forge-workflow 0.0.9 → 0.1.0-beta.2

package/scripts/parity-check.mjs

@@ -0,0 +1,145 @@
+// Byte-for-byte parity check between the two Forge distribution channels.
+//
+// Runs `forge setup` from BOTH the npm path (`node bin/forge.js`) and the compiled
+// single-file binary into two throwaway git projects, then compares the produced
+// trees by relative-path set + per-file SHA-256. Catches flattening, missing files,
+// CRLF mangling, and corruption in one assertion.
+//
+// This is the "one real-compile leg" the reliability guidance asks for. It is
+// runnable locally (`bun run parity:binary`) and by the step-3 CI matrix on each
+// host target. Requires `bun` and `git` on PATH.
+
+import { execFileSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const BIN = process.platform === 'win32' ? 'forge-bin.exe' : 'forge-bin';
+const BIN_PATH = path.join(REPO, BIN);
+
+function run(cmd, args, opts = {}) {
+  const r = spawnSync(cmd, args, { encoding: 'utf8', ...opts });
+  return r;
+}
+
+function sha256(file) {
+  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+
+// Directories to skip entirely while walking a setup tree. `node_modules` is a
+// package-manager install artifact, NOT a Forge-managed asset — `setup --quick`
+// may run an npm/bun install whose output (dependency trees, registry metadata)
+// is legitimately non-deterministic between runs, channels, and OSes. Comparing
+// it produces false-positive drift, so it is excluded. `.git` is runtime VCS state.
+const EXCLUDED_DIRS = new Set(['.git', 'node_modules']);
+
+// Files to skip regardless of location. Lockfiles are install byproducts: their
+// bytes vary with registry ordering/timestamps and are not Forge assets. Excluding
+// them keeps parity strict for real assets (skills/rules/hooks/.forge/AGENTS.md)
+// while ignoring package-manager noise. `.package-lock.json` normally lives under
+// node_modules/ (already excluded) but is guarded here too for robustness.
+const EXCLUDED_FILES = new Set(['package-lock.json', '.package-lock.json']);
+
+/**
+ * Map of relative-posix-path → sha256 for every Forge-managed file under dir.
+ * Excludes .git, node_modules/**, and package-manager lockfiles (see the
+ * EXCLUDED_* sets above) so parity compares only Forge assets, not install output.
+ */
+function hashTree(dir) {
+  const map = {};
+  const walk = (abs, rel) => {
+    for (const e of fs.readdirSync(abs)) {
+      if (EXCLUDED_DIRS.has(e)) continue;
+      const a = path.join(abs, e);
+      const r = rel ? `${rel}/${e}` : e;
+      const st = fs.lstatSync(a);
+      if (st.isDirectory()) walk(a, r);
+      else if (st.isFile() && !EXCLUDED_FILES.has(e)) map[r] = sha256(a);
+    }
+  };
+  walk(dir, '');
+  return map;
+}
+
+function makeProject(label) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), `forge-parity-${label}-`));
+  execFileSync('git', ['init', '-q'], { cwd: dir });
+  execFileSync('git', ['config', 'user.email', 'parity@forge.test'], { cwd: dir });
+  execFileSync('git', ['config', 'user.name', 'parity'], { cwd: dir });
+  return dir;
+}
+
+function runSetup(label, cmd, args, dir) {
+  console.log(`\n[${label}] ${cmd} ${args.join(' ')}  (cwd=${dir})`);
+  const r = run(cmd, args, { cwd: dir });
+  if (r.status !== 0) {
+    console.error(`[${label}] setup exited ${r.status}`);
+    if (r.stdout) console.error(r.stdout.slice(-2000));
+    if (r.stderr) console.error(r.stderr.slice(-2000));
+    throw new Error(`[${label}] setup failed`);
+  }
+  return r;
+}
+
+function main() {
+  // 1. Build the binary (regenerates the embed manifest first).
+  console.log('Building single-file binary (bun run build:binary)…');
+  const build = run('bun', ['run', 'build:binary'], { cwd: REPO });
+  if (build.status !== 0) {
+    console.error(build.stdout || '');
+    console.error(build.stderr || '');
+    throw new Error('build:binary failed');
+  }
+  if (!fs.existsSync(BIN_PATH)) throw new Error(`binary not found at ${BIN_PATH}`);
+
+  // 2. Run setup from both channels into fresh git projects.
+  const setupArgs = ['setup', '--quick', '--yes'];
+  const npmDir = makeProject('npm');
+  const binDir = makeProject('bin');
+
+  // try/finally so the throwaway temp git projects are removed even when setup
+  // or the comparison throws (no leaked dirs on any failure path).
+  try {
+    runSetup('npm', 'node', [path.join(REPO, 'bin', 'forge.js'), ...setupArgs], npmDir);
+    runSetup('bin', BIN_PATH, setupArgs, binDir);
+
+    // 3. Compare trees.
+    const a = hashTree(npmDir);
+    const b = hashTree(binDir);
+    const keys = new Set([...Object.keys(a), ...Object.keys(b)]);
+    const missingInBin = [];
+    const missingInNpm = [];
+    const differing = [];
+    for (const k of keys) {
+      if (!(k in b)) missingInBin.push(k);
+      else if (!(k in a)) missingInNpm.push(k);
+      else if (a[k] !== b[k]) differing.push(k);
+    }
+
+    const problems = missingInBin.length + missingInNpm.length + differing.length;
+    console.log(`\nParity: ${Object.keys(a).length} npm files vs ${Object.keys(b).length} binary files.`);
+    if (missingInBin.length) console.log(`  Missing in binary: ${missingInBin.join(', ')}`);
+    if (missingInNpm.length) console.log(`  Missing in npm:    ${missingInNpm.join(', ')}`);
+    if (differing.length) console.log(`  Differing bytes:   ${differing.join(', ')}`);
+
+    if (problems > 0) {
+      console.error(`\nPARITY FAILED (${problems} discrepancies).`);
+      process.exit(1);
+    }
+    console.log('\nPARITY OK — npm and compiled binary produced byte-identical setup trees.');
+  } finally {
+    fs.rmSync(npmDir, { recursive: true, force: true });
+    fs.rmSync(binDir, { recursive: true, force: true });
+  }
+}
+
+// Exported for unit testing the asset-vs-install-artifact filtering. `hashTree`
+// and the exclusion sets are the load-bearing parity logic; the rest of the file
+// drives real builds and only runs when executed directly (guarded below).
+export { hashTree, EXCLUDED_DIRS, EXCLUDED_FILES };
+
+// Only build + compare when run as a script, not when imported by a test.
+if (import.meta.main) main();

package/scripts/parity-check.test.mjs

@@ -0,0 +1,58 @@
+// Unit test for the parity-check asset filtering. The parity check compares the
+// npm-vs-binary `setup --quick` trees; it MUST ignore package-manager install
+// byproducts (node_modules/**, lockfiles) that are legitimately non-deterministic
+// between runs/channels/OSes, while staying strict for real Forge assets. This
+// test pins that exclusion so a genuine skills/rules/hook drift still fails but
+// install junk never produces a false-positive parity failure.
+
+import { test, expect } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { hashTree, EXCLUDED_DIRS, EXCLUDED_FILES } from './parity-check.mjs';
+
+function mkTree() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'parity-hashtree-'));
+  // Real Forge-managed assets — these MUST be compared.
+  fs.mkdirSync(path.join(dir, 'skills'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'skills', 'SKILL.md'), 'real asset\n');
+  fs.writeFileSync(path.join(dir, 'AGENTS.md'), 'real asset\n');
+  // Install byproducts — these MUST be excluded.
+  fs.mkdirSync(path.join(dir, 'node_modules', 'left-pad'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'node_modules', 'left-pad', 'index.js'), 'junk\n');
+  fs.writeFileSync(path.join(dir, 'node_modules', '.package-lock.json'), '{}\n');
+  fs.writeFileSync(path.join(dir, 'package-lock.json'), '{"v":1}\n');
+  return dir;
+}
+
+test('hashTree excludes node_modules and lockfiles but keeps real assets', () => {
+  const dir = mkTree();
+  try {
+    const keys = Object.keys(hashTree(dir)).sort();
+    expect(keys).toEqual(['AGENTS.md', 'skills/SKILL.md']);
+    // No install artifact leaked into the comparison set.
+    expect(keys.some(k => k.includes('node_modules'))).toBe(false);
+    expect(keys.some(k => k.endsWith('package-lock.json'))).toBe(false);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('a real asset byte change is still detected (parity stays strict)', () => {
+  const dir = mkTree();
+  try {
+    const before = hashTree(dir);
+    fs.writeFileSync(path.join(dir, 'skills', 'SKILL.md'), 'DRIFTED asset\n');
+    const after = hashTree(dir);
+    expect(after['skills/SKILL.md']).not.toBe(before['skills/SKILL.md']);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('exclusion sets document the intended artifacts', () => {
+  expect(EXCLUDED_DIRS.has('node_modules')).toBe(true);
+  expect(EXCLUDED_DIRS.has('.git')).toBe(true);
+  expect(EXCLUDED_FILES.has('package-lock.json')).toBe(true);
+  expect(EXCLUDED_FILES.has('.package-lock.json')).toBe(true);
+});

package/scripts/pin-agentic-workflow-images.js

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const DEFAULT_LOCK_FILES = [
+	'.github/agentic-workflows/behavioral-test.lock.yml',
+	'.github/workflows/behavioral-test.lock.yml',
+];
+
+const IMAGE_PINS = [
+	{
+		image: 'ghcr.io/github/gh-aw-mcpg:v0.3.0',
+		digest: 'sha256:9c2228324fb1f26f39dc9471612e530ae3efc3156dac05efb2e8d212878d454d',
+		pinnedImage: 'ghcr.io/github/gh-aw-mcpg@sha256:9c2228324fb1f26f39dc9471612e530ae3efc3156dac05efb2e8d212878d454d',
+	},
+	{
+		image: 'ghcr.io/github/github-mcp-server:v1.0.2',
+		digest: 'sha256:26db03408086a99cf1916348dcc4f9614206658f9082a8060dc7c81ad787f4ba',
+		pinnedImage: 'ghcr.io/github/github-mcp-server@sha256:26db03408086a99cf1916348dcc4f9614206658f9082a8060dc7c81ad787f4ba',
+	},
+];
+
+function updateManifestLine(line) {
+	const prefix = '# gh-aw-manifest: ';
+	if (!line.startsWith(prefix)) {
+		return line;
+	}
+
+	const manifest = JSON.parse(line.slice(prefix.length));
+	if (!Array.isArray(manifest.containers)) {
+		return line;
+	}
+
+	manifest.containers = manifest.containers.map((container) => {
+		const pin = IMAGE_PINS.find(candidate => candidate.image === container.image);
+		if (!pin) {
+			return container;
+		}
+
+		return {
+			...container,
+			digest: pin.digest,
+			pinned_image: pin.pinnedImage,
+		};
+	});
+
+	return `${prefix}${JSON.stringify(manifest)}`;
+}
+
+function pinLockContent(content) {
+	const lines = content.split(/\r?\n/);
+	if (lines.length > 1) {
+		lines[1] = updateManifestLine(lines[1]);
+	}
+
+	let pinned = lines.join('\n');
+	const manifestPrefix = /^# gh-aw-manifest: .*$/m;
+	const manifestMatch = pinned.match(manifestPrefix);
+	const manifestLine = manifestMatch ? manifestMatch[0] : null;
+	pinned = pinned.replace(manifestPrefix, '__GH_AW_MANIFEST_PLACEHOLDER__');
+
+	for (const pin of IMAGE_PINS) {
+		pinned = pinned.split(pin.image).join(pin.pinnedImage);
+	}
+
+	if (manifestLine) {
+		pinned = pinned.replace('__GH_AW_MANIFEST_PLACEHOLDER__', updateManifestLine(manifestLine));
+	}
+
+	return pinned;
+}
+
+function pinLockFile(filePath) {
+	const original = fs.readFileSync(filePath, 'utf8');
+	const pinned = pinLockContent(original);
+	if (pinned !== original) {
+		fs.writeFileSync(filePath, pinned, 'utf8');
+		return true;
+	}
+	return false;
+}
+
+function main() {
+	const args = process.argv.slice(2);
+	const files = args.length > 0 ? args : DEFAULT_LOCK_FILES;
+	const changed = [];
+
+	for (const file of files) {
+		const filePath = path.resolve(process.cwd(), file);
+		if (pinLockFile(filePath)) {
+			changed.push(file);
+		}
+	}
+
+	if (changed.length === 0) {
+		console.log('Agentic workflow runtime images already pinned');
+		return;
+	}
+
+	console.log(`Pinned agentic workflow runtime images: ${changed.join(', ')}`);
+}
+
+if (require.main === module) {
+	main();
+}
+
+module.exports = {
+	IMAGE_PINS,
+	pinLockContent,
+	pinLockFile,
+};

package/scripts/pr-coordinator.sh

@@ -15,6 +15,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [[ -f "$SCRIPT_DIR/bootstrap-windows-tools.sh" ]]; then
+  source "$SCRIPT_DIR/bootstrap-windows-tools.sh"
+fi
 source "$SCRIPT_DIR/lib/sanitize.sh" || { echo "FATAL: failed to source sanitize.sh" >&2; exit 2; }
 
 # Source these but don't fail if missing (tests may not have them)

package/scripts/preflight-sonar.eslint.config.mjs

@@ -0,0 +1,44 @@
+// Isolated ESLint flat config for `forge preflight`'s SonarCloud-parity gate.
+//
+// Run ONLY via `eslint --no-config-lookup --config scripts/preflight-sonar.eslint.config.mjs`
+// on changed files, so these Sonar rules never merge with the repo's main
+// eslint.config.js. The point is deterministic parity with the SonarCloud
+// quality gate WITHOUT the full (slow) Sonar scanner, on the change blast radius.
+//
+// cognitive-complexity is pinned to 15 — the same threshold SonarCloud's default
+// "Cognitive Complexity" (S3776) gate uses, and the most common gate failure.
+//
+// Rule name ↔ Sonar rule ID (eslint-plugin-sonarjs v4):
+//   sonarjs/cognitive-complexity  S3776  (pinned to 15)
+//   sonarjs/void-use              S3735  (void should not be used)
+//   sonarjs/regex-complexity      S5843  (regex too complex)
+//
+// prefer-optional-chain (S6582) is intentionally omitted: sonarjs exposes it
+// only through the TypeScript type-checker path, which this fast JS-only gate
+// does not wire (it would require @typescript-eslint/parser + a project graph
+// and defeats the speed goal). CI's full Sonar scan still enforces it.
+import sonarjs from 'eslint-plugin-sonarjs';
+
+const sonarRules = {
+  'sonarjs/cognitive-complexity': ['error', 15],
+  'sonarjs/void-use': 'error',
+  'sonarjs/regex-complexity': 'error',
+};
+
+export default [
+  {
+    ignores: ['node_modules/', 'coverage/', 'dist/', 'build/', '**/*.min.js'],
+  },
+  {
+    files: ['**/*.mjs'],
+    languageOptions: { ecmaVersion: 2023, sourceType: 'module' },
+    plugins: { sonarjs },
+    rules: sonarRules,
+  },
+  {
+    files: ['**/*.js', '**/*.cjs'],
+    languageOptions: { ecmaVersion: 2023, sourceType: 'commonjs' },
+    plugins: { sonarjs },
+    rules: sonarRules,
+  },
+];

package/scripts/preflight.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -f "$SCRIPT_DIR/bootstrap-windows-tools.sh" ]; then
+  source "$SCRIPT_DIR/bootstrap-windows-tools.sh"
+fi
+
+FORGE_CLI="$SCRIPT_DIR/../bin/forge.js"
+
+exit_code=0
+have_gh=0
+
+ok() {
+  printf 'OK %s - %s\n' "$1" "$2"
+}
+
+fixed() {
+  printf 'FIXED %s - %s\n' "$1" "$2"
+  if [ "$exit_code" -lt 1 ]; then
+    exit_code=1
+  fi
+}
+
+action() {
+  printf 'ACTION %s - %s\n' "$1" "$2"
+  exit_code=2
+}
+
+is_windows_shell() {
+  case "$(uname -s 2>/dev/null || printf unknown)" in
+    MINGW*|MSYS*|CYGWIN*)
+      return 0
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+check_tool() {
+  tool="$1"
+  hint="$2"
+
+  if command -v "$tool" >/dev/null 2>&1; then
+    ok "tool $tool" "found $(command -v "$tool")"
+    return 0
+  fi
+
+  action "tool $tool" "missing"
+  if is_windows_shell; then
+    printf '  Windows hint: %s\n' "$hint"
+  else
+    printf '  Install hint: %s\n' "$hint"
+  fi
+  return 1
+}
+
+check_tools() {
+  check_tool "node" "install Node.js (https://nodejs.org)" || true
+  check_tool "jq" "winget install jqlang.jq" || true
+
+  if check_tool "gh" "winget install GitHub.cli"; then
+    have_gh=1
+  fi
+}
+
+check_github_auth() {
+  if [ "$have_gh" -ne 1 ]; then
+    return 0
+  fi
+
+  if gh auth status >/dev/null 2>&1; then
+    ok "github-auth" "gh auth status succeeded"
+    return 0
+  fi
+
+  action "github-auth" "not logged in; run: gh auth login"
+}
+
+# Validate the Forge Kernel issue store. The kernel DB is a single-machine
+# SQLite store in the git common dir; any kernel issue command auto-migrates it
+# via broker.initialize(), so the ensure step is just a kernel read. `forge
+# doctor` then reports the filesystem class of that DB path (D19) — it only
+# reports, it does not init, which is why the ensure step runs first.
+check_kernel() {
+  if node "$FORGE_CLI" issue list --json >/dev/null 2>&1; then
+    ok "kernel-init" "Kernel issue store is readable"
+  else
+    action "kernel-init" "kernel issue store not initializable; inspect: node bin/forge.js doctor"
+    return 0
+  fi
+
+  if node "$FORGE_CLI" doctor >/dev/null 2>&1; then
+    ok "kernel-doctor" "forge doctor reports a healthy filesystem for the kernel database"
+  else
+    action "kernel-doctor" "forge doctor reports an unhealthy filesystem; inspect the kernel database path"
+  fi
+}
+
+main() {
+  check_tools
+  check_github_auth
+  check_kernel
+  exit "$exit_code"
+}
+
+main "$@"

package/scripts/protected-state-check.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+
+const { execFileSync } = require('node:child_process');
+const {
+	assertProtectedWriteAllowed,
+	recordProtectedStateAuditEvent,
+} = require('../lib/protected-state-surfaces');
+
+function parseNameStatus(output) {
+	const files = [];
+	for (const line of output.split(/\r?\n/)) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		const parts = trimmed.split('\t').filter(Boolean);
+		const status = parts[0] || '';
+		if (/^[RC]/.test(status)) {
+			files.push(...parts.slice(1, 3));
+		} else {
+			files.push(parts[1]);
+		}
+	}
+	return [...new Set(files.filter(Boolean))];
+}
+
+function getStagedFiles() {
+	if (process.env.FORGE_PROTECTED_STATE_STAGED_NAME_STATUS !== undefined) {
+		return parseNameStatus(process.env.FORGE_PROTECTED_STATE_STAGED_NAME_STATUS);
+	}
+
+	if (process.env.FORGE_PROTECTED_STATE_STAGED_FILES !== undefined) {
+		return process.env.FORGE_PROTECTED_STATE_STAGED_FILES
+			.split(/\r?\n/)
+			.map(line => line.trim())
+			.filter(Boolean);
+	}
+
+	const output = execFileSync('git', ['diff', '--cached', '--name-status', '--diff-filter=ACMRDT'], {
+		encoding: 'utf8',
+		stdio: ['ignore', 'pipe', 'pipe'],
+	});
+	return parseNameStatus(output);
+}
+
+function getAllowedSurfaces() {
+	return new Set(
+		String(process.env.FORGE_PROTECTED_STATE_ALLOWED_SURFACES || '')
+			.split(',')
+			.map(surface => surface.trim())
+			.filter(Boolean),
+	);
+}
+
+function main() {
+	const actor =
+		process.env.FORGE_PROTECTED_STATE_ACTOR ||
+		process.env.FORGE_ACTOR ||
+		process.env.USER ||
+		process.env.USERNAME ||
+		'unknown';
+	const allowedSurfaces = getAllowedSurfaces();
+	const decisions = getStagedFiles()
+		.map(file => {
+			const probe = assertProtectedWriteAllowed(file, { actor, operation: 'staged_edit' });
+			if (probe.requiredSurface && allowedSurfaces.has(probe.requiredSurface)) {
+				return assertProtectedWriteAllowed(file, {
+					actor,
+					operation: 'staged_edit',
+					viaForgeApi: true,
+					surface: probe.requiredSurface,
+				});
+			}
+			return probe;
+		})
+		.filter(decision => !decision.allowed);
+
+	for (const decision of decisions) {
+		const audit = recordProtectedStateAuditEvent(decision, { cwd: process.cwd() });
+		if (!audit.success) {
+			console.error(`WARN: Failed to record protected-state audit for ${decision.path}: ${audit.error}`);
+		}
+	}
+
+	if (decisions.length === 0) {
+		console.log('OK: No protected state edits detected.');
+		process.exit(0);
+	}
+
+	console.error('ERROR: Protected state edit detected. Direct edits to these paths are blocked:');
+	for (const decision of decisions) {
+		console.error(`  - ${decision.path} [${decision.requiredSurface}]`);
+		console.error(`    Decision: ${decision.decision}`);
+		console.error(`    Repair: ${decision.repairHint}`);
+	}
+	console.error('');
+	console.error('Use the owning Forge or Beads API surface, then stage the generated result if that command explicitly owns it.');
+	process.exit(1);
+}
+
+try {
+	main();
+} catch (error) {
+	console.error(`Protected state check failed: ${error.message}`);
+	process.exit(1);
+}

package/scripts/smart-status-score.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+
+const { scoreIssues } = require('../lib/smart-status/scoring.js');
+
+function readPayload() {
+	const raw = fs.readFileSync(0, 'utf8');
+	if (!raw.trim()) {
+		return { issues: [], epicStats: {} };
+	}
+
+	const payload = JSON.parse(raw);
+	return {
+		issues: Array.isArray(payload.issues) ? payload.issues : [],
+		epicStats: payload.epicStats && typeof payload.epicStats === 'object' ? payload.epicStats : {},
+	};
+}
+
+function main() {
+	try {
+		const payload = readPayload();
+		process.stdout.write(JSON.stringify(scoreIssues(payload.issues, { epicStats: payload.epicStats })));
+	} catch (error) {
+		console.error(`smart-status-score: ${error.message}`);
+		process.exit(1);
+	}
+}
+
+main();

package/scripts/smart-status-sessions.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+
+const {
+	applyMergeTreeConflicts,
+	computeFileConflicts,
+	matchInProgressIssues,
+	parseWorktreePorcelain,
+} = require('../lib/smart-status/conflicts.js');
+
+function readPayload() {
+	const raw = fs.readFileSync(0, 'utf8');
+	if (!raw.trim()) {
+		return {};
+	}
+
+	return JSON.parse(raw);
+}
+
+function buildSessions(payload) {
+	let sessions = Array.isArray(payload.sessions)
+		? payload.sessions
+		: matchInProgressIssues(
+			parseWorktreePorcelain(payload.worktreePorcelain || '', payload.baseBranch || 'master'),
+			Array.isArray(payload.inProgressIssues) ? payload.inProgressIssues : [],
+		);
+
+	if (payload.branchFiles) {
+		sessions = computeFileConflicts(sessions, payload.branchFiles);
+	}
+
+	if (payload.mergeTreeResults) {
+		sessions = applyMergeTreeConflicts(sessions, payload.mergeTreeResults);
+	}
+
+	return sessions;
+}
+
+function main() {
+	try {
+		const payload = readPayload();
+		process.stdout.write(JSON.stringify(buildSessions(payload)));
+	} catch (error) {
+		console.error(`smart-status-sessions: ${error.message}`);
+		process.exit(1);
+	}
+}
+
+main();