@moretea-labs/forge 1.6.0 → 1.7.1

package/src/runtime/gateway/mcp/resource-policy.ts

@@ -1,186 +0,0 @@
-import type { ResourceClaimSpec } from '../../execution/jobs/types';
-import { ephemeralWorkspaceCoordinates } from '../../../cli/repositories/ephemeral-workspace';
-import {
-  claimsForCheck,
-  claimsForRepositoryCommand,
-  claimHeavyCheck,
-  claimWorkspaceRead,
-  claimBuildCacheWrite,
-} from '../../execution/process-runtime/resource-claims';
-
-const READ_ONLY_TOOLS = new Set([
-  'controller_capabilities',
-  'controller_ready',
-  'controller_context',
-  'controller_context_pack',
-  'project_snapshot',
-  'get_project_state',
-  'get_project_governance',
-  'get_project_progress',
-  'get_project_board',
-  'get_task_progress_detail',
-  'get_issue',
-  'list_issues',
-  'list_task_runs',
-  'list_edit_sessions',
-  'list_checks',
-  'search_repository',
-  'read_repository_file',
-  'github_status',
-  'repository_get',
-  'repository_list',
-  'repository_workbench',
-  'repository_runtime_snapshot',
-  'list_schedules',
-  'repository_command_preview',
-  'get_local_job',
-  'get_local_job_output',
-  'local_bridge_status',
-  'get_task_run',
-  'get_task_run_events',
-  'get_task_run_log',
-  'get_task_diff',
-  'get_worklog_timeline',
-  'capability_recovery_probe',
-  'capability_recovery_plan',
-  'runtime_maintenance_status',
-  'goal_list',
-  'goal_get',
-  'goal_status',
-  'goal_handoff_packet_get',
-  'provider_list',
-  'provider_health',
-  'provider_config_status',
-  'executor_route_preview',
-  'repair_plan',
-  'workspace_auth_status',
-  'workspace_auth_login_prepare',
-  'external_filesystem_targets_list',
-  'external_filesystem_grant_preview',
-  'external_filesystem_text_snapshot',
-]);
-const REPO_STATE_TOOLS = new Set([
-  'create_issue', 'update_issue', 'plan_issue', 'append_task', 'split_task', 'supersede_task',
-  'set_task_dependencies', 'update_task', 'record_task_verification', 'accept_verified_task',
-  'write_prd', 'write_prd_from_idea', 'write_sprint', 'write_checklist_sprint', 'write_plan',
-  'record_candidate_finding', 'repository_register', 'repository_refresh', 'repository_validate',
-  'repository_update', 'repository_disable', 'repository_remove', 'create_edit_savepoint',
-  'begin_edit_session', 'set_current_issue', 'archive_issue', 'restore_issue', 'reconcile_project_governance',
-  'capability_recovery_apply', 'runtime_maintenance_apply', 'external_filesystem_grant_apply',
-  'goal_create', 'goal_start', 'goal_continue', 'goal_stop', 'goal_finalize', 'goal_tick_once',
-  'goal_handoff_packet_create', 'executor_dispatch', 'repair_continue',
-]);
-const CHECK_TOOLS = new Set(['run_check', 'verify_edit_session']);
-const INTEGRATION_TOOLS = new Set(['integrate_task_run', 'finish_edit_session']);
-const REMOTE_TOOLS = new Set(['publish_issue_to_github', 'refresh_github_issue', 'close_github_issue', 'configure_github_plugin']);
-const AGENT_TOOLS = new Set(['dispatch_task', 'launch_issue', 'dispatch_ready_tasks', 'retry_task_run', 'quick_agent_session']);
-const WORKSPACE_WRITE_TOOLS = new Set([
-  'apply_patch', 'apply_edit_operations', 'rollback_edit_session', 'finalize_edit_session',
-  'repository_command_execute',
-]);
-const DURABLE_WORK_TOOLS = new Set(['work_execute', 'work_validate', 'work_finalize']);
-
-function operationPaths(args: Record<string, unknown>): string[] {
-  const paths = new Set<string>();
-  const allowed = args.allowed_paths;
-  if (Array.isArray(allowed)) for (const value of allowed) if (typeof value === 'string' && value.trim()) paths.add(value.trim());
-  const operations = args.operations;
-  if (Array.isArray(operations)) {
-    for (const operation of operations) {
-      if (operation && typeof operation === 'object') {
-        const path = (operation as Record<string, unknown>).path;
-        if (typeof path === 'string' && path.trim()) paths.add(path.trim());
-      }
-    }
-  }
-  const path = args.path;
-  if (typeof path === 'string' && path.trim()) paths.add(path.trim());
-  return [...paths];
-}
-
-function isolatedWorktreeKey(args: Record<string, unknown>): string {
-  const issueId = typeof args.issue_id === 'string' ? args.issue_id.trim() : '';
-  const taskId = typeof args.task_id === 'string' ? args.task_id.trim() : '';
-  const runId = typeof args.run_id === 'string' ? args.run_id.trim() : '';
-  const requestId = typeof args.request_id === 'string' ? args.request_id.trim() : '';
-  const identity = (issueId && taskId ? `${issueId}-${taskId}` : runId || taskId || issueId || requestId || 'isolated')
-    .replace(/[^a-zA-Z0-9._-]+/g, '-');
-  return identity || 'isolated';
-}
-
-export function claimsForMcpOperation(name: string, args: Record<string, unknown>, repoId: string, checkoutId?: string): ResourceClaimSpec[] {
-  if (READ_ONLY_TOOLS.has(name)) return [];
-  if (REPO_STATE_TOOLS.has(name)) return [{ resourceKey: 'repo-state', mode: 'write' }];
-  // run_check: only true heavy/release checks take exclusive heavy-check lock.
-  // Ordinary typecheck / lint / package scripts use fine-grained claims.
-  if (name === 'run_check') {
-    const checkId = String(args.check_id ?? args.checkId ?? '').trim();
-    if (!checkId) return [claimWorkspaceRead(checkoutId), claimBuildCacheWrite(repoId)];
-    return claimsForCheck(checkId, undefined, repoId, checkoutId);
-  }
-  // verify/finish edit may run multiple checks — keep exclusive to avoid parallel mutate+verify races.
-  if (name === 'verify_edit_session') return [claimHeavyCheck(repoId)];
-  if (name === 'finish_edit_session') return [
-    claimHeavyCheck(repoId),
-    { resourceKey: `integration:${repoId}`, mode: 'exclusive' },
-    { resourceKey: `workspace:${checkoutId ?? 'active'}`, mode: 'write' },
-    { resourceKey: `git-refs:${repoId}`, mode: 'exclusive' },
-  ];
-  if (CHECK_TOOLS.has(name)) return claimsForCheck(String(args.check_id ?? name), undefined, repoId, checkoutId);
-  if (INTEGRATION_TOOLS.has(name)) return [
-    { resourceKey: `integration:${repoId}`, mode: 'exclusive' },
-    { resourceKey: `workspace:${checkoutId ?? 'active'}`, mode: 'write' },
-    { resourceKey: `git-refs:${repoId}`, mode: 'exclusive' },
-  ];
-  if (REMOTE_TOOLS.has(name)) return [{ resourceKey: `remote:${repoId}`, mode: 'exclusive' }];
-  if (AGENT_TOOLS.has(name)) {
-    if (args.agent === 'github-copilot') return [{ resourceKey: `remote:${repoId}`, mode: 'exclusive' }];
-    // Parent Execution Job only accepts the child Agent Run. Workspace/worktree
-    // write ownership belongs to the child Run, not the short-lived parent Job.
-    const requestId = typeof args.request_id === 'string' ? args.request_id.trim() : '';
-    const dispatchKey = isolatedWorktreeKey(args) || requestId || name;
-    return [{ resourceKey: `agent-dispatch:${repoId}:${dispatchKey}`, mode: 'write' }];
-  }
-  if (DURABLE_WORK_TOOLS.has(name)) {
-    const workId = typeof args.work_id === 'string' && args.work_id.trim()
-      ? args.work_id.trim()
-      : 'unresolved';
-    const claims: ResourceClaimSpec[] = [
-      { resourceKey: `work:${repoId}:${workId}`, mode: 'exclusive' },
-    ];
-    if (name === 'work_validate') claims.push(claimHeavyCheck(repoId));
-    if (name === 'work_finalize') claims.push(
-      { resourceKey: `integration:${repoId}`, mode: 'exclusive' },
-      { resourceKey: `git-refs:${repoId}`, mode: 'exclusive' },
-    );
-    return claims;
-  }
-  if (name === 'repository_command_execute' && args.command !== undefined) {
-    const workspaceRoot = typeof args.workspace_root === 'string' ? args.workspace_root.trim() : '';
-    const workspace = workspaceRoot ? ephemeralWorkspaceCoordinates(workspaceRoot) : undefined;
-    return claimsForRepositoryCommand(
-      args.command as string | string[],
-      workspace?.workspaceId ?? repoId,
-      workspace?.checkoutId ?? checkoutId,
-      typeof args.default_branch === 'string' ? args.default_branch : undefined,
-    );
-  }
-  if (WORKSPACE_WRITE_TOOLS.has(name)) {
-    const paths = operationPaths(args);
-    if (paths.length > 0) {
-      return paths.map((path) => ({
-        resourceKey: `path:${checkoutId ?? 'active'}:${path.replace(/^\.\//, '')}`,
-        mode: 'write' as const,
-      }));
-    }
-    return [{ resourceKey: `workspace:${checkoutId ?? 'active'}`, mode: 'write' }];
-  }
-  const paths = operationPaths(args);
-  if (paths.length > 0) {
-    return paths.map((path) => ({
-      resourceKey: `path:${checkoutId ?? 'active'}:${path.replace(/^\.\//, '')}`,
-      mode: 'write' as const,
-    }));
-  }
-  return [];
-}

package/src/runtime/personal-assistant/gmail-triage-manager.ts

@@ -1,231 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { dirname, join } from 'path';
-import type { RepositoryRecord } from '../../cli/repositories/types';
-import type { AssistantPluginManifest } from '../plugins/types';
-import {
-  defaultTriageRules,
-  normalizeAssistantItem,
-  triageItems,
-  type AssistantItem,
-  type TriageDecision,
-  type TriageRule,
-} from './triage-runtime';
-
-export interface GmailTriageRuleStore {
-  schemaVersion: 1;
-  updatedAt: string;
-  rules: TriageRule[];
-}
-
-export interface GmailTriageSummary {
-  total: number;
-  byPriority: Record<string, number>;
-  byCategory: Record<string, number>;
-  requiresUserInput: number;
-  remoteWriteActions: number;
-}
-
-export interface GmailTriagePlan {
-  repoId: string;
-  generatedAt: string;
-  plugin: {
-    pluginId: 'gmail';
-    configured: boolean;
-    enabled: boolean;
-    ready: boolean;
-    healthState?: string;
-    warnings: string[];
-    next: string[];
-  };
-  query: string;
-  rulesPath: string;
-  ruleCount: number;
-  summary: GmailTriageSummary;
-  decisions: TriageDecision[];
-  actionQueue: Array<{
-    actionId: string;
-    sourceId: string;
-    type: string;
-    risk: string;
-    requiresConfirmation: boolean;
-    summary: string;
-    executableByPlugin: boolean;
-    pluginActionId?: string;
-    arguments?: Record<string, unknown>;
-  }>;
-  next: string[];
-}
-
-export interface GmailTriageRuleUpsertResult {
-  path: string;
-  rule: TriageRule;
-  store: GmailTriageRuleStore;
-}
-
-const RULE_PATH = '.forge/assistant/gmail-triage-rules.json';
-
-function now(): string {
-  return new Date().toISOString();
-}
-
-function rulePath(repository: RepositoryRecord): string {
-  return join(repository.canonicalRoot, RULE_PATH);
-}
-
-function writeJson(path: string, value: unknown): void {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, 'utf-8');
-}
-
-function readStoredRules(repository: RepositoryRecord): GmailTriageRuleStore | undefined {
-  const path = rulePath(repository);
-  if (!existsSync(path)) return undefined;
-  const parsed = JSON.parse(readFileSync(path, 'utf-8')) as Partial<GmailTriageRuleStore>;
-  return {
-    schemaVersion: 1,
-    updatedAt: typeof parsed.updatedAt === 'string' ? parsed.updatedAt : now(),
-    rules: Array.isArray(parsed.rules) ? parsed.rules : [],
-  };
-}
-
-function normalizeRule(input: Record<string, unknown>, existing?: TriageRule): TriageRule {
-  const id = String(input.id ?? existing?.id ?? '').trim();
-  if (!id) throw new Error('GMAIL_TRIAGE_RULE_ID_REQUIRED');
-  const match = input.match && typeof input.match === 'object' && !Array.isArray(input.match)
-    ? input.match as TriageRule['match']
-    : existing?.match;
-  const decision = input.decision && typeof input.decision === 'object' && !Array.isArray(input.decision)
-    ? input.decision as TriageRule['decision']
-    : existing?.decision;
-  if (!match) throw new Error('GMAIL_TRIAGE_RULE_MATCH_REQUIRED');
-  if (!decision) throw new Error('GMAIL_TRIAGE_RULE_DECISION_REQUIRED');
-  return {
-    id,
-    enabled: input.enabled === undefined ? existing?.enabled ?? true : input.enabled === true,
-    order: typeof input.order === 'number' ? Math.trunc(input.order) : existing?.order ?? 50,
-    match,
-    decision,
-  };
-}
-
-export function readGmailTriageRules(repository: RepositoryRecord): GmailTriageRuleStore {
-  const stored = readStoredRules(repository);
-  if (stored) return stored;
-  return { schemaVersion: 1, updatedAt: now(), rules: defaultTriageRules() };
-}
-
-export function upsertGmailTriageRule(repository: RepositoryRecord, input: Record<string, unknown>): GmailTriageRuleUpsertResult {
-  const store = readGmailTriageRules(repository);
-  const id = String(input.id ?? '').trim();
-  const existing = store.rules.find((rule) => rule.id === id);
-  const rule = normalizeRule(input, existing);
-  const next: GmailTriageRuleStore = {
-    schemaVersion: 1,
-    updatedAt: now(),
-    rules: [rule, ...store.rules.filter((entry) => entry.id !== rule.id)].sort((left, right) => (left.order ?? 0) - (right.order ?? 0)),
-  };
-  writeJson(rulePath(repository), next);
-  return { path: RULE_PATH, rule, store: next };
-}
-
-function normalizedItems(items: unknown): AssistantItem[] {
-  if (!Array.isArray(items)) return [];
-  return items
-    .filter((entry): entry is Record<string, unknown> => Boolean(entry) && typeof entry === 'object' && !Array.isArray(entry))
-    .map((entry) => normalizeAssistantItem({
-      source: 'gmail',
-      source_id: String(entry.source_id ?? entry.sourceId ?? entry.id ?? entry.message_id ?? '').trim(),
-      kind: 'email',
-      title: String(entry.title ?? entry.subject ?? entry.snippet ?? '').trim(),
-      body: typeof entry.body === 'string' ? entry.body : typeof entry.snippet === 'string' ? entry.snippet : undefined,
-      actor: typeof entry.actor === 'string' ? entry.actor : typeof entry.from === 'string' ? entry.from : undefined,
-      timestamp: typeof entry.timestamp === 'string' ? entry.timestamp : typeof entry.date === 'string' ? entry.date : undefined,
-      labels: Array.isArray(entry.labels) ? entry.labels.map(String) : Array.isArray(entry.label_ids) ? entry.label_ids.map(String) : undefined,
-      urls: Array.isArray(entry.urls) ? entry.urls.map(String) : undefined,
-      attachments: Array.isArray(entry.attachments) ? entry.attachments as AssistantItem['attachments'] : undefined,
-      metadata: { ...entry },
-    }))
-    .filter((item) => item.source_id && item.title);
-}
-
-function pluginSummary(manifest: AssistantPluginManifest | undefined) {
-  const actions = new Set(manifest?.actions.map((action) => action.actionId) ?? []);
-  const ready = manifest?.enabled === true && manifest.health.ready === true;
-  const next: string[] = [];
-  if (!manifest) next.push('Initialize or enable the Gmail plugin manifest.');
-  else if (!manifest.enabled) next.push('Configure the Gmail plugin before trying to read mail.');
-  else if (!ready) next.push('Fix Gmail plugin health warnings before executing Gmail actions.');
-  return {
-    pluginId: 'gmail' as const,
-    configured: Boolean(manifest),
-    enabled: manifest?.enabled === true,
-    ready,
-    healthState: manifest?.health.state,
-    warnings: [...(manifest?.health.warnings ?? []), ...(manifest?.health.errors ?? [])],
-    next,
-    actions,
-  };
-}
-
-function summarize(decisions: TriageDecision[]): GmailTriageSummary {
-  const byPriority: Record<string, number> = {};
-  const byCategory: Record<string, number> = {};
-  let remoteWriteActions = 0;
-  for (const decision of decisions) {
-    byPriority[decision.priority] = (byPriority[decision.priority] ?? 0) + 1;
-    byCategory[decision.category] = (byCategory[decision.category] ?? 0) + 1;
-    remoteWriteActions += decision.suggested_actions.filter((action) => action.risk !== 'readonly').length;
-  }
-  return {
-    total: decisions.length,
-    byPriority,
-    byCategory,
-    requiresUserInput: decisions.filter((decision) => decision.requires_user_input).length,
-    remoteWriteActions,
-  };
-}
-
-function pluginActionFor(type: string): string | undefined {
-  if (type === 'archive' || type === 'mark_read' || type === 'label') return undefined;
-  if (type === 'draft_reply') return 'create_draft';
-  return undefined;
-}
-
-export function buildGmailTriagePlan(repository: RepositoryRecord, input: { manifest?: AssistantPluginManifest; items?: unknown; query?: unknown } = {}): GmailTriagePlan {
-  const rules = readGmailTriageRules(repository).rules;
-  const items = normalizedItems(input.items);
-  const decisions = triageItems(items, { rules, low_value_action_mode: 'archive_candidate' })
-    .sort((left, right) => left.priority.localeCompare(right.priority) || right.confidence - left.confidence);
-  const plugin = pluginSummary(input.manifest);
-  const actionQueue = decisions.flatMap((decision) => decision.suggested_actions.map((action) => {
-    const pluginActionId = pluginActionFor(action.type);
-    return {
-      actionId: action.id,
-      sourceId: decision.source_id,
-      type: action.type,
-      risk: action.risk,
-      requiresConfirmation: action.requires_confirmation,
-      summary: action.summary,
-      executableByPlugin: Boolean(pluginActionId && plugin.ready && plugin.actions.has(pluginActionId)),
-      pluginActionId,
-      arguments: action.arguments,
-    };
-  }));
-  const next = [
-    ...(items.length === 0 ? ['Fetch messages with the Gmail plugin list_messages action, then pass summaries into gmail_triage_plan.'] : []),
-    ...(actionQueue.some((action) => action.requiresConfirmation) ? ['Review remote-write action proposals before executing any Gmail mutations.'] : []),
-    ...plugin.next,
-  ];
-  return {
-    repoId: repository.repoId,
-    generatedAt: now(),
-    plugin: { pluginId: plugin.pluginId, configured: plugin.configured, enabled: plugin.enabled, ready: plugin.ready, healthState: plugin.healthState, warnings: plugin.warnings, next: plugin.next },
-    query: String(input.query ?? 'in:inbox newer_than:14d').trim(),
-    rulesPath: RULE_PATH,
-    ruleCount: rules.length,
-    summary: summarize(decisions),
-    decisions,
-    actionQueue,
-    next: [...new Set(next)],
-  };
-}