@moretea-labs/forge 1.5.0-rc.1

package/scripts/check-public-docs.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+required=(
+  README.md README.en.md README.zh-CN.md
+  CHANGELOG.md CONTRIBUTING.md SECURITY.md SUPPORT.md CODE_OF_CONDUCT.md
+  .github/PULL_REQUEST_TEMPLATE.md
+  .github/ISSUE_TEMPLATE/config.yml
+  .github/ISSUE_TEMPLATE/bug_report.yml
+  .github/ISSUE_TEMPLATE/feature_request.yml
+  .github/ISSUE_TEMPLATE/documentation.yml
+  .github/ISSUE_TEMPLATE/support.yml
+  .github/workflows/release.yml
+  docs/README.md
+  docs/tutorials/README.md docs/tutorials/README.zh-CN.md
+  docs/tutorials/01-install-and-start.md docs/tutorials/01-install-and-start.zh-CN.md
+  docs/tutorials/02-connect-chatgpt.md docs/tutorials/02-connect-chatgpt.zh-CN.md
+  docs/tutorials/03-first-repository-task.md docs/tutorials/03-first-repository-task.zh-CN.md
+  docs/operations/releasing.md docs/operations/releasing.zh-CN.md
+  docs/operations/github-repository.md docs/operations/homebrew.md
+  docs/operations/platform-support.md docs/operations/platform-support.zh-CN.md
+  docs/operations/features.md docs/operations/features.zh-CN.md
+  docs/operations/troubleshooting.md docs/operations/troubleshooting.zh-CN.md
+  docs/wiki/Home.md docs/wiki/Architecture.md docs/wiki/Operations.md
+)
+for path in "${required[@]}"; do
+  [[ -f "$path" ]] || { echo "[public-docs] missing: $path" >&2; exit 1; }
+done
+
+if git grep -n -E 'controller_capabilities and project_snapshot|Start repository work with controller_capabilities|20260612-legacy-research-notes|github[.]com/greyson[O]uyang/' -- README*.md docs ':!docs/architecture/history/**' ':!docs/architecture/snapshots/**' >/dev/null; then
+  echo "[public-docs] stale onboarding, personal repository URL, or removed legacy reference found" >&2
+  exit 1
+fi
+
+for path in README.md README.zh-CN.md; do
+  lines="$(wc -l < "$path" | tr -d ' ')"
+  [[ "$lines" -le 150 ]] || { echo "[public-docs] primary README is too long: $path ($lines lines)" >&2; exit 1; }
+  if [[ "$path" == "README.md" ]]; then
+    grep -q 'docs/images/forge-banner.svg' "$path" || { echo "[public-docs] missing English Forge banner: $path" >&2; exit 1; }
+  else
+    grep -q 'docs/images/forge-banner-cn.svg' "$path" || { echo "[public-docs] missing Chinese Forge banner: $path" >&2; exit 1; }
+  fi
+  grep -q 'Node.js 20.10' "$path" || { echo "[public-docs] missing Node baseline: $path" >&2; exit 1; }
+  grep -q 'npm install -g \.' "$path" || { echo "[public-docs] missing verified source install: $path" >&2; exit 1; }
+  grep -q '@moretea-labs/forge@next' "$path" || { echo "[public-docs] missing upcoming RC install reference: $path" >&2; exit 1; }
+  for link in SUPPORT.md SECURITY.md CONTRIBUTING.md CHANGELOG.md docs/wiki/Home.md; do
+    grep -q "$link" "$path" || { echo "[public-docs] missing $link link: $path" >&2; exit 1; }
+  done
+  if grep -qE '^```mermaid|Repo Actor|Global Scheduler|Evidence Plane|Controller Home|schema `10`|WorkContract|Process Record|resource claims' "$path"; then
+    echo "[public-docs] architecture internals belong in docs/Wiki, not $path" >&2
+    exit 1
+  fi
+done
+
+grep -q 'docs/tutorials/01-install-and-start.md' README.md || { echo "[public-docs] English README missing tutorial link" >&2; exit 1; }
+grep -q 'docs/tutorials/01-install-and-start.zh-CN.md' README.zh-CN.md || { echo "[public-docs] Chinese README missing tutorial link" >&2; exit 1; }
+grep -q 'npm `next`' README.md || { echo "[public-docs] English README must state the RC npm channel" >&2; exit 1; }
+grep -q 'npm 使用 `next`' README.zh-CN.md || { echo "[public-docs] Chinese README must state the RC npm channel" >&2; exit 1; }
+grep -q 'See \[README.md\](README.md)' README.en.md || { echo "[public-docs] README.en.md must point to the maintained English README" >&2; exit 1; }
+
+for path in docs/tutorials/01-install-and-start.md docs/tutorials/01-install-and-start.zh-CN.md; do
+  grep -q 'Node.js 20.10' "$path" || { echo "[public-docs] missing Node baseline: $path" >&2; exit 1; }
+  grep -q 'npm install -g \.' "$path" || { echo "[public-docs] missing source install: $path" >&2; exit 1; }
+  grep -q '@moretea-labs/forge@next' "$path" || { echo "[public-docs] missing upcoming package command: $path" >&2; exit 1; }
+done
+
+for path in docs/operations/releasing.md docs/operations/releasing.zh-CN.md; do
+  grep -q '@moretea-labs/forge' "$path" || { echo "[public-docs] missing package identity: $path" >&2; exit 1; }
+  grep -q 'forge-hook' "$path" || { echo "[public-docs] missing Forge hook identity: $path" >&2; exit 1; }
+  if grep -qE '(^|[^A-Za-z0-9_-])(matea|repo-harness)([^A-Za-z0-9_-]|$)' "$path"; then
+    echo "[public-docs] forbidden legacy product identity remains: $path" >&2
+    exit 1
+  fi
+  grep -q 'package.json' "$path" || { echo "[public-docs] release version must be derived from package.json: $path" >&2; exit 1; }
+  grep -q 'next' "$path" || { echo "[public-docs] missing RC channel: $path" >&2; exit 1; }
+  grep -q 'latest' "$path" || { echo "[public-docs] missing stable channel: $path" >&2; exit 1; }
+  grep -q 'Bun' "$path" || { echo "[public-docs] missing Bun distribution role: $path" >&2; exit 1; }
+  grep -q 'Homebrew' "$path" || { echo "[public-docs] missing Homebrew distribution role: $path" >&2; exit 1; }
+done
+
+grep -q 'npm.*primary package registry' docs/operations/releasing.md || { echo "[public-docs] npm primary registry role is unclear" >&2; exit 1; }
+grep -q 'GitHub Releases' docs/operations/releasing.md || { echo "[public-docs] GitHub Release role is unclear" >&2; exit 1; }
+grep -q 'publishConfig.provenance' docs/versioning.md || { echo "[public-docs] provenance contract is undocumented" >&2; exit 1; }
+grep -q 'after the first stable release' docs/operations/homebrew.md || { echo "[public-docs] Homebrew stable-only gate is unclear" >&2; exit 1; }
+grep -q 'WSL2' docs/operations/platform-support.md || { echo "[public-docs] platform matrix missing WSL2" >&2; exit 1; }
+grep -q 'Windows 原生' docs/operations/platform-support.zh-CN.md || { echo "[public-docs] Chinese platform matrix missing native Windows scope" >&2; exit 1; }
+grep -q 'rh_status' docs/tutorials/02-connect-chatgpt.md || { echo "[public-docs] connector tutorial missing facade verification" >&2; exit 1; }
+
+grep -q '@moretea-labs/forge' install.sh || { echo "[public-docs] shell installer uses the wrong package identity" >&2; exit 1; }
+grep -q '@moretea-labs/forge' install.ps1 || { echo "[public-docs] PowerShell installer uses the wrong package identity" >&2; exit 1; }
+if grep -q 'PACKAGE_NAME="forge"' install.sh || grep -q '\$PackageName = "forge"' install.ps1; then
+  echo "[public-docs] installer regressed to the unscoped package" >&2
+  exit 1
+fi
+
+# Package identity, publish metadata, required package files, and the Forge-only
+# bin surface are owned by one canonical checker. Reuse it here instead of an
+# inline `node -` stdin program so this gate also works when `node` is provided
+# by a Bun-compatible shim that does not interpret `-` as stdin JavaScript.
+node scripts/check-package-identity.mjs
+
+echo "[public-docs] OK"

package/scripts/check-public-release-surface.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+echo "[release-surface] typecheck"
+bun run check:type
+
+echo "[release-surface] focused tests"
+bun test --timeout 60000 \
+  tests/cli/local-bridge.test.ts \
+  tests/install-scripts.test.ts \
+  tests/readme-dx.test.ts
+
+echo "[release-surface] public export"
+bun run check:public-export
+
+echo "[release-surface] OK"

package/scripts/check-release-published.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+PACKAGE_NAME="$(bun -e 'const pkg = await Bun.file("package.json").json(); console.log(pkg.name)')"
+PACKAGE_VERSION="${1:-$(bun -e 'const pkg = await Bun.file("package.json").json(); console.log(pkg.version)')}"
+PACKAGE_DIST_TAG="${NPM_EXPECTED_DIST_TAG:-$(bun -e 'const pkg = await Bun.file("package.json").json(); console.log(pkg.publishConfig?.tag || (pkg.version.includes("-") ? "next" : "latest"))')}"
+NPM_RELEASE_REGISTRY="${NPM_RELEASE_REGISTRY:-https://registry.npmjs.org/}"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+echo "[release-published] package: ${PACKAGE_NAME}@${PACKAGE_VERSION}"
+echo "[release-published] registry: ${NPM_RELEASE_REGISTRY}"
+echo "[release-published] dist-tag: ${PACKAGE_DIST_TAG}"
+
+VIEW_JSON="$TMP_DIR/npm-view.json"
+TAGS_JSON="$TMP_DIR/npm-tags.json"
+PACK_JSON="$TMP_DIR/npm-pack.json"
+
+npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version dist.integrity dist.shasum dist.tarball --json --registry "$NPM_RELEASE_REGISTRY" >"$VIEW_JSON"
+npm view "$PACKAGE_NAME" dist-tags --json --registry "$NPM_RELEASE_REGISTRY" >"$TAGS_JSON"
+npm pack "${PACKAGE_NAME}@${PACKAGE_VERSION}" --json --pack-destination "$TMP_DIR" --registry "$NPM_RELEASE_REGISTRY" >"$PACK_JSON"
+
+bun - "$PACKAGE_NAME" "$PACKAGE_VERSION" "$PACKAGE_DIST_TAG" "$VIEW_JSON" "$TAGS_JSON" "$PACK_JSON" <<'JS_EOF'
+const [, , packageName, version, distTag, viewPath, tagsPath, packPath] = process.argv;
+const view = await Bun.file(viewPath).json();
+const tags = await Bun.file(tagsPath).json();
+const pack = await Bun.file(packPath).json();
+const packed = Array.isArray(pack) ? pack[0] : pack;
+
+function fail(message) {
+  console.error(`[release-published] ERROR: ${message}`);
+  process.exit(1);
+}
+
+function packPrefix(name) {
+  return name.replace(/^@/, "").replace(/\//g, "-");
+}
+
+if (view.version !== version) fail(`npm view returned version ${view.version}`);
+if (tags[distTag] !== version) fail(`${distTag} dist-tag is ${tags[distTag]}, expected ${version}`);
+if (!view["dist.integrity"] || !view["dist.shasum"] || !view["dist.tarball"]) {
+  fail("npm view response is missing dist integrity, shasum, or tarball");
+}
+if (!packed?.filename?.startsWith(`${packPrefix(packageName)}-${version}`)) {
+  fail(`npm pack returned unexpected filename ${packed?.filename}`);
+}
+if (packed.integrity !== view["dist.integrity"]) fail("packed tarball integrity does not match registry metadata");
+if (packed.shasum !== view["dist.shasum"]) fail("packed tarball shasum does not match registry metadata");
+JS_EOF
+
+git rev-parse -q --verify "refs/tags/v${PACKAGE_VERSION}" >/dev/null
+bun scripts/check-skill-version.ts --project . >/dev/null
+
+echo "[release-published] OK: registry, ${PACKAGE_DIST_TAG} dist-tag, tarball, tag, and local version files agree."

package/scripts/check-release-readiness.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Release-only checks. Main/type/focused evidence is owned by check:main.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+echo "[release-readiness] version, identity, and notices"
+node scripts/check-release-version.mjs
+node scripts/check-package-identity.mjs
+node scripts/check-third-party-notices.mjs
+
+echo "[release-readiness] focused release contracts"
+bun scripts/test-governance.ts affected \
+  tests/release/release-version.test.ts \
+  tests/release/package-release.test.ts \
+  tests/skill-version.test.ts
+
+echo "[release-readiness] public/package surfaces"
+bash scripts/check-public-docs.sh
+node scripts/check-platform-support.mjs
+bash scripts/check-open-source-tracked-surface.sh
+bun run check:public-export
+
+ARTIFACT_DIR="${FORGE_RELEASE_ARTIFACT_DIR:-$ROOT/.ai/harness/artifacts/release}"
+mkdir -p "$ARTIFACT_DIR"
+PACK_JSON="$ARTIFACT_DIR/pack.json"
+echo "[release-readiness] create one reusable tarball"
+npm pack --json --pack-destination "$ARTIFACT_DIR" >"$PACK_JSON"
+TARBALL="$(bun - "$PACK_JSON" <<'JS_EOF'
+const [, , path] = process.argv;
+const value = await Bun.file(path).json();
+const entry = Array.isArray(value) ? value[0] : value;
+if (!entry?.filename) throw new Error('npm pack did not report a filename');
+console.log(entry.filename);
+JS_EOF
+)"
+TARBALL_PATH="$ARTIFACT_DIR/$TARBALL"
+printf '%s\n' "$TARBALL_PATH" >"$ARTIFACT_DIR/latest-tarball.txt"
+
+echo "[release-readiness] smoke the same tarball"
+bash scripts/check-tarball-install-smoke.sh "$TARBALL_PATH"
+echo "[release-readiness] OK: $TARBALL_PATH"

package/scripts/check-release-version.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const root = resolve(scriptDir, "..");
+const args = process.argv.slice(2);
+
+function fail(message) {
+  console.error(`[release-version] ERROR: ${message}`);
+  process.exit(1);
+}
+
+function valueAfter(flag) {
+  const index = args.indexOf(flag);
+  if (index === -1) return undefined;
+  const value = args[index + 1];
+  if (!value || value.startsWith("--")) fail(`${flag} requires a value`);
+  return value;
+}
+
+function nonEmpty(value) {
+  const normalized = String(value ?? "").trim();
+  return normalized || undefined;
+}
+
+const packageJsonArg = valueAfter("--package-json");
+const packageJsonPath = packageJsonArg
+  ? resolve(process.cwd(), packageJsonArg)
+  : resolve(root, "package.json");
+
+let pkg;
+try {
+  pkg = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+} catch (error) {
+  fail(`cannot read package metadata at ${packageJsonPath}: ${error instanceof Error ? error.message : error}`);
+}
+
+const version = String(pkg.version ?? "");
+const match = version.match(/^(\d+\.\d+\.\d+)(?:-rc\.(\d+))?$/);
+if (!match) fail(`unsupported package version: ${version}`);
+
+if (pkg.publishConfig?.tag !== undefined) {
+  fail("publishConfig.tag must be omitted; release commands select next or latest explicitly");
+}
+
+const prerelease = match[2] !== undefined;
+const inferredChannel = prerelease ? "next" : "latest";
+const requestedChannel = valueAfter("--channel");
+if (requestedChannel && !["next", "latest"].includes(requestedChannel)) {
+  fail(`unsupported release channel: ${requestedChannel}`);
+}
+if (requestedChannel && requestedChannel !== inferredChannel) {
+  fail(`${version} must publish to ${inferredChannel}, not ${requestedChannel}`);
+}
+
+const explicitTag = valueAfter("--tag") ?? nonEmpty(process.env.RELEASE_TAG);
+const githubTag = process.env.GITHUB_REF_TYPE === "tag"
+  ? nonEmpty(process.env.GITHUB_REF_NAME)
+  : undefined;
+const releaseTag = explicitTag ?? githubTag;
+const expectedTag = `v${version}`;
+const requireTag = args.includes("--require-tag");
+
+if (releaseTag && releaseTag !== expectedTag) {
+  fail(`release tag ${releaseTag} does not match package version ${expectedTag}`);
+}
+if (requireTag && !releaseTag) {
+  fail(`set RELEASE_TAG=${expectedTag} or run from Git tag ${expectedTag}`);
+}
+
+console.log(`[release-version] OK: ${version} -> ${inferredChannel}${releaseTag ? ` (${releaseTag})` : ""}`);