL1 — code only under forge-cli/src/extensions/forgecli/.
+//   IL6 — no shell-string interpolation; no spawn calls.
+// ── Pattern set (ported verbatim from triage-error.js:10-20) ─────────────────
+/**
+ * Regex patterns that identify Forge-related Bash commands.
+ * Ported verbatim from forge/forge/hooks/triage-error.js lines 10–20.
+ * Exported as `readonly` so tests can verify count and identity.
+ */
+export const FORGE_PATTERNS = [
+    /manage-config/,
+    /\.forge\//,
+    /CLAUDE_PLUGIN_ROOT/,
+    /FORGE_ROOT/,
+    /MANAGE_CONFIG/,
+    /engineering\/tools\//,
+    /forge:init/,
+    /forge:health/,
+    /forge:regenerate/,
+    /forge:update/,
+    /forge:add-pipeline/,
+];
+// ── Pure helpers ──────────────────────────────────────────────────────────────
+/**
+ * Returns true if the command matches any Forge-related pattern.
+ * Mirrors `isForgeRelated()` from triage-error.js.
+ */
+export function isForgeRelated(command) {
+    return FORGE_PATTERNS.some((p) => p.test(command));
+}
+/**
+ * Build the ctx.ui.notify message for a failed Forge-related command.
+ *
+ * Format (condensed for notification surface):
+ *   FORGE_ERROR_TRIAGE: A Forge command just failed. [First error line: "...". ]
+ *   Would you like to file a bug? Run /forge:report-bug
+ *
+ * @param command     The original bash command string (unused in message body; kept for future use).
+ * @param outputSnippet  First few lines of tool output, already joined to a single string.
+ *                       Empty string if no output is available.
+ */
+export function buildTriageMessage(_command, outputSnippet) {
+    const snippetPart = outputSnippet ? `First error line: "${outputSnippet}". ` : "";
+    return (`FORGE_ERROR_TRIAGE: A Forge command just failed. ` +
+        snippetPart +
+        `Would you like to file a bug? Run /forge:report-bug`);
+}
+//# sourceMappingURL=triage-error.js.map

package/dist/extensions/forgecli/hooks/triage-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-error.js","sourceRoot":"","sources":["../../../../src/extensions/forgecli/hooks/triage-error.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,qFAAqF;AACrF,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,4EAA4E;AAC5E,yBAAyB;AACzB,EAAE;AACF,8EAA8E;AAC9E,kDAAkD;AAClD,EAAE;AACF,wFAAwF;AACxF,EAAE;AACF,aAAa;AACb,8DAA8D;AAC9D,yDAAyD;AAEzD,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAChD,eAAe;IACf,WAAW;IACX,oBAAoB;IACpB,YAAY;IACZ,eAAe;IACf,sBAAsB;IACtB,YAAY;IACZ,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,oBAAoB;CACX,CAAC;AAEX,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,aAAqB;IACzE,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,sBAAsB,aAAa,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,OAAO,CACN,mDAAmD;QACnD,WAAW;QACX,qDAAqD,CACrD,CAAC;AACH,CAAC"}

package/dist/extensions/forgecli/hooks/write-guard.d.ts

@@ -0,0 +1,28 @@
+interface RegistryEntry {
+    pattern: RegExp;
+    schema: string;
+    kind: string;
+}
+export declare const WRITE_REGISTRY: RegistryEntry[];
+export declare function matchWriteRegistry(absPath: string): RegistryEntry | null;
+export declare function applyPiEdits(filePath: string, edits: Array<{
+    oldText: string;
+    newText: string;
+}>): string;
+export interface WriteGuardResult {
+    block: boolean;
+    reason?: string;
+}
+/**
+ * Check whether a Write or Edit targeting `filePath` with `contents` satisfies
+ * the Forge schema for that path.
+ *
+ * @param filePath  Absolute path being written (from event.input.path, resolved).
+ * @param contents  Post-write/post-edit file contents as a string.
+ * @param forgeRoot Absolute path to the Forge plugin root.
+ * @returns { block: false } if allowed; { block: true, reason } if blocked.
+ *
+ * Fail-open: returns { block: false } on any internal error.
+ */
+export declare function checkWriteGuard(filePath: string, contents: string, forgeRoot: string): WriteGuardResult;
+export {};