@moretea-labs/forge 1.7.2 → 1.8.1

package/adapters/mcp/runtime-gateway/typescript-navigation-sidecar.ts

@@ -0,0 +1,136 @@
+#!/usr/bin/env bun
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+import type { McpPolicy, McpProfileName } from '../types';
+import { resolveMcpPath } from '../paths';
+import { PROCESS_RUNTIME_RELEASE_CANARY_ARG } from '../../../src/runtime/execution/process-runtime/canary';
+import {
+  clearTypeScriptNavigationCache,
+  extractTypeScriptSourceSymbols,
+  navigateTypeScriptSymbol,
+  type TypeScriptNavigationRequest,
+} from '../../../src/runtime/context/typescript-navigation';
+import type {
+  SemanticNavigationOutcome,
+  SemanticNavigationReadPolicy,
+} from '../../../src/runtime/context/semantic-navigation-contract';
+
+interface Envelope {
+  schemaVersion: 1;
+  operation?: 'navigation' | 'source_symbols';
+  repoRoot?: string;
+  requests?: TypeScriptNavigationRequest[];
+  path?: string;
+  source?: string;
+  access?: {
+    cacheScope: string;
+    sourceIdentity?: string;
+    profile: string;
+    readPolicy: SemanticNavigationReadPolicy;
+  };
+}
+
+function profile(value: string): McpProfileName {
+  if (value === 'planner' || value === 'executor' || value === 'orchestrator' || value === 'controller') return value;
+  throw new Error('TYPESCRIPT_NAVIGATION_POLICY_PROFILE_INVALID');
+}
+
+function readPolicy(input: SemanticNavigationReadPolicy): McpPolicy {
+  return {
+    profile: profile(input.profile),
+    readGlobs: [...input.readGlobs],
+    writeGlobs: [],
+    denyGlobs: [...input.denyGlobs],
+    maxFileBytes: input.maxFileBytes,
+    execution: {
+      fixedWorkflowCheck: false,
+      codexRunner: false,
+      agentRunner: false,
+      allowedAgents: [],
+      runnerTimeoutMs: 0,
+      runnerMaxTimeoutMs: 0,
+    },
+  };
+}
+
+export function runTypeScriptNavigationSidecar(
+  argv = process.argv.slice(2),
+  input = readFileSync(0, 'utf8'),
+): number {
+  if (argv.includes(PROCESS_RUNTIME_RELEASE_CANARY_ARG)) {
+    process.stdout.write('forge typescript-navigation release canary\n');
+    return 0;
+  }
+
+  const envelope = JSON.parse(input) as Envelope;
+  if (envelope.schemaVersion !== 1) throw new Error('TYPESCRIPT_NAVIGATION_REQUEST_INVALID');
+  if (envelope.operation === 'source_symbols') {
+    if (typeof envelope.path !== 'string' || typeof envelope.source !== 'string') {
+      throw new Error('TYPESCRIPT_SOURCE_SYMBOL_REQUEST_INVALID');
+    }
+    process.stdout.write(`${JSON.stringify({
+      schemaVersion: 1,
+      symbols: extractTypeScriptSourceSymbols(envelope.path, envelope.source),
+    })}\n`);
+    return 0;
+  }
+  if (!envelope.repoRoot || !Array.isArray(envelope.requests) || !envelope.access) {
+    throw new Error('TYPESCRIPT_NAVIGATION_REQUEST_INVALID');
+  }
+  const repoRoot = resolve(envelope.repoRoot);
+  const policy = readPolicy(envelope.access.readPolicy);
+  const outcomes: SemanticNavigationOutcome[] = [];
+  try {
+    for (const request of envelope.requests) {
+      let policyDeniedReads = 0;
+      const policyDeniedReadSamples = new Set<string>();
+      try {
+        const result = navigateTypeScriptSymbol(repoRoot, request, {
+          cacheScope: envelope.access.cacheScope,
+          sourceIdentity: envelope.access.sourceIdentity,
+          allowRepositoryPath: (relativePath) => {
+            const decision = resolveMcpPath(repoRoot, relativePath, policy, 'read');
+            if (decision.ok) return true;
+            policyDeniedReads += 1;
+            if (policyDeniedReadSamples.size < 20) policyDeniedReadSamples.add(relativePath);
+            return false;
+          },
+        });
+        outcomes.push({
+          ok: true,
+          result: {
+            providerId: 'typescript-language-service',
+            language: 'typescript',
+            navigation: result.navigation,
+            target: result.target,
+            locations: result.locations,
+            policyDeniedReads,
+            ...(policyDeniedReadSamples.size > 0 ? {
+              details: { policyDeniedReadSamples: [...policyDeniedReadSamples] },
+            } : {}),
+          },
+        });
+      } catch (error) {
+        outcomes.push({
+          ok: false,
+          code: 'SEMANTIC_NAVIGATION_FAILED',
+          message: error instanceof Error ? error.message : String(error),
+        });
+      }
+    }
+  } finally {
+    clearTypeScriptNavigationCache();
+  }
+
+  process.stdout.write(`${JSON.stringify({ schemaVersion: 1, outcomes })}\n`);
+  return 0;
+}
+
+if (import.meta.main) {
+  try {
+    process.exitCode = runTypeScriptNavigationSidecar();
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}

package/adapters/mcp/runtime-gateway/work-adapter.ts

@@ -0,0 +1,325 @@
+import type { CallToolResult } from '../../../packages/protocols/mcp/tool-contract';
+import type { MultiRepositoryMcpToolContext } from '../multi-repository';
+import { SEMANTIC_SCOPE_KEY } from '../../../src/cli/repositories/controller-home';
+import { listControllerChecks } from '../../../src/cli/controller/check-runner';
+import { repositoryGitStatus } from '../../../src/cli/repositories/structured-git';
+import { getWorkContract, updateWorkContract, workSemanticView } from '../../../packages/kernel/work/api/index';
+import { ensureRepositoryWorkHandle } from '../../../src/runtime/control-plane/execution/work-handle-authority';
+import { ensureManagedWorkspace } from '../../../src/runtime/execution/managed-workspace';
+import { ensureRepositoryProjectOnboarding } from '../../../src/runtime/control-plane/workspace/project-onboarding';
+import { buildFacadeResult } from '../../../src/runtime/control-plane/facade';
+import { isRhWorkAcceptedOperation } from '../../../src/runtime/control-plane/facade/rh-work-operation-contract';
+import { findControlPlaneRecordsByKey, readControlPlaneRecord } from '../../../src/runtime/control-plane/persistence/sqlite-store';
+import { result } from './result-adapter';
+import { selected } from './shared-adapter';
+import { invalidFacadeOperation } from './status-inbox-adapter';
+import { normalizeRhWorkInputWireMigration } from './work-input-wire-migration';
+import { callRhWorkScheduleAdapter, isRhWorkScheduleOperation } from './scheduler-adapter';
+import { callRhWorkRequirementOperation, isRhWorkRequirementOperation } from './work-requirement-operations';
+import { callRhWorkSemanticOperation, semanticWorkId } from './work-semantic-operations';
+import { callRhWorkListProjection } from './work-list-projection';
+import {
+  callRhWorkPlanCreateOperation,
+  callRhWorkPlanCreateWithoutRepository,
+  callRhWorkPlanOperation,
+} from './work-plan-operations';
+import { callRhWorkWorkflowOperation } from './work-workflow-operations';
+import { callRhWorkLearningOperation } from './work-learning-operations';
+import { callRhWorkControllerOperation } from './work-controller-operations';
+import { runFacadeRepair } from './work-repair-adapter';
+import { isAutomationReceiptCompatibilityCall } from './automation-receipt-adapter';
+import { authenticatedFacadeControllerIdentity } from './controller-authority-adapter';
+
+export { runFacadeRepair };
+export { runtimeIdentitySnapshot } from './controller-authority-adapter';
+
+export function contextRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+
+export function contextText(value: unknown, maxChars: number): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  return value.length <= maxChars ? value : `${value.slice(0, Math.max(0, maxChars - 3))}...`;
+}
+
+function boundedStringList(value: unknown, limit: number): string[] {
+  return Array.isArray(value)
+    ? value.map(String).map((entry) => entry.trim()).filter(Boolean).slice(0, limit)
+    : [];
+}
+
+function repositoryBoundStartRequested(args: Record<string, unknown>): boolean {
+  return typeof args.repo_id === 'string' && args.repo_id.trim().length > 0;
+}
+
+async function callRepositoryBoundStart(
+  ctx: MultiRepositoryMcpToolContext,
+  repository: ReturnType<typeof selected>,
+  args: Record<string, unknown>,
+): Promise<CallToolResult> {
+  const store = { controllerHome: ctx.controllerHome, repoId: repository.repoId };
+  const workId = semanticWorkId(store, args);
+  const semanticStart = await callRhWorkSemanticOperation(store, 'start', { ...args, work_id: workId });
+  if (!semanticStart) {
+    return result(buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_REPOSITORY_ADMISSION_SEMANTIC_START_UNAVAILABLE: ${workId}`,
+      data: { workId, repoId: repository.repoId },
+    }) as unknown as Record<string, unknown>, true);
+  }
+  if (semanticStart.isError) return semanticStart;
+  let contract = getWorkContract(store, workId);
+  if (!contract) {
+    return result(buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_REPOSITORY_ADMISSION_SEMANTIC_CONTEXT_MISSING: ${workId}`,
+      data: { workId, repoId: repository.repoId },
+    }) as unknown as Record<string, unknown>, true);
+  }
+
+  try {
+    const rawConstraints = contextRecord(args.constraints);
+    // Placement is caller-owned. Legacy `auto` is a stable mechanical spelling
+    // of the durable-Work isolated/frozen-base default; it never inspects dirty
+    // paths, risk, task text, or other semantic context to choose topology.
+    const requestedWorkspaceMode: 'current' | 'isolated' = rawConstraints.workspace_mode === 'isolated' || rawConstraints.workspace_mode === 'auto'
+      ? 'isolated'
+      : 'current';
+    const sourceStatus = repositoryGitStatus(repository);
+    const requestedSourceRevision = typeof args.source_revision === 'string' ? args.source_revision.trim() : '';
+    if (requestedSourceRevision && sourceStatus.head && requestedWorkspaceMode !== 'isolated' && requestedSourceRevision !== sourceStatus.head) {
+      throw new Error(`WORK_SOURCE_REVISION_MISMATCH: expected ${requestedSourceRevision}, found ${sourceStatus.head}`);
+    }
+    const requiresIsolatedWorkspace = requestedWorkspaceMode === 'isolated';
+    let checkoutId = repository.activeCheckoutId;
+    let worktreeRef: string | undefined;
+    let baseRevision = sourceStatus.head ?? undefined;
+    if (requiresIsolatedWorkspace) {
+      const workspace = ensureManagedWorkspace(ctx.controllerHome, repository, {
+        requestId: workId,
+        title: String(args.objective ?? workId),
+        ...(requestedSourceRevision ? { baseRef: requestedSourceRevision } : {}),
+        prepareDependencies: args.needs_dependencies === true,
+      });
+      if (!workspace.managed || !workspace.checkoutId || !workspace.root) throw new Error('MANAGED_WORKSPACE_NOT_MATERIALIZED');
+      checkoutId = workspace.checkoutId;
+      worktreeRef = workspace.root;
+      baseRevision = workspace.baseRevision ?? baseRevision;
+    }
+
+    const constraints = {
+      ...contract.constraints,
+      workspaceMode: requestedWorkspaceMode,
+      ...(rawConstraints.allow_commit === false ? { allowCommit: false } : rawConstraints.allow_commit === true ? { allowCommit: true } : {}),
+      ...(rawConstraints.allow_merge === false ? { allowMerge: false } : rawConstraints.allow_merge === true ? { allowMerge: true } : {}),
+      ...(rawConstraints.allow_cleanup === false ? { allowCleanup: false } : rawConstraints.allow_cleanup === true ? { allowCleanup: true } : {}),
+    };
+    contract = updateWorkContract(store, workId, {
+      checkoutId,
+      executionPlacement: { schemaVersion: 1, repositoryId: repository.repoId, checkoutId },
+      ...(baseRevision ? { baseRevision } : {}),
+      ...(worktreeRef ? { worktreeRef } : {}),
+      acceptanceCriteria: boundedStringList(args.acceptance_criteria, 20),
+      checks: boundedStringList(args.check_ids, 30),
+      constraints,
+    });
+    const identity = authenticatedFacadeControllerIdentity(ctx, args);
+    const handle = ensureRepositoryWorkHandle({
+      controllerHome: ctx.controllerHome,
+      repository,
+      workId,
+      checkoutId,
+      identity: { sessionId: identity.sessionId, principalId: identity.principalId },
+    });
+    if (!handle) throw new Error(`WORK_REPOSITORY_ADMISSION_HANDLE_REQUIRED: ${workId}`);
+    const projectOnboarding = ensureRepositoryProjectOnboarding({
+      controllerHome: ctx.controllerHome,
+      repository,
+      sourceRevision: baseRevision,
+    });
+    return result(buildFacadeResult({
+      summary: `Work ${workId} admitted to repository execution on checkout ${checkoutId}.`,
+      data: {
+        work: workSemanticView(contract),
+        deduplicated: Boolean(contextRecord(semanticStart.structuredContent).data && contextRecord(contextRecord(semanticStart.structuredContent).data).deduplicated),
+        projectOnboarding,
+        executionHandle: { workId: handle.workId, checkoutId: handle.checkoutId, managedWorktree: handle.managedWorktree, state: handle.state },
+      },
+    }) as unknown as Record<string, unknown>);
+  } catch (error) {
+    return result(buildFacadeResult({
+      status: 'blocked',
+      summary: `WORK_REPOSITORY_ADMISSION_FAILED: ${error instanceof Error ? error.message : String(error)}`,
+      data: { workId, repoId: repository.repoId, canonicalWorkRetained: true },
+    }) as unknown as Record<string, unknown>, true);
+  }
+}
+
+function semanticStableSpec(operation: string) {
+  if (operation === 'get' || operation === 'revise' || operation === 'complete') {
+    return { namespace: 'work_contract', idField: 'work_id', kind: 'work' as const };
+  }
+  if (operation === 'plan_get' || operation === 'plan_revise') {
+    return { namespace: 'plan_contract', idField: 'plan_id', kind: 'plan' as const };
+  }
+  return undefined;
+}
+
+async function routeStableSemanticOperation(
+  ctx: MultiRepositoryMcpToolContext,
+  operation: string,
+  args: Record<string, unknown>,
+): Promise<CallToolResult | undefined> {
+  const spec = semanticStableSpec(operation);
+  if (!spec) return undefined;
+
+  const id = String(args[spec.idField] ?? '').trim();
+  if (!id) {
+    return result(buildFacadeResult({
+      status: 'not_found',
+      summary: `${spec.kind === 'work' ? 'Work' : 'Plan'} stable id is required.`,
+      data: {},
+    }) as unknown as Record<string, unknown>, true);
+  }
+
+  const explicitRepoId = typeof args.repo_id === 'string' && args.repo_id.trim()
+    ? args.repo_id.trim()
+    : undefined;
+  let targetScope: string;
+  if (explicitRepoId) {
+    const exact = readControlPlaneRecord<unknown>(ctx.controllerHome, spec.namespace, explicitRepoId, id);
+    if (!exact) {
+      return result(buildFacadeResult({
+        status: 'not_found',
+        summary: `${spec.kind === 'work' ? 'Work' : 'Plan'} ${id} not found in repository ${explicitRepoId}.`,
+        data: spec.kind === 'work' ? { workId: id, repoId: explicitRepoId } : { planId: id, repoId: explicitRepoId },
+      }) as unknown as Record<string, unknown>, true);
+    }
+    targetScope = explicitRepoId;
+  } else {
+    const canonicalSemantic = readControlPlaneRecord<unknown>(
+      ctx.controllerHome,
+      spec.namespace,
+      SEMANTIC_SCOPE_KEY,
+      id,
+    );
+    const matches = canonicalSemantic
+      ? [{ ...canonicalSemantic, scope: SEMANTIC_SCOPE_KEY }]
+      : findControlPlaneRecordsByKey<unknown>(ctx.controllerHome, {
+          namespace: spec.namespace,
+          key: id,
+          limit: 2,
+        });
+    if (matches.length === 0) {
+      return result(buildFacadeResult({
+        status: 'not_found',
+        summary: `${spec.kind === 'work' ? 'Work' : 'Plan'} ${id} not found.`,
+        data: spec.kind === 'work' ? { workId: id } : { planId: id },
+      }) as unknown as Record<string, unknown>, true);
+    }
+    if (matches.length > 1) {
+      return result(buildFacadeResult({
+        status: 'blocked',
+        summary: `SEMANTIC_ID_SCOPE_AMBIGUOUS: ${id} resolves to ${matches.length} scopes.`,
+        data: { id, scopes: matches.map((record) => record.scope).sort() },
+      }) as unknown as Record<string, unknown>, true);
+    }
+    targetScope = matches[0]!.scope;
+  }
+
+  const semanticStore = { controllerHome: ctx.controllerHome, scopeKey: targetScope };
+  return spec.kind === 'work'
+    ? callRhWorkSemanticOperation(semanticStore, operation, args)
+    : callRhWorkPlanOperation(semanticStore, operation, args);
+}
+
+/**
+ * Thin rh_work router.
+ *
+ * Work is semantic context only. Repository execution, checks, review, Git
+ * delivery and cleanup are separate capabilities and never re-enter a Work
+ * lifecycle here.
+ */
+export async function callWorkAdapter(
+  ctx: MultiRepositoryMcpToolContext,
+  input: Record<string, unknown>,
+): Promise<CallToolResult> {
+  const wireMigration = normalizeRhWorkInputWireMigration(input);
+  if (!wireMigration.ok) {
+    return result(buildFacadeResult({
+      status: 'blocked',
+      summary: wireMigration.summary,
+      data: wireMigration.data,
+    }) as unknown as Record<string, unknown>, true);
+  }
+
+  const args = wireMigration.args;
+  const operation = wireMigration.operation;
+  if (!isRhWorkAcceptedOperation(operation)) return invalidFacadeOperation('rh_work', operation);
+
+  if (operation === 'repair' && isAutomationReceiptCompatibilityCall(args)) {
+    return result(buildFacadeResult({
+      summary: 'Workflow Supervisor automation receipt accepted for canonical persistence.',
+      data: { automationReceiptCompatibility: true },
+    }) as unknown as Record<string, unknown>);
+  }
+
+  if (isRhWorkRequirementOperation(operation) && operation !== 'requirement_promote_candidate') {
+    const requirement = await callRhWorkRequirementOperation(ctx, undefined, operation, args);
+    if (requirement) return requirement;
+  }
+
+  const stableSemantic = await routeStableSemanticOperation(ctx, operation, args);
+  if (stableSemantic) return stableSemantic;
+
+  const repositoryOptionalPlan = await callRhWorkPlanCreateWithoutRepository(ctx, operation, args);
+  if (repositoryOptionalPlan) return repositoryOptionalPlan;
+
+  if (operation === 'start' && !repositoryBoundStartRequested(args)) {
+    const semanticStart = await callRhWorkSemanticOperation(
+      { controllerHome: ctx.controllerHome, scopeKey: SEMANTIC_SCOPE_KEY },
+      operation,
+      args,
+    );
+    if (semanticStart) return semanticStart;
+  }
+
+  const repository = selected(ctx, args);
+  if (operation === 'start') return callRepositoryBoundStart(ctx, repository, args);
+  const store = { controllerHome: ctx.controllerHome, repoId: repository.repoId };
+
+  const workList = callRhWorkListProjection(store, operation, args);
+  if (workList) return workList;
+
+  if (isRhWorkScheduleOperation(operation)) {
+    return callRhWorkScheduleAdapter(ctx, repository, operation, args);
+  }
+
+  if (operation === 'launcher_start') {
+    const controller = await callRhWorkControllerOperation(ctx, repository, operation, args);
+    if (controller) return controller;
+  }
+
+  const workflow = await callRhWorkWorkflowOperation(ctx, repository, operation, args);
+  if (workflow) return workflow;
+
+  const learning = callRhWorkLearningOperation(ctx, repository, operation, args);
+  if (learning) return learning;
+
+  const requirement = await callRhWorkRequirementOperation(ctx, repository, operation, args);
+  if (requirement) return requirement;
+
+  const plan = await callRhWorkPlanOperation(store, operation, args);
+  if (plan) return plan;
+
+  const planCreate = await callRhWorkPlanCreateOperation(store, operation, args, {
+    controllerHome: ctx.controllerHome,
+    repoId: repository.repoId,
+    checks: listControllerChecks(repository.canonicalRoot),
+  });
+  if (planCreate) return planCreate;
+
+  if (operation === 'repair') return runFacadeRepair(ctx, repository, args);
+
+  return invalidFacadeOperation('rh_work', operation);
+}