@moretea-labs/forge 1.7.2 → 1.8.1

package/src/cli/commands/runtime.ts

@@ -5,12 +5,14 @@ import { fileURLToPath } from 'url';
 import { resolveControllerHome, resolveRepoPreferredControllerHome } from '../repositories/controller-home';
 import { findExecutionJob, listActiveExecutionJobs, listExecutionJobs } from '../../runtime/execution/jobs/store';
 import { readJobEvents } from '../../runtime/evidence/event-ledger';
-import { getRepository, listRepositories } from '../repositories/registry';
+import { findRegisteredRepositoryByCheckoutRoot, getRepository, listRepositories } from '../repositories/registry';
 import { executeReadOnlyDiagnostic, isReadOnlyDiagnosticTool } from '../../runtime/diagnostics/read-only-tool';
 import { readRepositoryProjection } from '../../runtime/projections/materialized-view';
-import { listOccurrences, listSchedules } from '../../runtime/workflow/schedules/store';
+import { listOccurrences, listSchedules } from '../../../packages/kernel/scheduler/api/index';
 import { observeRuntimeStatus } from '../../runtime/root/status';
-import { readMcpServiceBearerToken } from '../mcp/auth';
+import { readMcpServiceBearerToken } from '../../../adapters/mcp/auth';
+import { createSetupBootstrapControlApi } from './bootstrap-control';
+import { readSetupProfile, runtimeDeploymentTopologyForSetupProfile } from './setup-profile';
 import { publishRuntimeRelease } from '../../runtime/root/release-store';
 import { installForgeRuntimeService } from '../../runtime/root/service';
 import { activateScheduledPackageRuntimeServiceFromPath, installPackageRuntimeService, readPackageRuntimeActivationReceipt } from '../../runtime/root/package-runtime-service';
@@ -72,15 +74,18 @@ export function buildRuntimeCommand(): Command {
         writeFileSync(tokenPath, `${token}\n`, { mode: 0o600 });
       }
       const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+      const setupProfile = readSetupProfile();
       const result = await installPackageRuntimeService({
         controllerHome: home,
         packageRoot,
         host: opts.host,
         port,
         authTokenFile: tokenPath,
+        ...(setupProfile ? { topology: runtimeDeploymentTopologyForSetupProfile(setupProfile) } : {}),
         forcePortable: opts.portable === true,
         refreshConnector: opts.refreshConnector === true,
       });
+      const bootstrap = await createSetupBootstrapControlApi({ controllerHome: home }).refresh();
       output({
         status: result.status,
         mode: result.mode,
@@ -99,6 +104,7 @@ export function buildRuntimeCommand(): Command {
         connector: result.connector,
         activation: result.activation,
         warnings: result.warnings,
+        bootstrap: { status: bootstrap.status, revision: bootstrap.revision, blockers: bootstrap.blockers, actions: bootstrap.actions },
         next: result.activation
           ? `forge runtime service activation-status --receipt ${result.activation.receiptPath}`
           : `forge runtime status --controller-home ${home}`,
@@ -113,7 +119,6 @@ export function buildRuntimeCommand(): Command {
     .option('--port <port>', 'MCP listener port', '8765')
     .option('--stage-only', 'Build and validate the immutable Runtime release without publishing or activating it')
     .option('--auth-token-file <path>', 'Raw bearer token file (defaults to controllerHome/mcp/runtime-token, created from the MCP bearer token when missing)')
-    .option('--exclusive-work-id <id>', 'Persistently admit only this P0 Work while migration is active')
     .option('--node-executable <path>', 'Executable launchd uses to run the Forge Runtime service runner', process.execPath)
     .option('--runner-path <path>', 'Forge Runtime service runner entry', join(resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..'), 'bin', 'forge-runtime-service.mjs'))
     .action(async (opts: {
@@ -122,7 +127,6 @@ export function buildRuntimeCommand(): Command {
       host: string;
       port: string;
       authTokenFile?: string;
-      exclusiveWorkId?: string;
       nodeExecutable: string;
       runnerPath: string;
       stageOnly?: boolean;
@@ -133,7 +137,9 @@ export function buildRuntimeCommand(): Command {
       const port = Number(opts.port);
       if (!Number.isInteger(port) || port < 1 || port > 65_535) throw new Error('RUNTIME_SERVICE_PORT_INVALID');
 
-      const staged = stageRuntimeReleaseFromCandidateSource({ controllerHome: home, sourceRoot: repoRoot });
+      const sourceRepository = findRegisteredRepositoryByCheckoutRoot(repoRoot, home);
+      if (!sourceRepository) throw new Error(`RUNTIME_SERVICE_REPOSITORY_NOT_REGISTERED: ${repoRoot}`);
+      const staged = stageRuntimeReleaseFromCandidateSource({ controllerHome: home, sourceRoot: repoRoot, sourceRepositoryId: sourceRepository.repoId });
       assertRuntimeReleaseFiles(staged);
       if (opts.stageOnly === true) {
         output({
@@ -166,7 +172,6 @@ export function buildRuntimeCommand(): Command {
           host: opts.host,
           port,
           authTokenFile: tokenPath,
-          ...(opts.exclusiveWorkId?.trim() ? { exclusiveWorkId: opts.exclusiveWorkId.trim() } : {}),
         },
         runnerPath: resolve(opts.runnerPath),
         nodeExecutable: resolve(opts.nodeExecutable),

package/src/cli/commands/setup-profile.ts

@@ -1,10 +1,14 @@
 import { spawnSync } from 'child_process';
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
 import { homedir } from 'os';
-import { loadMcpServiceLocalConfig } from '../mcp/auth';
+import { loadMcpServiceLocalConfig } from '../../../adapters/mcp/auth';
 import { resolveControllerHome } from '../repositories/controller-home';
 import { observeRuntimeStatus } from '../../runtime/root/status';
 import { dirname, join, resolve } from 'path';
+import { openAiSecureTunnelStatusArgs, parseOpenAiSecureTunnelRuntimeStatus, tunnelRuntimeProfileTargetsEndpoint } from '../../../adapters/mcp/tunnels/openai-secure-tunnel';
+import { discoverExecutable, type ExecutableDiscoveryResult } from '../../runtime/platform/executable-discovery';
+import { resolvePlatformServiceManager, type PlatformServiceManagerKind } from '../../runtime/platform/service-manager';
+import { deriveRuntimeDeploymentTopology, type RuntimeDeploymentTopology } from '../../runtime/root/deployment-topology';
 
 export type SetupControllerKind = 'chatgpt' | 'codex' | 'claude' | 'mcp';
 export type SetupTunnelProvider = 'auto' | 'openai' | 'cloudflare' | 'tailscale' | 'existing' | 'none';
@@ -14,6 +18,7 @@ export interface SetupProfile {
   schemaVersion: 1;
   primaryController: SetupControllerKind;
   controllers: SetupControllerKind[];
+  capabilityIntents?: string[];
   tunnel: {
     provider: SetupTunnelProvider;
     endpoint?: string;
@@ -27,7 +32,7 @@ export interface SetupPlatformSnapshot {
   platform: NodeJS.Platform;
   arch: string;
   environment: 'macos' | 'linux' | 'wsl2' | 'windows' | 'other';
-  serviceManager: 'launchd' | 'systemd-user' | 'windows-preview' | 'foreground';
+  serviceManager: PlatformServiceManagerKind;
   commands: {
     brew: boolean;
     cloudflared: boolean;
@@ -36,6 +41,7 @@ export interface SetupPlatformSnapshot {
     systemctl: boolean;
     winget: boolean;
   };
+  prerequisites?: Record<string, ExecutableDiscoveryResult>;
 }
 
 export interface SetupProfileOptions {
@@ -50,6 +56,7 @@ export interface ConfigureSetupProfileOptions extends SetupProfileOptions {
   tunnel?: string;
   endpoint?: string;
   tunnelId?: string;
+  capabilities?: string[];
 }
 
 export interface TunnelGuidance {
@@ -90,6 +97,12 @@ function normalizeTunnel(value: string | undefined): SetupTunnelProvider | undef
   return normalized as SetupTunnelProvider;
 }
 
+function normalizeCapabilityIntent(value: string): string {
+  const normalized = value.trim().toLowerCase();
+  if (!/^[-a-z0-9_.]{3,128}$/.test(normalized)) throw new Error(`invalid capability intent "${value}"`);
+  return normalized;
+}
+
 function normalizeTunnelId(value: string | undefined): string | undefined {
   const trimmed = value?.trim();
   if (!trimmed) return undefined;
@@ -115,7 +128,8 @@ export function readSetupProfile(options: SetupProfileOptions = {}): SetupProfil
     const controllers = Array.isArray(value.controllers)
       ? value.controllers.filter((entry): entry is SetupControllerKind => CONTROLLERS.includes(entry))
       : [];
-    return { ...value, controllers: Array.from(new Set([value.primaryController, ...controllers])) };
+    const capabilityIntents = Array.isArray(value.capabilityIntents) ? value.capabilityIntents.filter((entry): entry is string => typeof entry === 'string').map(normalizeCapabilityIntent) : [];
+    return { ...value, controllers: Array.from(new Set([value.primaryController, ...controllers])), capabilityIntents: Array.from(new Set(capabilityIntents)).sort() };
   } catch {
     return undefined;
   }
@@ -128,6 +142,7 @@ export function configureSetupProfile(options: ConfigureSetupProfileOptions): Se
     ?? 'chatgpt';
   const additions = (options.addControllers ?? []).map((entry) => normalizeController(entry, 'forge setup configure --add-controller')!);
   const controllers = Array.from(new Set([primaryController, ...(previous?.controllers ?? []), ...additions]));
+  const capabilityIntents = Array.from(new Set([...(previous?.capabilityIntents ?? []), ...(options.capabilities ?? []).map(normalizeCapabilityIntent)])).sort();
   const provider = normalizeTunnel(options.tunnel)
     ?? previous?.tunnel.provider
     ?? (controllers.some((entry) => entry === 'chatgpt' || entry === 'mcp') ? 'auto' : 'none');
@@ -146,6 +161,7 @@ export function configureSetupProfile(options: ConfigureSetupProfileOptions): Se
     schemaVersion: 1,
     primaryController,
     controllers,
+    capabilityIntents,
     tunnel: { provider, ...(endpoint ? { endpoint } : {}), ...(tunnelId ? { tunnelId } : {}) },
     createdAt: previous?.createdAt ?? now,
     updatedAt: now,
@@ -172,11 +188,30 @@ export function setupNeedsRemoteAccess(profile: SetupProfile | undefined): boole
   return Boolean(profile?.controllers.some((entry) => entry === 'chatgpt' || entry === 'mcp'));
 }
 
-function commandExists(command: string, platform = process.platform): boolean {
-  const probe = platform === 'win32'
-    ? spawnSync('where.exe', [command], { stdio: 'ignore' })
-    : spawnSync('sh', ['-lc', `command -v ${command}`], { stdio: 'ignore' });
-  return probe.status === 0;
+export function runtimeDeploymentTopologyForSetupProfile(profile: SetupProfile): RuntimeDeploymentTopology {
+  return deriveRuntimeDeploymentTopology({
+    controllers: profile.controllers,
+    capabilityIntents: profile.capabilityIntents,
+  });
+}
+
+export type SetupConnectorAuthMode = 'oauth' | 'none';
+
+export function setupConnectorAuthMode(profile: SetupProfile | undefined): SetupConnectorAuthMode {
+  const provider = profile?.tunnel.provider === 'auto' ? 'openai' : profile?.tunnel.provider;
+  return provider === 'openai' ? 'none' : 'oauth';
+}
+
+function chatgptConnectorRepairCommand(profile: SetupProfile, controllerHome: string): string {
+  const endpoint = profile.tunnel.endpoint
+    ? ` --endpoint ${profile.tunnel.endpoint}`
+    : ' --clear-endpoint';
+  return `forge mcp setup chatgpt --user-level --controller-home ${JSON.stringify(controllerHome)} --connector-auth ${setupConnectorAuthMode(profile)}${endpoint}`;
+}
+
+
+function commandExists(command: string, platform = process.platform, env: NodeJS.ProcessEnv = process.env): boolean {
+  return discoverExecutable({ id: command, candidates: [command], platform, env }).status === 'ready';
 }
 
 function isWsl(env: NodeJS.ProcessEnv): boolean {
@@ -188,20 +223,30 @@ export function detectSetupPlatform(options: { platform?: NodeJS.Platform; arch?
   const platform = options.platform ?? process.platform;
   const env = options.env ?? process.env;
   const wsl = platform === 'linux' && isWsl(env);
-  const systemctl = platform === 'linux' && commandExists('systemctl', platform);
+  const prerequisites = Object.fromEntries([
+    ['brew', discoverExecutable({ id: 'brew', candidates: ['brew'], platform, env, supportedPlatforms: ['darwin'], recovery: 'Install Homebrew only when a selected provider requires it.' })],
+    ['cloudflared', discoverExecutable({ id: 'cloudflared', candidates: ['cloudflared'], platform, env, recovery: 'Install cloudflared or choose another tunnel provider.' })],
+    ['tailscale', discoverExecutable({ id: 'tailscale', candidates: ['tailscale'], platform, env, recovery: 'Install Tailscale or choose another tunnel provider.' })],
+    ['tunnelClient', discoverExecutable({ id: 'tunnel-client', candidates: ['tunnel-client'], platform, env, recovery: 'Install the selected tunnel client or configure an existing HTTPS endpoint.' })],
+    ['systemctl', discoverExecutable({ id: 'systemctl', candidates: ['systemctl'], platform, env, supportedPlatforms: ['linux'], recovery: 'Use portable service mode when systemd-user is unavailable.' })],
+    ['winget', discoverExecutable({ id: 'winget', candidates: ['winget'], platform, env, supportedPlatforms: ['win32'], recovery: 'Install prerequisites manually or provide an explicit executable path.' })],
+  ]);
+  const systemctl = prerequisites.systemctl?.status === 'ready';
+  const serviceManager = resolvePlatformServiceManager({ platform, systemdUserAvailable: systemctl });
   return {
     platform,
     arch: options.arch ?? process.arch,
     environment: platform === 'darwin' ? 'macos' : platform === 'linux' ? (wsl ? 'wsl2' : 'linux') : platform === 'win32' ? 'windows' : 'other',
-    serviceManager: platform === 'darwin' ? 'launchd' : platform === 'linux' && systemctl ? 'systemd-user' : platform === 'win32' ? 'windows-preview' : 'foreground',
+    serviceManager: serviceManager.kind,
     commands: {
-      brew: platform === 'darwin' && commandExists('brew', platform),
-      cloudflared: commandExists('cloudflared', platform),
-      tailscale: commandExists('tailscale', platform),
-      tunnelClient: commandExists('tunnel-client', platform),
+      brew: prerequisites.brew?.status === 'ready',
+      cloudflared: prerequisites.cloudflared?.status === 'ready',
+      tailscale: prerequisites.tailscale?.status === 'ready',
+      tunnelClient: prerequisites.tunnelClient?.status === 'ready',
       systemctl,
-      winget: platform === 'win32' && commandExists('winget', platform),
+      winget: prerequisites.winget?.status === 'ready',
     },
+    prerequisites,
   };
 }
 
@@ -220,11 +265,6 @@ function isLoopbackMcpEndpoint(value: string | undefined): value is string {
   }
 }
 
-function tunnelRuntimeProfileTargetsEndpoint(profilePath: string | undefined, endpoint: string): boolean {
-  if (!profilePath) return false;
-  try { return readFileSync(profilePath, 'utf8').includes(endpoint); } catch { return false; }
-}
-
 export interface ControllerGuidance {
   controller: SetupControllerKind;
   ready: boolean;
@@ -265,14 +305,14 @@ export function resolveControllerGuidance(
         && Number.isInteger(localConfig.server?.port);
       const connectorReady = controller !== 'chatgpt' || isLoopbackMcpEndpoint(localConfig?.chatgpt?.localEndpoint);
       const endpointReady = !profile.tunnel.endpoint || localConfig?.chatgpt?.endpoint === profile.tunnel.endpoint;
-      if (!localReady || !connectorReady || !endpointReady) {
-        const endpoint = profile.tunnel.endpoint ? ` --endpoint ${profile.tunnel.endpoint}` : '';
+      const authReady = localConfig?.auth?.mode === setupConnectorAuthMode(profile);
+      if (!localReady || !connectorReady || !endpointReady || !authReady) {
         return {
           controller,
           ready: false,
           title: controller === 'chatgpt' ? 'Configure the ChatGPT controller endpoint' : 'Configure the remote MCP controller endpoint',
-          detail: 'Create or refresh the Forge OAuth/MCP configuration in the selected Controller Home. This does not install Codex or Claude and does not require a repository.',
-          command: `forge mcp setup chatgpt --user-level --controller-home ${JSON.stringify(controllerHome)}${endpoint}`,
+          detail: 'Create or refresh the transport-aware Forge MCP configuration in the selected Controller Home. Secure Tunnel uses tunnel authority at the loopback Connector; public HTTPS connectors retain OAuth.',
+          command: chatgptConnectorRepairCommand(profile, controllerHome),
         };
       }
       continue;
@@ -344,9 +384,6 @@ export function resolveTunnelGuidance(
   if (!profile || !setupNeedsRemoteAccess(profile)) {
     return { provider: 'none', ready: true, title: 'Remote controller connection', detail: 'Not required by the configured local controller set.' };
   }
-  if (profile.tunnel.endpoint) {
-    return { provider: profile.tunnel.provider, ready: true, title: 'HTTPS endpoint configured', detail: `Configured: ${profile.tunnel.endpoint}. Live connector reachability is verified in the ChatGPT connection step.` };
-  }
   let provider = profile.tunnel.provider;
   if (provider === 'auto') {
     // ChatGPT's private outbound path is the default. Do not silently choose a
@@ -355,6 +392,21 @@ export function resolveTunnelGuidance(
     // fallback provider.
     provider = 'openai';
   }
+  const controllerHome = resolveControllerHome(options.controllerHome);
+  const localConfig = loadMcpServiceLocalConfig(controllerHome);
+  const expectedAuthMode = setupConnectorAuthMode(profile);
+  if (profile.tunnel.endpoint) {
+    if (localConfig && localConfig.auth?.mode !== expectedAuthMode) {
+      return {
+        provider,
+        ready: false,
+        title: 'Restore the public HTTPS Connector OAuth boundary',
+        detail: 'Public HTTPS MCP transport must terminate at the OAuth-protected Connector rather than the bearer-only Runtime.',
+        command: chatgptConnectorRepairCommand(profile, controllerHome),
+      };
+    }
+    return { provider, ready: true, title: 'HTTPS endpoint configured', detail: `Configured: ${profile.tunnel.endpoint}. Live connector reachability is verified in the ChatGPT connection step.` };
+  }
   if (provider === 'openai') {
     if (!profile.tunnel.tunnelId) {
       return {
@@ -369,13 +421,21 @@ export function resolveTunnelGuidance(
         detail: 'Install the supported tunnel-client binary from OpenAI Platform Tunnels or the official openai/tunnel-client release. The runtime API key remains an environment/file reference owned by tunnel-client; Forge does not store it.',
       };
     }
-    const localConfig = loadMcpServiceLocalConfig(resolveControllerHome(options.controllerHome));
+    if (localConfig && localConfig.auth?.mode !== expectedAuthMode) {
+      return {
+        provider,
+        ready: false,
+        title: 'Align the Secure Tunnel Connector authorization boundary',
+        detail: 'OpenAI Secure MCP Tunnel must terminate at a loopback Connector using tunnel/workspace authority, not a loopback browser OAuth issuer.',
+        command: chatgptConnectorRepairCommand(profile, controllerHome),
+      };
+    }
     const localEndpoint = localConfig?.chatgpt?.localEndpoint;
     if (!isLoopbackMcpEndpoint(localEndpoint)) {
       return {
-        provider, ready: false, title: 'Prepare the local ChatGPT OAuth endpoint',
-        detail: 'Secure Tunnel must terminate at Forge’s loopback OAuth Gateway, not the bearer-only Canonical Runtime. Refresh the user-level ChatGPT MCP configuration first.',
-        command: `forge mcp setup chatgpt --user-level --controller-home ${JSON.stringify(resolveControllerHome(options.controllerHome))}`,
+        provider, ready: false, title: 'Prepare the local ChatGPT Secure Tunnel Connector',
+        detail: 'Secure Tunnel must terminate at Forge’s loopback transport-authorized Connector, not the bearer-only Canonical Runtime and not a browser-facing loopback OAuth issuer. Refresh the user-level ChatGPT MCP configuration first.',
+        command: chatgptConnectorRepairCommand(profile, controllerHome),
       };
     }
     const preferredAlias = 'forge';
@@ -393,13 +453,11 @@ export function resolveTunnelGuidance(
     }
     const aliases = Array.from(new Set([...configuredAliases, preferredAlias]));
     for (const alias of aliases) {
-      const status = spawnSync('tunnel-client', ['runtimes', 'status', alias, '--json'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 15_000, env: options.env ?? process.env });
+      const status = spawnSync('tunnel-client', openAiSecureTunnelStatusArgs(alias), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 15_000, env: options.env ?? process.env });
       if (status.status !== 0) continue;
       try {
-        const value = JSON.parse(status.stdout || '{}') as { process_running?: boolean; healthy?: boolean; ready?: boolean; tunnel_id?: string; profile_path?: string };
-        if (value.process_running === true && value.healthy === true && value.ready === true
-          && value.tunnel_id === profile.tunnel.tunnelId
-          && tunnelRuntimeProfileTargetsEndpoint(value.profile_path, localEndpoint)) {
+        const value = parseOpenAiSecureTunnelRuntimeStatus(status.stdout || '{}', { alias, tunnelId: profile.tunnel.tunnelId, mcpServerUrl: localEndpoint });
+        if (value.ok) {
           return {
             provider, ready: true, title: 'OpenAI Secure MCP Tunnel',
             detail: `Managed runtime ${alias} is running, healthy, and bound to ${profile.tunnel.tunnelId} -> ${localEndpoint}.`,
@@ -448,7 +506,7 @@ export function resolveTunnelGuidance(
     }
     return {
       provider, ready: false, title: 'Create a stable Cloudflare Tunnel',
-      detail: 'Authenticate cloudflared, create/route a named tunnel to 127.0.0.1:8765, then record its HTTPS /mcp URL.',
+      detail: 'Authenticate cloudflared, create/route a named tunnel to the loopback OAuth Connector (normally 127.0.0.1:8767), then record its HTTPS /mcp URL. Never expose the bearer-only Canonical Runtime directly.',
       command: 'cloudflared tunnel login',
     };
   }
@@ -464,8 +522,8 @@ export function resolveTunnelGuidance(
   }
   return {
     provider: 'tailscale', ready: false, title: 'Enable Tailscale Funnel',
-    detail: 'Expose only the local Forge MCP service and then record the generated HTTPS /mcp URL.',
-    command: 'tailscale funnel --bg 8765',
+    detail: 'Expose only the loopback OAuth Connector and then record the generated HTTPS /mcp URL. Never expose the bearer-only Canonical Runtime directly.',
+    command: 'tailscale funnel --bg 8767',
   };
 }
 

package/src/cli/commands/status.ts

@@ -18,7 +18,8 @@ import { FORGE_VERSION } from '../../version';
 
 export const CLI_VERSION = FORGE_VERSION;
 
-const OPT_IN_MARKER = '.ai/harness/workflow-contract.json';
+const OPT_IN_MARKER = 'forge.config.json';
+const LEGACY_OPT_IN_MARKER = '.ai/harness/workflow-contract.json';
 
 export interface StatusReport {
   cli: { version: string };