forge-workflow 0.1.0-beta.5 → 0.1.0-beta.7

package/lib/commands/ship.js

@@ -14,6 +14,7 @@ const path = require('node:path');
 
 const { fireAndForget } = require('../pr-monitor/reconcile-executor');
 const { getResolvedRuntimeGraph } = require('../core/runtime-graph');
+const { resolveBaseRemote, resolveBaseBranch } = require('../base-remote');
 
 const AUTO_SHEPHERD_RAIL = 'rail.auto_shepherd';
 
@@ -65,72 +66,6 @@ function getQuietGitExecOptions(cwd = process.cwd()) {
 	return { ...getGitExecOptions(cwd), stdio: 'pipe' };
 }
 
-function resolveRemoteHeadTarget(exec = execFileSync, cwd = process.cwd(), remoteName) {
-	try {
-		const symbolicRef = exec('git', ['symbolic-ref', `refs/remotes/${remoteName}/HEAD`], getQuietGitExecOptions(cwd)).trim();
-		if (!symbolicRef) {
-			return null;
-		}
-		exec('git', ['rev-parse', '--verify', symbolicRef], getQuietGitExecOptions(cwd));
-		return symbolicRef;
-	} catch (_error) {
-		return null;
-	}
-}
-
-function remoteHasTrackingBase(exec = execFileSync, cwd = process.cwd(), remoteName) {
-	if (resolveRemoteHeadTarget(exec, cwd, remoteName)) {
-		return true;
-	}
-
-	for (const candidate of ['main', 'master']) {
-		try {
-			exec('git', ['rev-parse', '--verify', `refs/remotes/${remoteName}/${candidate}`], getQuietGitExecOptions(cwd));
-			return true;
-		} catch (_error) {
-			// Probe next candidate.
-		}
-	}
-
-	return false;
-}
-
-function resolveBaseRemote(exec = execFileSync, cwd = process.cwd()) {
-	for (const candidate of ['upstream', 'origin']) {
-		try {
-			exec('git', ['remote', 'get-url', candidate], getQuietGitExecOptions(cwd));
-			if (remoteHasTrackingBase(exec, cwd, candidate)) {
-				return candidate;
-			}
-		} catch (_error) {
-			// Probe next candidate.
-		}
-	}
-
-	return 'origin';
-}
-
-function resolveBaseBranch(exec = execFileSync, cwd = process.cwd(), remoteName = resolveBaseRemote(exec, cwd)) {
-	const symbolicRef = resolveRemoteHeadTarget(exec, cwd, remoteName);
-	if (symbolicRef) {
-		const match = new RegExp(`^refs/remotes/${remoteName}/(.+)$`).exec(symbolicRef);
-		if (match && match[1]) {
-			return match[1];
-		}
-	}
-
-	for (const candidate of ['main', 'master']) {
-		try {
-			exec('git', ['rev-parse', '--verify', `refs/remotes/${remoteName}/${candidate}`], getQuietGitExecOptions(cwd));
-			return candidate;
-		} catch (_error) {
-			// Probe next candidate.
-		}
-	}
-
-	return 'master';
-}
-
 function refreshBaseReference(exec = execFileSync, cwd = process.cwd(), remoteName, baseBranch) {
 	exec(
 		'git',
@@ -457,10 +392,13 @@ function validatePRTitle(title) {
 
 async function createPR(options) { // NOSONAR S3776
 	const { title, body, dryRun = false, exec = execFileSync, cwd = process.cwd() } = options;
+	const gh = options.githubContext?.bound
+		? (args, runOptions) => options.githubContext.runGh(args, runOptions)
+		: (args, runOptions) => exec('gh', args, runOptions);
 	const titleValidation = validatePRTitle(title);
 	if (!titleValidation.valid) return { success: false, error: titleValidation.error };
 	try {
-		exec('gh', ['--version'], { ...getGhCheckOptions(), cwd });  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
+		gh(['--version'], { ...getGhCheckOptions(), cwd });
 	} catch (error) {
 		if (isCommandNotFound(error)) {
 			return { success: false, error: 'GitHub CLI (gh) not found. Install from: https://cli.github.com/' };
@@ -495,7 +433,7 @@ async function createPR(options) { // NOSONAR S3776
 		return { success: true, message: '[DRY RUN] Would create PR with title: ' + title, prUrl: 'https://github.com/owner/repo/pull/1' };
 	}
 	try {
-		const result = exec('gh', ['pr', 'create', '--title', title, '--body', body], getGitExecOptions(cwd));  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
+		const result = gh(['pr', 'create', '--title', title, '--body', body], getGitExecOptions(cwd));
 		const urlMatch = /https:\/\/github\.com\/[^\s]+/.exec(result);
 		const prUrl = urlMatch ? urlMatch[0] : null;
 		const numberMatch = /\/pull\/(\d+)/.exec(result);
@@ -585,7 +523,10 @@ async function executeShip(options) {
 			testScenarios,
 			coverage,
 		});
-		const result = await createPr({ title, body: prBody, dryRun });
+		const result = await createPr({
+			title, body: prBody, dryRun,
+			exec: options.exec, cwd: options.cwd || projectRoot, githubContext: options.githubContext,
+		});
 		if (!result.success) return result;
 		maybeTriggerShepherdAfterShip({ dryRun, projectRoot, fireAndForget: trigger });
 		return {
@@ -601,6 +542,7 @@ async function executeShip(options) {
 
 module.exports = {
 	name: 'ship',
+	githubAuth: true,
 	description: 'Create a pull request from validated feature work',
 	handler: async (args, flags = {}, projectRoot = process.cwd(), deps = {}) => {
 		const result = await executeShip({
@@ -609,6 +551,10 @@ module.exports = {
 			dryRun: Boolean(flags.dryRun || flags['--dry-run']),
 			projectRoot,
 			fireAndForget: deps.fireAndForget,
+			exec: deps.exec,
+			cwd: deps.cwd || projectRoot,
+			githubContext: deps.githubContext,
+			createPr: deps.createPr,
 		});
 		if (!result.success) {
 			return result;

package/lib/commands/skill.js

@@ -23,6 +23,7 @@ const { runBehavioralEvaluation } = require('../../scripts/lib/behavioral-eval-r
 const { resolveBehavioralEvaluation } = require('../../scripts/lib/behavioral-eval-runtime');
 const { loadPromotionEvidence } = require('../../scripts/lib/promotion-evidence-loader');
 const { scorePromotion } = require('../../scripts/lib/promotion-scorecard');
+const { createGithubContext } = require('../github-context');
 
 const BEHAVIORAL_TIERS = Object.freeze([30, 100, 300]);
 const BEHAVIORAL_TIER_VALUES = new Set(BEHAVIORAL_TIERS.map(String));
@@ -158,12 +159,19 @@ async function handleFullEval(rest, flags, projectRoot, opts) {
   let behavioralOptions = opts.behavioralOptions || {};
   if (!opts.runBehavioralEvaluation || opts.resolveBehavioralEvaluation) {
     const resolver = opts.resolveBehavioralEvaluation || resolveBehavioralEvaluation;
+    let githubContext;
+    try {
+      githubContext = (opts.prepareGithubContext || createGithubContext)(projectRoot);
+    } catch {
+      return { success: false, error: 'Unable to prepare GitHub account context. Run forge github status for guidance.' };
+    }
     const resolved = await resolver({
       projectRoot,
       skillName: name,
       skillPath: path.join(ctx.skillsDir, name, 'SKILL.md'),
       tier,
       env: opts.env || process.env,
+      ...(githubContext.bound ? { deps: { runGh: githubContext.runGh } } : {}),
     });
     if (!resolved.ok) return formatResult(scoreResult(resolved.result));
     behavioralOptions = { ...resolved.options, ...behavioralOptions };

package/lib/commands/team.js

@@ -1,7 +1,25 @@
 const { existsSync } = require('node:fs');
 const { execFileSync } = require('node:child_process');
 const path = require('node:path');
-const { getPackageRoot } = require('../package-root');
+const { getPackageRoot, isCompiledBinary } = require('../package-root');
+const { firstPositionalIndex, stripGlobalFlags } = require('../global-flags');
+
+function teamArguments(args) {
+  const subcommandIndex = firstPositionalIndex(args);
+  if (subcommandIndex === -1) return stripGlobalFlags(args);
+  const result = stripGlobalFlags(args.slice(0, subcommandIndex));
+  // Path is routing metadata anywhere; other flags after the subcommand belong to Team.
+  for (let index = subcommandIndex; index < args.length; index++) {
+    const arg = args[index];
+    if (arg.startsWith('--path=')) continue;
+    if (arg === '-p' || arg === '--path') {
+      if (args[index + 1] !== undefined && !args[index + 1].startsWith('-')) index++;
+    } else {
+      result.push(arg);
+    }
+  }
+  return result;
+}
 
 // Resolve bash binary from fixed, known locations only (no PATH search).
 // SonarCloud S4036: PATH must not be searched for OS commands.
@@ -22,28 +40,49 @@ function _resolveBash() {
   return '/usr/bin/bash';
 }
 
-function handleTeam(args) {
+function handleTeam(args, projectRoot = process.cwd(), deps = {}) {
   // Route through the asset root so `forge team` finds the script in BOTH channels:
   // the on-disk package (npm/npx) and a compiled binary (extracted embed dir).
-  const scriptPath = path.join(getPackageRoot(), 'scripts', 'forge-team', 'index.sh');
+  const packageRoot = getPackageRoot();
+  const scriptPath = path.join(packageRoot, 'scripts', 'forge-team', 'index.sh');
   const bashPath = _resolveBash();
+  const runFile = deps.execFileSync || execFileSync;
+  const options = { stdio: 'inherit' };
+  if (deps.githubContext?.bound) {
+    // Bash also runs Git/Forge/helpers. Only the re-entering gh bridge may resolve credentials.
+    const compiled = (deps.isCompiledBinary || isCompiledBinary)();
+    const env = { ...(deps.env || process.env) };
+    for (const key of Object.keys(env)) {
+      if (['gh_token', 'github_token', 'gh_host'].includes(key.toLowerCase())) delete env[key];
+    }
+    options.cwd = projectRoot;
+    options.env = {
+      ...env,
+      GH_CMD: path.join(packageRoot, 'scripts', 'github-context-bridge.sh').replaceAll('\\', '/'),
+      FORGE_GITHUB_RUNTIME: process.execPath.replaceAll('\\', '/'),
+      FORGE_GITHUB_ENTRY: compiled ? '' : path.join(packageRoot, 'bin', 'forge.js').replaceAll('\\', '/'),
+    };
+  }
 
   try {
-    execFileSync(bashPath, [scriptPath, ...args], {
-      stdio: 'inherit',
-    });
+    runFile(bashPath, [scriptPath, ...teamArguments(args)], options);
   } catch (err) {
     process.exit(err.status || 1);
   }
 }
 
-async function handler(args = []) {
-  handleTeam(args);
+async function handler(args, _flags, projectRoot, deps = {}) {
+  handleTeam(args || [], projectRoot, deps);
   return { success: true };
 }
 
 module.exports = {
   name: 'team',
+  githubAuth: (args = []) => {
+    const teamArgs = teamArguments(args);
+    return ['add', 'verify', 'sync', 'claim'].includes(teamArgs[0])
+      || (teamArgs[0] === 'workload' && teamArgs.slice(1).some(arg => arg.replace(/\r$/, '') === '--me'));
+  },
   description: 'Team coordination workflows and sync utilities',
   handler,
   handleTeam

package/lib/commands/test.js

@@ -32,6 +32,9 @@ const DIRECT_TEST_CANDIDATES = Object.freeze({
 		'test/cli-flags.test.js',
 		'test/forge-cli-registry.test.js',
 		'test/setup-runtime-flags.test.js',
+		'test/github-launcher.test.js',
+		'test/integration/github-account-context.test.js',
+		'test/structural/github-account-public-surface.test.js',
 	],
 	// The second CLI surface (command descriptions + shepherd wiring). Without an
 	// entry here it resolves to zero tests and pushes fall back to the full suite.
@@ -47,15 +50,143 @@ const DIRECT_TEST_CANDIDATES = Object.freeze({
 		'test/doc-assertions.test.js',
 		'test/scripts/doc-asserting-tests.test.js',
 	],
+	// The suites that assert the repo .gitignore's actual content. The path is
+	// already known to the classifier, so without candidates here it resolves
+	// zero tests and a one-line ignore addition pays the full-suite lane.
+	'.gitignore': [
+		'test/check-forge-token.test.js',
+		'test/cleanup/dropped-agent-config.test.js',
+		'test/coverage-config.test.js',
+		'test/eval/eval-history.test.js',
+		'test/freshness-token.test.js',
+		'test/mutation-config.test.js',
+		'test/test-dashboard.test.js',
+	],
 	'lib/lefthook-check.js': ['test/lefthook-check.test.js', 'test/runtime-health.test.js'],
 	'lib/runtime-health.js': ['test/runtime-health.test.js'],
 	// skill-eval hosts the accuracy-lint detectors (auditCommandDocumentation /
 	// auditRouterPrecision), so edits there must also run their detector suite.
 	'lib/skill-eval.js': ['test/skill-eval.test.js', 'test/skill-accuracy.test.js'],
+	// Schema is shared by every kernel authority; keep it on the full-suite lane.
+	'lib/kernel/schema.js': [],
+	// Migrations have consumers across the kernel; an empty mapping deliberately
+	// selects the full-suite lane, matching the shared SQLite driver.
+	'lib/kernel/migrations.js': [],
+	'lib/commands/shepherd.js': [
+		'test/commands/shepherd.test.js',
+		'test/commands/github-route-matrix.test.js',
+		'test/pr-monitor/arm-on-push.test.js',
+		'test/pr-monitor/shepherd-watch.test.js',
+		'test/pr-monitor/watch-owner-cutover.test.js',
+		'test/pr-monitor/watch-owner-launch-contention.test.js',
+		'test/pr-monitor/watch-owner-launch-gate.test.js',
+	],
+	'lib/commands/github.js': [
+		'test/commands/github.test.js',
+		'test/github-launcher.test.js',
+		'test/integration/github-account-context.test.js',
+	],
+	'lib/github-context.js': ['test/github-context.test.js', 'test/integration/github-account-context.test.js'],
+	'lib/commands/_registry.js': [
+		'test/commands/_registry.test.js',
+		'test/commands/_registry-github-context.test.js',
+	],
+	'lib/commands/pr.js': ['test/commands/pr.test.js', 'test/commands/github-route-matrix.test.js'],
+	'lib/commands/ship.js': ['test/commands/ship.test.js', 'test/commands/github-route-matrix.test.js'],
+	'lib/commands/merge.js': ['test/commands/merge.test.js', 'test/commands/github-route-matrix.test.js'],
+	'lib/commands/team.js': ['test/commands/team.test.js', 'test/commands/github-route-matrix.test.js'],
+	'lib/commands/clean.js': ['test/commands/clean.test.js', 'test/commands/github-route-matrix.test.js'],
+	'scripts/github-context-bridge.sh': ['test/commands/github-route-matrix.test.js'],
+	'lib/commands/push.js': ['test/commands/push.test.js', 'test/commands/github-indirect-routes.test.js'],
+	'lib/commands/hooks.js': ['test/commands/hooks.test.js', 'test/hooks-session-start.test.js', 'test/commands/github-indirect-routes.test.js'],
+	'lib/commands/serve.js': ['test/commands/serve.test.js', 'test/commands/github-indirect-routes.test.js'],
+	'lib/commands/skill.js': ['test/commands/skill.test.js', 'test/commands/github-indirect-routes.test.js'],
+	'scripts/lib/behavioral-eval-runtime.js': ['test/eval/behavioral-eval-runtime.test.js', 'test/commands/github-indirect-routes.test.js'],
+	'web/dashboard/generate-snapshot.mjs': ['test/commands/github-indirect-routes.test.js'],
+	// The shared SQLite driver has more consumers than a bounded direct list can
+	// safely represent; its empty mapping deliberately selects the full-suite lane.
+	'lib/kernel/sqlite-driver.js': [],
+	'lib/pr-monitor/watch-owner.js': [
+		'test/pr-monitor/watch-owner.test.js',
+		'test/kernel/watch-owner-transaction.test.js',
+	],
+	'lib/pr-monitor/reconcile.js': [
+		'test/pr-monitor/reconcile.test.js',
+		'test/pr-monitor/reconcile-owner-authority.test.js',
+	],
+	'lib/pr-monitor/reconcile-executor.js': [
+		'test/commands/github-indirect-routes.test.js',
+		'test/pr-monitor/auto-trigger-containment.test.js',
+		'test/pr-monitor/reconcile-executor-owner-authority.test.js',
+		'test/pr-monitor/reconcile-executor.test.js',
+		'test/pr-monitor/reconcile-daemon-owner-authority.test.js',
+		'test/pr-monitor/reconcile-migration-gate.test.js',
+		'test/pr-monitor/watch-owner-launch-contention.test.js',
+		'test/windows-hide-background-spawns.test.js',
+	],
+	'lib/pr-monitor/watch.js': [
+		'test/pr-monitor/watch-owner-cutover.test.js',
+		'test/pr-monitor/watch.test.js',
+	],
+	'lib/pr-monitor/watch-lifecycle.js': [
+		'test/commands/github-indirect-routes.test.js',
+		'test/pr-monitor/watch-lifecycle.test.js',
+		'test/pr-monitor/watch-owner-launch-contention.test.js',
+		'test/pr-monitor/watch-owner-launch-gate.test.js',
+	],
+	'lib/pr-monitor/shepherd-lease.js': [
+		'test/pr-monitor/shepherd-lease.test.js',
+		'test/pr-monitor/shepherd-lease-election-only.test.js',
+	],
+	'lib/pr-monitor/monitor.js': [
+		'test/pr-monitor/monitor.test.js',
+		'test/pr-monitor/monitor-owner-signal.test.js',
+	],
 	'lib/upgrade-safety.js': ['test/commands/upgrade.test.js'],
 	'scripts/test.js': ['test/scripts/test-runner.test.js'],
+	// `bun.lock` is deliberately absent: a dependency change can break anything,
+	// so it stays on the full-suite lane.
+	// lefthook.yml is the repository's hook wiring, so this must also cover the
+	// suites that assert the individual pre-commit/pre-push commands exist.
+	'lefthook.yml': [
+		'test/lefthook-check.test.js',
+		'test/lefthook-wiring.test.js',
+		'test/commands/lefthook-user-config.test.js',
+		'test/branch-protection.test.js',
+		'test/commitlint.test.js',
+		'test/cross-platform-install.test.js',
+		'test/sync-d20-audit-script.test.js',
+	],
+	'eslint.config.js': ['test/lint-script.test.js'],
+	'.coderabbit.yaml': ['test/coderabbit-config.test.js'],
+	'.claude-plugin/marketplace.json': [
+		'test/activation/plugin-scaffold.test.js',
+		'test/plugin-catalog.test.js',
+	],
 });
 
+// Shared authority modules must run the full suite even when another changed file
+// resolves a targeted test. Keep this signal separate from test candidates: an
+// empty candidate list is not enough once a mapped consumer is also changed.
+const FULL_SUITE_REQUIRED_FILES = new Set([
+	'lib/kernel/schema.js',
+	'lib/kernel/migrations.js',
+	'lib/kernel/sqlite-driver.js',
+]);
+
+// Directory-level mappings for source trees that own a dedicated suite. Without
+// these a change under any of them resolves to zero tests and forces the full
+// suite (see hasZeroResolvedTests in scripts/test.js).
+const PREFIX_TEST_TARGETS = Object.freeze([
+	['validation/', ['test/validation/risk-manifest.test.js', 'test/validation/risk-manifest-generator.test.js']],
+	// `eval/corpus/` must come first: the corpus hash and manifest checks live in
+	// immutable-corpus, and eval-sets only reads `eval/commands/`.
+	['eval/corpus/', ['test/eval/immutable-corpus.test.js']],
+	['eval/', ['test/eval/eval-sets.test.js']],
+	['rules/', ['test/rules-sync.test.js', 'test/skill-dispatch-parity.test.js']],
+	['plugin/', ['test/activation/plugin-scaffold.test.js', 'test/plugin-catalog.test.js', 'test/release-readiness.test.js']],
+]);
+
 // Skill sources (canonical `skills/**` and the committed `.agents/skills/**` mirror)
 // map to the fast skill suite. This is what keeps a skills-only PR on the targeted
 // lane instead of the full ~1500-test suite. `skills-sync-drift` guards the mirror.
@@ -176,7 +307,9 @@ function getChangedFiles(execFileSync, options = {}) {
  * @returns {string[]} Array of test file paths (e.g. ['test/foo.test.js'])
  */
 function getAffectedTestFiles(projectRoot, execFileSync, fs = defaultFs, options = {}) {
-	const changedFiles = getChangedFiles(execFileSync, options);
+	const changedFiles = Array.isArray(options.changedFiles)
+		? options.changedFiles
+		: getChangedFiles(execFileSync, options);
 	const testFiles = new Set();
 	for (const file of changedFiles) {
 		for (const candidate of getTestCandidatesForChangedFile(file)) {
@@ -215,10 +348,24 @@ function getTestCandidatesForChangedFile(file) {
 		return [...SKILL_TEST_TARGETS];
 	}
 
+	// Maintainer-only contributor skills. They document the AGENTS.md product /
+	// maintainer split, so the docs-bleed gate is the suite that can catch a
+	// contradiction between them.
+	if (file.startsWith('.forge/contributor-skills/')) {
+		return ['test/structural/agents-docs-bleed.test.js'];
+	}
+
+	for (const [prefix, targets] of PREFIX_TEST_TARGETS) {
+		if (file.startsWith(prefix)) {
+			return [...targets];
+		}
+	}
+
 	if (file === 'README.md'
 		|| file === 'QUICKSTART.md'
 		|| file === 'CHANGELOG.md'
 		|| file === 'AGENTS.md'
+		|| file === 'CODING_STANDARDS.md'
 		|| file === 'DEVELOPMENT.md'
 		|| file === 'docs/INDEX.md'
 		|| file === 'docs/PROJECT_DESIGN.md'
@@ -226,7 +373,9 @@ function getTestCandidatesForChangedFile(file) {
 		|| file.startsWith('docs/guides/')
 		|| file.startsWith('docs/reference/')
 		|| file.startsWith('docs/work/')) {
-		return ['test/docs-consistency.test.js'];
+		return file === 'AGENTS.md'
+			? ['test/docs-consistency.test.js', 'test/structural/agents-docs-bleed.test.js']
+			: ['test/docs-consistency.test.js'];
 	}
 
 	if (file.startsWith('lib/') && file.endsWith('.js')) {
@@ -270,10 +419,15 @@ function getTestCandidatesForChangedFile(file) {
 	return [];
 }
 
+function isFullSuiteRequiredFile(file) {
+	return FULL_SUITE_REQUIRED_FILES.has(file);
+}
+
 module.exports = {
 	getChangedFiles,
 	getAffectedTestFiles,
 	getTestCandidatesForChangedFile,
+	isFullSuiteRequiredFile,
 	name: 'test',
 	description: 'Run tests with smart defaults (timeout, affected-only)',
 	usage: 'forge test [--affected]',
@@ -318,10 +472,15 @@ module.exports = {
 
 		// 4. --affected flag: find changed test files
 		if (flags['--affected'] || flags.affected) {
-			const affectedTests = getAffectedTestFiles(projectRoot, execFileSync, fs, {
+			const diffOptions = {
 				sinceUpstream: flags.sinceUpstream || flags['--since-upstream'],
+			};
+			const changedFiles = getChangedFiles(execFileSync, diffOptions);
+			const affectedTests = getAffectedTestFiles(projectRoot, execFileSync, fs, {
+				...diffOptions,
+				changedFiles,
 			});
-			if (affectedTests.length > 0) {
+			if (!changedFiles.some(isFullSuiteRequiredFile) && affectedTests.length > 0) {
 				testArgs = ['run', 'test', ...affectedTests];
 			}
 			// If no affected tests found, fall back to running all tests