@warpgogol/forge 4.2.4 → 5.1.1

package/src/validators/port-validate.ts

@@ -27,7 +27,7 @@ interface PortValidateResult {
 const FORBIDDEN_IMPORTS = [
   "@warpgogol/werkstatt-engine/kernel",
   "@warpgogol/werkstatt-site/ui",
-  "@warpgogol/werkstatt-shared/share/page",
+  "@warpgogol/werkstatt-shared/page",
 ];
 
 export function runPortValidate(

package/src/validators/skill-validate.ts

@@ -6,17 +6,16 @@
 </non-goals>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
-  <item>RFC-0374: initial forge.skill.validate handler.</item>
-  <item>RFC-0393: added SKILL-11 — canonical skill bodies must not contain hardcoded project-specific literals.</item>
-  <item>RFC-0523: added SKILL-12 — concerns must be one of four-level enum. Updated SKILL-10 to cover read-only skills.</item>
-  <item>RFC-0524: added SKILL-13 — declared knowledge files must exist relative to SKILL.md directory.</item>
-  <item>RFC-0539: added SKILL-14 (pack skill name must start with pack prefix) and SKILL-15 (non-forge skill may not use fo- prefix). Extended SKILL-07 with asymmetric dependency direction (forge→pack forbidden). Added pack skill validation loop.</item>
-  <item>RFC-0548: added SKILL-16 — triggers field must be an array of 1-5 strings, each 5-100 characters, only allowed on fo-category skills.</item>
-  <item>RFC-0553: added SKILL-17 — skill files must not contain specific platform RFC/ADR ids (RFC-\\d{4}, ADR-\\d{4}) or platform names (Warpgogol, WarpGogol).</item>
   <item>RFC-0642: added SKILL-18 — forge skill instruction lines must not reference software-specific binding keys (typecheck, scopedBuild, test); use semantic keys (validate, produce, verify) instead.</item>
   <item>RFC-0660: added SKILL-19 (knowledge entry schema validity) and SKILL-20 (entry identifier uniqueness) for structured knowledge files.</item>
   <item>RFC-0661: added SKILL-21 (knowledge layer token budget warnings), refactored warning handling — warnings go to separate `warnings` array, not `violations`.</item>
-  <item>2026-08-03: SKILL-17 WarpGogol brand pattern made case-sensitive — the /gi flag defeated the first pattern's @-lookbehind and false-flagged every `@warpgogol/<pkg>` npm-scope reference.</item>
+  <item>RFC-1097: step 6 — compass.migrate codemod run
+
+Mechanical v1 to v2 header migration across the workspace: 942 files rewritten — CHANGE_SUMMARY windows collapsed into history, forbidden v1 blocks stripped, KEY_DECISIONS seeded from @ai-invariant comments (5 files) or TODO placeholders (103 files), blocks reordered to canonical order.</item>
+  <item>RFC-1097: sweep — packages/forge + services clean
+
+Sweep batch 2: real KEY_DECISIONS on 10 files, expanded purposes (CONTRACT-02/PURPOSE-02), headers on mission/index + gen-upstreams, sanitizeItemText in summary.record (literal Compass tags corrupted history), excludedPaths for wrangler types, test-fixtures testPattern. forge+services now 0 diagnostics under --mode error.</item>
+  <history>RFC-0374, RFC-0393, RFC-0523, RFC-0524, RFC-0539, RFC-0548, RFC-0553</history>
 </CHANGE_SUMMARY>
 */
 

package/skills/shared/extension-e2e-mitm/SKILL.md

@@ -1,53 +0,0 @@
----
-name: extension-e2e-mitm
-description: Intercept Chrome-extension tab navigations in Playwright e2e via a local CONNECT MITM proxy — the only reliable seam when page.route cannot see chrome.tabs.create traffic.
-invocation: user
-category: shared
-concerns: code-mutation
-dependsOn: []
-languagePolicy: ref(PREFERENCES.md)
----
-
-# extension-e2e-mitm
-
-Before starting, read `PREFERENCES.md` at the repository root. If the file is missing or `aiLanguage` is unset, ask the operator once and create the file using the `my-preferences` skill semantics.
-
-Use this skill when a Playwright e2e suite must control what a Chrome MV3 extension's tabs load — and `context.route` / `page.route` cannot see the traffic.
-
-## When this applies
-
-- The extension's service worker opens tabs via `chrome.tabs.create` (or `windows.create`).
-- Playwright route interception is installed but the fixture HTML never reaches the tab.
-- Symptom: `context.on("page")` fires with the real URL already in flight — the navigation started before the page surfaced to Playwright, so no route handler ever runs.
-
-This is a hard platform limitation, not a misconfiguration: extension-spawned navigations bypass the Playwright route layer entirely. Do not retry routing with different scopes (`context.route`, per-page `page.route`, `routeFromHAR`) — none of them see the request. Intercept at the network layer instead.
-
-## The pattern
-
-1. **Local CONNECT proxy** (`fixture-proxy.ts` in this skill's directory — copy it into the project's e2e folder). It listens on `127.0.0.1`, accepts CONNECT only for an allowlist of host suffixes, answers TLS with a per-run self-signed cert, and serves the currently-installed fixture HTML for every request. Non-allowlisted CONNECTs are refused — the proxy never tunnels real traffic.
-2. **Browser flags** at `chromium.launchPersistentContext`:
-   - `--proxy-server=http://127.0.0.1:<port>` — all browser traffic through the proxy.
-   - `--proxy-bypass-list=127.0.0.1;localhost` — the local API/backend must NOT go through the proxy.
-   - `--ignore-certificate-errors-spki-list=<spki>` — whitelist ONLY the proxy cert's SPKI fingerprint (exposed as `proxy.spkiFingerprint`). Never use blanket `--ignore-certificate-errors` — it disables TLS verification for the whole browser.
-3. **Fixture swap** — `proxy.setContent(html)` changes what every intercepted request returns. Install fixtures per spec, not per suite.
-
-## Integration steps
-
-1. Copy `fixture-proxy.ts` into the project's e2e directory.
-2. Pass the site's host suffixes to `startFixtureProxy({ hosts: [...] })` — the cert CN/SAN and the CONNECT allowlist derive from them.
-3. Launch the browser with the three flags above (proxy server, bypass list, spki-list).
-4. In each spec, `proxy.setContent(fixtureHtml)` before triggering the extension flow; assert on backend state (D1/API), not on page DOM.
-5. Close the proxy with the browser context (`context.on("close", () => proxy.close())`).
-
-## Parameters and limits
-
-- `hosts` — suffix list; `host === suffix || host.endsWith("." + suffix)` matches. Keep it tight: only the fixture-served sites.
-- The cert is generated per run via `openssl req -x509` into a temp dir — openssl must be on PATH; no secrets touch the repo.
-- The CONNECT parser reads the first TCP chunk — sufficient on loopback; do not reuse this proxy for real forwarding.
-- Headed browser required for MV3 service workers — wrap CI in `xvfb-run`.
-
-## Anti-patterns
-
-- Do not add runtime hooks to the extension to make it "testable" — the proxy keeps production code untouched.
-- Do not copy fixture HTML into the e2e folder — serve the canonical fixtures from their owning package.
-- Do not broaden the allowlist to "just make it work" — a refused CONNECT is the signal that a new host needs an explicit decision.

package/skills/shared/extension-e2e-mitm/fixture-proxy.ts

@@ -1,113 +0,0 @@
-/*
-@ai-invariant Fixture serving happens at the network layer — a local CONNECT proxy MITMs the allowlisted hosts.
-<MODULE_CONTRACT>
-<purpose>Starts a minimal CONNECT proxy on 127.0.0.1 that answers TLS for the allowlisted hosts with a per-run self-signed cert and serves the current fixture HTML for every request. Extension-spawned tab navigations bypass Playwright's route interception — the proxy intercepts them at the network layer instead.</purpose>
-<non-goals>
-  <item>Does not tunnel or forward real traffic — non-allowlisted CONNECTs are refused; the backend bypasses the proxy via --proxy-bypass-list.</item>
-</non-goals>
-</MODULE_CONTRACT>
-<CHANGE_SUMMARY>
-  <item>Ported from dater RFC-0015 — parameterized host allowlist and cert SANs.</item>
-</CHANGE_SUMMARY>
-*/
-
-import { createServer, type Server } from "node:net";
-import { TLSSocket, createSecureContext } from "node:tls";
-import { execFileSync } from "node:child_process";
-import { X509Certificate, createHash } from "node:crypto";
-import { readFileSync, mkdtempSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-
-export interface FixtureProxy {
-  port: number;
-  /** Base64 SHA-256 of the leaf cert's SPKI — for --ignore-certificate-errors-spki-list. */
-  spkiFingerprint: string;
-  /** Swap the HTML served for every intercepted request. */
-  setContent(html: string): void;
-  close(): void;
-}
-
-export interface FixtureProxyOptions {
-  /** Host suffixes the proxy may MITM — e.g. ["example.com"] also covers sub.example.com. */
-  hosts: string[];
-}
-
-function generateCert(dir: string, hosts: string[]): { key: Buffer; cert: Buffer } {
-  const keyPath = join(dir, "key.pem");
-  const certPath = join(dir, "cert.pem");
-  const primary = hosts[0];
-  if (!primary) throw new Error("fixture proxy needs at least one host");
-  const san = hosts.flatMap((h) => [`DNS:${h}`, `DNS:*.${h}`]).join(",");
-  execFileSync("openssl", [
-    "req", "-x509", "-newkey", "rsa:2048", "-nodes",
-    "-keyout", keyPath,
-    "-out", certPath,
-    "-days", "1",
-    "-subj", `/CN=*.${primary}`,
-    "-addext", `subjectAltName=${san}`,
-  ]);
-  return { key: readFileSync(keyPath), cert: readFileSync(certPath) };
-}
-
-/** Base64 SHA-256 of the cert's SubjectPublicKeyInfo — Chromium's spki-list format. */
-function spkiFingerprintOf(cert: Buffer): string {
-  const spki = new X509Certificate(cert).publicKey.export({ format: "der", type: "spki" });
-  return createHash("sha256").update(spki).digest("base64");
-}
-
-/**
- * Start a CONNECT proxy that MITMs the allowlisted hosts. Launch the browser
- * with --proxy-server pointing here, --proxy-bypass-list for the local
- * backend, and --ignore-certificate-errors-spki-list scoped to
- * proxy.spkiFingerprint.
- */
-export async function startFixtureProxy(options: FixtureProxyOptions): Promise<FixtureProxy> {
-  const dir = mkdtempSync(join(tmpdir(), "e2e-fixture-cert-"));
-  const { key, cert } = generateCert(dir, options.hosts);
-  const secureContext = createSecureContext({ key, cert });
-  const spkiFingerprint = spkiFingerprintOf(cert);
-  let content = "<html><body>no fixture installed</body></html>";
-
-  const server: Server = createServer((sock) => {
-    sock.once("data", (head) => {
-      const line = head.toString("utf8").split("\r\n")[0] ?? "";
-      const m = line.match(/^CONNECT ([^:]+):(\d+)/);
-      if (!m) {
-        sock.destroy();
-        return;
-      }
-      const host = m[1]!;
-      if (!options.hosts.some((s) => host === s || host.endsWith(`.${s}`))) {
-        sock.destroy();
-        return;
-      }
-      sock.write("HTTP/1.1 200 Connection Established\r\n\r\n");
-      const tls = new TLSSocket(sock, { secureContext, isServer: true });
-      tls.once("secure", () => {
-        tls.once("data", () => {
-          const body = content;
-          tls.end(
-            `HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: ${Buffer.byteLength(body)}\r\nConnection: close\r\n\r\n${body}`,
-          );
-        });
-      });
-      tls.on("error", () => sock.destroy());
-    });
-    sock.on("error", () => sock.destroy());
-  });
-
-  await new Promise<void>((resolveListen) => server.listen(0, "127.0.0.1", resolveListen));
-  const port = (server.address() as { port: number }).port;
-
-  return {
-    port,
-    spkiFingerprint,
-    setContent(html: string) {
-      content = html;
-    },
-    close() {
-      server.close();
-    },
-  };
-}