@moretea-labs/forge 1.7.2 → 1.8.0

package/src/runtime/platform/windows-host-discovery.ts

@@ -0,0 +1,118 @@
+import { spawnSync } from 'child_process';
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+
+export interface WindowsHostEnvironment {
+  commandExecutable: string;
+  userProfileWindows: string;
+  userProfile: string;
+  localAppDataWindows?: string;
+  localAppData?: string;
+  programFilesWindows: string[];
+  programFiles: string[];
+  programDataWindows?: string;
+  programData?: string;
+  systemRootWindows?: string;
+  systemRoot?: string;
+  driveMounts: Readonly<Record<string, string>>;
+}
+
+export interface WindowsHostDiscoveryOptions {
+  fileExists?: typeof existsSync;
+  readText?: (path: string) => string;
+  commandCandidates?: readonly string[];
+  runCommand?: (executable: string, args: readonly string[]) => { status: number | null; stdout: string };
+  mountTable?: string;
+}
+
+function unescapeMount(value: string): string {
+  return value.replace(/\\040/g, ' ').replace(/\\011/g, '\t').replace(/\\134/g, '\\');
+}
+
+export function discoverWslWindowsDriveMounts(mountTable: string): Record<string, string> {
+  const mounts: Record<string, string> = {};
+  for (const line of mountTable.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    const fields = line.split(' ');
+    const source = unescapeMount(fields[0] ?? '');
+    const mountPoint = unescapeMount(fields[1] ?? '');
+    const fsType = fields[2] ?? '';
+    const sourceDrive = /^([A-Za-z]):(?:\\|$)/.exec(source)?.[1]?.toLowerCase();
+    const optionDrive = /(?:^|,)aname=drvfs;path=([A-Za-z]):(?:\\|,|$)/.exec(fields.slice(3).join(' '))?.[1]?.toLowerCase();
+    const drive = sourceDrive ?? optionDrive;
+    if (drive && mountPoint.startsWith('/') && (fsType === '9p' || fsType === 'drvfs')) mounts[drive] = mountPoint;
+  }
+  return mounts;
+}
+
+export function windowsPathToHostPath(value: string, driveMounts: Readonly<Record<string, string>>): string | undefined {
+  if (value.startsWith('/')) return value;
+  const normalized = value.trim().replace(/^"|"$/g, '').replace(/\\/g, '/');
+  const match = /^([A-Za-z]):\/(.*)$/.exec(normalized);
+  if (!match) return undefined;
+  const mount = driveMounts[match[1]!.toLowerCase()];
+  return mount ? join(mount, match[2]!) : undefined;
+}
+
+
+export function hostPathToWindowsPath(value: string, driveMounts: Readonly<Record<string, string>>): string | undefined {
+  const normalized = value.replace(/\\/g, '/');
+  const entries = Object.entries(driveMounts).sort((left, right) => right[1].length - left[1].length);
+  for (const [drive, mountRoot] of entries) {
+    const root = mountRoot.endsWith('/') ? mountRoot.slice(0, -1) : mountRoot;
+    if (normalized === root) return `${drive.toUpperCase()}:\\`;
+    if (normalized.startsWith(`${root}/`)) return `${drive.toUpperCase()}:\\${normalized.slice(root.length + 1).replace(/\//g, '\\')}`;
+  }
+  return undefined;
+}
+
+function parseEnvironment(stdout: string): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const line of stdout.split(/\r?\n/)) {
+    const match = /^FORGE_([A-Z0-9_]+)=(.*)$/.exec(line.trim());
+    if (match && match[2]!.trim() && !/%[^%]+%/.test(match[2]!)) result[match[1]!] = match[2]!.trim();
+  }
+  return result;
+}
+
+export function discoverWslWindowsHostEnvironment(options: WindowsHostDiscoveryOptions = {}): WindowsHostEnvironment | undefined {
+  const fileExists = options.fileExists ?? existsSync;
+  const readText = options.readText ?? ((path: string) => readFileSync(path, 'utf8'));
+  let mountTable = options.mountTable;
+  if (mountTable === undefined) {
+    try { mountTable = readText('/proc/mounts'); } catch { mountTable = ''; }
+  }
+  const driveMounts = discoverWslWindowsDriveMounts(mountTable);
+  const discoveredCmd = Object.entries(driveMounts)
+    .map(([, root]) => join(root, 'Windows', 'System32', 'cmd.exe'))
+    .find(fileExists);
+  const commandExecutable = options.commandCandidates?.find(fileExists) ?? discoveredCmd;
+  if (!commandExecutable) return undefined;
+  const runCommand = options.runCommand ?? ((executable: string, args: readonly string[]) => {
+    const result = spawnSync(executable, [...args], { encoding: 'utf8', windowsHide: true, timeout: 5_000 });
+    return { status: result.status, stdout: result.stdout ?? '' };
+  });
+  const observed = runCommand(commandExecutable, ['/d', '/s', '/c', 'echo FORGE_USERPROFILE=%USERPROFILE%&&echo FORGE_LOCALAPPDATA=%LOCALAPPDATA%&&echo FORGE_PROGRAMFILES=%ProgramFiles%&&echo FORGE_PROGRAMFILES_X86=%ProgramFiles(x86)%&&echo FORGE_PROGRAMDATA=%ProgramData%&&echo FORGE_SYSTEMROOT=%SystemRoot%']);
+  if (observed.status !== 0) return undefined;
+  const env = parseEnvironment(observed.stdout);
+  const userProfileWindows = env.USERPROFILE;
+  if (!userProfileWindows) return undefined;
+  const userProfile = windowsPathToHostPath(userProfileWindows, driveMounts);
+  if (!userProfile) return undefined;
+  const localAppDataWindows = env.LOCALAPPDATA;
+  const localAppData = localAppDataWindows ? windowsPathToHostPath(localAppDataWindows, driveMounts) : undefined;
+  const programFilesWindows = [env.PROGRAMFILES, env.PROGRAMFILES_X86].filter((value): value is string => Boolean(value));
+  const programFiles = programFilesWindows.map((value) => windowsPathToHostPath(value, driveMounts)).filter((value): value is string => Boolean(value));
+  const programDataWindows = env.PROGRAMDATA;
+  const programData = programDataWindows ? windowsPathToHostPath(programDataWindows, driveMounts) : undefined;
+  const systemRootWindows = env.SYSTEMROOT;
+  const systemRoot = systemRootWindows ? windowsPathToHostPath(systemRootWindows, driveMounts) : undefined;
+  return {
+    commandExecutable, userProfileWindows, userProfile,
+    ...(localAppDataWindows ? { localAppDataWindows } : {}), ...(localAppData ? { localAppData } : {}),
+    programFilesWindows, programFiles,
+    ...(programDataWindows ? { programDataWindows } : {}), ...(programData ? { programData } : {}),
+    ...(systemRootWindows ? { systemRootWindows } : {}), ...(systemRoot ? { systemRoot } : {}),
+    driveMounts,
+  };
+}

package/src/runtime/platform/windows-recovery-deployment.ts

@@ -0,0 +1,67 @@
+import { join, resolve } from 'path';
+import {
+  hostPathToWindowsPath,
+  windowsPathToHostPath,
+  type WindowsHostEnvironment,
+} from './windows-host-discovery';
+
+export interface WindowsRecoveryDeploymentBinding {
+  schemaVersion: 1;
+  rescueRoot: string;
+  recoveryScriptHostPath: string;
+  recoveryScriptWindowsPath: string;
+  powershellHostPath: string;
+  powershellWindowsPath: string;
+  source: 'discovered' | 'override';
+}
+
+function pair(input: {
+  hostPath?: string;
+  windowsPath?: string;
+  defaultHostPath?: string;
+  defaultWindowsPath?: string;
+  host?: WindowsHostEnvironment;
+  code: string;
+}): { hostPath: string; windowsPath: string; overridden: boolean } {
+  const hostPath = input.hostPath?.trim() || input.defaultHostPath;
+  const windowsPath = input.windowsPath?.trim() || input.defaultWindowsPath;
+  const resolvedHost = hostPath || (windowsPath && input.host ? windowsPathToHostPath(windowsPath, input.host.driveMounts) : undefined);
+  const resolvedWindows = windowsPath || (hostPath && input.host ? hostPathToWindowsPath(hostPath, input.host.driveMounts) : undefined);
+  if (!resolvedHost || !resolvedWindows) throw new Error(`${input.code}: explicit host/windows path pair or discoverable Windows host binding is required`);
+  return { hostPath: resolve(resolvedHost), windowsPath: resolvedWindows, overridden: Boolean(input.hostPath || input.windowsPath) };
+}
+
+export function resolveWindowsRecoveryDeployment(input: {
+  rescueRoot: string;
+  host?: WindowsHostEnvironment;
+  recoveryScriptHostPath?: string;
+  recoveryScriptWindowsPath?: string;
+  powershellHostPath?: string;
+  powershellWindowsPath?: string;
+}): WindowsRecoveryDeploymentBinding {
+  const recovery = pair({
+    hostPath: input.recoveryScriptHostPath,
+    windowsPath: input.recoveryScriptWindowsPath,
+    defaultHostPath: input.host?.programData ? join(input.host.programData, 'ForgeRecovery', 'ForgeRecovery.ps1') : undefined,
+    defaultWindowsPath: input.host?.programDataWindows ? `${input.host.programDataWindows}\\ForgeRecovery\\ForgeRecovery.ps1` : undefined,
+    host: input.host,
+    code: 'WINDOWS_RECOVERY_SCRIPT_DEPLOYMENT_UNRESOLVED',
+  });
+  const powershell = pair({
+    hostPath: input.powershellHostPath,
+    windowsPath: input.powershellWindowsPath,
+    defaultHostPath: input.host?.systemRoot ? join(input.host.systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe') : undefined,
+    defaultWindowsPath: input.host?.systemRootWindows ? `${input.host.systemRootWindows}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe` : undefined,
+    host: input.host,
+    code: 'WINDOWS_RECOVERY_POWERSHELL_DEPLOYMENT_UNRESOLVED',
+  });
+  return {
+    schemaVersion: 1,
+    rescueRoot: resolve(input.rescueRoot),
+    recoveryScriptHostPath: recovery.hostPath,
+    recoveryScriptWindowsPath: recovery.windowsPath,
+    powershellHostPath: powershell.hostPath,
+    powershellWindowsPath: powershell.windowsPath,
+    source: recovery.overridden || powershell.overridden ? 'override' : 'discovered',
+  };
+}

package/src/runtime/plugins/action-application.ts

@@ -0,0 +1,135 @@
+import type { RepositoryRecord } from '../../cli/repositories/types';
+import type { ProcessHandle } from '../execution/process-runtime/types';
+import { startLightweightPluginAction, waitLightweightPluginAction } from './lightweight-action';
+import {
+  executeAssistantPluginDirectNonPersistent,
+  executeAssistantPluginReadDirect,
+  getAssistantPluginManifest,
+  isDirectNonPersistentPluginAction,
+  isDirectPluginReadAction,
+  submitAssistantPluginAction,
+} from './store';
+import type {
+  AssistantPluginActionDescriptor,
+  AssistantPluginActionRequest,
+  AssistantPluginManifest,
+} from './types';
+
+export type AssistantPluginActionApplicationResult =
+  | {
+      kind: 'direct_read';
+      manifest: AssistantPluginManifest;
+      action: AssistantPluginActionDescriptor;
+      result: Record<string, unknown>;
+    }
+  | {
+      kind: 'direct_non_persistent';
+      manifest: AssistantPluginManifest;
+      action: AssistantPluginActionDescriptor;
+      result: Record<string, unknown>;
+    }
+  | {
+      kind: 'lightweight_running';
+      manifest: AssistantPluginManifest;
+      action?: AssistantPluginActionDescriptor;
+      requestId: string;
+      process: ProcessHandle;
+    }
+  | {
+      kind: 'lightweight_failed';
+      manifest: AssistantPluginManifest;
+      action?: AssistantPluginActionDescriptor;
+      requestId: string;
+      process: ProcessHandle;
+    }
+  | {
+      kind: 'submitted';
+      submitted: Awaited<ReturnType<typeof submitAssistantPluginAction>>;
+    };
+
+/**
+ * Canonical plugin execution-path coordinator.
+ *
+ * MCP/CLI adapters translate transport inputs and render results. They do not
+ * decide whether an action executes inline, through the lightweight Process
+ * Runtime, or through the deterministic receipt path.
+ */
+export async function executeAssistantPluginActionApplication(input: {
+  controllerHome: string;
+  repository: RepositoryRecord;
+  request: AssistantPluginActionRequest;
+  interactiveWaitMs?: number;
+  wait?: boolean;
+  waitMs?: number;
+}): Promise<AssistantPluginActionApplicationResult> {
+  const manifest = getAssistantPluginManifest(input.controllerHome, input.repository, input.request.pluginId);
+  const action = manifest.actions.find((entry) => entry.actionId === input.request.actionId);
+
+  if (action && isDirectPluginReadAction(action)) {
+    const direct = await executeAssistantPluginReadDirect(input.controllerHome, input.repository, input.request);
+    return {
+      kind: 'direct_read',
+      manifest: direct.manifest,
+      action: direct.action,
+      result: direct.result,
+    };
+  }
+
+  if (action?.executionMode === 'direct_non_persistent') {
+    if (!isDirectNonPersistentPluginAction(action)) {
+      throw new Error(`PLUGIN_DIRECT_NON_PERSISTENT_CONTRACT_INVALID: ${input.request.pluginId}/${input.request.actionId}`);
+    }
+    const direct = await executeAssistantPluginDirectNonPersistent(input.controllerHome, input.repository, input.request);
+    return {
+      kind: 'direct_non_persistent',
+      manifest: direct.manifest,
+      action: direct.action,
+      result: direct.result,
+    };
+  }
+
+  if (input.repository.repoId !== '__controller__' && action?.executionMode === 'lightweight_process') {
+    const timeoutMs = Math.max(1_000, input.request.timeoutMs ?? action.defaultTimeoutMs ?? 10 * 60_000);
+    let { handle } = await startLightweightPluginAction({
+      controllerHome: input.controllerHome,
+      repository: input.repository,
+      request: input.request,
+      interactiveWaitMs: input.interactiveWaitMs,
+      timeoutMs,
+    });
+    if (!handle.completed && input.wait === true) {
+      handle = await waitLightweightPluginAction(
+        input.controllerHome,
+        input.repository.repoId,
+        handle.processId,
+        Math.max(1, input.waitMs ?? 15_000),
+        input.request.signal,
+      );
+    }
+    if (!handle.completed) {
+      return {
+        kind: 'lightweight_running',
+        manifest,
+        action,
+        requestId: input.request.requestId,
+        process: handle,
+      };
+    }
+    if (!handle.ok) {
+      return {
+        kind: 'lightweight_failed',
+        manifest,
+        action,
+        requestId: input.request.requestId,
+        process: handle,
+      };
+    }
+    // The sidecar writes the authoritative receipt. Re-enter the deterministic
+    // store with the same request id to read/bind that receipt without replay.
+  }
+
+  return {
+    kind: 'submitted',
+    submitted: await submitAssistantPluginAction(input.controllerHome, input.repository, input.request),
+  };
+}

package/src/runtime/plugins/app-store-connect-adapter.ts

@@ -12,11 +12,10 @@ import type {
   AssistantPluginPermissionScope,
 } from './types';
 import { AssistantPluginError, toAssistantPluginError } from './errors';
+import { readRepositoryPluginConfig, writeRepositoryPluginConfig } from './config-store';
 import { buildQueryString, encodeBase64Url, stableMockId } from './google-shared';
 
 const APP_STORE_CONNECT_PLUGIN_ID = 'app_store_connect';
-const CONFIG_ROOT = '.forge/plugins';
-const LEGACY_CONFIG_ROOT = '.repo-harness/plugins';
 const API_BASE_URL = 'https://api.appstoreconnect.apple.com';
 const DEFAULT_TIMEOUT_MS = 60_000;
 const PRIVATE_KEY_READ_MAX_ATTEMPTS = 4;
@@ -72,14 +71,6 @@ function boundedTimeout(value: unknown): number | undefined {
   return normalized && normalized <= 10 * 60_000 ? normalized : undefined;
 }
 
-function configPath(repoRoot: string): string {
-  return join(repoRoot, CONFIG_ROOT, 'app-store-connect.json');
-}
-
-function legacyConfigPath(repoRoot: string): string {
-  return join(repoRoot, LEGACY_CONFIG_ROOT, 'app-store-connect.json');
-}
-
 function globalConfigPath(controllerHome: string): string {
   return join(controllerSystemRoot(controllerHome), 'plugins', 'profiles', 'app-store-connect.json');
 }
@@ -109,17 +100,15 @@ function readConfigFile(path: string): Partial<AppStoreConnectPluginConfig> | un
   }
 }
 
-function repositoryConfig(repoRoot: string): { raw?: Partial<AppStoreConnectPluginConfig>; source?: 'current' | 'legacy' } {
-  const current = readConfigFile(configPath(repoRoot));
-  if (current) return { raw: current, source: 'current' };
-  const legacy = readConfigFile(legacyConfigPath(repoRoot));
-  return legacy ? { raw: legacy, source: 'legacy' } : {};
+function repositoryConfig(repoRoot: string, controllerHome?: string, repoId?: string): Partial<AppStoreConnectPluginConfig> | undefined {
+  if (!controllerHome || !repoId) return undefined;
+  return readRepositoryPluginConfig<Partial<AppStoreConnectPluginConfig>>({ controllerHome, repoId, repoRoot }, APP_STORE_CONNECT_PLUGIN_ID);
 }
 
 function loadConfig(repoRoot: string, controllerHome?: string, repoId?: string): AppStoreConnectPluginConfig {
   const global = controllerHome ? readConfigFile(globalConfigPath(controllerHome)) : undefined;
   if (repoId === CONTROLLER_SCOPE_REPO_ID) return normalizeConfig(global ?? {});
-  const local = repositoryConfig(repoRoot).raw;
+  const local = repositoryConfig(repoRoot, controllerHome, repoId);
   return normalizeConfig({ ...(global ?? {}), ...(local ?? {}) });
 }
 
@@ -142,13 +131,12 @@ function saveConfig(
     return next;
   }
 
+  if (!controllerHome || !repoId) throw new Error('APP_STORE_CONNECT_CONTROLLER_CONTEXT_REQUIRED');
   // Repository state is an overlay only. Do not materialize inherited global
   // credential references into every repository just because configure ran.
-  const existing = repositoryConfig(repoRoot).raw ?? {};
+  const existing = repositoryConfig(repoRoot, controllerHome, repoId) ?? {};
   const overlay = { schemaVersion: 1 as const, ...existing, ...cleanPatch };
-  const path = configPath(repoRoot);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(overlay, null, 2)}\n`, 'utf-8');
+  writeRepositoryPluginConfig({ controllerHome, repoId, repoRoot }, APP_STORE_CONNECT_PLUGIN_ID, overlay);
   return loadConfig(repoRoot, controllerHome, repoId);
 }
 
@@ -840,7 +828,7 @@ export function buildAppStoreConnectPluginManifest(previousRevision = 0, previou
     provider: 'apple',
     displayName: 'App Store Connect API Plugin',
     pluginVersion: '1.1.1',
-    authority: { strategy: 'derived', duplicateStateAllowed: false, sourceOfTruth: ['controller-global:system/plugins/profiles/app-store-connect.json', `repo-overlay:${CONFIG_ROOT}/app-store-connect.json`, `legacy-read-fallback:${LEGACY_CONFIG_ROOT}/app-store-connect.json`, 'env:FORGE_ASC_*'] },
+    authority: { strategy: 'derived', duplicateStateAllowed: false, sourceOfTruth: ['controller-global:system/plugins/profiles/app-store-connect.json', 'controller-home:repositories/<repoId>/plugins/config/app-store-connect.json', 'legacy-import-only:.forge/plugins|.repo-harness/plugins/app-store-connect.json', 'env:FORGE_ASC_*'] },
     enabled: config.enabled,
     lifecycle: { state: state.lifecycleState, reason: !config.enabled ? 'App Store Connect plugin is disabled.' : auth.ready ? 'App Store Connect API credentials are ready.' : auth.errors[0] ?? auth.warnings[0] },
     health: state.health,