@oomerevren/tryforge 0.1.2 → 0.1.3

package/dist/cli/src/core/semver.js

@@ -1,5 +1,5 @@
-// cli/src/core/semver.ts — Epoch 1c: tam semver (^ ~ >= > <= < * exact + kompozit + x-range + pre-release)
-// Tek kaynak (single source of truth) — registry.ts ve project.ts burayı kullanır.
+// cli/src/core/semver.ts — Epoch 1c: full semver (^ ~ >= > <= < * exact + composite + x-range + pre-release)
+// Single source of truth — used by registry.ts and project.ts.
 export function parseSemver(v) {
     const m = v.trim().match(/^(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:[-.]?([a-zA-Z0-9.]+))?/);
     if (!m)
@@ -50,17 +50,17 @@ export function isValidRange(r) {
         return true;
     if (/^\d+\.\d+\.(\*|x)$/.test(t))
         return true;
-    // Kısmi aralıklar: ^1, ~1, ~1.2
+    // Partial ranges: ^1, ~1, ~1.2
     if (/^\^\d+$/.test(t))
         return true;
     if (/^~\d+$/.test(t))
         return true;
     if (/^~\d+\.\d+$/.test(t))
         return true;
-    // Tek operatörler: >=1.0.0, <2.0.0, =1.2.3
+    // Single operators: >=1.0.0, <2.0.0, =1.2.3
     if (/^(>=|<=|>|<|=)\s*v?\d+\.\d+\.\d+/.test(t))
         return true;
-    // Kompozit aralıklar: >=1.2.0 <2.0.0
+    // Composite ranges: >=1.2.0 <2.0.0
     if (/^(>=|<=|>|<)\s*v?\d+\.\d+\.\d+\s+(>=|<=|>|<)\s*v?\d+\.\d+\.\d+/.test(t))
         return true;
     return false;
@@ -69,7 +69,7 @@ export function satisfiesRange(version, range) {
     const r = range.trim();
     if (r === "*" || r === "" || r === "latest")
         return true;
-    // Kompozit aralık: "op1 ver1 op2 ver2"
+    // Composite range: "op1 ver1 op2 ver2"
     const composite = r.match(/^(>=|<=|>|<)\s*(v?\d+\.\d+\.\d+)\s+(>=|<=|>|<)\s*(v?\d+\.\d+\.\d+)$/);
     if (composite) {
         const [, op1, ver1, op2, ver2] = composite;
@@ -125,7 +125,7 @@ export function satisfiesRange(version, range) {
         // 1.2.x → major = 1, minor = 2
         return pv.major === parseInt(maj, 10) && pv.minor === parseInt(min, 10);
     }
-    // Tek operatörler
+    // Single operators
     if (r.startsWith(">="))
         return applyOp(version, ">=", r.slice(2).trim());
     if (r.startsWith("<="))

package/dist/cli/src/core/sign.js

@@ -1,5 +1,5 @@
-// cli/src/core/sign.ts — Epoch 1e: paket imzalama/doğrulama
-// RSA key pair ile paket imzalama, verified publisher sistemi
+// cli/src/core/sign.ts — Epoch 1e: package signing/verification
+// RSA key-pair package signing, verified-publisher system
 import { createHash, createSign, createVerify, generateKeyPairSync } from "crypto";
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
 import { join } from "path";

package/dist/cli/src/core/sources.js

@@ -0,0 +1,171 @@
+// cli/src/core/sources.ts — Decentralized package sources (Phase 3).
+//
+// Beyond the verified registry, forge resolves:
+//   registry:      pdf/merge, pdf/merge@^1.0.0          (default)
+//   github:        github:owner/repo[#ref], owner/repo (fallback when the
+//                  registry has no such name), https://github.com/o/r[.git][#ref]
+//   git:           https://host/...git, git@host:... (shallow clone)
+//   local:         ./path, ../path, /abs/path (monorepo / custom skills)
+//
+// Registry names win on conflict (owner/repo first tries the registry, then
+// falls back to GitHub). Remote sources are cloned shallow (--depth 1) into
+// a temp dir; the manifest (forge.toml [package], else SKILL.md / agent.md)
+// is parsed for name/version/type/description.
+import { existsSync, readFileSync, mkdirSync, rmSync, readdirSync } from "fs";
+import { join, resolve, basename } from "path";
+import { tmpdir } from "os";
+import { execFileSync } from "child_process";
+import { parse } from "smol-toml";
+import { copyDirRecursive } from "./fsutil.js";
+export function parseSourceArg(arg) {
+    const a = arg.trim();
+    // Local paths: ./x, ../x, /abs, ~/x, or .\x on Windows
+    if (a.startsWith("./") ||
+        a.startsWith("../") ||
+        a.startsWith(".\\") ||
+        a.startsWith("/") ||
+        a.startsWith("~/") ||
+        /^[a-zA-Z]:[\\/]/.test(a)) {
+        return { kind: "local", source: `local:${a}`, ref: a, explicit: true };
+    }
+    // github:owner/repo[#ref]
+    if (a.startsWith("github:")) {
+        const rest = a.slice("github:".length);
+        const hash = rest.indexOf("#");
+        const repo = hash === -1 ? rest : rest.slice(0, hash);
+        const want = hash === -1 ? undefined : rest.slice(hash + 1);
+        assertRepoShape(repo);
+        return { kind: "github", source: want ? `github:${repo}@${want}` : `github:${repo}`, ref: repo, want, explicit: true };
+    }
+    // Direct git URLs (optional #ref trailer)
+    if (/^(https?:\/\/|git@|ssh:\/\/)/.test(a)) {
+        let url = a;
+        let want;
+        const schemeEnd = a.indexOf("://") + 3;
+        const hash = a.lastIndexOf("#");
+        if (hash > schemeEnd) {
+            want = a.slice(hash + 1);
+            url = a.slice(0, hash);
+        }
+        const kind = url.includes("github.com") ? "github" : "git";
+        return { kind, source: want ? `${url}@${want}` : url, ref: url, want, explicit: true };
+    }
+    // owner/repo shorthand (registry fallback handled by caller)
+    if (/^[a-z0-9-]+\/[a-z0-9-_.]+(#[a-z0-9-_.]+)?$/i.test(a)) {
+        const hash = a.indexOf("#");
+        const repo = hash === -1 ? a : a.slice(0, hash);
+        const want = hash === -1 ? undefined : a.slice(hash + 1);
+        return { kind: "github", source: want ? `github:${repo}@${want}` : `github:${repo}`, ref: repo, want, explicit: false };
+    }
+    return { kind: "registry", source: "registry", ref: a, explicit: true };
+}
+function assertRepoShape(repo) {
+    if (!/^[a-z0-9-]+\/[a-z0-9-_.]+$/i.test(repo)) {
+        throw new Error(`[forge] invalid GitHub repo "${repo}" — expected owner/repo`);
+    }
+}
+function stageDir() {
+    const dir = join(tmpdir(), `forge-src-${process.pid}-${Date.now()}`);
+    mkdirSync(dir, { recursive: true });
+    return dir;
+}
+function parseManifest(dir, fallbackName) {
+    const tomlPath = join(dir, "forge.toml");
+    if (existsSync(tomlPath)) {
+        try {
+            const parsed = parse(readFileSync(tomlPath, "utf-8"));
+            const pkg = parsed.package;
+            if (pkg && typeof pkg.name === "string") {
+                const type = typeof pkg.type === "string" ? pkg.type : "skill";
+                return {
+                    name: pkg.name,
+                    version: typeof pkg.version === "string" ? pkg.version : "0.0.0",
+                    type,
+                    description: typeof pkg.description === "string" ? pkg.description : `${pkg.name} (from external source)`,
+                };
+            }
+        }
+        catch (e) {
+            throw new Error(`[forge] invalid forge.toml in ${dir}: ${e.message}`, { cause: e });
+        }
+    }
+    // Fall back to SKILL.md / agent.md conventions
+    const skillMd = join(dir, "SKILL.md");
+    const agentMd = join(dir, "agent.md");
+    const mdPath = existsSync(skillMd) ? skillMd : existsSync(agentMd) ? agentMd : null;
+    if (mdPath) {
+        const raw = readFileSync(mdPath, "utf-8");
+        const heading = raw.split("\n").map((l) => l.trim()).find((l) => l.startsWith("# "));
+        const scope = fallbackName.replace(/[^a-z0-9-]/gi, "").toLowerCase() || "external";
+        return {
+            name: `external/${basename(dir).replace(/[^a-z0-9-]/gi, "").toLowerCase() || scope}`,
+            version: "0.0.0",
+            type: mdPath === agentMd ? "agent" : "skill",
+            description: heading ? heading.replace(/^#\s+/, "").slice(0, 200) : `${fallbackName} (from external source)`,
+        };
+    }
+    throw new Error(`[forge] no manifest in ${dir}: expected forge.toml, SKILL.md, or agent.md`);
+}
+/** Resolve a local directory source into a staged package. */
+export function resolveLocalSource(absDir) {
+    const dir = resolve(absDir.replace(/^~\//, `${process.env.HOME ?? ""}/`));
+    if (!existsSync(dir))
+        throw new Error(`[forge] local source not found: ${absDir}`);
+    const stat = (() => {
+        try {
+            return { dir: readdirSync(dir).length >= 0 };
+        }
+        catch {
+            return null;
+        }
+    })();
+    if (!stat)
+        throw new Error(`[forge] local source is not a directory: ${absDir}`);
+    const meta = parseManifest(dir, basename(dir));
+    const stage = stageDir();
+    // NOTE: raw fs.cpSync silently yields empty dirs under non-ASCII paths.
+    copyDirRecursive(dir, stage);
+    return {
+        kind: "local",
+        source: `local:${absDir}`,
+        ...meta,
+        dir: stage,
+        cleanup: () => rmSync(stage, { recursive: true, force: true }),
+    };
+}
+/** Shallow-clone a git URL (or owner/repo) into a staged package. */
+export function resolveGitSource(repo, want) {
+    const url = repo.includes("://") || repo.startsWith("git@") ? repo : `https://github.com/${repo}.git`;
+    if (!/^(https?:\/\/|git@|ssh:\/\/)/.test(url)) {
+        throw new Error(`[forge] invalid git source "${repo}"`);
+    }
+    const kind = url.includes("github.com") ? "github" : "git";
+    const stage = stageDir();
+    try {
+        const args = want && want !== "HEAD"
+            ? ["clone", "--depth", "1", "--branch", want, url, stage]
+            : ["clone", "--depth", "1", url, stage];
+        execFileSync("git", args, { stdio: "pipe" });
+    }
+    catch (e) {
+        rmSync(stage, { recursive: true, force: true });
+        throw new Error(`[forge] git clone failed for ${url}${want ? ` (ref ${want})` : ""}: ${e.message}\n` +
+            `[forge] Check the URL/ref and that 'git' is installed.`, { cause: e });
+    }
+    const shortName = (repo.split("/").pop() ?? "repo").replace(/\.git$/, "");
+    const meta = parseManifest(stage, shortName);
+    const canonical = !repo.includes("://") && kind === "github" ? `github:${repo}` : url;
+    return {
+        kind,
+        source: want ? `${canonical}@${want}` : canonical,
+        ...meta,
+        dir: stage,
+        cleanup: () => rmSync(stage, { recursive: true, force: true }),
+    };
+}
+/** Dispatch any non-registry SourceSpec to its resolver. */
+export function resolveExternalSource(spec) {
+    if (spec.kind === "local")
+        return resolveLocalSource(spec.ref);
+    return resolveGitSource(spec.ref, spec.want);
+}

package/dist/cli/src/index.js

@@ -1,15 +1,17 @@
 #!/usr/bin/env node
-// forge CLI — v0.1 (Faz 1: gerçek add/remove/list/doctor)
+// forge CLI — v0.1 (Phase 1: real add/remove/list/doctor)
 import { Command } from "commander";
 import { existsSync, rmSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 import { loadPackageDetail, resolveVersion, parsePackageArg, searchPackages } from "./core/registry.js";
+import { parseSourceArg } from "./core/sources.js";
 import { ensurePackageContent } from "./core/installer.js";
 import { ensureForgeDirs, readLinks, writeLinks, packageDir, toSlug, listInstalledPackages } from "./core/store.js";
 import { allAdapters, detectAdapters, addMcpServerToConfig, removeMcpServerFromConfig, readMcpConfig } from "./adapters/index.js";
 import { runInit } from "./commands/init.js";
 import { runInstall } from "./commands/install.js";
+import { runSync } from "./commands/sync.js";
 import { runOutdated, runUpdate } from "./commands/update.js";
 import { runAudit } from "./commands/audit.js";
 import { DEP_NAME_RE } from "./core/project.js";
@@ -19,22 +21,42 @@ const program = new Command();
 program
     .name("forge")
     .description("The Homebrew for AI Agents — one CLI for skills, MCPs, plugins, agents")
-    .version("0.1.1")
+    .version("0.1.2")
     .helpOption("-h, --help", "display help for command");
 // --- add ---
 program
     .command("add")
-    .description("Install a package (e.g. forge add anthropics/plan@1.2.0)")
-    .argument("<pkg>", "package name, e.g. anthropics/plan or anthropics/plan@1.2.0")
+    .description("Install a package (registry, github:, git URL, or local path)")
+    .argument("<pkg>", "package ref: scope/name[@range], github:owner/repo[#ref], <git-url>[#ref], ./local/path")
     .option("--global", "install globally (default)")
     .option("--dry-run", "show what would be installed without writing")
     .option("--mock", "allow mock content for packages with no verified tarball yet")
+    .option("--skip-scan", "skip the pre-install security scan (not recommended)", false)
     .action(async (pkgArg, opts) => {
+    const { installExternal } = await import("./commands/add-external.js");
+    const extOpts = { dryRun: opts.dryRun, mock: opts.mock, skipScan: opts.skipScan };
+    const spec = parseSourceArg(pkgArg);
+    // Explicit external sources (github:, git URLs, local paths) bypass the registry.
+    if (spec.kind !== "registry" && spec.explicit) {
+        await installExternal(spec, extOpts);
+        return;
+    }
+    // Bare owner/repo (or scope/name[@range]): registry FIRST, GitHub fallback.
     const { name, version: requested } = parsePackageArg(pkgArg);
     if (!DEP_NAME_RE.test(name)) {
         console.error(`[forge] invalid package name "${name}" — expected scope/name (e.g. anthropics/plan)`);
         process.exit(1);
     }
+    if (spec.kind !== "registry") {
+        try {
+            await loadPackageDetail(name);
+        }
+        catch {
+            console.log(`[forge] ${name} not in registry — trying GitHub...`);
+            await installExternal({ ...spec, explicit: true }, extOpts);
+            return;
+        }
+    }
     console.log(`[forge] resolving ${name}${requested ? "@" + requested : ""}...`);
     let detail, version, versionMeta;
     try {
@@ -81,7 +103,7 @@ program
     let failed = 0;
     for (const adapter of adapters) {
         try {
-            await adapter.install(slug, srcDir, detail.type);
+            await adapter.install(slug, srcDir, detail.type, { version, description: detail.description });
             console.log(`  ✓ ${adapter.displayName} → ${adapter.skillDir(slug)}`);
             // MCP: inject into mcp config
             if (detail.type === "mcp" && versionMeta.mcp) {
@@ -98,7 +120,7 @@ program
             failed++;
         }
     }
-    // Epoch 1e: herhangi bir adapter hatasında exit 1
+    // Epoch 1e: exit 1 on any adapter failure
     if (failed > 0) {
         console.log(`\n[forge] ✗ ${failed} harness(es) failed — installed on ${adapters.length - failed}/${adapters.length}`);
         process.exitCode = 1;
@@ -115,7 +137,10 @@ program
                 const depResolved = await resolveVersion(depName, depRange);
                 const depSrc = await ensurePackageContent(depName, depResolved.version, depResolved.detail, depResolved.versionMeta, { allowMock: opts.mock });
                 for (const adapter of adapters) {
-                    await adapter.install(toSlug(depName), depSrc, depResolved.detail.type);
+                    await adapter.install(toSlug(depName), depSrc, depResolved.detail.type, {
+                        version: depResolved.version,
+                        description: depResolved.detail.description,
+                    });
                 }
                 console.log(`  ✓ dep ${depName}@${depResolved.version}`);
             }
@@ -161,7 +186,6 @@ program
     const version = record?.version ?? "unknown";
     // Remove from adapters
     const adapters = allAdapters; // try all to be thorough
-    let cleaned = false;
     for (const adapter of adapters) {
         const wasInstalled = await adapter.isInstalled(slug);
         if (wasInstalled) {
@@ -171,7 +195,6 @@ program
                 await adapter.uninstall(slug, "mcp");
                 await adapter.uninstall(slug, "agent");
                 console.log(`  ✓ removed from ${adapter.displayName}`);
-                cleaned = true;
             }
             catch (e) {
                 console.warn(`  ✗ ${adapter.displayName}: ${e.message}`);
@@ -184,7 +207,7 @@ program
             try {
                 removeMcpServerFromConfig(cfgPath, slug);
             }
-            catch { }
+            catch { /* stale MCP entries are best-effort cleanup */ }
         }
     }
     // Remove from store (keep cache? remove package dir)
@@ -194,13 +217,13 @@ program
             rmSync(dir, { recursive: true, force: true });
             console.log(`[forge] removed store: ${dir}`);
         }
-        delete links[name];
+        Reflect.deleteProperty(links, name);
         writeLinks(links);
     }
     else {
         // Epoch 1d: always clean links entry if it exists (even partial)
         if (links[name]) {
-            delete links[name];
+            Reflect.deleteProperty(links, name);
             writeLinks(links);
         }
         // try to clean any version dir matching slug
@@ -323,7 +346,6 @@ program
                             console.log(`  ! missing MCP config: ${name} on ${adapterName} → ${cfgPath}`);
                             if (opts.fix && existsSync(liveDir)) {
                                 try {
-                                    const detail = await loadPackageDetail(name);
                                     const resolved = await resolveVersion(name, rec.version);
                                     if (resolved.versionMeta.mcp) {
                                         addMcpServerToConfig(cfgPath, rec.slug, resolved.versionMeta.mcp);
@@ -351,7 +373,7 @@ program
                 if (opts.fix) {
                     const src = liveDir;
                     if (existsSync(src)) {
-                        await adapter.install(rec.slug, src, rec.type ?? "skill");
+                        await adapter.install(rec.slug, src, rec.type ?? "skill", { version: rec.version });
                         console.log(`    → fixed`);
                         fixed++;
                     }
@@ -457,6 +479,15 @@ program
     .action(async (opts) => {
     await runInstall({ frozen: opts.frozen, mock: opts.mock });
 });
+// --- sync ---
+program
+    .command("sync")
+    .description("One-command team sync: skills + rules + MCP servers + agent roles (e.g. forge sync)")
+    .option("--mock", "allow mock content for packages with no verified tarball yet", false)
+    .option("--skip-scan", "skip the pre-install security scan (not recommended)", false)
+    .action(async (opts) => {
+    await runSync({ mock: opts.mock, skipScan: opts.skipScan });
+});
 // --- outdated ---
 program
     .command("outdated")
@@ -473,10 +504,46 @@ program
     .action(async (pkg, opts) => {
     await runUpdate(pkg, { mock: opts.mock });
 });
-// --- audit (Faz 10 iskelet, Faz 22'de tam) ---
+// --- tui ---
+program
+    .command("tui")
+    .description("Launch interactive TUI dashboard (no args = same as npx forge)")
+    .action(async () => {
+    const { runTui } = await import("./commands/tui.js");
+    await runTui();
+});
+// --- test ---
+program
+    .command("test")
+    .description("Test a package against the adapter matrix (dry-run install)")
+    .argument("<pkg>", "package name or path")
+    .option("--mock", "allow mock content for packages with no verified tarball yet", false)
+    .action(async (pkg, opts) => {
+    const { runTest } = await import("./commands/test.js");
+    await runTest(pkg, { mock: opts.mock });
+});
+// --- pack ---
+program
+    .command("pack")
+    .description("Package the current directory into a verified tarball")
+    .option("--check", "validate only — do not write tarball", false)
+    .action(async (opts) => {
+    const { runPack } = await import("./commands/pack.js");
+    await runPack({ check: opts.check });
+});
+// --- verify ---
+program
+    .command("verify")
+    .description("Verify a package: schema, permissions, security scan")
+    .argument("<pkg>", "package name or path")
+    .action(async (pkg) => {
+    const { runVerify } = await import("./commands/verify.js");
+    await runVerify(pkg);
+});
+// --- audit (Phase 10 skeleton, full DB in Phase 22) ---
 program
     .command("audit")
-    .description("Audit installed packages (skeleton — full DB in Faz 22)")
+    .description("Audit installed packages (skeleton — full DB in Phase 22)")
     .option("--json", "output JSON", false)
     .action(async (opts) => {
     await runAudit({ json: opts.json });