forge-workflow 0.0.10 → 0.1.0-beta.3

package/scripts/pr-auto-actions.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * pr-auto-actions — the pr-monitor workflow's bridge from the `--pull --json`
+ * verdict payload to Tier-2 auto-action DECISIONS. Reads the payload file the
+ * monitor already wrote (default `pull.json`), asks lib/pr-monitor/auto-actions
+ * (the single, unit-tested decision core) what is safe to do, and emits the
+ * flags to `$GITHUB_OUTPUT` (or stdout locally) for the workflow's action steps.
+ *
+ * This script performs NO GitHub writes and takes NO action — it only decides.
+ * The workflow owns the visible `gh` calls and the per-head-SHA idempotency
+ * markers. Fails CLOSED: an unreadable/malformed payload or any thrown error
+ * yields `update_branch=false` / `rerun=false`.
+ *
+ * Usage: node scripts/pr-auto-actions.js [pull.json] [isFork]
+ *   isFork: "true" when the PR head is a cross-repository fork (skips update).
+ *
+ * @module scripts/pr-auto-actions
+ */
+
+const fs = require('node:fs');
+
+const { decideAutoActions } = require('../lib/pr-monitor/auto-actions');
+
+/**
+ * Append `key=value` lines to `$GITHUB_OUTPUT` when set, else print them. Values
+ * are single-line (booleans / csv / short reasons) so no multiline escaping is
+ * needed; newlines are stripped defensively.
+ *
+ * @param {Record<string,string>} outputs
+ */
+function emitOutputs(outputs) {
+  const target = process.env.GITHUB_OUTPUT;
+  const text = Object.entries(outputs)
+    .map(([k, val]) => `${k}=${String(val).replace(/[\r\n]+/g, ' ')}`)
+    .join('\n') + '\n';
+  if (target) fs.appendFileSync(target, text);
+  else process.stdout.write(text);
+}
+
+/** Read + parse the payload file, returning null (fail-closed) on any error. */
+function readPayload(path) {
+  try {
+    return JSON.parse(fs.readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function main(argv) {
+  const path = argv[2] || 'pull.json';
+  const isFork = String(argv[3] || '').toLowerCase() === 'true';
+
+  const payload = readPayload(path);
+  if (!payload) {
+    // Fail closed: no readable verdict payload → take no action.
+    emitOutputs({
+      update_branch: 'false', update_reason: `no readable payload at ${path}`,
+      rerun: 'false', rerun_run_ids: '', rerun_reason: `no readable payload at ${path}`,
+    });
+    console.log(`auto-actions: no readable payload at ${path} — no action (fail closed)`);
+    return 0;
+  }
+
+  const { updateBranch, rerunFlaky } = decideAutoActions(payload, { isFork });
+  emitOutputs({
+    update_branch: updateBranch.should ? 'true' : 'false',
+    update_reason: updateBranch.reason,
+    rerun: rerunFlaky.should ? 'true' : 'false',
+    rerun_run_ids: (rerunFlaky.runIds || []).join(','),
+    rerun_reason: rerunFlaky.reason,
+  });
+  console.log(`auto-actions: update_branch=${updateBranch.should} (${updateBranch.reason})`);
+  console.log(`auto-actions: rerun=${rerunFlaky.should} (${rerunFlaky.reason})`);
+  return 0;
+}
+
+if (require.main === module) {
+  try {
+    process.exit(main(process.argv));
+  } catch (err) {
+    // Absolute fail-closed backstop: never let this script red-X the monitor.
+    emitOutputs({
+      update_branch: 'false', update_reason: `error: ${(err && err.message) || err}`,
+      rerun: 'false', rerun_run_ids: '', rerun_reason: `error: ${(err && err.message) || err}`,
+    });
+    console.log(`auto-actions: error — no action (fail closed): ${(err && err.message) || err}`);
+    process.exit(0);
+  }
+}
+
+module.exports = { emitOutputs, readPayload, main };

package/scripts/pr-coordinator.sh

@@ -15,6 +15,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [[ -f "$SCRIPT_DIR/bootstrap-windows-tools.sh" ]]; then
+  source "$SCRIPT_DIR/bootstrap-windows-tools.sh"
+fi
 source "$SCRIPT_DIR/lib/sanitize.sh" || { echo "FATAL: failed to source sanitize.sh" >&2; exit 2; }
 
 # Source these but don't fail if missing (tests may not have them)

package/scripts/pr-verdict-label.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * pr-verdict label emitter — maps a canonical merge verdict (from
+ * `forge shepherd <pr> --pull --json`, lib/pr-pull.js) to its single
+ * `pr-verdict:*` label and emits `label` + `all_labels` to `$GITHUB_OUTPUT`
+ * (or stdout locally) for the pr-monitor workflow's reconcile step.
+ *
+ * SINGLE SOURCE: the verdict value and the label vocabulary both come from
+ * lib/pr-pull.js — this script computes NO verdict of its own, so the label can
+ * never disagree with `--pull`. Fails closed to `unknown` on empty input.
+ * Performs NO GitHub writes (the workflow owns the visible `gh` calls).
+ *
+ * Usage: node scripts/pr-verdict-label.js <VERDICT>
+ *
+ * @module scripts/pr-verdict-label
+ */
+
+const fs = require('node:fs');
+
+const { verdictLabel, VERDICT_LABELS } = require('../lib/pr-pull');
+
+/**
+ * Append `key=value` lines to `$GITHUB_OUTPUT` when set, else print them.
+ *
+ * @param {Record<string,string>} outputs
+ */
+function emitOutputs(outputs) {
+  const target = process.env.GITHUB_OUTPUT;
+  const text = Object.entries(outputs).map(([k, val]) => `${k}=${val}`).join('\n') + '\n';
+  if (target) fs.appendFileSync(target, text);
+  else process.stdout.write(text);
+}
+
+function main(argv) {
+  // Fail closed: a missing/empty verdict arg maps to the `unknown` label rather
+  // than erroring — the workflow must still land a label on every pass.
+  const verdict = argv[2] || 'UNKNOWN';
+  const label = verdictLabel(verdict);
+  emitOutputs({ label, all_labels: VERDICT_LABELS.join(',') });
+  console.log(`pr-verdict label: ${label} (verdict ${verdict})`);
+  return 0;
+}
+
+if (require.main === module) {
+  process.exit(main(process.argv));
+}
+
+module.exports = { emitOutputs, main };

package/scripts/preflight-sonar.eslint.config.mjs

@@ -0,0 +1,44 @@
+// Isolated ESLint flat config for `forge preflight`'s SonarCloud-parity gate.
+//
+// Run ONLY via `eslint --no-config-lookup --config scripts/preflight-sonar.eslint.config.mjs`
+// on changed files, so these Sonar rules never merge with the repo's main
+// eslint.config.js. The point is deterministic parity with the SonarCloud
+// quality gate WITHOUT the full (slow) Sonar scanner, on the change blast radius.
+//
+// cognitive-complexity is pinned to 15 — the same threshold SonarCloud's default
+// "Cognitive Complexity" (S3776) gate uses, and the most common gate failure.
+//
+// Rule name ↔ Sonar rule ID (eslint-plugin-sonarjs v4):
+//   sonarjs/cognitive-complexity  S3776  (pinned to 15)
+//   sonarjs/void-use              S3735  (void should not be used)
+//   sonarjs/regex-complexity      S5843  (regex too complex)
+//
+// prefer-optional-chain (S6582) is intentionally omitted: sonarjs exposes it
+// only through the TypeScript type-checker path, which this fast JS-only gate
+// does not wire (it would require @typescript-eslint/parser + a project graph
+// and defeats the speed goal). CI's full Sonar scan still enforces it.
+import sonarjs from 'eslint-plugin-sonarjs';
+
+const sonarRules = {
+  'sonarjs/cognitive-complexity': ['error', 15],
+  'sonarjs/void-use': 'error',
+  'sonarjs/regex-complexity': 'error',
+};
+
+export default [
+  {
+    ignores: ['node_modules/', 'coverage/', 'dist/', 'build/', '**/*.min.js'],
+  },
+  {
+    files: ['**/*.mjs'],
+    languageOptions: { ecmaVersion: 2023, sourceType: 'module' },
+    plugins: { sonarjs },
+    rules: sonarRules,
+  },
+  {
+    files: ['**/*.js', '**/*.cjs'],
+    languageOptions: { ecmaVersion: 2023, sourceType: 'commonjs' },
+    plugins: { sonarjs },
+    rules: sonarRules,
+  },
+];

package/scripts/preflight.sh

@@ -1,8 +1,14 @@
 #!/usr/bin/env bash
 set -u
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -f "$SCRIPT_DIR/bootstrap-windows-tools.sh" ]; then
+  source "$SCRIPT_DIR/bootstrap-windows-tools.sh"
+fi
+
+FORGE_CLI="$SCRIPT_DIR/../bin/forge.js"
+
 exit_code=0
-have_bd=0
 have_gh=0
 
 ok() {
@@ -21,62 +27,6 @@ action() {
   exit_code=2
 }
 
-snapshot_hooks_dir() {
-  hooks_dir="$1"
-  hooks_snapshot_dir="$(mktemp -d 2>/dev/null || mktemp -d -t forge-preflight-hooks)"
-
-  if [ -d "$hooks_dir" ]; then
-    cp -pR "$hooks_dir"/. "$hooks_snapshot_dir"/
-  fi
-}
-
-restore_hooks_dir() {
-  hooks_dir="$1"
-  mkdir -p "$hooks_dir"
-
-  find "$hooks_dir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
-
-  if [ -d "$hooks_snapshot_dir" ]; then
-    cp -pR "$hooks_snapshot_dir"/. "$hooks_dir"/
-    rm -rf "$hooks_snapshot_dir"
-  fi
-}
-
-write_beads_config() {
-  mkdir -p .beads
-  {
-    printf '%s\n' 'issue-prefix: forge'
-    printf '\n'
-    printf '%s\n' 'database:'
-    printf '%s\n' '  backend: dolt'
-    printf '\n'
-  } > .beads/config.yaml
-}
-
-write_beads_gitignore() {
-  mkdir -p .beads
-  {
-    printf '%s\n' '# Dolt database files (binary, not suitable for git)'
-    printf '%s\n' 'dolt/'
-    printf '%s\n' '*.db'
-    printf '%s\n' '*.lock'
-    printf '\n'
-  } > .beads/.gitignore
-}
-
-safe_bd_init() {
-  hooks_dir="$(git rev-parse --git-path hooks 2>/dev/null || printf '.git/hooks')"
-  write_beads_config
-  write_beads_gitignore
-  snapshot_hooks_dir "$hooks_dir"
-
-  bd init --database forge --prefix forge >/dev/null 2>&1
-  init_status=$?
-
-  restore_hooks_dir "$hooks_dir"
-  return "$init_status"
-}
-
 is_windows_shell() {
   case "$(uname -s 2>/dev/null || printf unknown)" in
     MINGW*|MSYS*|CYGWIN*)
@@ -107,10 +57,7 @@ check_tool() {
 }
 
 check_tools() {
-  if check_tool "bd" "install Forge/Beads tooling, then rerun: bunx forge setup --quick"; then
-    have_bd=1
-  fi
-
+  check_tool "node" "install Node.js (https://nodejs.org)" || true
   check_tool "jq" "winget install jqlang.jq" || true
 
   if check_tool "gh" "winget install GitHub.cli"; then
@@ -131,50 +78,30 @@ check_github_auth() {
   action "github-auth" "not logged in; run: gh auth login"
 }
 
-check_beads() {
-  if [ "$have_bd" -ne 1 ]; then
-    return 0
-  fi
-
-  init_ok=0
-  if bd list --json --limit 1 >/dev/null 2>&1; then
-    ok "beads-init" "Beads database is readable"
-    init_ok=1
+# Validate the Forge Kernel issue store. The kernel DB is a single-machine
+# SQLite store in the git common dir; any kernel issue command auto-migrates it
+# via broker.initialize(), so the ensure step is just a kernel read. `forge
+# doctor` then reports the filesystem class of that DB path (D19) — it only
+# reports, it does not init, which is why the ensure step runs first.
+check_kernel() {
+  if node "$FORGE_CLI" issue list --json >/dev/null 2>&1; then
+    ok "kernel-init" "Kernel issue store is readable"
   else
-    if safe_bd_init; then
-      fixed "beads-init" "ran hook-preserving bd init --database forge --prefix forge"
-      init_ok=1
-    else
-      action "beads-init" "bd init failed; inspect Beads setup manually"
-    fi
-  fi
-
-  if [ "$init_ok" -ne 1 ]; then
+    action "kernel-init" "kernel issue store not initializable; inspect: node bin/forge.js doctor"
     return 0
   fi
 
-  doctor_output="$(bd doctor --fix --yes 2>&1)"
-  doctor_status=$?
-  if [ "$doctor_status" -eq 0 ]; then
-    doctor_output_lower="$(printf '%s' "$doctor_output" | tr '[:upper:]' '[:lower:]')"
-    if [ "$exit_code" -eq 1 ] ||
-      [[ "$doctor_output_lower" == *fix* ]] ||
-      [[ "$doctor_output_lower" == *repair* ]] ||
-      [[ "$doctor_output_lower" == *migrat* ]] ||
-      [[ "$doctor_output_lower" == *updat* ]]; then
-      fixed "beads-doctor" "ran bd doctor --fix --yes after Beads repair"
-    else
-      ok "beads-doctor" "bd doctor --fix --yes succeeded"
-    fi
+  if node "$FORGE_CLI" doctor >/dev/null 2>&1; then
+    ok "kernel-doctor" "forge doctor reports a healthy filesystem for the kernel database"
   else
-    action "beads-doctor" "bd doctor --fix --yes failed; inspect Beads manually"
+    action "kernel-doctor" "forge doctor reports an unhealthy filesystem; inspect the kernel database path"
   fi
 }
 
 main() {
   check_tools
   check_github_auth
-  check_beads
+  check_kernel
   exit "$exit_code"
 }
 

package/scripts/protected-state-check.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+
+const { execFileSync } = require('node:child_process');
+const {
+	assertProtectedWriteAllowed,
+	recordProtectedStateAuditEvent,
+} = require('../lib/protected-state-surfaces');
+
+function parseNameStatus(output) {
+	const files = [];
+	for (const line of output.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		const parts = trimmed.split('\t').filter(Boolean);
+		const status = parts[0] || '';
+		if (/^[RC]/.test(status)) {
+			files.push(...parts.slice(1, 3));
+		} else {
+			files.push(parts[1]);
+		}
+	}
+	return [...new Set(files.filter(Boolean))];
+}
+
+function getStagedFiles() {
+	if (process.env.FORGE_PROTECTED_STATE_STAGED_NAME_STATUS !== undefined) {
+		return parseNameStatus(process.env.FORGE_PROTECTED_STATE_STAGED_NAME_STATUS);
+	}
+
+	if (process.env.FORGE_PROTECTED_STATE_STAGED_FILES !== undefined) {
+		return process.env.FORGE_PROTECTED_STATE_STAGED_FILES
+			.split(/\r?\n/)
+			.map(line => line.trim())
+			.filter(Boolean);
+	}
+
+	const output = execFileSync('git', ['diff', '--cached', '--name-status', '--diff-filter=ACMRDT'], {
+		encoding: 'utf8',
+		stdio: ['ignore', 'pipe', 'pipe'],
+	});
+	return parseNameStatus(output);
+}
+
+function getAllowedSurfaces() {
+	return new Set(
+		String(process.env.FORGE_PROTECTED_STATE_ALLOWED_SURFACES || '')
+			.split(',')
+			.map(surface => surface.trim())
+			.filter(Boolean),
+	);
+}
+
+function main() {
+	const actor =
+		process.env.FORGE_PROTECTED_STATE_ACTOR ||
+		process.env.FORGE_ACTOR ||
+		process.env.USER ||
+		process.env.USERNAME ||
+		'unknown';
+	const allowedSurfaces = getAllowedSurfaces();
+	const decisions = getStagedFiles()
+		.map(file => {
+			const probe = assertProtectedWriteAllowed(file, { actor, operation: 'staged_edit' });
+			if (probe.requiredSurface && allowedSurfaces.has(probe.requiredSurface)) {
+				return assertProtectedWriteAllowed(file, {
+					actor,
+					operation: 'staged_edit',
+					viaForgeApi: true,
+					surface: probe.requiredSurface,
+				});
+			}
+			return probe;
+		})
+		.filter(decision => !decision.allowed);
+
+	for (const decision of decisions) {
+		const audit = recordProtectedStateAuditEvent(decision, { cwd: process.cwd() });
+		if (!audit.success) {
+			console.error(`WARN: Failed to record protected-state audit for ${decision.path}: ${audit.error}`);
+		}
+	}
+
+	if (decisions.length === 0) {
+		console.log('OK: No protected state edits detected.');
+		process.exit(0);
+	}
+
+	console.error('ERROR: Protected state edit detected. Direct edits to these paths are blocked:');
+	for (const decision of decisions) {
+		console.error(`  - ${decision.path} [${decision.requiredSurface}]`);
+		console.error(`    Decision: ${decision.decision}`);
+		console.error(`    Repair: ${decision.repairHint}`);
+	}
+	console.error('');
+	console.error('Use the owning Forge or Beads API surface, then stage the generated result if that command explicitly owns it.');
+	process.exit(1);
+}
+
+try {
+	main();
+} catch (error) {
+	console.error(`Protected state check failed: ${error.message}`);
+	process.exit(1);
+}