@oomerevren/tryforge 0.1.2 → 0.1.3

package/dist/scripts/build-registry.js

@@ -118,8 +118,6 @@ function build() {
             process.exit(1);
         }
         const existing = JSON.parse(readFileSync(INDEX_FILE, "utf-8"));
-        const expected = JSON.stringify(index, null, 2);
-        const actual = JSON.stringify(existing, null, 2);
         // compare count and package keys (ignore generatedAt)
         const existingCount = existing.count;
         const expectedCount = index.count;
@@ -130,7 +128,7 @@ function build() {
         }
         console.log(`[build --check] OK — index.json in sync (count=${existingCount})`);
         if (placeholderCount > 0)
-            console.warn(`[build --check] warn: ${placeholderCount} placeholder sha256 (expected in Faz 2)`);
+            console.warn(`[build --check] warn: ${placeholderCount} placeholder sha256 (expected in Phase 2)`);
         return;
     }
     writeFileSync(INDEX_FILE, JSON.stringify(index, null, 2) + "\n");
@@ -140,6 +138,6 @@ function build() {
     console.log(`[build] wrote ${SEARCH_FILE} (${search.length} entries)`);
     console.log(`[build] wrote ${STATS_FILE} ${JSON.stringify(byType)}`);
     if (placeholderCount > 0)
-        console.warn(`[build] warn: ${placeholderCount} placeholder sha256 (Faz 2 mock, Faz 3 real)`);
+        console.warn(`[build] warn: ${placeholderCount} placeholder sha256 (Phase 2 mock, Phase 3 real)`);
 }
 build();

package/dist/scripts/publish-verified.js

@@ -1,13 +1,19 @@
 #!/usr/bin/env tsx
-// scripts/publish-verified.ts — forge-authored icerigi tarball yap, registry-v1 release'ine
-// yukle, sha256 pinle + verified:true isaretle. Idempotent (--clobber upload).
-// Ayrica sahte-SHA'li girdileri community katmanina dusurur (demote listesi).
-import { readFileSync, writeFileSync, existsSync, rmSync } from "fs";
+// scripts/publish-verified.ts — pack forge-authored content into tarballs, upload
+// them to the registry-v1 release, then pin sha256 + mark verified:true.
+// Idempotent (--clobber upload). Entries carrying fake-SHA values are demoted
+// to the community tier (demote list).
+// Tarballs are built in .cache/forge-publish/ (gitignored temp dir) and removed
+// after upload — prebuilt archives must never live in the git tree.
+import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync } from "fs";
 import { execSync } from "child_process";
 import { createHash } from "crypto";
 const OWNER_REPO = "oomerevren-beep/forge";
 const RELEASE = "registry-v1";
-// registry slug -> registry-content dir (ayni ad)
+// Scratch dir for tarball staging (gitignored via .cache/). Created on demand,
+// cleaned per-asset after upload.
+const STAGE_DIR = ".cache/forge-publish";
+// registry slug -> registry-content dir (same name)
 const VERIFY = [
     "pdf-merge", "pdf-split", "pdf-ocr", "pdf-extract",
     "pdf-compress", "pdf-convert", "pdf-forms", "pdf-tables",
@@ -15,7 +21,7 @@ const VERIFY = [
     "agent-changelog-writer", "agent-researcher",
     "cmd-plan", "cmd-review",
 ];
-// Sahte hex + 404 URL tasiyanlar: community katmanina dusur (durustluk).
+// Fake hex + 404 URL carriers: demote to community tier (honesty).
 const DEMOTE = ["anthropics-plan", "skill-pdf"];
 function sh(cmd) {
     return execSync(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
@@ -27,7 +33,7 @@ async function main() {
         console.log(`[publish] release ${RELEASE} exists`);
     }
     catch {
-        sh(`gh release create ${RELEASE} --repo ${OWNER_REPO} --title "Forge verified registry content v1" --notes "Seed-verified package tarballs (Faz 6-oncesi). Each asset sha256-pinned in registry/packages/*.json."`);
+        sh(`gh release create ${RELEASE} --repo ${OWNER_REPO} --title "Forge verified registry content v1" --notes "Seed-verified package tarballs (pre-Phase-6). Each asset sha256-pinned in registry/packages/*.json."`);
         console.log(`[publish] release ${RELEASE} created`);
     }
     let ok = 0;
@@ -40,11 +46,13 @@ async function main() {
         }
         const detail = JSON.parse(readFileSync(pkgPath, "utf-8"));
         const version = detail.latest;
-        // forge.toml manifest uret (paket bildirimi)
+        // generate forge.toml manifest (package declaration)
         const manifest = `[package]\nname = "${detail.name}"\nversion = "${version}"\ntype = "${detail.type}"\ndescription = "${detail.description.replace(/"/g, "'")}"\nlicense = "MIT"\nrepository = "https://github.com/${OWNER_REPO}"\n`;
         writeFileSync(`${srcDir}/forge.toml`, manifest);
         const asset = `${slug}-${version}.tar.gz`;
-        const tmp = `registry-content/${asset}`;
+        // Stage the tarball under the gitignored scratch dir — never in the repo tree.
+        mkdirSync(STAGE_DIR, { recursive: true });
+        const tmp = `${STAGE_DIR}/${asset}`;
         sh(`tar -czf ${tmp} -C ${srcDir} .`);
         const buf = readFileSync(tmp);
         const sha256 = createHash("sha256").update(buf).digest("hex");

package/dist/scripts/seed-registry-13lite.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env tsx
-// scripts/seed-registry-13lite.ts — Faz 13-lite: 100 → 250 paket (+150, elle kürasyon)
-// Odak: pdf (10+), agent (20+), mcp kategorileri — search "wow" için.
-// Idempotent: var olan dosyaları atlar, sonra 'npm run registry:build' çalıştır.
+// scripts/seed-registry-13lite.ts — Phase 13-lite: 100 → 250 packages (+150, hand-curated)
+// Focus: pdf (10+), agent (20+), mcp categories — for a "wow" search.
+// Idempotent: skips existing files, then run 'npm run registry:build'.
 import { existsSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
 const PACKAGES_DIR = "registry/packages";
 const ROWS = [
-    // --- PDF (12) — forge search pdf 10+ hedefi ---
+    // --- PDF (12) — 'forge search pdf' 10+ goal ---
     ["pdf/merge", "skill", "PDF merge skill — combine multiple PDFs into one document fast", ["pdf", "merge", "document"]],
     ["pdf/split", "skill", "PDF split skill — extract pages and split PDFs by range", ["pdf", "split", "pages"]],
     ["pdf/ocr", "skill", "PDF OCR skill — scanned PDFs to searchable text with OCR", ["pdf", "ocr", "scan"]],
@@ -19,7 +19,7 @@ const ROWS = [
     ["pdf/convert", "skill", "PDF convert skill — PDF to Word, HTML, Markdown and back", ["pdf", "convert", "export"]],
     ["pdf/annotate", "skill", "PDF annotate skill — comments, highlights and review markup", ["pdf", "annotate", "review"]],
     ["pdf/tables", "skill", "PDF tables skill — detect and export tables from PDFs to CSV", ["pdf", "tables", "csv"]],
-    // --- Agent (25) — forge search agent 20+ hedefi ---
+    // --- Agent (25) — 'forge search agent' 20+ goal ---
     ["agent/pr-reviewer", "agent", "PR reviewer agent — thorough pull request reviews with suggestions", ["agent", "review", "pr"]],
     ["agent/changelog-writer", "agent", "Changelog writer agent — generate release notes from commits", ["agent", "changelog", "release"]],
     ["agent/migrator", "agent", "Migrator agent — framework and version migration assistant", ["agent", "migrate", "refactor"]],

package/dist/scripts/seed-registry.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env tsx
-// scripts/seed-registry.ts — Epoch 1d: sadece gerçek tarball'ı olan paketleri seed
-// Var olmayan repo'ları eklemez — fail-closed
+// scripts/seed-registry.ts — Epoch 1d: seed only packages with real tarballs
+// Never adds repos that do not exist — fail-closed
 import { existsSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
 const PACKAGES_DIR = "registry/packages";
-// Sadece gerçekten doğrulanmış tarball'lar — Epoch 1d
+// Only genuinely verified tarballs — Epoch 1d
 const CATALOG = [
-    // Gerçek tarball'lı paketler (SHA256 doğrulanmış)
+    // Real-tarball packages (SHA256 verified)
     {
         name: "pdf/compress", type: "skill", description: "PDF compress skill — shrink PDF size without quality loss",
         keywords: ["pdf", "compress", "optimize"], source: "registry-content",

package/dist/scripts/verify-npm-mcps.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env tsx
-// scripts/verify-npm-mcps.ts — MCP girdilerini gercek upstream npm tarball'iyla dogrula.
-// Her paket icin: npm metadata -> dist.tarball indir -> sha256 hesapla -> JSON'a pin + verified:true.
-// Fail-closed: herhangi bir adim basarisizsa o paket atlanir (placeholder korunur).
+// scripts/verify-npm-mcps.ts — verify MCP entries against real upstream npm tarballs.
+// Per package: npm metadata -> dist.tarball download -> sha256 compute -> pin into JSON + verified:true.
+// Fail-closed: any failing step skips that package (placeholder preserved).
 import { readFileSync, writeFileSync } from "fs";
 import { createHash } from "crypto";
 const MAP = [
@@ -20,7 +20,9 @@ async function main() {
             const version = meta["dist-tags"]?.latest;
             if (!version || !meta.versions?.[version]?.dist?.tarball)
                 throw new Error("no latest dist");
-            const tarball = meta.versions[version].dist.tarball;
+            const tarball = meta.versions[version].dist?.tarball;
+            if (!tarball)
+                throw new Error("no latest dist");
             const publishedAt = meta.time?.[version] ?? new Date().toISOString();
             const dl = await fetch(tarball);
             if (!dl.ok)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oomerevren/tryforge",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "The Homebrew for AI Agents — one CLI for skills, MCPs, plugins, agents",
   "license": "MIT",
   "author": "Ömer Evren",
@@ -27,8 +27,8 @@
   ],
   "type": "module",
   "bin": {
-    "forge": "dist/cli/src/index.js",
-    "tryforge": "dist/cli/src/index.js"
+    "forge": "./dist/index.cjs",
+    "tryforge": "./dist/index.cjs"
   },
   "files": [
     "dist/",
@@ -45,20 +45,29 @@
   },
   "scripts": {
     "dev": "tsx cli/src/index.ts",
-    "build": "tsc",
-    "prepublishOnly": "npm run build && npm test && npm run registry:build -- --check",
+    "build": "tsc -p tsconfig.build.json",
+    "bundle": "esbuild cli/src/index.ts --bundle --platform=node --format=cjs --outfile=dist/index.cjs --banner:js=\"#!/usr/bin/env node\" --minify && node -e \"const fs=require('fs');const p='dist/index.cjs';const L=fs.readFileSync(p,'utf8').split('\\n');if(L[1]&&L[1].startsWith('#!'))L.splice(1,1);fs.writeFileSync(p,L.join('\\n'));fs.chmodSync(p, 0o755)\"",
+    "lint": "eslint cli/ scripts/ tests/ eslint.config.js --max-warnings 0",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build && npm run bundle && npm test && npm run registry:build -- --check",
     "test": "node --import tsx --test tests/**/*.test.ts cli/src/**/*.test.ts",
     "registry:build": "tsx scripts/build-registry.ts",
     "seed": "tsx scripts/seed-registry.ts"
   },
   "dependencies": {
+    "@clack/prompts": "^0.11.0",
     "commander": "^12.0.0",
+    "picocolors": "^1.1.1",
     "smol-toml": "^1.8.0"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/node": "^26.4.1",
+    "esbuild": "^0.28.2",
+    "eslint": "^10.9.1",
     "playwright": "^1.62.1",
     "tsx": "^4.23.13",
-    "typescript": "^7.0.2"
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.69.0"
   }
 }