@moretea-labs/forge 1.6.0 → 1.7.1

package/scripts/host-temporary-cloud-mcp-e2e.sh

@@ -0,0 +1,265 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+BUN_BIN="${BUN_BIN:-bun}"
+RUNTIME_PORT="${FORGE_CLOUD_MCP_RUNTIME_PORT:-18765}"
+GATEWAY_PORT="${FORGE_CLOUD_MCP_GATEWAY_PORT:-18767}"
+HOLD_SECONDS="${FORGE_CLOUD_MCP_HOLD_SECONDS:-1500}"
+TUNNEL_ID="${FORGE_CLOUD_TUNNEL_ID:-}"
+TUNNEL_ALIAS="${FORGE_CLOUD_TUNNEL_ALIAS:-forge-cloud-ci}"
+TUNNEL_CLIENT_VERSION="${FORGE_TUNNEL_CLIENT_VERSION:-v0.0.12}"
+MCP_AUTH_MODE="${FORGE_CLOUD_MCP_AUTH_MODE:-none}"
+RUNTIME_API_KEY="${FORGE_CLOUD_TUNNEL_RUNTIME_API_KEY:-}"
+
+if [[ -z "$TUNNEL_ID" ]]; then
+  echo 'FORGE_CLOUD_TUNNEL_ID is required' >&2
+  exit 2
+fi
+if [[ -z "$RUNTIME_API_KEY" ]]; then
+  echo 'FORGE_CLOUD_TUNNEL_RUNTIME_API_KEY is required' >&2
+  exit 2
+fi
+if ! [[ "$HOLD_SECONDS" =~ ^[0-9]+$ ]]; then
+  echo 'FORGE_CLOUD_MCP_HOLD_SECONDS must be a non-negative integer' >&2
+  exit 2
+fi
+
+TMP_ROOT="$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/forge-cloud-mcp-e2e.XXXXXX")"
+CONTROLLER_HOME="$TMP_ROOT/controller-home"
+SETUP_LOG="$TMP_ROOT/setup.log"
+INSTALL_JSON="$TMP_ROOT/runtime-install.json"
+GATEWAY_LOG="$TMP_ROOT/gateway.log"
+TUNNEL_ARCHIVE="$TMP_ROOT/tunnel-client.zip"
+TUNNEL_DIR="$TMP_ROOT/tunnel-client"
+TUNNEL_CLIENT="$TUNNEL_DIR/tunnel-client"
+TUNNEL_STATUS_JSON="$TMP_ROOT/tunnel-status.json"
+RUNTIME_PID=''
+GATEWAY_PID=''
+
+stop_pid() {
+  local pid="$1"
+  [[ -n "$pid" ]] || return 0
+  kill -0 "$pid" 2>/dev/null || return 0
+  kill "$pid" 2>/dev/null || true
+  for _ in $(seq 1 40); do
+    kill -0 "$pid" 2>/dev/null || return 0
+    sleep 0.25
+  done
+  kill -KILL "$pid" 2>/dev/null || true
+  for _ in $(seq 1 20); do
+    kill -0 "$pid" 2>/dev/null || return 0
+    sleep 0.1
+  done
+  return 1
+}
+
+tunnel_status_ready() {
+  "$TUNNEL_CLIENT" runtimes status "$TUNNEL_ALIAS" --json > "$TUNNEL_STATUS_JSON" 2>/dev/null || return 1
+  node - "$TUNNEL_STATUS_JSON" <<'NODE'
+const fs = require('node:fs');
+const status = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+process.exit(status.process_running === true && status.healthy === true && status.ready === true ? 0 : 1);
+NODE
+}
+
+print_tunnel_status_summary() {
+  if [[ ! -s "$TUNNEL_STATUS_JSON" ]]; then
+    printf 'FORGE_CLOUD_TUNNEL_STATUS unavailable\n' >&2
+    return
+  fi
+  node - "$TUNNEL_STATUS_JSON" <<'NODE'
+const fs = require('node:fs');
+try {
+  const status = JSON.parse(fs.readFileSync(process.argv[2], 'utf8'));
+  const flag = (name) => status[name] === true ? 'true' : status[name] === false ? 'false' : 'unknown';
+  console.error(`FORGE_CLOUD_TUNNEL_STATUS process_running=${flag('process_running')} healthy=${flag('healthy')} ready=${flag('ready')}`);
+} catch {
+  console.error('FORGE_CLOUD_TUNNEL_STATUS unreadable');
+}
+NODE
+}
+
+wait_for_tunnel_ready() {
+  local attempts="$1"
+  for _ in $(seq 1 "$attempts"); do
+    if tunnel_status_ready; then
+      return 0
+    fi
+    sleep 1
+  done
+  print_tunnel_status_summary
+  return 1
+}
+
+cleanup() {
+  local original_status=$?
+  local cleanup_failed=0
+  trap - EXIT INT TERM
+  if [[ -x "$TUNNEL_CLIENT" ]]; then
+    "$TUNNEL_CLIENT" runtimes stop "$TUNNEL_ALIAS" --json >/dev/null 2>&1 || cleanup_failed=1
+  fi
+  stop_pid "$GATEWAY_PID" || cleanup_failed=1
+  stop_pid "$RUNTIME_PID" || cleanup_failed=1
+  unset RUNTIME_API_KEY
+  for _ in $(seq 1 20); do
+    rm -rf "$TMP_ROOT" 2>/dev/null || true
+    [[ ! -e "$TMP_ROOT" ]] && break
+    sleep 0.25
+  done
+  if [[ -e "$TMP_ROOT" ]]; then
+    echo 'FORGE_CLOUD_MCP_CLEANUP_FAILED: temporary root remained after bounded teardown' >&2
+    cleanup_failed=1
+  fi
+  if (( cleanup_failed != 0 )); then
+    exit 1
+  fi
+  exit "$original_status"
+}
+trap cleanup EXIT INT TERM
+
+cd "$ROOT"
+
+"$BUN_BIN" bin/forge.mjs mcp setup chatgpt \
+  --user-level \
+  --controller-home "$CONTROLLER_HOME" \
+  --host 127.0.0.1 \
+  --port "$RUNTIME_PORT" \
+  --local-controller-port $((RUNTIME_PORT + 1)) \
+  --connector-port "$GATEWAY_PORT" > "$SETUP_LOG"
+
+# Package Runtime normally materializes its own persistent OAuth Connector from
+# chatgpt.localEndpoint. This temporary Secure Tunnel benchmark owns the
+# connector port itself with the explicit MCP_AUTH_MODE below, so suppress the
+# package connector in this disposable Controller Home before installation.
+MCP_LOCAL_CONFIG="$CONTROLLER_HOME/mcp/mcp.local.json"
+node - "$MCP_LOCAL_CONFIG" <<'NODE'
+const fs = require('node:fs');
+const path = process.argv[2];
+const config = JSON.parse(fs.readFileSync(path, 'utf8'));
+if (!config.chatgpt || typeof config.chatgpt.localEndpoint !== 'string') {
+  console.error('FORGE_CLOUD_MCP_SETUP_LOCAL_ENDPOINT_MISSING');
+  process.exit(1);
+}
+delete config.chatgpt.localEndpoint;
+fs.writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+NODE
+
+"$BUN_BIN" bin/forge.mjs repo register "$ROOT" \
+  --controller-home "$CONTROLLER_HOME" \
+  --json > "$TMP_ROOT/repository.json"
+
+"$BUN_BIN" bin/forge.mjs runtime service install-package \
+  --controller-home "$CONTROLLER_HOME" \
+  --host 127.0.0.1 \
+  --port "$RUNTIME_PORT" \
+  --portable > "$INSTALL_JSON"
+RUNTIME_PID="$(node -e "const x=require(process.argv[1]); const pid=x?.pid; if(!Number.isInteger(pid)||pid<=0) process.exit(2); process.stdout.write(String(pid))" "$INSTALL_JSON")"
+
+curl --fail --silent --show-error \
+  --retry 30 --retry-delay 1 --retry-connrefused \
+  "http://127.0.0.1:${RUNTIME_PORT}/ready" > "$TMP_ROOT/runtime-ready.json"
+
+FORGE_CONTROLLER_LIFECYCLE_OWNER=1 \
+  "$BUN_BIN" bin/forge.mjs mcp serve \
+  --repo "$ROOT" \
+  --controller-home "$CONTROLLER_HOME" \
+  --transport http \
+  --host 127.0.0.1 \
+  --port "$GATEWAY_PORT" \
+  --profile controller \
+  --auth "$MCP_AUTH_MODE" > "$GATEWAY_LOG" 2>&1 &
+GATEWAY_PID=$!
+
+case "$MCP_AUTH_MODE" in
+  oauth)
+    for _ in $(seq 1 30); do
+      if curl --fail --silent "http://127.0.0.1:${GATEWAY_PORT}/.well-known/oauth-authorization-server" > "$TMP_ROOT/local-oauth.json" 2>/dev/null; then
+        break
+      fi
+      if ! kill -0 "$GATEWAY_PID" 2>/dev/null; then
+        cat "$GATEWAY_LOG" >&2
+        exit 1
+      fi
+      sleep 1
+    done
+    test -s "$TMP_ROOT/local-oauth.json"
+    ;;
+  none)
+    MCP_INITIALIZE_HEADERS="$TMP_ROOT/mcp-initialize.headers"
+    MCP_INITIALIZE_BODY="$TMP_ROOT/mcp-initialize.body"
+    MCP_INITIALIZE_PAYLOAD='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"forge-cloud-readiness","version":"1"}}}'
+    for _ in $(seq 1 30); do
+      if curl --fail --silent --show-error \
+        --dump-header "$MCP_INITIALIZE_HEADERS" \
+        --output "$MCP_INITIALIZE_BODY" \
+        --request POST \
+        --header 'content-type: application/json' \
+        --header 'accept: application/json, text/event-stream' \
+        --data "$MCP_INITIALIZE_PAYLOAD" \
+        "http://127.0.0.1:${GATEWAY_PORT}/mcp" 2>/dev/null \
+        && grep -Eiq '^mcp-session-id:[[:space:]]*[^[:space:]]+' "$MCP_INITIALIZE_HEADERS" \
+        && grep -q 'forge-mcp' "$MCP_INITIALIZE_BODY"; then
+        break
+      fi
+      if ! kill -0 "$GATEWAY_PID" 2>/dev/null; then
+        cat "$GATEWAY_LOG" >&2
+        exit 1
+      fi
+      sleep 1
+    done
+    grep -Eiq '^mcp-session-id:[[:space:]]*[^[:space:]]+' "$MCP_INITIALIZE_HEADERS"
+    grep -q 'forge-mcp' "$MCP_INITIALIZE_BODY"
+    ;;
+  bearer)
+    echo 'FORGE_CLOUD_MCP_AUTH_MODE=bearer is not supported by the unauthenticated Secure Tunnel connector path; use oauth or none.' >&2
+    exit 2
+    ;;
+  *)
+    echo "unsupported FORGE_CLOUD_MCP_AUTH_MODE: $MCP_AUTH_MODE" >&2
+    exit 2
+    ;;
+esac
+
+mkdir -p "$TUNNEL_DIR"
+TUNNEL_CLIENT_ASSET="tunnel-client-${TUNNEL_CLIENT_VERSION}-linux-amd64.zip"
+curl -LfsS \
+  "https://github.com/openai/tunnel-client/releases/download/${TUNNEL_CLIENT_VERSION}/${TUNNEL_CLIENT_ASSET}" \
+  -o "$TUNNEL_ARCHIVE"
+unzip -q "$TUNNEL_ARCHIVE" -d "$TUNNEL_DIR"
+chmod +x "$TUNNEL_CLIENT" "$TUNNEL_DIR/cloudflared"
+
+FORGE_RUNTIME_API_KEY="$RUNTIME_API_KEY" \
+  "$TUNNEL_CLIENT" runtimes connect \
+  --alias "$TUNNEL_ALIAS" \
+  --tunnel-id "$TUNNEL_ID" \
+  --runtime-api-key 'env:FORGE_RUNTIME_API_KEY' \
+  --mcp-server-url "http://127.0.0.1:${GATEWAY_PORT}/mcp" \
+  --profile "$TUNNEL_ALIAS" \
+  --profile-dir "$TMP_ROOT/tunnel-profiles" \
+  --json > "$TMP_ROOT/tunnel-connect.json"
+
+if ! wait_for_tunnel_ready 30; then
+  echo 'FORGE_CLOUD_TUNNEL_NOT_READY' >&2
+  exit 1
+fi
+
+printf 'FORGE_CLOUD_TUNNEL_ID=%s\n' "$TUNNEL_ID"
+printf 'FORGE_CLOUD_TUNNEL_ALIAS=%s\n' "$TUNNEL_ALIAS"
+printf 'FORGE_CLOUD_MCP_RUN_ID=%s\n' "${GITHUB_RUN_ID:-unknown}"
+printf 'FORGE_CLOUD_MCP_RUNNER_OS=%s\n' "${RUNNER_OS:-unknown}"
+printf 'FORGE_CLOUD_MCP_RUNNER_ARCH=%s\n' "${RUNNER_ARCH:-unknown}"
+printf 'FORGE_CLOUD_MCP_AUTH_MODE=%s\n' "$MCP_AUTH_MODE"
+
+elapsed=0
+while (( elapsed < HOLD_SECONDS )); do
+  kill -0 "$RUNTIME_PID" 2>/dev/null || { echo 'runtime exited' >&2; exit 1; }
+  kill -0 "$GATEWAY_PID" 2>/dev/null || { cat "$GATEWAY_LOG" >&2; exit 1; }
+  if ! wait_for_tunnel_ready 5; then
+    echo 'FORGE_CLOUD_TUNNEL_LOST_READINESS' >&2
+    exit 1
+  fi
+  sleep 60
+  elapsed=$((elapsed + 60))
+  printf 'FORGE_CLOUD_MCP_HEARTBEAT elapsed=%ss tunnel_id=%s\n' "$elapsed" "$TUNNEL_ID"
+done

package/scripts/inspect-project-state.ts

@@ -1,280 +1,5 @@
-import { existsSync, readFileSync, readdirSync } from "fs";
-import { join, resolve } from "path";
-import { loadWorkflowContract, resolveWorkflowContractForRepo } from "./workflow-contract.ts";
+#!/usr/bin/env bun
+export * from "../assets/templates/helpers/inspect-project-state";
+import { runTrackedForgeHelper } from "./lib/run-forge-helper";
 
-type Mode = "initialize" | "migrate" | "audit" | "repair";
-
-type InspectionResult = {
-  repo: string;
-  mode: Mode;
-  legacy_contract_version: string;
-  drift_signals: string[];
-  required_decisions: string[];
-  safe_defaults: string[];
-  detected_paths: string[];
-  upgrade_plan: UpgradePlanItem[];
-};
-
-type UpgradePlanItem = {
-  id: string;
-  signal: string;
-  action: string;
-  risk: string;
-  ownership: string;
-  paths: string[];
-  target_paths?: string[];
-  summary: string;
-};
-
-function parseArgs(argv: string[]) {
-  let repo = process.cwd();
-  let format: "json" | "text" = "json";
-
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (arg === "--repo") {
-      repo = argv[i + 1] ? resolve(argv[i + 1]) : repo;
-      i += 1;
-      continue;
-    }
-    if (arg === "--format") {
-      format = argv[i + 1] === "text" ? "text" : "json";
-      i += 1;
-    }
-  }
-
-  return { repo, format };
-}
-
-function fileHasContent(path: string, pattern: RegExp): boolean {
-  if (!existsSync(path)) return false;
-  return pattern.test(readFileSync(path, "utf-8"));
-}
-
-function jsonPathExists(path: string, keys: string[]): boolean {
-  if (!existsSync(path)) return false;
-  try {
-    let value: unknown = JSON.parse(readFileSync(path, "utf-8"));
-    for (const key of keys) {
-      if (!value || typeof value !== "object" || !(key in value)) return false;
-      value = (value as Record<string, unknown>)[key];
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function hasAnyPath(repo: string, relPaths: string[]): boolean {
-  return relPaths.some((relPath) => existsSync(join(repo, relPath)));
-}
-
-function hasCustomClaudeHooks(repo: string): boolean {
-  const hooksDir = join(repo, ".claude", "hooks");
-  if (!existsSync(hooksDir)) return false;
-  try {
-    return readdirSync(hooksDir).some((entry) => /^custom-.*\.sh$/.test(entry));
-  } catch {
-    return false;
-  }
-}
-
-function detectMode(repo: string): Mode {
-  const hasTasks = existsSync(join(repo, "tasks"));
-  const hasPlan = existsSync(join(repo, "plans"));
-  const hasLegacyDocs =
-    existsSync(join(repo, "docs", "plan.md")) || existsSync(join(repo, "docs", "TODO.md"));
-  const hasLegacySkillFactory =
-    existsSync(join(repo, ".claude", "skill-factory")) ||
-    existsSync(join(repo, "scripts", "skill-factory-check.sh")) ||
-    existsSync(join(repo, "scripts", "skill-factory-create.sh")) ||
-    existsSync(join(repo, ".ai", "hooks", "memory-intake.sh")) ||
-    existsSync(join(repo, ".ai", "hooks", "skill-factory-session-end.sh"));
-
-  if (hasTasks && hasPlan) return "audit";
-  if (hasLegacyDocs || hasLegacySkillFactory) return "migrate";
-  if (!hasTasks && !hasPlan && !hasLegacyDocs) return "initialize";
-  return "repair";
-}
-
-export function inspectRepo(repo: string): InspectionResult {
-  const contract = loadWorkflowContract(resolveWorkflowContractForRepo(repo));
-  const latestContract = loadWorkflowContract();
-  const upgradeActions = latestContract.migrations.upgrade?.actions ?? contract.migrations.upgrade?.actions ?? [];
-  const detectedPathSet = new Set(
-    [...new Set([...contract.migrations.legacyPaths, ...latestContract.migrations.legacyPaths])]
-      .map((relPath) => relPath)
-      .filter((relPath) => existsSync(join(repo, relPath)))
-  );
-  const driftSignals: string[] = [];
-  const requiredDecisions: string[] = [];
-  const safeDefaults = [
-    "Preserve repo-local tasks-first workflow",
-    "Archive uncertain legacy content instead of overwriting it",
-    "Delete only manifest-owned known_generated legacy files",
-    "Distill repeated corrections into tasks/lessons.md and hidden contracts into docs/researches/",
-  ];
-
-  const runtimeManifest = join(repo, contract.artifacts.runtimeManifest);
-  const todoFile = join(repo, contract.documents.deferredGoalLedger ?? contract.documents.taskChecklist ?? "tasks/todos.md");
-  const legacySingularTodoFile = join(repo, "tasks", "todo.md");
-  const legacyTaskSprintDir = join(repo, "tasks", "sprints");
-  const policyFile = join(repo, ".ai", "harness", "policy.json");
-  const generatedClaudeHookPaths = [
-    ".claude/hooks/run-hook.sh",
-    ".claude/hooks/finalize-handoff.sh",
-    ".claude/hooks/session-start-context.sh",
-    ".claude/hooks/hook-input.sh",
-    ".claude/hooks/lib/workflow-state.sh",
-    ".claude/hooks/lib/session-state.sh",
-  ];
-  const ignoredReferenceOrSecretPaths = [
-    "_ref",
-    "_ops",
-  ];
-
-  if (!existsSync(runtimeManifest)) {
-    driftSignals.push("missing-runtime-contract-manifest");
-  }
-  if (existsSync(policyFile) && !jsonPathExists(policyFile, ["upgrade", "strategy_version"])) {
-    driftSignals.push("policy-missing-upgrade-strategy");
-  }
-  if (existsSync(join(repo, "docs", "plan.md"))) {
-    driftSignals.push("legacy-docs-plan");
-  }
-  if (existsSync(join(repo, "docs", "TODO.md"))) {
-    driftSignals.push("legacy-docs-todo");
-  }
-  if (existsSync(legacySingularTodoFile) && legacySingularTodoFile !== todoFile) {
-    driftSignals.push("legacy-singular-todo-file");
-  }
-  if (existsSync(legacyTaskSprintDir)) {
-    driftSignals.push("legacy-task-sprint-prds");
-  }
-  if (
-    existsSync(join(repo, ".claude", "skill-factory")) ||
-    existsSync(join(repo, "scripts", "skill-factory-check.sh")) ||
-    existsSync(join(repo, "scripts", "skill-factory-create.sh")) ||
-    existsSync(join(repo, ".ai", "hooks", "memory-intake.sh")) ||
-    existsSync(join(repo, ".ai", "hooks", "skill-factory-session-end.sh"))
-  ) {
-    driftSignals.push("legacy-skill-factory-surface");
-  }
-  if (existsSync(join(repo, "docs", "PROGRESS.md"))) {
-    driftSignals.push("legacy-docs-progress");
-  }
-  if (
-    existsSync(todoFile) &&
-    (
-      !fileHasContent(todoFile, /^# Deferred Goal Ledger\s*$/m) ||
-      !fileHasContent(todoFile, /^\> \*\*Status\*\*:\s*Backlog\s*$/m)
-    )
-  ) {
-    driftSignals.push("legacy-task-checklist-format");
-  }
-  if (hasAnyPath(repo, generatedClaudeHookPaths)) {
-    driftSignals.push("stale-generated-claude-hook-shims");
-  }
-
-  if (driftSignals.includes("missing-runtime-contract-manifest")) {
-    requiredDecisions.push("Install runtime workflow contract manifest");
-  }
-  if (driftSignals.includes("policy-missing-upgrade-strategy")) {
-    requiredDecisions.push("Merge versioned upgrade strategy into harness policy");
-  }
-  if (driftSignals.includes("legacy-docs-plan") || driftSignals.includes("legacy-docs-todo")) {
-    requiredDecisions.push("Run legacy document migration before template refresh");
-  }
-  if (driftSignals.includes("legacy-singular-todo-file")) {
-    requiredDecisions.push("Migrate legacy tasks/todo.md into tasks/todos.md");
-  }
-  if (driftSignals.includes("legacy-task-sprint-prds")) {
-    requiredDecisions.push("Move legacy tasks/sprints/*.sprint.md into plans/sprints/*.sprint.md");
-  }
-  if (driftSignals.includes("legacy-docs-progress")) {
-    requiredDecisions.push("Archive legacy docs/PROGRESS.md into research report or changelog surfaces");
-  }
-  if (driftSignals.includes("legacy-skill-factory-surface")) {
-    requiredDecisions.push("Remove repo-local Skill Factory and auto-memory surfaces");
-  }
-  if (driftSignals.includes("stale-generated-claude-hook-shims")) {
-    requiredDecisions.push("Remove manifest-owned generated .claude/hooks shims and keep .ai/hooks as source of truth");
-  }
-
-  const upgradeSignals = new Set(driftSignals);
-  if (hasCustomClaudeHooks(repo)) {
-    upgradeSignals.add("custom-claude-hooks");
-  }
-  if (hasAnyPath(repo, ignoredReferenceOrSecretPaths)) {
-    upgradeSignals.add("ignored-reference-or-secret-surfaces");
-  }
-  const upgradePlan = upgradeActions
-    .filter((action) => upgradeSignals.has(action.signal))
-    .map((action) => {
-      for (const relPath of action.paths) {
-        if (!relPath.includes("*") && existsSync(join(repo, relPath))) {
-          detectedPathSet.add(relPath);
-        }
-      }
-      return {
-        id: action.id,
-        signal: action.signal,
-        action: action.action,
-        risk: action.risk,
-        ownership: action.ownership,
-        paths: action.paths,
-        target_paths: action.targetPaths,
-        summary: action.summary,
-      };
-    });
-
-  let legacyContractVersion = "current-v1";
-  if (driftSignals.includes("legacy-docs-plan") || driftSignals.includes("legacy-docs-todo")) {
-    legacyContractVersion = "pre-tasks-first";
-  } else if (driftSignals.includes("missing-runtime-contract-manifest")) {
-    legacyContractVersion = "tasks-first-without-contract-manifest";
-  }
-
-  return {
-    repo,
-    mode: detectMode(repo),
-    legacy_contract_version: legacyContractVersion,
-    drift_signals: driftSignals,
-    required_decisions: requiredDecisions,
-    safe_defaults: safeDefaults,
-    detected_paths: [...detectedPathSet].sort(),
-    upgrade_plan: upgradePlan,
-  };
-}
-
-function renderText(result: InspectionResult): string {
-  const lines = [
-    `repo: ${result.repo}`,
-    `mode: ${result.mode}`,
-    `legacy_contract_version: ${result.legacy_contract_version}`,
-    `drift_signals: ${result.drift_signals.join(", ") || "(none)"}`,
-    `required_decisions: ${result.required_decisions.join(" | ") || "(none)"}`,
-    `safe_defaults: ${result.safe_defaults.join(" | ")}`,
-    `upgrade_plan:`,
-  ];
-  if (result.upgrade_plan.length === 0) {
-    lines.push("- (none)");
-  } else {
-    for (const item of result.upgrade_plan) {
-      const target = item.target_paths?.length ? ` -> ${item.target_paths.join(", ")}` : "";
-      lines.push(
-        `- ${item.action} ${item.id} [${item.risk}, ${item.ownership}]: ${item.paths.join(", ")}${target}`
-      );
-    }
-  }
-  return lines.join("\n");
-}
-
-const { repo, format } = parseArgs(process.argv.slice(2));
-const result = inspectRepo(repo);
-
-if (format === "text") {
-  console.log(renderText(result));
-} else {
-  console.log(JSON.stringify(result, null, 2));
-}
+if (import.meta.main) runTrackedForgeHelper("inspect-project-state.ts");

package/scripts/install-standalone-recovery.ts

@@ -44,6 +44,22 @@ const recoveryTunnelService = launchdService(
   'RECOVERY_TUNNEL_SERVICE',
 );
 if (Boolean(recoveryTunnelService) !== Boolean(recoveryPublicUrl)) throw new Error('RECOVERY_PUBLIC_URL_AND_TUNNEL_SERVICE_MUST_BE_CONFIGURED_TOGETHER');
+const primaryConnectorLocalUrl = endpointOption('--primary-connector-local-url');
+const primaryConnectorBase = launchdService(
+  option('--primary-connector-service-label'),
+  option('--primary-connector-service-plist'),
+  'RECOVERY_PRIMARY_CONNECTOR',
+);
+if (primaryConnectorLocalUrl && !primaryConnectorBase) throw new Error('RECOVERY_PRIMARY_CONNECTOR_LABEL_REQUIRED_FOR_LOCAL_URL');
+const primaryConnectorService = primaryConnectorBase
+  ? { ...primaryConnectorBase, ...(primaryConnectorLocalUrl ? { localMcpUrl: primaryConnectorLocalUrl } : {}) }
+  : undefined;
+const primaryPublicTunnelService = launchdService(
+  option('--primary-tunnel-service-label'),
+  option('--primary-tunnel-service-plist'),
+  'RECOVERY_PRIMARY_TUNNEL',
+);
+if (primaryPublicTunnelService && !primaryConnectorService) throw new Error('RECOVERY_PRIMARY_CONNECTOR_REQUIRED_FOR_PRIMARY_TUNNEL');
 
 const result = await installStandaloneRecovery({
   controllerHome,
@@ -54,6 +70,8 @@ const result = await installStandaloneRecovery({
   publicMcpUrl,
   recoveryPublicUrl,
   recoveryTunnelService,
+  primaryPublicTunnelService,
+  primaryConnectorService,
 });
 const config = result.config;
 console.log(JSON.stringify({
@@ -70,5 +88,11 @@ console.log(JSON.stringify({
     recoveryTunnelService: config.recoveryTunnelService
       ? { platform: config.recoveryTunnelService.platform, label: config.recoveryTunnelService.label, plistPath: config.recoveryTunnelService.plistPath }
       : undefined,
+    primaryConnectorService: config.primaryConnectorService
+      ? { platform: config.primaryConnectorService.platform, label: config.primaryConnectorService.label, plistPath: config.primaryConnectorService.plistPath, localMcpUrl: config.primaryConnectorService.localMcpUrl }
+      : undefined,
+    primaryPublicTunnelService: config.primaryPublicTunnelService
+      ? { platform: config.primaryPublicTunnelService.platform, label: config.primaryPublicTunnelService.label, plistPath: config.primaryPublicTunnelService.plistPath }
+      : undefined,
   },
 }, null, 2));