@moretea-labs/forge 1.8.0 → 1.8.1

package/scripts/check-tarball-install-smoke.sh

@@ -1,150 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT"
-
-PACKAGE_VERSION="$(node -e 'const fs=require("node:fs"); const pkg=JSON.parse(fs.readFileSync("package.json","utf8")); console.log(pkg.version)')"
-TMP_DIR="$(mktemp -d)"
-trap 'rm -rf "$TMP_DIR"' EXIT
-
-CLEAN_HOME="$TMP_DIR/home"
-CONTROLLER_HOME="$TMP_DIR/controller-home"
-XDG_STATE_HOME_DIR="$TMP_DIR/xdg-state"
-NPM_CACHE_DIR="$TMP_DIR/npm-cache"
-mkdir -p "$CLEAN_HOME" "$XDG_STATE_HOME_DIR" "$NPM_CACHE_DIR"
-export HOME="$CLEAN_HOME"
-export FORGE_CONTROLLER_HOME="$CONTROLLER_HOME"
-export XDG_STATE_HOME="$XDG_STATE_HOME_DIR"
-export npm_config_cache="$NPM_CACHE_DIR"
-unset BUN_INSTALL
-# The hosting immutable Runtime may be older than the package under test. Its
-# build identity must not override the installed tarball's package version.
-unset FORGE_BUILD_VERSION
-
-if [[ -e "$FORGE_CONTROLLER_HOME" ]]; then
-  echo "[tarball-smoke] ERROR: isolated Controller Home must start empty: $FORGE_CONTROLLER_HOME" >&2
-  exit 1
-fi
-
-if [[ "$#" -gt 0 ]]; then
-  TARBALL_PATH="$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"
-  if [[ ! -f "$TARBALL_PATH" ]]; then
-    echo "[tarball-smoke] ERROR: tarball not found: $TARBALL_PATH" >&2
-    exit 1
-  fi
-  TARBALL="$(basename "$TARBALL_PATH")"
-else
-  PACK_OUTPUT="$(npm pack --silent --pack-destination "$TMP_DIR")"
-  TARBALL="$(printf '%s\n' "$PACK_OUTPUT" | awk '/\.tgz$/ { name=$0 } END { print name }')"
-  if [[ -z "$TARBALL" ]]; then
-    echo "[tarball-smoke] ERROR: npm pack did not report a tarball filename" >&2
-    printf '%s\n' "$PACK_OUTPUT" >&2
-    exit 1
-  fi
-  TARBALL_PATH="$TMP_DIR/$TARBALL"
-fi
-APP_DIR="$TMP_DIR/app"
-TARGET_REPO="$TMP_DIR/target-repo"
-
-mkdir -p "$APP_DIR" "$TARGET_REPO"
-git -C "$TARGET_REPO" init -q
-
-cd "$APP_DIR"
-printf '{"private":true,"name":"forge-tarball-smoke","version":"0.0.0"}
-' > package.json
-npm install "$TARBALL_PATH" --omit=optional --ignore-scripts --no-audit --no-fund >/dev/null
-
-CLI="$APP_DIR/node_modules/.bin/forge"
-HOOK="$APP_DIR/node_modules/.bin/forge-hook"
-
-VERSION="$("$CLI" --version)"
-if [[ "$VERSION" != "$PACKAGE_VERSION" ]]; then
-  echo "[tarball-smoke] ERROR: forge --version returned $VERSION, expected $PACKAGE_VERSION" >&2
-  exit 1
-fi
-
-(cd "$TARGET_REPO" && "$CLI" status --json >"$TMP_DIR/status.json")
-"$CLI" adopt --repo "$TARGET_REPO" --dry-run --json >"$TMP_DIR/adopt-plan.json"
-node - "$TMP_DIR/adopt-plan.json" <<'JS_EOF'
-const fs = require('node:fs');
-const path = process.argv[2];
-const plan = JSON.parse(fs.readFileSync(path, 'utf8'));
-if (plan.protocol !== 1 || plan.command !== "adopt" || plan.apply !== false) {
-  console.error("[tarball-smoke] ERROR: packaged adopt dry-run did not return protocol v1 plan JSON");
-  process.exit(1);
-}
-JS_EOF
-
-if ! "$CLI" run check-task-workflow --help >/dev/null; then
-  echo "[tarball-smoke] ERROR: packaged 'forge run check-task-workflow --help' failed (run dispatcher / helper lookup / bin startup broken)" >&2
-  exit 1
-fi
-printf '{"prompt":"review release readiness"}\n' | "$HOOK" prompt-guard-decide >/dev/null
-
-SETUP_OUTPUT="$TMP_DIR/setup-open.txt"
-"$CLI" setup open --controller mcp --tunnel none --capability computer.observe.v1 --json >"$SETUP_OUTPUT"
-for marker in \
-  "forge setup: open" \
-  "Primary controller: mcp" \
-  "Install the user-level Forge Runtime" \
-  "forge runtime service install-package --controller-home"; do
-  if ! grep -Fq "$marker" "$SETUP_OUTPUT"; then
-    echo "[tarball-smoke] ERROR: packaged setup did not expose expected bootstrap marker: $marker" >&2
-    cat "$SETUP_OUTPUT" >&2
-    exit 1
-  fi
-done
-
-case "$(uname -s)" in
-  Darwin)
-    if ! grep -Eq 'Platform: macos/[^;]+; service=launchd' "$SETUP_OUTPUT"; then
-      echo "[tarball-smoke] ERROR: macOS packaged bootstrap did not select launchd" >&2
-      cat "$SETUP_OUTPUT" >&2
-      exit 1
-    fi
-    ;;
-  Linux)
-    if ! grep -Eq 'Platform: (linux|wsl2)/[^;]+; service=(systemd-user|portable)' "$SETUP_OUTPUT"; then
-      echo "[tarball-smoke] ERROR: Linux packaged bootstrap did not select systemd-user or the explicit portable fallback" >&2
-      cat "$SETUP_OUTPUT" >&2
-      exit 1
-    fi
-    ;;
-esac
-
-COMPUTER_STATUS="$TMP_DIR/computer-status.json"
-"$CLI" computer status --controller-home "$FORGE_CONTROLLER_HOME" --json >"$COMPUTER_STATUS"
-node - "$COMPUTER_STATUS" <<'JS_EOF'
-const fs = require('node:fs');
-const path = process.argv[2];
-const status = JSON.parse(fs.readFileSync(path, 'utf8'));
-if (status.schemaVersion !== 1 || status.product !== 'computer' || !Array.isArray(status.capabilities)) {
-  console.error('[tarball-smoke] ERROR: packaged Computer status did not expose the capability-level contract');
-  process.exit(1);
-}
-if (status.ready !== true) {
-  const blockers = status.capabilities.filter((entry) => entry.ready !== true);
-  if (blockers.length === 0 || blockers.some((entry) => typeof entry.reason !== 'string' || entry.reason.trim().length === 0)) {
-    console.error('[tarball-smoke] ERROR: non-ready Computer status lacked a precise capability blocker');
-    process.exit(1);
-  }
-}
-JS_EOF
-
-if [[ -d "$FORGE_CONTROLLER_HOME" ]] && grep -RIlF "$ROOT" "$FORGE_CONTROLLER_HOME" 2>/dev/null | grep -q .; then
-  echo "[tarball-smoke] ERROR: packaged Controller state captured the Forge source checkout path" >&2
-  exit 1
-fi
-
-CLI_REALPATH="$(node -e 'const fs=require("node:fs"); console.log(fs.realpathSync(process.argv[1]))' "$CLI")"
-APP_REALPATH="$(node -e 'const fs=require("node:fs"); console.log(fs.realpathSync(process.argv[1]))' "$APP_DIR")"
-case "$CLI_REALPATH" in
-  "$APP_REALPATH"/*) ;;
-  *)
-    echo "[tarball-smoke] ERROR: packaged forge executable resolved outside isolated install: $CLI_REALPATH" >&2
-    exit 1
-    ;;
-esac
-
-echo "[tarball-smoke] OK: ${TARBALL} installs under isolated HOME/Controller Home and packaged CLI bins start without Bun."

package/scripts/package-source-archive.sh

@@ -1,147 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT"
-
-usage() {
-  cat <<'EOF'
-Usage: scripts/package-source-archive.sh [output.zip]
-
-Build a portable source archive from the current working tree.
-The archive excludes rebuildable dependencies, Git metadata, and machine-local runtime state.
-EOF
-}
-
-fail() {
-  echo "source-archive: $*" >&2
-  exit 1
-}
-
-normalize_path() {
-  local value="${1#./}"
-  printf '%s\n' "${value%/}"
-}
-
-is_allowed_ai_path() {
-  case "$1" in
-    .ai/context/*) return 0 ;;
-    .ai/hooks/*) return 0 ;;
-    .ai/harness/brain-manifest.json) return 0 ;;
-    .ai/harness/policy.json) return 0 ;;
-    .ai/harness/workflow-contract.json) return 0 ;;
-    .ai/harness/*/.gitkeep) return 0 ;;
-    .ai/harness/*/*/.gitkeep) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-should_include() {
-  local path
-  path="$(normalize_path "$1")"
-  [[ -n "$path" ]] || return 1
-
-  case "$path" in
-    node_modules|node_modules/*) return 1 ;;
-    .git|.git/*) return 1 ;;
-    .codegraph|.codegraph/*) return 1 ;;
-    _ops|_ops/*) return 1 ;;
-    coverage|coverage/*) return 1 ;;
-    artifacts|artifacts/*) return 1 ;;
-    autoresearch|autoresearch/*) return 1 ;;
-    .DS_Store|*/.DS_Store) return 1 ;;
-    *.log|*.tgz|*.tar.gz|*.zip) return 1 ;;
-    SOURCE_ARCHIVE_MANIFEST.sha256) return 1 ;;
-    .ai|.ai/*)
-      is_allowed_ai_path "$path"
-      return
-      ;;
-    *)
-      return 0
-      ;;
-  esac
-}
-
-copy_path() {
-  local rel="$1"
-  local source="$ROOT/$rel"
-  local target="$STAGE_ROOT/$rel"
-
-  if [[ -L "$source" ]]; then
-    fail "symlink is not allowed in source archive: $rel"
-  fi
-  if [[ -d "$source" ]]; then
-    return 0
-  fi
-  if [[ ! -f "$source" ]]; then
-    fail "missing source file: $rel"
-  fi
-
-  mkdir -p "$(dirname "$target")"
-  cp "$source" "$target"
-}
-
-build_manifest() {
-  local manifest="$STAGE_ROOT/SOURCE_ARCHIVE_MANIFEST.sha256"
-  : >"$manifest"
-  while IFS= read -r rel; do
-    [[ -n "$rel" ]] || continue
-    local file="${rel#./}"
-    [[ "$file" == "SOURCE_ARCHIVE_MANIFEST.sha256" ]] && continue
-    shasum -a 256 "$file"
-  done < <(
-    cd "$STAGE_ROOT"
-    find . -type f | LC_ALL=C sort
-  ) >>"$manifest"
-}
-
-if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
-  usage
-  exit 0
-fi
-
-if [[ $# -gt 1 ]]; then
-  usage >&2
-  exit 2
-fi
-
-TIMESTAMP="$(date '+%Y%m%d-%H%M%S')"
-ARCHIVE_STEM="forge-source-${TIMESTAMP}"
-OUTPUT="${1:-$ROOT/artifacts/source-archives/${ARCHIVE_STEM}.zip}"
-[[ "$OUTPUT" == *.zip ]] || OUTPUT="${OUTPUT}.zip"
-[[ "$OUTPUT" == /* ]] || OUTPUT="$ROOT/$OUTPUT"
-
-mkdir -p "$(dirname "$OUTPUT")"
-[[ ! -e "$OUTPUT" ]] || fail "output already exists: $OUTPUT"
-
-STAGE_PARENT="$(mktemp -d "${TMPDIR:-/tmp}/forge-source-archive.XXXXXX")"
-trap 'rm -rf "$STAGE_PARENT"' EXIT
-STAGE_ROOT="$STAGE_PARENT/$ARCHIVE_STEM"
-mkdir -p "$STAGE_ROOT"
-
-included_count=0
-while IFS= read -r -d '' rel; do
-  rel="$(normalize_path "$rel")"
-  should_include "$rel" || continue
-  copy_path "$rel"
-  included_count=$((included_count + 1))
-done < <(git ls-files --cached --others --exclude-standard -z)
-
-(( included_count > 0 )) || fail "no files selected for archive"
-
-build_manifest
-
-(
-  cd "$STAGE_PARENT"
-  zip -qr "$OUTPUT" "$ARCHIVE_STEM"
-)
-
-if unzip -Z -1 "$OUTPUT" | rg -q '(^|/)node_modules/'; then
-  fail "archive unexpectedly contains node_modules"
-fi
-if unzip -Z -1 "$OUTPUT" | rg -q '(^|/)\.git/'; then
-  fail "archive unexpectedly contains .git"
-fi
-
-echo "source archive ready: $OUTPUT"
-echo "included files: $included_count + SOURCE_ARCHIVE_MANIFEST.sha256"

package/scripts/public-release-files.txt

@@ -1,39 +0,0 @@
-# Public release allowlist. Directory entries are recursive.
-.gitignore
-.npmignore
-.github/
-.agents/
-AGENTS.md
-CLAUDE.md
-LICENSE
-CHANGELOG.md
-CONTRIBUTING.md
-SECURITY.md
-SUPPORT.md
-CODE_OF_CONDUCT.md
-NOTICE
-THIRD_PARTY_NOTICES.md
-README.md
-README.en.md
-README.zh-CN.md
-README.ja.md
-README.es.md
-README.fr.md
-SKILL.md
-agents/
-assets/
-bun.lock
-install.ps1
-install.sh
-package.json
-package-lock.json
-docs/README.md
-docs/tutorials/
-docs/operations/releasing.md
-docs/operations/releasing.zh-CN.md
-docs/operations/github-repository.md
-docs/operations/homebrew.md
-docs/wiki/
-scripts/
-src/
-tsconfig.json

package/scripts/public-release.ts

@@ -1,174 +0,0 @@
-#!/usr/bin/env bun
-import { spawnSync } from "node:child_process";
-import {
-  copyFileSync,
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  realpathSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const manifest = process.env.FORGE_PUBLIC_MANIFEST
-  ? resolve(process.env.FORGE_PUBLIC_MANIFEST)
-  : join(root, "scripts/public-release-files.txt");
-
-function fail(message: string): never {
-  throw new Error(`public export: ${message}`);
-}
-
-function inside(base: string, candidate: string): boolean {
-  const value = relative(base, candidate);
-  return value === "" || (!value.startsWith(`..${sep}`) && value !== ".." && !isAbsolute(value));
-}
-
-function normalized(path: string): string {
-  return path.replaceAll("\\", "/").replace(/^\.\//, "");
-}
-
-function forbidden(path: string): boolean {
-  const value = normalized(path);
-  const roots = [
-    ".git",
-    ".ai",
-    ".claude",
-    ".codex",
-    ".forge",
-    "tasks",
-    "coverage",
-    "artifacts",
-    "autoresearch",
-    "docs/researches",
-  ];
-  return (
-    roots.some((entry) => value === entry || value.startsWith(`${entry}/`)) ||
-    /^docs\/forge-.*-file-manifest\.sha256$/.test(value) ||
-    /\.(?:log|tgz|tar\.gz|pem|key)$/.test(value)
-  );
-}
-
-function manifestEntries(): string[] {
-  if (!existsSync(manifest)) fail(`manifest not found: ${manifest}`);
-  return readFileSync(manifest, "utf-8")
-    .split("\n")
-    .map((line) => line.replace(/#.*$/, "").trim())
-    .filter(Boolean)
-    .map((entry) => {
-      if (isAbsolute(entry)) fail(`absolute manifest entry is forbidden: ${entry}`);
-      if (entry.split("/").includes("..")) fail(`parent traversal is forbidden: ${entry}`);
-      return entry;
-    });
-}
-
-function selectedFiles(): string[] {
-  const files = new Set<string>();
-  for (const entry of manifestEntries()) {
-    const result = spawnSync(
-      "git",
-      ["ls-files", "--cached", "--others", "--exclude-standard", "--", entry],
-      { cwd: root, encoding: "utf-8" },
-    );
-    if (result.status !== 0) fail(`git ls-files failed for ${entry}: ${result.stderr.trim()}`);
-    const directoryEntry = entry.endsWith("/");
-    for (const line of result.stdout.split("\n")) {
-      const file = normalized(line.trim());
-      if (!file) continue;
-      if (!existsSync(join(root, file))) {
-        if (directoryEntry) continue;
-        fail(`selected file disappeared: ${file}`);
-      }
-      files.add(file);
-    }
-  }
-  const result = [...files].sort();
-  if (result.length === 0) fail("manifest selected no files");
-  return result;
-}
-
-function copyFiles(output: string, files: string[]): void {
-  for (const file of files) {
-    if (forbidden(file)) fail(`forbidden file selected: ${file}`);
-    const source = join(root, file);
-    if (!existsSync(source)) fail(`selected file disappeared: ${file}`);
-    const stat = lstatSync(source);
-    if (stat.isDirectory()) continue;
-    if (stat.isSymbolicLink()) {
-      const target = realpathSync(source);
-      if (!inside(root, target)) fail(`symlink escapes repository: ${file} -> ${target}`);
-    } else if (!stat.isFile()) {
-      fail(`unsupported file type selected: ${file}`);
-    }
-    const target = join(output, file);
-    mkdirSync(dirname(target), { recursive: true });
-    copyFileSync(source, target);
-  }
-}
-
-function walk(directory: string): string[] {
-  const result: string[] = [];
-  for (const entry of readdirSync(directory, { withFileTypes: true })) {
-    const path = join(directory, entry.name);
-    if (entry.isDirectory()) result.push(...walk(path));
-    else if (entry.isFile()) result.push(path);
-    else fail(`non-regular file in export: ${path}`);
-  }
-  return result;
-}
-
-function scan(output: string): void {
-  for (const required of ["LICENSE", "NOTICE", "THIRD_PARTY_NOTICES.md", "package.json", "package-lock.json", "README.md", "README.en.md", "src", "scripts"]) {
-    if (!existsSync(join(output, required))) fail(`required public file missing: ${required}`);
-  }
-  for (const blocked of [".git", ".ai", ".claude", ".codex", ".forge", "tasks", "coverage", "artifacts", "autoresearch"]) {
-    if (existsSync(join(output, blocked))) fail(`runtime/internal path leaked: ${blocked}`);
-  }
-
-  const ignoredScanners = new Set([
-    "scripts/public-release.ts",
-    "scripts/check-public-export.sh",
-    "scripts/check-open-source-tracked-surface.sh",
-  ]);
-  const patterns: Array<[string, RegExp]> = [
-    ["macOS personal path detected", /(?<![A-Za-z0-9._-])\/Users\/[^/\s"'`]+/],
-    ["Linux personal path detected", /(?<![A-Za-z0-9._-])\/home\/[^/\s"'`]+/],
-    ["private key detected", /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/],
-    ["AWS access key detected", /AKIA[0-9A-Z]{16}/],
-    ["GitHub token detected", /gh[pousr]_[A-Za-z0-9_]{20,}/],
-    ["OpenAI-style secret detected", /(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}/],
-    ["real repository binding detected", /repo_[0-9a-f]{24,}/],
-    ["real checkout binding detected", /checkout_[0-9a-f]{16,}/],
-  ];
-
-  for (const path of walk(output)) {
-    const rel = normalized(relative(output, path));
-    if (forbidden(rel)) fail(`runtime, key, or package snapshot file detected: ${rel}`);
-    if (ignoredScanners.has(rel) || basename(rel).endsWith(".svg")) continue;
-    const bytes = readFileSync(path);
-    if (bytes.includes(0)) continue;
-    const text = bytes.toString("utf-8");
-    for (const [label, pattern] of patterns) {
-      if (pattern.test(text)) fail(`${label}: ${rel}`);
-    }
-  }
-}
-
-const requestedOutput = process.argv[2];
-const output = requestedOutput
-  ? resolve(requestedOutput)
-  : mkdtempSync(join(tmpdir(), "forge-public-"));
-if (requestedOutput) {
-  if (existsSync(output)) fail(`output already exists: ${output}`);
-  mkdirSync(output, { recursive: true });
-}
-if (output === root || inside(output, root)) fail("output must not replace or contain the source repository");
-
-const files = selectedFiles();
-copyFiles(output, files);
-scan(output);
-console.log(`public export ready: ${output} (${files.length} files)`);

package/scripts/publish-release-tarball.sh

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT"
-
-CHANNEL="${1:-latest}"
-NPM_RELEASE_REGISTRY="${NPM_RELEASE_REGISTRY:-https://registry.npmjs.org/}"
-if [[ "$CHANNEL" != "latest" && "$CHANNEL" != "next" ]]; then
-  echo "usage: $0 latest|next" >&2
-  exit 2
-fi
-
-node scripts/check-release-version.mjs --channel "$CHANNEL" --require-tag
-bash scripts/check-npm-release.sh
-TARBALL_PATH="$(cat .ai/harness/artifacts/release/latest-tarball.txt)"
-if [[ ! -f "$TARBALL_PATH" ]]; then
-  echo "[release] reusable tarball missing: $TARBALL_PATH" >&2
-  exit 1
-fi
-echo "[release] publish registry: ${NPM_RELEASE_REGISTRY}"
-if [[ "${NPM_RELEASE_BOOTSTRAP:-0}" == "1" ]]; then
-  echo "[release] bootstrap publication: disabling provenance for this one-time local publish"
-  npm publish "$TARBALL_PATH" --tag "$CHANNEL" --access public --registry "$NPM_RELEASE_REGISTRY" --provenance=false
-else
-  npm publish "$TARBALL_PATH" --tag "$CHANNEL" --access public --registry "$NPM_RELEASE_REGISTRY"
-fi