@oomerevren/tryforge 0.1.2

package/dist/cli/src/adapters/types.js

@@ -0,0 +1,140 @@
+// cli/src/adapters/types.ts — Epoch 1c: fail-closed MCP config, Windows junction, skill files
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, cpSync, copyFileSync, symlinkSync, lstatSync, unlinkSync, renameSync } from "fs";
+import { join, dirname } from "path";
+export { forgeHome, packagesDir, packageDir, toSlug } from "../core/store.js";
+export function ensureDir(dir) {
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+}
+export function trySymlinkOrCopy(src, dest) {
+    ensureDir(dirname(dest));
+    if (existsSync(dest)) {
+        try {
+            const stat = lstatSync(dest);
+            if (stat.isSymbolicLink())
+                unlinkSync(dest);
+            else
+                rmSync(dest, { recursive: true, force: true });
+        }
+        catch {
+            rmSync(dest, { recursive: true, force: true });
+        }
+    }
+    try {
+        const isWin = process.platform === "win32";
+        symlinkSync(src, dest, isWin ? "junction" : "dir");
+        return;
+    }
+    catch {
+        cpSync(src, dest, { recursive: true });
+    }
+}
+export function removeLinkOrDir(target) {
+    if (!existsSync(target))
+        return;
+    try {
+        const stat = lstatSync(target);
+        if (stat.isSymbolicLink())
+            unlinkSync(target);
+        else
+            rmSync(target, { recursive: true, force: true });
+    }
+    catch {
+        rmSync(target, { recursive: true, force: true });
+    }
+}
+/**
+ * Read MCP config — FAIL-CLOSED.
+ * Returns null if file doesn't exist.
+ * Returns parsed JSON if file is valid JSON.
+ * THROWS on parse error (invalid JSON/JSONC) — caller must NOT silently overwrite.
+ * This protects user configs with comments (JSONC) or trailing commas from being destroyed.
+ */
+export function readMcpConfig(configPath) {
+    if (!existsSync(configPath))
+        return null;
+    const raw = readFileSync(configPath, "utf-8");
+    try {
+        return JSON.parse(raw);
+    }
+    catch (e) {
+        throw new Error(`[forge] MCP config at ${configPath} contains invalid JSON: ${e.message}\n` +
+            `[forge] Refusing to modify. Fix the config manually or rename it, then retry.`);
+    }
+}
+export function writeMcpConfig(configPath, data, opts = {}) {
+    ensureDir(dirname(configPath));
+    backupFileIfExists(configPath);
+    // Epoch 1d: Atomic write — temp dosyaya yaz, sonra rename (crash-safe)
+    const tmp = configPath + ".tmp." + Date.now();
+    writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n");
+    renameSync(tmp, configPath);
+}
+/** Snapshot a user-owned config before we overwrite it (single `.bak`, like `sed -i.bak`).
+ *  Returns the backup path, or null when there was nothing to back up. */
+export function backupFileIfExists(configPath) {
+    if (!existsSync(configPath))
+        return null;
+    const bak = configPath + ".bak";
+    try {
+        copyFileSync(configPath, bak);
+        console.log(`[forge] backup: ${configPath} → ${bak}`);
+        return bak;
+    }
+    catch (e) {
+        console.warn(`[forge] warning: could not back up ${configPath}: ${e.message}`);
+        return null;
+    }
+}
+export function addMcpServerToConfig(configPath, name, mcp) {
+    // Epoch 1e: dosya yoksa oluştur (taze makine desteği)
+    let cfg = readMcpConfig(configPath);
+    if (cfg === null) {
+        // Dosya yok veya boş — yeni config oluştur
+        cfg = {};
+    }
+    if (!cfg["mcpServers"])
+        cfg["mcpServers"] = {};
+    const servers = cfg["mcpServers"];
+    servers[name] = {
+        command: mcp.command,
+        args: mcp.args ?? [],
+        ...(mcp.env ? { env: mcp.env } : {}),
+    };
+    writeMcpConfig(configPath, cfg);
+}
+export function removeMcpServerFromConfig(configPath, name) {
+    const cfg = readMcpConfig(configPath);
+    if (cfg === null)
+        return; // file doesn't exist or invalid — nothing to remove
+    const servers = cfg["mcpServers"];
+    if (servers && name in servers) {
+        delete servers[name];
+        writeMcpConfig(configPath, cfg);
+    }
+}
+// Epoch 1d: type-aware hedef dizin
+export function targetDirFor(base, type) {
+    const dirMap = {
+        skill: "skills",
+        agent: "agents",
+        command: "commands",
+        hook: "hooks",
+        plugin: "plugins",
+    };
+    return join(base, dirMap[type] || "skills");
+}
+export function installSkillFiles(_adapterName, pkgSlug, srcDir, destBase) {
+    const dest = join(destBase, pkgSlug);
+    trySymlinkOrCopy(srcDir, dest);
+}
+export function uninstallSkillFiles(pkgSlug, destBase) {
+    const dest = join(destBase, pkgSlug);
+    removeLinkOrDir(dest);
+}
+export async function listDirNames(dir) {
+    if (!existsSync(dir))
+        return [];
+    const { readdirSync } = await import("fs");
+    return readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory() || d.isSymbolicLink()).map((d) => d.name);
+}

package/dist/cli/src/adapters/windsurf.js

@@ -0,0 +1,43 @@
+// cli/src/adapters/windsurf.ts — Windsurf harness (Faz 12 yeni)
+import { existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { installSkillFiles, uninstallSkillFiles, listDirNames } from "./types.js";
+export const windsurfAdapter = {
+    name: "windsurf",
+    displayName: "Windsurf",
+    version: "0.1.0",
+    detect: () => existsSync(join(process.cwd(), ".windsurf")) || existsSync(join(homedir(), ".windsurf")) || existsSync(join(homedir(), ".codeium", "windsurf")),
+    skillDir: (slug) => {
+        if (existsSync(join(process.cwd(), ".windsurf")))
+            return join(process.cwd(), ".windsurf", "skills", slug);
+        return join(homedir(), ".windsurf", "skills", slug);
+    },
+    mcpConfigPath: () => {
+        if (existsSync(join(process.cwd(), ".windsurf")))
+            return join(process.cwd(), ".windsurf", "mcp_config.json");
+        return join(homedir(), ".codeium", "windsurf", "mcp_config.json");
+    },
+    async install(pkgSlug, srcDir, type) {
+        void type;
+        const base = existsSync(join(process.cwd(), ".windsurf")) ? join(process.cwd(), ".windsurf", "skills") : join(homedir(), ".windsurf", "skills");
+        installSkillFiles("windsurf", pkgSlug, srcDir, base);
+    },
+    async uninstall(pkgSlug, _type) {
+        const bases = [join(process.cwd(), ".windsurf", "skills"), join(homedir(), ".windsurf", "skills")];
+        for (const b of bases)
+            uninstallSkillFiles(pkgSlug, b);
+    },
+    async list() {
+        const bases = [join(process.cwd(), ".windsurf", "skills"), join(homedir(), ".windsurf", "skills")];
+        for (const b of bases) {
+            if (existsSync(b))
+                return listDirNames(b);
+        }
+        return [];
+    },
+    async isInstalled(pkgSlug) {
+        const bases = [join(process.cwd(), ".windsurf", "skills"), join(homedir(), ".windsurf", "skills")];
+        return bases.some((b) => existsSync(join(b, pkgSlug)));
+    },
+};

package/dist/cli/src/commands/audit.js

@@ -0,0 +1,62 @@
+// cli/src/commands/audit.ts — trust-tier audit (verified vs community vs mock).
+// Full vulnerability DB in Faz 22; tier flags are accurate as of the verified-core sprint.
+import { existsSync } from "fs";
+import { join } from "path";
+import { readLinks, packageDir } from "../core/store.js";
+import { loadPackageDetail } from "../core/registry.js";
+import { isPlaceholderSha } from "../core/installer.js";
+export async function runAudit(opts = {}) {
+    const links = readLinks();
+    const entries = Object.values(links);
+    const findings = [];
+    if (entries.length === 0) {
+        console.log("[forge] audit: no installed packages — nothing to check");
+        console.log("[forge] audit: full vulnerability DB in Faz 22");
+        return;
+    }
+    for (const rec of entries) {
+        try {
+            const detail = await loadPackageDetail(rec.pkg);
+            const meta = detail.versions[rec.version];
+            if (!meta) {
+                findings.push({ pkg: rec.pkg, level: "warn", message: `version ${rec.version} not in registry` });
+                continue;
+            }
+            if (meta.sha256 && isPlaceholderSha(meta.sha256)) {
+                findings.push({ pkg: rec.pkg, level: 'info', message: 'community tier (unverified tarball) — install needs --mock' });
+            }
+            else if (!meta.verified) {
+                findings.push({ pkg: rec.pkg, level: 'warn', message: 'sha256 not verified against tarball content' });
+            }
+            if (!meta.tarball || meta.tarball.includes("placeholder")) {
+                findings.push({ pkg: rec.pkg, level: "warn", message: `tarball URL placeholder` });
+            }
+            // On-disk truth: .forge-mock marker means this install is mock content (--mock).
+            try {
+                if (existsSync(join(packageDir(rec.slug, rec.version), ".forge-mock"))) {
+                    findings.push({ pkg: rec.pkg, level: "info", message: `installed from MOCK content (--mock was used)` });
+                }
+            }
+            catch { }
+        }
+        catch (e) {
+            findings.push({ pkg: rec.pkg, level: "warn", message: `registry read failed: ${e.message}` });
+        }
+    }
+    if (opts.json) {
+        console.log(JSON.stringify({ packages: entries.length, findings }, null, 2));
+        return;
+    }
+    console.log(`[forge] audit — ${entries.length} package(s) checked (skeleton, full DB Faz 22):\n`);
+    if (findings.length === 0) {
+        console.log("[forge] ✓ no issues");
+    }
+    else {
+        for (const f of findings.slice(0, 30)) {
+            console.log(`  [${f.level}] ${f.pkg}: ${f.message}`);
+        }
+        if (findings.length > 30)
+            console.log(`  ... and ${findings.length - 30} more`);
+    }
+    console.log(`\n[forge] audit done: ${findings.length} finding(s)`);
+}

package/dist/cli/src/commands/init.js

@@ -0,0 +1,104 @@
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { join, resolve, basename, sep } from "path";
+const TEMPLATES = {
+    skill: {
+        forgeToml: (name) => {
+            const short = name.split("/")[1] ?? name;
+            return `[package]\nname = "${name}"\nversion = "0.1.0"\ntype = "skill"\ndescription = "A new Forge skill — describe what it does"\nlicense = "MIT"\n\n[engines]\nclaude-code = "*"\n\n[skill]\nname = "${short}"\ninvocation = "/${short}"\nallowed-tools = ["Read", "Write", "Bash"]\n`;
+        },
+        extraFiles: (name) => ({
+            "SKILL.md": `# ${name}\n\nA Forge skill. Replace this with your skill prompt.\n\n## Usage\n\nDescribe when Muse should use this skill.\n\n## Instructions\n\n- Step 1: ...\n- Step 2: ...\n`,
+        }),
+    },
+    mcp: {
+        forgeToml: (name) => `[package]\nname = "${name}"\nversion = "0.1.0"\ntype = "mcp"\ndescription = "A new MCP server"\nlicense = "MIT"\n\n[mcp]\ncommand = "node"\nargs = ["./dist/index.js"]\n`,
+        extraFiles: (name) => ({
+            "src/index.ts": `#!/usr/bin/env node\n// ${name} — MCP server scaffold\nconsole.log("MCP server: ${name}");\n`,
+            "mcp.json": JSON.stringify({ mcpServers: { [name.split("/")[1] ?? name]: { command: "node", args: ["./dist/index.js"] } } }, null, 2) + "\n",
+            "README.md": `# ${name}\n\nMCP server scaffold generated by \`forge init\`.\n`,
+        }),
+    },
+    agent: {
+        forgeToml: (name) => `[package]\nname = "${name}"\nversion = "0.1.0"\ntype = "agent"\ndescription = "A new Forge agent"\nlicense = "MIT"\n\n[agent]\nmodel = "claude-sonnet-4"\ntools = ["Read", "Write", "Bash"]\nprompt = "agent.md"\n`,
+        extraFiles: (name) => ({
+            "agent.md": `# ${name} — Agent\n\nDefine your agent's system prompt here.\n`,
+        }),
+    },
+    command: {
+        forgeToml: (name) => {
+            const short = name.split("/")[1] ?? name;
+            return `[package]\nname = "${name}"\nversion = "0.1.0"\ntype = "command"\ndescription = "A new Forge command"\nlicense = "MIT"\n\n[command]\nname = "${short}"\ninvocation = "/${short}"\n`;
+        },
+        extraFiles: (name) => ({
+            "command.md": `# ${name} — Command\n\nDefine the slash command here.\n`,
+        }),
+    },
+    hook: {
+        forgeToml: (name) => `[package]\nname = "${name}"\nversion = "0.1.0"\ntype = "hook"\ndescription = "A new Forge hook"\nlicense = "MIT"\n\n[hook]\nevent = "pre-tool"\nentry = "hook.json"\n`,
+        extraFiles: (name) => ({
+            "hook.json": JSON.stringify({ name, hooks: { "pre-tool": { entry: "./hook.js" } } }, null, 2) + "\n",
+        }),
+    },
+    plugin: {
+        forgeToml: (name) => `[package]\nname = "${name}"\nversion = "0.1.0"\ntype = "plugin"\ndescription = "A new Forge plugin"\nlicense = "MIT"\n\n[plugin]\nentry = "index.js"\nhooks = ["pre-tool", "post-tool"]\n`,
+        extraFiles: () => ({
+            "plugin.json": JSON.stringify({ name: "plugin", entry: "index.js", hooks: ["pre-tool", "post-tool"] }, null, 2) + "\n",
+            "index.js": `// Forge plugin entry\nmodule.exports = {};\n`,
+            "README.md": "# Plugin scaffold\n",
+        }),
+    },
+};
+export async function runInit(opts) {
+    const cwd = resolve(opts.cwd ?? process.cwd());
+    const rawName = opts.name ?? basename(cwd);
+    const pkgName = normalizeName(rawName);
+    const type = (opts.type ?? "skill");
+    if (!TEMPLATES[type]) {
+        console.error(`[forge] unknown type "${type}" — choose: ${Object.keys(TEMPLATES).join(", ")}`);
+        process.exit(1);
+    }
+    // Epoch 1c: prevent path traversal — targetDir must be inside cwd
+    const targetDir = opts.name ? resolve(cwd, opts.name) : cwd;
+    const resolvedCwd = resolve(cwd);
+    if (!targetDir.startsWith(resolvedCwd + sep) && targetDir !== resolvedCwd) {
+        console.error(`[forge] invalid path "${opts.name}" — must be within the current directory`);
+        process.exit(1);
+    }
+    const forgeTomlPath = join(targetDir, "forge.toml");
+    if (existsSync(forgeTomlPath) && !opts.force) {
+        console.error(`[forge] ${forgeTomlPath} already exists — use --force to overwrite`);
+        process.exit(1);
+    }
+    if (!existsSync(targetDir))
+        mkdirSync(targetDir, { recursive: true });
+    const tpl = TEMPLATES[type];
+    const tomlContent = tpl.forgeToml(pkgName);
+    writeFileSync(forgeTomlPath, tomlContent);
+    const extras = tpl.extraFiles(pkgName);
+    for (const [rel, content] of Object.entries(extras)) {
+        const full = join(targetDir, rel);
+        // ensure parent
+        mkdirSync(join(targetDir, ...rel.split("/").slice(0, -1)), { recursive: true });
+        if (!existsSync(full) || opts.force)
+            writeFileSync(full, content);
+    }
+    const relDir = targetDir === cwd ? "." : opts.name;
+    console.log(`[forge] ✓ created ${relDir}/forge.toml [${type}]`);
+    if (Object.keys(extras).length)
+        console.log(`[forge]   + ${Object.keys(extras).join(", ")}`);
+    console.log(`[forge] next: edit forge.toml & SKILL.md, then 'forge publish' (Faz 8)`);
+}
+function normalizeName(input) {
+    // allow my-skill -> my-skill/my-skill ? We expect scope/name
+    // If input contains /, keep; otherwise treat as unscoped and prefix with local scope?
+    // For scaffold we use "local/<name>" if no slash? But spec expects scope/name — use "local/<name>" fallback?
+    // Simpler: if no slash, use "<name>/<name>" is weird. Use input as-is if it has /, else input (consumer scaffold may be folder name)
+    // Forge init in a project folder without scope — keep as input; for package scaffold we need scope/name.
+    // We'll produce scope/name: if input has /, use it; else `local/${input}`
+    if (input.includes("/"))
+        return input;
+    // If it's a simple name like my-skill, make it local/my-skill
+    if (/^[a-z0-9-]+$/.test(input))
+        return `local/${input}`;
+    return input;
+}

package/dist/cli/src/commands/install.js

@@ -0,0 +1,212 @@
+import { existsSync } from "fs";
+import { resolve, join } from "path";
+import { homedir } from "os";
+import { resolveVersion, satisfiesRange } from "../core/registry.js";
+import { ensurePackageContent } from "../core/installer.js";
+import { ensureForgeDirs, readLinks, writeLinks, toSlug } from "../core/store.js";
+import { allAdapters, detectAdapters, addMcpServerToConfig } from "../adapters/index.js";
+import { findProjectToml, loadProjectToml, validateProjectToml } from "../core/project.js";
+import { readLock, writeLock } from "../core/lock.js";
+import { loadConfig } from "../core/config.js";
+function pickAdapters(projectHarnesses) {
+    if (projectHarnesses && projectHarnesses.length > 0) {
+        const filtered = allAdapters.filter((a) => projectHarnesses.includes(a.name));
+        if (filtered.length === 0) {
+            console.warn(`[forge] warning: [forge].harnesses has no known adapter, falling back to auto-detect`);
+            return detectAdapters();
+        }
+        return filtered;
+    }
+    const cfg = loadConfig();
+    if (cfg.defaultHarnesses.length > 0) {
+        const filtered = allAdapters.filter((a) => cfg.defaultHarnesses.includes(a.name));
+        if (filtered.length > 0)
+            return filtered;
+    }
+    return detectAdapters();
+}
+export async function runInstall(opts = {}) {
+    const cwd = resolve(opts.cwd ?? process.cwd());
+    const tomlPath = findProjectToml(cwd);
+    if (!tomlPath) {
+        console.error(`[forge] forge.toml not found in ${cwd}`);
+        console.error(`[forge] run 'forge init' to create a project, or create forge.toml with [dependencies]`);
+        process.exit(1);
+    }
+    let project;
+    try {
+        project = loadProjectToml(tomlPath);
+    }
+    catch (e) {
+        console.error(`[forge] ${e.message}`);
+        process.exit(1);
+    }
+    const errs = validateProjectToml(project, tomlPath);
+    if (errs.length > 0) {
+        for (const er of errs)
+            console.error(`[forge] ${er}`);
+        process.exit(1);
+    }
+    const deps = project.dependencies;
+    if (Object.keys(deps).length === 0) {
+        console.log(`[forge] no dependencies in ${tomlPath}`);
+        return;
+    }
+    // --frozen: install exactly from lock
+    if (opts.frozen) {
+        const lock = readLock(cwd);
+        if (!lock) {
+            console.error(`[forge] --frozen requires forge.lock, but none found in ${cwd}`);
+            process.exit(1);
+        }
+        // verify lock matches dependencies keys (at least every dep has an entry)
+        // AND that each locked version still satisfies forge.toml's range —
+        // a hand-aged lock must never silently downgrade under --frozen.
+        const lockMap = new Map(lock.packages.map((p) => [p.name, p]));
+        for (const [depName, depRange] of Object.entries(deps)) {
+            const locked = lockMap.get(depName);
+            if (!locked) {
+                console.error(`[forge] --frozen: lock missing ${depName} (run 'forge install' without --frozen to update lock)`);
+                process.exit(1);
+            }
+            if (!satisfiesRange(locked.version, depRange)) {
+                console.error(`[forge] --frozen: locked ${depName}@${locked.version} does not satisfy forge.toml range "${depRange}" (run 'forge install' without --frozen to update lock)`);
+                process.exit(1);
+            }
+        }
+        console.log(`[forge] installing ${lock.packages.length} package(s) from forge.lock (frozen)...`);
+        const adapters = pickAdapters(project.forge?.harnesses);
+        console.log(`[forge] harnesses: ${adapters.map((a) => a.displayName).join(", ")}`);
+        const t0 = Date.now();
+        let ok = 0;
+        for (const entry of lock.packages) {
+            try {
+                const { detail, version, versionMeta } = await resolveVersion(entry.name, entry.version);
+                const src = await ensurePackageContent(entry.name, version, detail, versionMeta, { allowMock: opts.mock });
+                for (const adapter of adapters) {
+                    await adapter.install(toSlug(entry.name), src, detail.type);
+                    if (detail.type === "mcp" && versionMeta.mcp) {
+                        const cfgPath = adapter.mcpConfigPath();
+                        if (cfgPath)
+                            addMcpServerToConfig(cfgPath, toSlug(entry.name), versionMeta.mcp);
+                    }
+                }
+                // update links
+                const links = readLinks();
+                links[entry.name] = {
+                    pkg: entry.name,
+                    version,
+                    slug: toSlug(entry.name),
+                    type: detail.type,
+                    adapters: adapters.map((a) => a.name),
+                    installedAt: new Date().toISOString(),
+                };
+                writeLinks(links);
+                ok++;
+                console.log(`  ✓ ${entry.name}@${version}`);
+            }
+            catch (e) {
+                console.warn(`  ✗ ${entry.name} failed: ${e.message}`);
+            }
+        }
+        const dt = ((Date.now() - t0) / 1000).toFixed(1);
+        console.log(`\n[forge] ✓ installed ${ok}/${lock.packages.length} from lock in ${dt}s`);
+        return;
+    }
+    // Normal: resolve from dependencies
+    console.log(`[forge] installing ${Object.keys(deps).length} package(s) from ${tomlPath}...`);
+    const adapters = pickAdapters(project.forge?.harnesses);
+    console.log(`[forge] harnesses: ${adapters.map((a) => a.displayName).join(", ")}`);
+    const t0 = Date.now();
+    const lockEntries = [];
+    let ok = 0;
+    let skipped = 0;
+    // Check existing links to skip already-installed exact version? We reinstall if range resolves same version already installed? For idempotency allow skip? We'll still ensure content but count skipped.
+    const existingLinks = readLinks();
+    for (const [depName, depRange] of Object.entries(deps)) {
+        try {
+            const { detail, version, versionMeta } = await resolveVersion(depName, depRange);
+            const already = existingLinks[depName];
+            const isSameVersionInstalled = already?.version === version && existsSyncForSlug(toSlug(depName), version);
+            if (isSameVersionInstalled) {
+                // verify adapters still have it? For speed skip re-install? But ensure adapters have it
+                // For mcp packages isInstalled checks skillDir which is not created — treat store existence as enough
+                if (detail.type === "mcp") {
+                    lockEntries.push({ name: depName, version, type: detail.type });
+                    skipped++;
+                    console.log(`  = ${depName}@${version} already installed`);
+                    continue;
+                }
+                // We do lightweight check: if every adapter reports installed, skip heavy install
+                let allPresent = true;
+                for (const a of adapters) {
+                    if (!(await a.isInstalled(toSlug(depName))))
+                        allPresent = false;
+                }
+                if (allPresent) {
+                    lockEntries.push({ name: depName, version, type: detail.type });
+                    skipped++;
+                    console.log(`  = ${depName}@${version} already installed`);
+                    continue;
+                }
+            }
+            const src = await ensurePackageContent(depName, version, detail, versionMeta, { allowMock: opts.mock });
+            for (const adapter of adapters) {
+                await adapter.install(toSlug(depName), src, detail.type);
+                if (detail.type === "mcp" && versionMeta.mcp) {
+                    const cfgPath = adapter.mcpConfigPath();
+                    if (cfgPath)
+                        addMcpServerToConfig(cfgPath, toSlug(depName), versionMeta.mcp);
+                }
+            }
+            // deps of dep (one level)
+            const subDeps = versionMeta.dependencies ?? {};
+            for (const [subName, subRange] of Object.entries(subDeps)) {
+                try {
+                    const sub = await resolveVersion(subName, subRange);
+                    const subSrc = await ensurePackageContent(subName, sub.version, sub.detail, sub.versionMeta, { allowMock: opts.mock });
+                    for (const adapter of adapters)
+                        await adapter.install(toSlug(subName), subSrc, sub.detail.type);
+                    console.log(`    dep ${subName}@${sub.version}`);
+                }
+                catch (e) {
+                    console.warn(`    ! dep ${subName} failed: ${e.message}`);
+                }
+            }
+            ensureForgeDirs();
+            const links = readLinks();
+            links[depName] = {
+                pkg: depName,
+                version,
+                slug: toSlug(depName),
+                type: detail.type,
+                adapters: adapters.map((a) => a.name),
+                installedAt: new Date().toISOString(),
+            };
+            writeLinks(links);
+            lockEntries.push({ name: depName, version, type: detail.type });
+            ok++;
+            console.log(`  ✓ ${depName}@${version}`);
+        }
+        catch (e) {
+            console.error(`  ✗ ${depName} failed: ${e.message}`);
+        }
+    }
+    // Write lock (deterministic order)
+    lockEntries.sort((a, b) => a.name.localeCompare(b.name));
+    writeLock(lockEntries, cwd);
+    const dt = ((Date.now() - t0) / 1000).toFixed(1);
+    const total = ok + skipped;
+    const failed = Object.keys(deps).length - total;
+    if (failed > 0) {
+        console.log(`\n[forge] ✗ ${failed} package(s) failed — installed ${ok} new, ${skipped} cached (${total}/${Object.keys(deps).length}) on ${adapters.length} harness(es) in ${dt}s`);
+        process.exitCode = 1;
+    }
+    else {
+        console.log(`\n[forge] ✓ installed ${ok} new, ${skipped} cached (${total}/${Object.keys(deps).length}) on ${adapters.length} harness(es) in ${dt}s`);
+    }
+    console.log(`[forge] lock written to ${cwd}/forge.lock`);
+}
+function existsSyncForSlug(slug, version) {
+    return existsSync(join(homedir(), ".forge", "packages", `${slug}@${version}`));
+}