@moretea-labs/forge 1.7.2 → 1.8.1

package/scripts/package-source-archive.sh

@@ -1,147 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT"
-
-usage() {
-  cat <<'EOF'
-Usage: scripts/package-source-archive.sh [output.zip]
-
-Build a portable source archive from the current working tree.
-The archive excludes rebuildable dependencies, Git metadata, and machine-local runtime state.
-EOF
-}
-
-fail() {
-  echo "source-archive: $*" >&2
-  exit 1
-}
-
-normalize_path() {
-  local value="${1#./}"
-  printf '%s\n' "${value%/}"
-}
-
-is_allowed_ai_path() {
-  case "$1" in
-    .ai/context/*) return 0 ;;
-    .ai/hooks/*) return 0 ;;
-    .ai/harness/brain-manifest.json) return 0 ;;
-    .ai/harness/policy.json) return 0 ;;
-    .ai/harness/workflow-contract.json) return 0 ;;
-    .ai/harness/*/.gitkeep) return 0 ;;
-    .ai/harness/*/*/.gitkeep) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-should_include() {
-  local path
-  path="$(normalize_path "$1")"
-  [[ -n "$path" ]] || return 1
-
-  case "$path" in
-    node_modules|node_modules/*) return 1 ;;
-    .git|.git/*) return 1 ;;
-    .codegraph|.codegraph/*) return 1 ;;
-    _ops|_ops/*) return 1 ;;
-    coverage|coverage/*) return 1 ;;
-    artifacts|artifacts/*) return 1 ;;
-    autoresearch|autoresearch/*) return 1 ;;
-    .DS_Store|*/.DS_Store) return 1 ;;
-    *.log|*.tgz|*.tar.gz|*.zip) return 1 ;;
-    SOURCE_ARCHIVE_MANIFEST.sha256) return 1 ;;
-    .ai|.ai/*)
-      is_allowed_ai_path "$path"
-      return
-      ;;
-    *)
-      return 0
-      ;;
-  esac
-}
-
-copy_path() {
-  local rel="$1"
-  local source="$ROOT/$rel"
-  local target="$STAGE_ROOT/$rel"
-
-  if [[ -L "$source" ]]; then
-    fail "symlink is not allowed in source archive: $rel"
-  fi
-  if [[ -d "$source" ]]; then
-    return 0
-  fi
-  if [[ ! -f "$source" ]]; then
-    fail "missing source file: $rel"
-  fi
-
-  mkdir -p "$(dirname "$target")"
-  cp "$source" "$target"
-}
-
-build_manifest() {
-  local manifest="$STAGE_ROOT/SOURCE_ARCHIVE_MANIFEST.sha256"
-  : >"$manifest"
-  while IFS= read -r rel; do
-    [[ -n "$rel" ]] || continue
-    local file="${rel#./}"
-    [[ "$file" == "SOURCE_ARCHIVE_MANIFEST.sha256" ]] && continue
-    shasum -a 256 "$file"
-  done < <(
-    cd "$STAGE_ROOT"
-    find . -type f | LC_ALL=C sort
-  ) >>"$manifest"
-}
-
-if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ $# -gt 1 ]]; then
-  usage >&2
-  exit 2
-fi
-
-TIMESTAMP="$(date '+%Y%m%d-%H%M%S')"
-ARCHIVE_STEM="forge-source-${TIMESTAMP}"
-OUTPUT="${1:-$ROOT/artifacts/source-archives/${ARCHIVE_STEM}.zip}"
-[[ "$OUTPUT" == *.zip ]] || OUTPUT="${OUTPUT}.zip"
-[[ "$OUTPUT" == /* ]] || OUTPUT="$ROOT/$OUTPUT"
-
-mkdir -p "$(dirname "$OUTPUT")"
-[[ ! -e "$OUTPUT" ]] || fail "output already exists: $OUTPUT"
-
-STAGE_PARENT="$(mktemp -d "${TMPDIR:-/tmp}/forge-source-archive.XXXXXX")"
-trap 'rm -rf "$STAGE_PARENT"' EXIT
-STAGE_ROOT="$STAGE_PARENT/$ARCHIVE_STEM"
-mkdir -p "$STAGE_ROOT"
-
-included_count=0
-while IFS= read -r -d '' rel; do
-  rel="$(normalize_path "$rel")"
-  should_include "$rel" || continue
-  copy_path "$rel"
-  included_count=$((included_count + 1))
-done < <(git ls-files --cached --others --exclude-standard -z)
-
-(( included_count > 0 )) || fail "no files selected for archive"
-
-build_manifest
-
-(
-  cd "$STAGE_PARENT"
-  zip -qr "$OUTPUT" "$ARCHIVE_STEM"
-)
-
-if unzip -Z -1 "$OUTPUT" | rg -q '(^|/)node_modules/'; then
-  fail "archive unexpectedly contains node_modules"
-fi
-if unzip -Z -1 "$OUTPUT" | rg -q '(^|/)\.git/'; then
-  fail "archive unexpectedly contains .git"
-fi
-
-echo "source archive ready: $OUTPUT"
-echo "included files: $included_count + SOURCE_ARCHIVE_MANIFEST.sha256"

package/scripts/public-release-files.txt

@@ -1,39 +0,0 @@
-# Public release allowlist. Directory entries are recursive.
-.gitignore
-.npmignore
-.github/
-.agents/
-AGENTS.md
-CLAUDE.md
-LICENSE
-CHANGELOG.md
-CONTRIBUTING.md
-SECURITY.md
-SUPPORT.md
-CODE_OF_CONDUCT.md
-NOTICE
-THIRD_PARTY_NOTICES.md
-README.md
-README.en.md
-README.zh-CN.md
-README.ja.md
-README.es.md
-README.fr.md
-SKILL.md
-agents/
-assets/
-bun.lock
-install.ps1
-install.sh
-package.json
-package-lock.json
-docs/README.md
-docs/tutorials/
-docs/operations/releasing.md
-docs/operations/releasing.zh-CN.md
-docs/operations/github-repository.md
-docs/operations/homebrew.md
-docs/wiki/
-scripts/
-src/
-tsconfig.json

package/scripts/public-release.ts

@@ -1,174 +0,0 @@
-#!/usr/bin/env bun
-import { spawnSync } from "node:child_process";
-import {
-  copyFileSync,
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  realpathSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const manifest = process.env.FORGE_PUBLIC_MANIFEST
-  ? resolve(process.env.FORGE_PUBLIC_MANIFEST)
-  : join(root, "scripts/public-release-files.txt");
-
-function fail(message: string): never {
-  throw new Error(`public export: ${message}`);
-}
-
-function inside(base: string, candidate: string): boolean {
-  const value = relative(base, candidate);
-  return value === "" || (!value.startsWith(`..${sep}`) && value !== ".." && !isAbsolute(value));
-}
-
-function normalized(path: string): string {
-  return path.replaceAll("\\", "/").replace(/^\.\//, "");
-}
-
-function forbidden(path: string): boolean {
-  const value = normalized(path);
-  const roots = [
-    ".git",
-    ".ai",
-    ".claude",
-    ".codex",
-    ".forge",
-    "tasks",
-    "coverage",
-    "artifacts",
-    "autoresearch",
-    "docs/researches",
-  ];
-  return (
-    roots.some((entry) => value === entry || value.startsWith(`${entry}/`)) ||
-    /^docs\/forge-.*-file-manifest\.sha256$/.test(value) ||
-    /\.(?:log|tgz|tar\.gz|pem|key)$/.test(value)
-  );
-}
-
-function manifestEntries(): string[] {
-  if (!existsSync(manifest)) fail(`manifest not found: ${manifest}`);
-  return readFileSync(manifest, "utf-8")
-    .split("\n")
-    .map((line) => line.replace(/#.*$/, "").trim())
-    .filter(Boolean)
-    .map((entry) => {
-      if (isAbsolute(entry)) fail(`absolute manifest entry is forbidden: ${entry}`);
-      if (entry.split("/").includes("..")) fail(`parent traversal is forbidden: ${entry}`);
-      return entry;
-    });
-}
-
-function selectedFiles(): string[] {
-  const files = new Set<string>();
-  for (const entry of manifestEntries()) {
-    const result = spawnSync(
-      "git",
-      ["ls-files", "--cached", "--others", "--exclude-standard", "--", entry],
-      { cwd: root, encoding: "utf-8" },
-    );
-    if (result.status !== 0) fail(`git ls-files failed for ${entry}: ${result.stderr.trim()}`);
-    const directoryEntry = entry.endsWith("/");
-    for (const line of result.stdout.split("\n")) {
-      const file = normalized(line.trim());
-      if (!file) continue;
-      if (!existsSync(join(root, file))) {
-        if (directoryEntry) continue;
-        fail(`selected file disappeared: ${file}`);
-      }
-      files.add(file);
-    }
-  }
-  const result = [...files].sort();
-  if (result.length === 0) fail("manifest selected no files");
-  return result;
-}
-
-function copyFiles(output: string, files: string[]): void {
-  for (const file of files) {
-    if (forbidden(file)) fail(`forbidden file selected: ${file}`);
-    const source = join(root, file);
-    if (!existsSync(source)) fail(`selected file disappeared: ${file}`);
-    const stat = lstatSync(source);
-    if (stat.isDirectory()) continue;
-    if (stat.isSymbolicLink()) {
-      const target = realpathSync(source);
-      if (!inside(root, target)) fail(`symlink escapes repository: ${file} -> ${target}`);
-    } else if (!stat.isFile()) {
-      fail(`unsupported file type selected: ${file}`);
-    }
-    const target = join(output, file);
-    mkdirSync(dirname(target), { recursive: true });
-    copyFileSync(source, target);
-  }
-}
-
-function walk(directory: string): string[] {
-  const result: string[] = [];
-  for (const entry of readdirSync(directory, { withFileTypes: true })) {
-    const path = join(directory, entry.name);
-    if (entry.isDirectory()) result.push(...walk(path));
-    else if (entry.isFile()) result.push(path);
-    else fail(`non-regular file in export: ${path}`);
-  }
-  return result;
-}
-
-function scan(output: string): void {
-  for (const required of ["LICENSE", "NOTICE", "THIRD_PARTY_NOTICES.md", "package.json", "package-lock.json", "README.md", "README.en.md", "src", "scripts"]) {
-    if (!existsSync(join(output, required))) fail(`required public file missing: ${required}`);
-  }
-  for (const blocked of [".git", ".ai", ".claude", ".codex", ".forge", "tasks", "coverage", "artifacts", "autoresearch"]) {
-    if (existsSync(join(output, blocked))) fail(`runtime/internal path leaked: ${blocked}`);
-  }
-
-  const ignoredScanners = new Set([
-    "scripts/public-release.ts",
-    "scripts/check-public-export.sh",
-    "scripts/check-open-source-tracked-surface.sh",
-  ]);
-  const patterns: Array<[string, RegExp]> = [
-    ["macOS personal path detected", /(?<![A-Za-z0-9._-])\/Users\/[^/\s"'`]+/],
-    ["Linux personal path detected", /(?<![A-Za-z0-9._-])\/home\/[^/\s"'`]+/],
-    ["private key detected", /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/],
-    ["AWS access key detected", /AKIA[0-9A-Z]{16}/],
-    ["GitHub token detected", /gh[pousr]_[A-Za-z0-9_]{20,}/],
-    ["OpenAI-style secret detected", /(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}/],
-    ["real repository binding detected", /repo_[0-9a-f]{24,}/],
-    ["real checkout binding detected", /checkout_[0-9a-f]{16,}/],
-  ];
-
-  for (const path of walk(output)) {
-    const rel = normalized(relative(output, path));
-    if (forbidden(rel)) fail(`runtime, key, or package snapshot file detected: ${rel}`);
-    if (ignoredScanners.has(rel) || basename(rel).endsWith(".svg")) continue;
-    const bytes = readFileSync(path);
-    if (bytes.includes(0)) continue;
-    const text = bytes.toString("utf-8");
-    for (const [label, pattern] of patterns) {
-      if (pattern.test(text)) fail(`${label}: ${rel}`);
-    }
-  }
-}
-
-const requestedOutput = process.argv[2];
-const output = requestedOutput
-  ? resolve(requestedOutput)
-  : mkdtempSync(join(tmpdir(), "forge-public-"));
-if (requestedOutput) {
-  if (existsSync(output)) fail(`output already exists: ${output}`);
-  mkdirSync(output, { recursive: true });
-}
-if (output === root || inside(output, root)) fail("output must not replace or contain the source repository");
-
-const files = selectedFiles();
-copyFiles(output, files);
-scan(output);
-console.log(`public export ready: ${output} (${files.length} files)`);

package/scripts/publish-release-tarball.sh

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT"
-
-CHANNEL="${1:-latest}"
-NPM_RELEASE_REGISTRY="${NPM_RELEASE_REGISTRY:-https://registry.npmjs.org/}"
-if [[ "$CHANNEL" != "latest" && "$CHANNEL" != "next" ]]; then
-  echo "usage: $0 latest|next" >&2
-  exit 2
-fi
-
-node scripts/check-release-version.mjs --channel "$CHANNEL" --require-tag
-bash scripts/check-npm-release.sh
-TARBALL_PATH="$(cat .ai/harness/artifacts/release/latest-tarball.txt)"
-if [[ ! -f "$TARBALL_PATH" ]]; then
-  echo "[release] reusable tarball missing: $TARBALL_PATH" >&2
-  exit 1
-fi
-echo "[release] publish registry: ${NPM_RELEASE_REGISTRY}"
-if [[ "${NPM_RELEASE_BOOTSTRAP:-0}" == "1" ]]; then
-  echo "[release] bootstrap publication: disabling provenance for this one-time local publish"
-  npm publish "$TARBALL_PATH" --tag "$CHANNEL" --access public --registry "$NPM_RELEASE_REGISTRY" --provenance=false
-else
-  npm publish "$TARBALL_PATH" --tag "$CHANNEL" --access public --registry "$NPM_RELEASE_REGISTRY"
-fi