@moretea-labs/forge 1.5.0-rc.1

package/src/cli/mcp/paths.ts

@@ -0,0 +1,134 @@
+import { existsSync, lstatSync, realpathSync } from 'fs';
+import { dirname, isAbsolute, resolve, sep } from 'path';
+import type { McpPathDecision, McpPathIntent, McpPolicy } from './types';
+
+function toPosixPath(value: string): string {
+  return value.split(sep).join('/').replace(/\\+/g, '/');
+}
+
+export function normalizeMcpRelativePath(input: string): McpPathDecision {
+  const trimmed = input.trim();
+  if (trimmed.length === 0) return { ok: false, reason: 'path is required' };
+  if (isAbsolute(trimmed)) return { ok: false, reason: 'absolute paths are not allowed' };
+  const normalized = toPosixPath(trimmed).replace(/^\.\/+/, '');
+  if (normalized === '' || normalized === '.') return { ok: false, reason: 'path must target a file' };
+  if (normalized.split('/').some((part) => part === '..')) {
+    return { ok: false, reason: 'path traversal is not allowed' };
+  }
+  return { ok: true, relativePath: normalized };
+}
+
+function escapeRegex(value: string): string {
+  return value.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+}
+
+export function globMatches(pattern: string, relativePath: string): boolean {
+  const normalizedPattern = toPosixPath(pattern.trim()).replace(/^\.\/+/, '').replace(/\/{2,}/g, '/');
+  const normalizedPath = toPosixPath(relativePath).replace(/^\.\/+/, '').replace(/\/{2,}/g, '/').replace(/\/$/, '');
+  if (normalizedPattern === '**' || normalizedPattern === '**/*') return true;
+  let expression = '';
+  for (let index = 0; index < normalizedPattern.length; index += 1) {
+    const char = normalizedPattern[index];
+    const next = normalizedPattern[index + 1];
+    if (char === '*' && next === '*') {
+      const after = normalizedPattern[index + 2];
+      if (after === '/') {
+        // Globstar directory prefixes match zero or more path segments.
+        expression += '(?:.*/)?';
+        index += 2;
+      } else {
+        expression += '.*';
+        index += 1;
+      }
+    } else if (char === '*') {
+      expression += '[^/]*';
+    } else if (char === '?') {
+      expression += '[^/]';
+    } else if (char === '{') {
+      const close = normalizedPattern.indexOf('}', index + 1);
+      if (close > index) {
+        const alternatives = normalizedPattern.slice(index + 1, close).split(',').map((part) => escapeRegex(part));
+        expression += `(?:${alternatives.join('|')})`;
+        index = close;
+      } else {
+        expression += '\\{';
+      }
+    } else {
+      expression += escapeRegex(char);
+    }
+  }
+  return new RegExp(`^${expression}/?$`).test(normalizedPath);
+}
+function anyGlobMatches(patterns: string[], relativePath: string): boolean {
+  return patterns.some((pattern) => globMatches(pattern, relativePath));
+}
+
+function denyGlobMatches(pattern: string, relativePath: string): boolean {
+  if (globMatches(pattern, relativePath)) return true;
+  if (!pattern.includes('/')) {
+    return relativePath.split('/').some((segment) => globMatches(pattern, segment));
+  }
+  if (!pattern.startsWith('**/')) {
+    return globMatches(`**/${pattern}`, relativePath);
+  }
+  return false;
+}
+
+function anyDenyGlobMatches(patterns: string[], relativePath: string): boolean {
+  return patterns.some((pattern) => denyGlobMatches(pattern, relativePath));
+}
+
+function realpathInside(child: string, parent: string): boolean {
+  const normalizedParent = parent.endsWith(sep) ? parent : `${parent}${sep}`;
+  return child === parent || child.startsWith(normalizedParent);
+}
+
+function nearestExistingPath(path: string): string | undefined {
+  let current = path;
+  while (!existsSync(current)) {
+    const parent = dirname(current);
+    if (parent === current) return undefined;
+    current = parent;
+  }
+  return current;
+}
+
+export function resolveMcpPath(repoRoot: string, inputPath: string, policy: McpPolicy, intent: McpPathIntent): McpPathDecision {
+  const normalized = normalizeMcpRelativePath(inputPath);
+  if (!normalized.ok || !normalized.relativePath) return normalized;
+
+  const relativePath = normalized.relativePath;
+  if (anyDenyGlobMatches(policy.denyGlobs, relativePath)) {
+    return { ok: false, relativePath, reason: `path is denied by MCP policy: ${relativePath}` };
+  }
+
+  const allowGlobs = intent === 'read' ? policy.readGlobs : policy.writeGlobs;
+  if (!anyGlobMatches(allowGlobs, relativePath)) {
+    return { ok: false, relativePath, reason: `path is not allowed for ${intent}: ${relativePath}` };
+  }
+
+  const repoRealpath = realpathSync(repoRoot);
+  const absolutePath = resolve(repoRealpath, relativePath);
+  if (intent === 'read' && !existsSync(absolutePath)) {
+    return { ok: false, relativePath, reason: `path does not exist: ${relativePath}` };
+  }
+
+  const existingPath = existsSync(absolutePath) ? absolutePath : nearestExistingPath(dirname(absolutePath));
+  if (!existingPath) {
+    return { ok: false, relativePath, reason: `path cannot be resolved: ${relativePath}` };
+  }
+
+  const realExistingPath = realpathSync(existingPath);
+  if (!realpathInside(realExistingPath, repoRealpath)) {
+    return { ok: false, relativePath, reason: `path escapes repository root: ${relativePath}` };
+  }
+
+  if (existsSync(absolutePath) && lstatSync(absolutePath).isSymbolicLink()) {
+    const realTarget = realpathSync(absolutePath);
+    if (!realpathInside(realTarget, repoRealpath)) {
+      return { ok: false, relativePath, reason: `symlink escapes repository root: ${relativePath}` };
+    }
+  }
+
+  return { ok: true, relativePath, absolutePath };
+}

package/src/cli/mcp/policy.ts

@@ -0,0 +1,230 @@
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { DEFAULT_AGENT_TIMEOUT_MS, defaultLocalAgentRunners, MAX_AGENT_TIMEOUT_MS } from '../controller/runtime-config';
+import type { McpAgentRunnerName, McpPolicy, McpProfileName } from './types';
+
+const COMMON_DENY_GLOBS = [
+  '.env',
+  '.env.*',
+  '*.pem',
+  '*.key',
+  '*.p12',
+  '*.pfx',
+  '.ssh/**',
+  '.git/**',
+  'node_modules/**',
+  'dist/**',
+  'build/**',
+  'coverage/**',
+  'secrets/**',
+  'credentials/**',
+  'private/**',
+  '.cache/**',
+  '.DS_Store',
+];
+
+export const PLANNER_READ_GLOBS = [
+  'AGENTS.md',
+  'CLAUDE.md',
+  'SKILL.md',
+  'docs/spec.md',
+  'docs/reference-configs/**',
+  'plans/**',
+  'tasks/current.md',
+  'tasks/contracts/**',
+  'tasks/reviews/**',
+  'tasks/notes/**',
+  '.ai/context/**',
+  '.ai/harness/handoff/**',
+  '.ai/harness/checks/**',
+];
+
+export const PLANNER_WRITE_GLOBS = [
+  'plans/prds/**',
+  'plans/sprints/**',
+  'plans/plan-*.md',
+  '.ai/harness/handoff/codex-goal.md',
+  '.ai/harness/handoff/chatgpt-plan.md',
+];
+
+export interface McpPolicyOptions {
+  devAgentRunner?: boolean;
+  allowedAgents?: McpAgentRunnerName[];
+  runnerTimeoutMs?: number;
+  runnerMaxTimeoutMs?: number;
+  repoRoot?: string;
+}
+
+interface McpPolicyOverrideProfile {
+  readGlobs?: string[];
+  writeGlobs?: string[];
+  denyGlobs?: string[];
+  appendReadGlobs?: string[];
+  appendWriteGlobs?: string[];
+  appendDenyGlobs?: string[];
+  maxFileBytes?: number;
+}
+
+interface McpPolicyOverrideFile {
+  profiles?: Partial<Record<McpProfileName, McpPolicyOverrideProfile>>;
+}
+
+function executionPolicy(overrides: Partial<McpPolicy['execution']> = {}): McpPolicy['execution'] {
+  return {
+    fixedWorkflowCheck: false,
+    codexRunner: false,
+    agentRunner: false,
+    allowedAgents: [],
+    runnerTimeoutMs: DEFAULT_AGENT_TIMEOUT_MS,
+    runnerMaxTimeoutMs: MAX_AGENT_TIMEOUT_MS,
+    ...overrides,
+  };
+}
+
+function uniqueStrings(values: string[]): string[] {
+  return Array.from(new Set(values.filter((value) => value.trim().length > 0)));
+}
+
+function parseStringArray(value: unknown): string[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const normalized = value.map((entry) => String(entry).trim()).filter((entry) => entry.length > 0);
+  return normalized;
+}
+
+function loadMcpPolicyOverrides(repoRoot?: string): McpPolicyOverrideFile | undefined {
+  if (!repoRoot) return undefined;
+  const path = join(repoRoot, '.forge', 'mcp.policy.json');
+  if (!existsSync(path)) return undefined;
+  const raw = JSON.parse(readFileSync(path, 'utf-8')) as Record<string, unknown>;
+  const profilesRaw = raw.profiles;
+  if (!profilesRaw || typeof profilesRaw !== 'object' || Array.isArray(profilesRaw)) return undefined;
+  const profiles: Partial<Record<McpProfileName, McpPolicyOverrideProfile>> = {};
+  for (const profile of ['planner', 'executor', 'orchestrator', 'controller'] as const) {
+    const entry = (profilesRaw as Record<string, unknown>)[profile];
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) continue;
+    const record = entry as Record<string, unknown>;
+    const maxFileBytes = typeof record.maxFileBytes === 'number' && Number.isFinite(record.maxFileBytes)
+      ? Math.trunc(record.maxFileBytes)
+      : undefined;
+    profiles[profile] = {
+      readGlobs: parseStringArray(record.readGlobs),
+      writeGlobs: parseStringArray(record.writeGlobs),
+      denyGlobs: parseStringArray(record.denyGlobs),
+      appendReadGlobs: parseStringArray(record.appendReadGlobs),
+      appendWriteGlobs: parseStringArray(record.appendWriteGlobs),
+      appendDenyGlobs: parseStringArray(record.appendDenyGlobs),
+      maxFileBytes,
+    };
+  }
+  return { profiles };
+}
+
+function applyPolicyOverrides(
+  base: McpPolicy,
+  profile: McpProfileName,
+  repoRoot?: string,
+): McpPolicy {
+  const override = loadMcpPolicyOverrides(repoRoot)?.profiles?.[profile];
+  if (!override) return base;
+  return {
+    ...base,
+    readGlobs: uniqueStrings([...(override.readGlobs ?? base.readGlobs), ...(override.appendReadGlobs ?? [])]),
+    writeGlobs: uniqueStrings([...(override.writeGlobs ?? base.writeGlobs), ...(override.appendWriteGlobs ?? [])]),
+    denyGlobs: uniqueStrings([...COMMON_DENY_GLOBS, ...(override.denyGlobs ?? base.denyGlobs), ...(override.appendDenyGlobs ?? [])]),
+    maxFileBytes: override.maxFileBytes ?? base.maxFileBytes,
+  };
+}
+
+export function getMcpPolicy(profile: McpProfileName, opts: McpPolicyOptions = {}): McpPolicy {
+  if (profile === 'planner') {
+    return applyPolicyOverrides({
+      profile,
+      readGlobs: PLANNER_READ_GLOBS,
+      writeGlobs: PLANNER_WRITE_GLOBS,
+      denyGlobs: [
+        ...COMMON_DENY_GLOBS,
+        'src/**',
+        'app/**',
+        'packages/**',
+        'package.json',
+        'bun.lock',
+        'package-lock.json',
+        'pnpm-lock.yaml',
+        'yarn.lock',
+        '.github/workflows/**',
+      ],
+      maxFileBytes: 512 * 1024,
+      execution: executionPolicy({
+        fixedWorkflowCheck: true,
+      }),
+    }, profile, opts.repoRoot);
+  }
+
+  if (profile === 'executor') {
+    return applyPolicyOverrides({
+      profile,
+      readGlobs: ['plans/**', 'tasks/**', 'docs/spec.md', '.ai/context/**', '.ai/harness/**'],
+      writeGlobs: ['tasks/reviews/**', '.ai/harness/checks/**', '.ai/harness/handoff/**'],
+      denyGlobs: COMMON_DENY_GLOBS,
+      maxFileBytes: 512 * 1024,
+      execution: executionPolicy({
+        fixedWorkflowCheck: true,
+      }),
+    }, profile, opts.repoRoot);
+  }
+
+  if (profile === 'controller') {
+    const devRunner = opts.devAgentRunner === true;
+    return applyPolicyOverrides({
+      profile,
+      readGlobs: ['**'],
+      writeGlobs: ['**'],
+      denyGlobs: [
+        ...COMMON_DENY_GLOBS,
+        '.forge/**',
+        '.ai/harness/security/**',
+        '.codex/**',
+        '.claude/**',
+        'package-lock.json',
+        'pnpm-lock.yaml',
+        'yarn.lock',
+        'bun.lock',
+        '.github/workflows/**',
+      ],
+      maxFileBytes: 2 * 1024 * 1024,
+      execution: executionPolicy({
+        fixedWorkflowCheck: true,
+        codexRunner: devRunner,
+        agentRunner: devRunner,
+        allowedAgents: devRunner ? (opts.allowedAgents?.length ? opts.allowedAgents : defaultLocalAgentRunners()) : [],
+        runnerTimeoutMs: opts.runnerTimeoutMs ?? DEFAULT_AGENT_TIMEOUT_MS,
+        runnerMaxTimeoutMs: opts.runnerMaxTimeoutMs ?? MAX_AGENT_TIMEOUT_MS,
+      }),
+    }, profile, opts.repoRoot);
+  }
+
+  if (profile === 'orchestrator') {
+    const devRunner = opts.devAgentRunner === true;
+    return applyPolicyOverrides({
+      profile,
+      readGlobs: devRunner ? ['.ai/harness/handoff/codex-goal.md'] : [],
+      writeGlobs: [],
+      denyGlobs: devRunner ? COMMON_DENY_GLOBS : ['**'],
+      maxFileBytes: devRunner ? 512 * 1024 : 0,
+      execution: executionPolicy({
+        codexRunner: devRunner,
+        agentRunner: devRunner,
+        allowedAgents: devRunner ? (opts.allowedAgents?.length ? opts.allowedAgents : defaultLocalAgentRunners()) : [],
+        runnerTimeoutMs: opts.runnerTimeoutMs ?? DEFAULT_AGENT_TIMEOUT_MS,
+        runnerMaxTimeoutMs: opts.runnerMaxTimeoutMs ?? MAX_AGENT_TIMEOUT_MS,
+      }),
+    }, profile, opts.repoRoot);
+  }
+
+  throw new Error(`unknown MCP profile: ${String(profile)}`);
+}
+
+export function parseMcpProfile(value: string): McpProfileName {
+  if (value === 'planner' || value === 'executor' || value === 'orchestrator' || value === 'controller') return value;
+  throw new Error(`invalid MCP profile "${value}" (expected: planner, executor, orchestrator, controller)`);
+}

package/src/cli/mcp/proxy-env.ts

@@ -0,0 +1,62 @@
+/**
+ * Local HTTP/SOCKS proxies must not intercept Tailscale Funnel / MagicDNS or
+ * loopback controller surfaces. Bun fetch does not honor `*.ts.net` wildcards;
+ * leading-dot forms (`.ts.net`) are required for reliable bypass.
+ */
+export const DIRECT_NETWORK_NO_PROXY_ENTRIES = [
+  '127.0.0.1',
+  'localhost',
+  '::1',
+  '.local',
+  '.ts.net',
+  '*.ts.net',
+  '.tailscale.com',
+  '*.tailscale.com',
+  '100.64.0.0/10',
+] as const;
+
+export function mergeNoProxy(...parts: Array<string | undefined | null>): string {
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const part of parts) {
+    if (!part) continue;
+    for (const entry of part.split(',').map((item) => item.trim()).filter(Boolean)) {
+      const key = entry.toLowerCase();
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push(entry);
+    }
+  }
+  return out.join(',');
+}
+
+/**
+ * Return a copy of `env` with NO_PROXY/no_proxy extended so local MCP, Tailscale
+ * Funnel, and MagicDNS health probes never go through a system HTTP proxy.
+ */
+export function withDirectNetworkProxyBypass(
+  env: NodeJS.ProcessEnv = process.env,
+): NodeJS.ProcessEnv {
+  const merged = mergeNoProxy(
+    env.NO_PROXY,
+    env.no_proxy,
+    ...DIRECT_NETWORK_NO_PROXY_ENTRIES,
+  );
+  return {
+    ...env,
+    NO_PROXY: merged,
+    no_proxy: merged,
+  };
+}
+
+/**
+ * Mutate the current process env in place (keepalive/supervisor long-running paths).
+ */
+export function applyDirectNetworkProxyBypass(
+  env: NodeJS.ProcessEnv = process.env,
+): NodeJS.ProcessEnv {
+  const next = withDirectNetworkProxyBypass(env);
+  env.NO_PROXY = next.NO_PROXY;
+  env.no_proxy = next.no_proxy;
+  return env;
+}

package/src/cli/mcp/readiness-projection.ts

@@ -0,0 +1,24 @@
+import type { TaskLedgerProjection } from '../controller/task-ledger';
+import {
+  reconcileProjectionWithTaskLedger,
+  type RepositoryRuntimeProjectionSnapshot,
+} from '../../runtime/projections/materialized-view';
+
+/**
+ * Readiness must stay independent from the legacy Issue/Task board after the
+ * Requirement portfolio cutover. The persisted runtime projection remains the
+ * readiness source; Task Ledger comparison is optional diagnostic evidence.
+ */
+export function reconcileReadinessProjectionSource(
+  snapshot: RepositoryRuntimeProjectionSnapshot,
+  ledger?: TaskLedgerProjection,
+) {
+  if (!ledger) {
+    return {
+      status: 'unknown' as const,
+      projectionRunningWorkers: Math.max(0, snapshot.projection.runningWorkers),
+      detail: 'legacy task ledger retired; readiness uses persisted projection state',
+    };
+  }
+  return reconcileProjectionWithTaskLedger(snapshot, ledger);
+}

package/src/cli/mcp/redaction.ts

@@ -0,0 +1,21 @@
+import { redactSensitiveText } from '../../runtime/evidence/sensitive-output';
+
+export interface McpRedaction {
+  type: string;
+  count: number;
+}
+
+export interface McpRedactionResult {
+  text: string;
+  redactions: McpRedaction[];
+}
+
+/**
+ * MCP is a presentation boundary, not a separate secret-detection engine.
+ * Reuse the same bounded patterns as Process Runtime persistence so a value
+ * cannot be safe in one tool surface and exposed in another.
+ */
+export function redactMcpText(input: string): McpRedactionResult {
+  const result = redactSensitiveText(input);
+  return { text: result.text, redactions: result.redactions };
+}

package/src/cli/mcp/repo.ts

@@ -0,0 +1,24 @@
+import { existsSync } from 'fs';
+import { join, resolve } from 'path';
+import { runProcess } from '../../effects/process-runner';
+
+export function resolveMcpRepoRoot(repo = '.'): string {
+  const candidate = resolve(repo);
+  const result = runProcess('git', ['-C', candidate, 'rev-parse', '--show-toplevel'], {
+    timeoutMs: 5000,
+    stdio: 'pipe',
+  });
+  return result.status === 0 && result.stdout.trim() ? result.stdout.trim() : candidate;
+}
+
+export function isForgeAdopted(repoRoot: string): boolean {
+  return existsSync(join(repoRoot, '.ai', 'harness', 'policy.json')) || existsSync(join(repoRoot, 'tasks', 'current.md'));
+}
+
+export function currentGitBranch(repoRoot: string): string | null {
+  const result = runProcess('git', ['-C', repoRoot, 'branch', '--show-current'], {
+    timeoutMs: 5000,
+    stdio: 'pipe',
+  });
+  return result.status === 0 && result.stdout.trim() ? result.stdout.trim() : null;
+}