@getmonoceros/workbench 1.29.1 → 1.30.0

package/bundled-components/features/atlassian/component.yml

@@ -1,7 +1,7 @@
 id: atlassian
 category: feature
 displayName: Atlassian
-description: 'Rovo Dev (`acli rovodev`) and Teamwork Graph (`twg`) CLIs sharing one Atlassian account. Auth persists across rebuilds.'
+description: 'Rovo Dev (`acli rovodev`), Teamwork Graph (`twg`) and Forge (`forge`) CLIs sharing one Atlassian account. Auth persists across rebuilds.'
 documentationURL: https://developer.atlassian.com/cloud/
 options:
   rovodev:
@@ -14,6 +14,11 @@ options:
     default: true
     description: 'Install twg (Teamwork Graph CLI).'
     surface: yml
+  forge:
+    type: boolean
+    default: true
+    description: 'Install the Forge CLI (`forge`) for building Atlassian apps.'
+    surface: yml
   instance:
     type: string
     default: ''
@@ -35,18 +40,36 @@ options:
     description: "Optional Bitbucket app password; only needed for twg's Bitbucket commands."
     surface: env
 feature:
-  version: 1.1.0
+  version: 1.2.0
   persistentHomePaths: [.config/acli, .rovodev, .config/twg, .agents]
   vscodeExtensions: [Atlassian.atlascode]
+  # Forge is keychain-free in a container: instead of `forge login` (which
+  # needs libsecret), Atlassian's documented path is the FORGE_EMAIL /
+  # FORGE_API_TOKEN env vars, read at command time. We hand them to the
+  # workspace runtime env from the shared account options, gated on the
+  # `forge` toggle. Sibling of a service's connectionEnv (ADR 0021).
+  workspaceEnv:
+    - whenOption: forge
+      vars:
+        FORGE_EMAIL: '${email}'
+        FORGE_API_TOKEN: '${apiToken}'
 briefing:
   - whenOption: rovodev
     text: 'Atlassian Rovo Dev — invoke via `acli rovodev`. Pre-authenticated against the Atlassian account configured in the feature options (shared with twg).'
   - whenOption: twg
     text: 'Atlassian Teamwork Graph CLI (`twg`) — work-data access across Jira, Confluence, Bitbucket, JSM and Assets. Pre-authenticated. Sub-skills cover status rollups, engineering work, ops health and context discovery.'
+  - whenOption: forge
+    text: 'Atlassian Forge CLI (`forge`) for building and deploying Forge apps. Authenticated via FORGE_EMAIL / FORGE_API_TOKEN from the shared account (no `forge login` needed in the container).'
 presets:
   twg:
     rovodev: false
     twg: true
+    forge: false
   rovodev:
     rovodev: true
     twg: false
+    forge: false
+  forge:
+    rovodev: false
+    twg: false
+    forge: true

package/bundled-components/features/atlassian/install.sh

@@ -3,25 +3,31 @@
 #
 # Installs Atlassian CLIs that share a single Atlassian account:
 #   - Rovo Dev (acli, default on) — the `acli rovodev` AI agent
-#   - Teamwork Graph (twg, default off)
+#   - Teamwork Graph (twg, default on)
+#   - Forge (forge, default on) — the `@forge/cli` app-dev toolchain
 #
-# Each tool is toggled independently via the `rovodev` / `twg`
-# options. Credentials (instance / email / apiToken) are shared
-# across both tools when set; per-tool post-create hooks under
-# /usr/local/share/monoceros/post-create.d/ perform the
-# non-interactive login on first container start.
+# Each tool is toggled independently via the `rovodev` / `twg` / `forge`
+# options. Credentials (instance / email / apiToken) are shared across
+# the tools when set; rovodev and twg get per-tool post-create hooks
+# under /usr/local/share/monoceros/post-create.d/ that perform the
+# non-interactive login on first container start. Forge has no login
+# hook: it reads FORGE_EMAIL / FORGE_API_TOKEN from the workspace
+# runtime env, which the workbench injects from the shared account
+# options (feature.workspaceEnv) — the keychain-free path Atlassian
+# recommends for containers.
 
 set -euo pipefail
 
 ROVODEV="${ROVODEV:-true}"
 TWG="${TWG:-true}"
+FORGE="${FORGE:-true}"
 INSTANCE="${INSTANCE:-}"
 EMAIL="${EMAIL:-}"
 APITOKEN="${APITOKEN:-}"
 BITBUCKETTOKEN="${BITBUCKETTOKEN:-}"
 
-if [ "${ROVODEV}" != "true" ] && [ "${TWG}" != "true" ]; then
-  echo "[atlassian] both rovodev and twg disabled — nothing to install" >&2
+if [ "${ROVODEV}" != "true" ] && [ "${TWG}" != "true" ] && [ "${FORGE}" != "true" ]; then
+  echo "[atlassian] rovodev, twg and forge all disabled — nothing to install" >&2
   exit 0
 fi
 
@@ -185,4 +191,24 @@ EOF
   fi
 fi
 
+# ─── Forge (@forge/cli) ───────────────────────────────────────────
+if [ "${FORGE}" = "true" ]; then
+  # Forge is a Node CLI; the runtime ships Node, so a global npm install
+  # is enough. No post-create login hook: `forge login` stores creds in
+  # the OS keychain (libsecret on Linux), which we deliberately do not
+  # carry. Instead Forge reads FORGE_EMAIL / FORGE_API_TOKEN at command
+  # time; the workbench injects them into the workspace runtime env from
+  # this feature's `email` / `apiToken` options (feature.workspaceEnv),
+  # so the right account is in scope without a login step here.
+  echo "[atlassian/forge] installing @forge/cli globally via npm"
+  npm install -g @forge/cli
+  forge --version >/dev/null 2>&1 || {
+    echo "[atlassian/forge] ERROR: install completed but \`forge\` is not on PATH" >&2
+    exit 1
+  }
+  if [ -z "${EMAIL}" ] || [ -z "${APITOKEN}" ]; then
+    echo "[atlassian/forge] no email/apiToken set — set them in the container yml so FORGE_EMAIL/FORGE_API_TOKEN reach the shell"
+  fi
+fi
+
 echo "[atlassian] done"

package/dist/bin.js

@@ -665,7 +665,16 @@ var init_feature_doc = __esm({
 
 // src/catalog/descriptor.ts
 import { z as z2 } from "zod";
-var DESCRIPTOR_ID_RE, CategorySchema, OptionTypeSchema, SurfaceSchema, OptionValueSchema, OptionSpecSchema, BriefingLineSchema, HealthcheckSchema, LanguageBlockSchema, ServiceBlockSchema, PersistentHomeFileSchema, FeatureBlockSchema, DescriptorSchema;
+function workspaceEnvTokens(vars) {
+  const tokens = [];
+  for (const template of Object.values(vars)) {
+    for (const m of template.matchAll(/\$\{([A-Za-z0-9_]+)\}/g)) {
+      tokens.push(m[1]);
+    }
+  }
+  return tokens;
+}
+var DESCRIPTOR_ID_RE, CategorySchema, OptionTypeSchema, SurfaceSchema, OptionValueSchema, OptionSpecSchema, BriefingLineSchema, HealthcheckSchema, LanguageBlockSchema, ServiceBlockSchema, PersistentHomeFileSchema, WorkspaceEnvBlockSchema, FeatureBlockSchema, DescriptorSchema;
 var init_descriptor = __esm({
   "src/catalog/descriptor.ts"() {
     "use strict";
@@ -766,12 +775,24 @@ var init_descriptor = __esm({
       path: z2.string().min(1),
       initialContent: z2.string().optional()
     });
+    WorkspaceEnvBlockSchema = z2.object({
+      whenOption: z2.string().optional(),
+      vars: z2.record(z2.string(), z2.string())
+    });
     FeatureBlockSchema = z2.object({
       /** Publishable feature version (devcontainer-feature.json `version`). */
       version: z2.string().min(1),
       persistentHomePaths: z2.array(z2.string().min(1)).optional(),
       persistentHomeFiles: z2.array(PersistentHomeFileSchema).optional(),
-      vscodeExtensions: z2.array(z2.string()).optional()
+      vscodeExtensions: z2.array(z2.string()).optional(),
+      /**
+       * Named runtime env injected into the workspace container (compose
+       * `environment:` / image-mode `containerEnv`). Catalog/CLI-side only — not
+       * emitted into the published devcontainer-feature.json (like `presets`),
+       * because it drives how the workbench wires the container, not the feature
+       * install. See `featureWorkspaceEnv` in create/scaffold.ts.
+       */
+      workspaceEnv: z2.array(WorkspaceEnvBlockSchema).optional()
     });
     DescriptorSchema = z2.object({
       id: z2.string().regex(DESCRIPTOR_ID_RE, "id must be lowercase letters/digits/hyphens"),
@@ -833,6 +854,24 @@ var init_descriptor = __esm({
           });
         }
       });
+      data.feature?.workspaceEnv?.forEach((block, i) => {
+        if (block.whenOption !== void 0 && !optionKeys.has(block.whenOption)) {
+          ctx.addIssue({
+            code: z2.ZodIssueCode.custom,
+            path: ["feature", "workspaceEnv", i, "whenOption"],
+            message: `whenOption '${block.whenOption}' is not a declared option`
+          });
+        }
+        for (const token of workspaceEnvTokens(block.vars)) {
+          if (!optionKeys.has(token)) {
+            ctx.addIssue({
+              code: z2.ZodIssueCode.custom,
+              path: ["feature", "workspaceEnv", i, "vars"],
+              message: `workspaceEnv template references '\${${token}}', which is not a declared option`
+            });
+          }
+        }
+      });
       if (data.presets) {
         if (data.category !== "feature") {
           ctx.addIssue({
@@ -2845,7 +2884,8 @@ function resolveFeatures(opts) {
       devcontainerKey: entry2.feature,
       options,
       persistentHomePaths: [],
-      persistentHomeFiles: []
+      persistentHomeFiles: [],
+      workspaceEnv: []
     });
   }
   const aptPackages = [
@@ -2859,7 +2899,8 @@ function resolveFeatures(opts) {
       devcontainerKey: "ghcr.io/devcontainers-contrib/features/apt-packages:1",
       options: { packages: aptPackages.join(",") },
       persistentHomePaths: [],
-      persistentHomeFiles: []
+      persistentHomeFiles: [],
+      workspaceEnv: []
     });
   }
   if (opts.features) {
@@ -2869,6 +2910,7 @@ function resolveFeatures(opts) {
         const name = match.name;
         const descriptor = featureDescriptor(name);
         const { paths, files } = descriptorPersistentHome(descriptor);
+        const workspaceEnv = descriptor?.feature?.workspaceEnv ?? [];
         const sourceRoot = featuresSourceRoot();
         const localSourceDir = sourceRoot ? path10.join(sourceRoot, name) : null;
         if (descriptor && localSourceDir && existsSync7(localSourceDir)) {
@@ -2879,7 +2921,8 @@ function resolveFeatures(opts) {
             localName: name,
             generatedManifest: descriptorToFeatureManifest(descriptor),
             persistentHomePaths: paths,
-            persistentHomeFiles: files
+            persistentHomeFiles: files,
+            workspaceEnv
           });
           continue;
         }
@@ -2887,7 +2930,8 @@ function resolveFeatures(opts) {
           devcontainerKey: rawRef,
           options,
           persistentHomePaths: paths,
-          persistentHomeFiles: files
+          persistentHomeFiles: files,
+          workspaceEnv
         });
         continue;
       }
@@ -2895,7 +2939,8 @@ function resolveFeatures(opts) {
         devcontainerKey: rawRef,
         options,
         persistentHomePaths: [],
-        persistentHomeFiles: []
+        persistentHomeFiles: [],
+        workspaceEnv: []
       });
     }
   }
@@ -2915,6 +2960,33 @@ function descriptorPersistentHome(descriptor) {
     files: filterFileEntries(descriptor?.feature?.persistentHomeFiles)
   };
 }
+function isOptionEnabled(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") return value !== 0;
+  if (typeof value === "string") return value !== "" && value !== "false";
+  return false;
+}
+function featureWorkspaceEnv(features) {
+  const env = {};
+  for (const f of features) {
+    for (const block of f.workspaceEnv) {
+      if (block.whenOption !== void 0 && !isOptionEnabled(f.options[block.whenOption])) {
+        continue;
+      }
+      for (const [name, template] of Object.entries(block.vars)) {
+        const value = template.replace(
+          /\$\{([A-Za-z0-9_]+)\}/g,
+          (_, token) => {
+            const v = f.options[token];
+            return v === void 0 || v === null ? "" : String(v);
+          }
+        );
+        if (value !== "") env[name] = value;
+      }
+    }
+  }
+  return env;
+}
 function filterSubpaths(raw) {
   if (!Array.isArray(raw)) return [];
   return raw.filter(
@@ -3034,6 +3106,8 @@ function buildDevcontainerJson(opts, dockerMode = "rootful") {
     }
   } : void 0;
   const sshPostStart = runtimeSupportsSshAttach(opts.runtimeVersion) ? { postStartCommand: "sudo /usr/local/bin/monoceros-sshd-up.sh" } : {};
+  const workspaceEnv = featureWorkspaceEnv(resolvedFeatures);
+  const containerEnvField = Object.keys(workspaceEnv).length > 0 ? { containerEnv: workspaceEnv } : void 0;
   if (needsCompose(opts)) {
     return {
       name: opts.name,
@@ -3074,6 +3148,7 @@ function buildDevcontainerJson(opts, dockerMode = "rootful") {
     forwardPorts: ports,
     postCreateCommand: ".devcontainer/post-create.sh",
     ...sshPostStart,
+    ...containerEnvField ?? {},
     ...featuresField ?? {},
     ...customizationsField ?? {}
   };
@@ -3123,7 +3198,10 @@ function buildComposeYaml(opts, dockerMode = "rootful") {
   for (const v of ideVolumes) {
     lines.push(`      - ${v.volume}:${v.target}`);
   }
-  const wsEnv = serviceConnectionEnv(opts.services);
+  const wsEnv = {
+    ...serviceConnectionEnv(opts.services),
+    ...featureWorkspaceEnv(resolvedFeatures)
+  };
   const wsEnvKeys = Object.keys(wsEnv);
   if (wsEnvKeys.length > 0) {
     lines.push("    environment:");
@@ -3812,26 +3890,39 @@ function addInstallUrlToDoc(doc, url) {
   seq.add(url);
   return true;
 }
-function addFeatureToDoc(doc, ref, options = {}, displayName) {
+function addFeatureToDoc(doc, ref, options = {}, opts = {}) {
   const seq = ensureSeq(doc, "features");
-  const label = displayName ?? ref;
+  const label = opts.displayName ?? ref;
   const summary = loadFeatureManifestSummary(ref);
-  const hints = featureOptionHints(summary, ref, Object.keys(options));
-  const mergedOptions = { ...options };
-  for (const h of hints) mergedOptions[h.key] = h.placeholder;
+  const withHints = (o) => {
+    const out = { ...o };
+    for (const h of featureOptionHints(summary, ref, Object.keys(out))) {
+      out[h.key] = h.placeholder;
+    }
+    return out;
+  };
   for (const item of seq.items) {
     if (!isMap2(item)) continue;
     const itemRef = item.get("ref");
     if (itemRef !== ref) continue;
     const itemJs = item.toJS(doc);
     const existingJs = itemJs.options ?? {};
-    if (JSON.stringify(existingJs) === JSON.stringify(mergedOptions)) {
+    if (opts.isPreset) {
+      const merged = withHints(mergeFeatureOptions(existingJs, options));
+      if (JSON.stringify(existingJs) === JSON.stringify(merged)) {
+        return false;
+      }
+      item.set("options", merged);
+      return true;
+    }
+    if (JSON.stringify(existingJs) === JSON.stringify(withHints(options))) {
       return false;
     }
     throw new Error(
       `Feature ${label} is already configured with different options. Remove it first (\`monoceros remove-feature ${label}\`) before re-adding.`
     );
   }
+  const mergedOptions = withHints(options);
   const entry2 = new YAMLMap2();
   entry2.set("ref", ref);
   if (Object.keys(mergedOptions).length > 0) {
@@ -3993,6 +4084,7 @@ var init_yml = __esm({
     "use strict";
     init_scaffold();
     init_manifest();
+    init_components();
     init_feature_doc();
     init_env_file();
     GIT_USER_HEADER_COMMENT = [
@@ -4340,7 +4432,10 @@ async function runAddFeature(input) {
   };
   const result = await mutate(
     input,
-    (doc) => addFeatureToDoc(doc, resolved.ref, merged, raw)
+    (doc) => addFeatureToDoc(doc, resolved.ref, merged, {
+      isPreset: resolved.isPreset,
+      displayName: raw
+    })
   );
   if (result.status === "updated") {
     const summary = loadFeatureManifestSummary(resolved.ref);
@@ -4368,7 +4463,7 @@ async function runAddFeature(input) {
 }
 async function resolveFeatureRefOrShortname(input) {
   if (REGEX.featureRef.test(input)) {
-    return { ref: input, defaultOptions: {} };
+    return { ref: input, defaultOptions: {}, isPreset: false };
   }
   const catalog = await loadComponentCatalog();
   const component = catalog.get(input);
@@ -4400,7 +4495,8 @@ async function resolveFeatureRefOrShortname(input) {
   const [first] = features;
   return {
     ref: first.ref,
-    defaultOptions: { ...first.options ?? {} }
+    defaultOptions: { ...first.options ?? {} },
+    isPreset: input.includes("/")
   };
 }
 function runRemoveLanguage(input) {
@@ -4683,7 +4779,7 @@ var init_add_feature = __esm({
       meta: {
         name: "add-feature",
         group: "edit",
-        description: "Add a devcontainer feature by ref to the container config. Options follow `--` as `key=value` pairs. Idempotent (same ref + same options is a no-op). Adding the same ref with different options is an error."
+        description: "Add a devcontainer feature by ref to the container config. Options follow `--` as `key=value` pairs. Adding a sub-tool selector (e.g. `atlassian/forge`) to an already-present feature merges it in additively, keeping the other sub-tools on. A plain feature already present with different options is an error (remove + re-add to change it)."
       },
       args: {
         name: {
@@ -4846,7 +4942,7 @@ var init_add_repo = __esm({
         },
         provider: {
           type: "string",
-          description: "Git provider for credential-helper guidance: github | gitlab | bitbucket. Required when the URL host is not github.com, gitlab.com, or bitbucket.org \u2014 Monoceros uses this to suggest the right CLI (gh / glab / Atlassian token) on missing credentials."
+          description: "Git provider for credential-helper guidance: github | gitlab | bitbucket | gitea. Required when the URL host is not github.com, gitlab.com, or bitbucket.org \u2014 Monoceros uses this to suggest the right auth (gh / glab / a provider token) on missing credentials."
         },
         yes: {
           type: "boolean",
@@ -5400,7 +5496,9 @@ async function setupWindowsBridge(name, hostAlias, privateKey, deps, logger) {
   }
   const monoDir = path13.join(profile.homeWsl, ".ssh", "monoceros");
   await fs10.mkdir(monoDir, { recursive: true });
-  await fs10.copyFile(privateKey, path13.join(monoDir, name));
+  const keyDst = path13.join(monoDir, name);
+  await fs10.rm(keyDst, { force: true });
+  await fs10.copyFile(privateKey, keyDst);
   const keyWin = `${profile.homeWin}\\.ssh\\monoceros\\${name}`;
   await upsertMarkedBlock(
     path13.join(profile.homeWsl, ".ssh", "config"),
@@ -8082,7 +8180,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "1.29.1" : "dev";
+    CLI_VERSION = true ? "1.30.0" : "dev";
   }
 });