forgedock 1.0.22 → 1.1.2

package/scripts/issue-dedup.sh

@@ -0,0 +1,236 @@
+#!/usr/bin/env bash
+# issue-dedup.sh — Deterministic near-duplicate check for GitHub issue creation
+#
+# Usage:
+#   issue-dedup.sh <title> [-R <owner/repo>] [--force]
+#   issue-dedup.sh <title> ["-R <owner/repo>"] [--force]   (single pre-joined token also accepted)
+#
+#   <title>           : Proposed issue title (required, must be quoted if it contains spaces)
+#   -R <owner/repo>   : GitHub repository, as two argv tokens (optional, defaults to
+#                       FORGE_REPO or current repo)
+#   "-R <owner/repo>" : GitHub repository, as ONE pre-joined token (e.g. when a caller
+#                       passes an already-composed $GH_FLAG variable quoted as "$GH_FLAG").
+#                       Both forms are accepted. A title that happens to start with "-R "
+#                       but lacks the "/" separator (e.g. "-R login is broken") is
+#                       correctly detected by the parser and treated as a title, not a
+#                       repo flag. See the -R\ * case arm guard in the arg-parsing loop.
+#   --force           : Skip dedup check and always allow creation (explicit override)
+#
+# Exit codes:
+#   0 — No near-duplicate found. Creation is safe. Stdout is empty.
+#   1 — Near-duplicate found. Stdout contains the matched issue number and title.
+#       Callers MUST check exit code before running `gh issue create`.
+#   2 — Usage error (missing required argument).
+#
+# Algorithm (deterministic — no LLM required):
+#   1. Normalize the proposed title: lowercase, strip punctuation, split into tokens
+#      of length ≥ 4 (short words are noise: "fix", "add", "the", etc.)
+#   2. Query open issues: search GitHub using the 2 most distinctive title tokens
+#      as the --search query (balances recall vs API cost)
+#   3. For each candidate open issue, count shared tokens (length ≥ 4) between
+#      the proposed title and the candidate title.
+#   4. MATCH threshold: ≥ 3 shared tokens OR shared token count ≥ 50% of
+#      the shorter title's token set — whichever fires first.
+#   5. On match: print "DUPLICATE: #<N> <title>" to stdout, exit 1.
+#   6. On no match: exit 0 (silent).
+#
+# Integration pattern (for command specs that call gh issue create):
+#
+#   DEDUP_RESULT=$(scripts/issue-dedup.sh "$PROPOSED_TITLE" "$GH_FLAG" 2>&1)
+#   # ^ $GH_FLAG is typically already composed as "-R owner/repo" and quoted here,
+#   #   producing ONE argv token — the parser accepts this joined form directly
+#   #   (see the -R\ * case arm below). An unset/empty $GH_FLAG quotes to an empty
+#   #   token, which the parser also treats as "no repo flag" rather than a title.
+#   DEDUP_EXIT=$?
+#   if [ $DEDUP_EXIT -eq 1 ]; then
+#     echo "Near-duplicate detected: $DEDUP_RESULT"
+#     echo "Comment on the existing issue instead of creating a new one."
+#     echo "Use --force to override and create anyway."
+#     exit 1
+#   elif [ $DEDUP_EXIT -eq 2 ]; then
+#     echo "Dedup check usage error: $DEDUP_RESULT"
+#     echo "Do NOT proceed to issue creation — fix the invocation and retry."
+#     exit 2
+#   fi
+#   gh issue create ...   # only runs when exit 0
+#
+#   Callers MUST explicitly branch on exit 2 (usage error) as a hard stop, not
+#   just exit 1 (duplicate found). Silently falling through on any non-1 exit
+#   code — including redirecting stderr to /dev/null — means a malformed
+#   invocation (bad flag, missing argument) is indistinguishable from "no
+#   duplicate found" and proceeds to create a possibly-duplicate issue with
+#   zero operator-visible signal.
+#
+# Notes:
+#   - Closed issues are NOT matched (a regression should be filed fresh with a
+#     "Regression of #N" reference; see issue.md Phase 2D).
+#   - The --force flag is the explicit override path. Human decision is required
+#     to use it — agents MUST NOT pass --force without user authorization.
+#   - Token matching is case-insensitive and punctuation-agnostic.
+#   - GitHub's --search flag performs a full-text search; the token query is a
+#     tiebreaker against the full candidate list, not the sole filter.
+#
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -euo pipefail
+
+# --------------------------------------------------------------------------- #
+# Argument parsing
+# --------------------------------------------------------------------------- #
+PROPOSED_TITLE=""
+GH_FLAG=""
+FORCE=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    "")
+      # Empty-string token — e.g. a caller quoting an unset/empty $GH_FLAG
+      # ("$GH_FLAG" -> ""). Treat as "no repo flag supplied", not as a title.
+      shift
+      ;;
+    -R)
+      shift
+      if [[ $# -eq 0 ]]; then
+        echo "Missing value for -R" >&2
+        exit 2
+      fi
+      GH_FLAG="-R $1"
+      shift
+      ;;
+    -R\ *)
+      # Single pre-joined token, e.g. "-R owner/repo" — produced when a caller
+      # quotes an already-composed $GH_FLAG variable ("$GH_FLAG") instead of
+      # passing -R and the repo as two separate argv tokens. Both call shapes
+      # are valid integration patterns used across commands/*.md callers.
+      #
+      # Guard: a valid repo token always contains '/' (owner/repo format).
+      # If the value after "-R " has no '/', the token is a positional title
+      # that happens to start with "-R " (e.g. "-R login is broken") — treat
+      # it as the title instead. This prevents argv-flag-title-collision (#1625).
+      _rval="${1#-R }"
+      if [[ "$_rval" == */* ]]; then
+        GH_FLAG="$1"
+        shift
+      else
+        PROPOSED_TITLE="$1"
+        shift
+      fi
+      ;;
+    --force)
+      FORCE=1
+      shift
+      ;;
+    -*)
+      echo "Unknown flag: $1" >&2
+      exit 2
+      ;;
+    *)
+      PROPOSED_TITLE="$1"
+      shift
+      ;;
+  esac
+done
+
+if [[ -z "$PROPOSED_TITLE" ]]; then
+  echo "Usage: issue-dedup.sh <title> [-R <owner/repo>] [--force]" >&2
+  exit 2
+fi
+
+# Force override — skip all checks
+if [[ "$FORCE" -eq 1 ]]; then
+  exit 0
+fi
+
+# --------------------------------------------------------------------------- #
+# Token normalization
+# Lowercase, strip non-alphanumeric chars except spaces, split on whitespace,
+# keep tokens of length >= 4 to filter out noise words.
+# --------------------------------------------------------------------------- #
+normalize_tokens() {
+  local text="$1"
+  echo "$text" \
+    | tr '[:upper:]' '[:lower:]' \
+    | sed 's/[^a-z0-9 ]/ /g' \
+    | tr -s ' ' '\n' \
+    | awk 'length >= 4' \
+    | sort -u
+}
+
+PROPOSED_TOKENS=$(normalize_tokens "$PROPOSED_TITLE")
+# grep -c always prints a numeric count (including "0") even when it matches
+# nothing — it just exits 1 in that case. `|| echo 0` would append a SECOND
+# "0" line on top of grep's own "0" output, corrupting the numeric comparison
+# below. `|| true` only suppresses the non-zero exit under `set -e`.
+PROPOSED_TOKEN_COUNT=$(echo "$PROPOSED_TOKENS" | grep -c . || true)
+
+if [[ "$PROPOSED_TOKEN_COUNT" -lt 1 ]]; then
+  # Title has no meaningful tokens — skip dedup (cannot match)
+  exit 0
+fi
+
+# Build a search query from the 2 most distinctive tokens (longest first)
+SEARCH_TERMS=$(echo "$PROPOSED_TOKENS" | awk '{ print length, $0 }' | sort -rn | awk '{print $2}' | head -2 | tr '\n' ' ')
+SEARCH_QUERY=$(echo "$SEARCH_TERMS" | xargs)
+
+# --------------------------------------------------------------------------- #
+# Query open issues
+# --------------------------------------------------------------------------- #
+CANDIDATES=$(gh issue list $GH_FLAG \
+  --state open \
+  --search "$SEARCH_QUERY" \
+  --limit 30 \
+  --json number,title \
+  --jq '.[] | "\(.number)\t\(.title)"' 2>/dev/null || true)
+
+if [[ -z "$CANDIDATES" ]]; then
+  exit 0
+fi
+
+# --------------------------------------------------------------------------- #
+# Token overlap matching
+# For each candidate, count shared tokens between proposed and candidate titles.
+# Match if: shared_count >= 3  OR  shared_count >= 50% of the shorter token set.
+# --------------------------------------------------------------------------- #
+MATCH_NUMBER=""
+MATCH_TITLE=""
+
+while IFS=$'\t' read -r CAND_NUMBER CAND_TITLE; do
+  [[ -z "$CAND_NUMBER" ]] && continue
+
+  CAND_TOKENS=$(normalize_tokens "$CAND_TITLE")
+  # Same double-fallback hazard as PROPOSED_TOKEN_COUNT above — see comment there.
+  CAND_TOKEN_COUNT=$(echo "$CAND_TOKENS" | grep -c . || true)
+
+  # Shared token count: intersection of proposed and candidate token sets
+  SHARED_COUNT=$(comm -12 \
+    <(echo "$PROPOSED_TOKENS") \
+    <(echo "$CAND_TOKENS") \
+    | grep -c . || true)
+
+  # Shorter token set size (for percentage threshold)
+  if [[ "$PROPOSED_TOKEN_COUNT" -le "$CAND_TOKEN_COUNT" ]]; then
+    SHORTER=$PROPOSED_TOKEN_COUNT
+  else
+    SHORTER=$CAND_TOKEN_COUNT
+  fi
+
+  # 50% threshold: shared >= ceil(shorter / 2)
+  HALF_THRESHOLD=$(( (SHORTER + 1) / 2 ))
+
+  if [[ "$SHARED_COUNT" -ge 3 ]] || [[ "$SHARED_COUNT" -ge "$HALF_THRESHOLD" && "$SHORTER" -ge 2 ]]; then
+    MATCH_NUMBER="$CAND_NUMBER"
+    MATCH_TITLE="$CAND_TITLE"
+    break
+  fi
+done <<< "$CANDIDATES"
+
+# --------------------------------------------------------------------------- #
+# Output result
+# --------------------------------------------------------------------------- #
+if [[ -n "$MATCH_NUMBER" ]]; then
+  echo "DUPLICATE: #${MATCH_NUMBER} ${MATCH_TITLE}"
+  exit 1
+fi
+
+exit 0

package/scripts/validate-annotation-node.mjs

@@ -0,0 +1,233 @@
+#!/usr/bin/env node
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: MIT
+//
+// validate-annotation-node.mjs — Thin Node.js adapter: validates FORGE annotation bodies
+// against the MIT/Apache protocol validation library (packages/protocol/, built in #1291).
+//
+// This script is the dogfooding consumer for the protocol library (#1291), satisfying
+// the requirement from #1292. It wraps the library's validate() API with:
+//   - Graceful degradation when the library is not yet installed (exits 0 with WARN)
+//   - A stable CLI that matches forge-annotation.sh validate's argument shape,
+//     so future forge-annotation.sh validate integration (#1267) is a one-line shim
+//   - MIT license: this file is NOT AGPL — it must remain importable by MIT/Apache
+//     consumers without license contamination. Do not import AGPL modules here.
+//
+// Usage:
+//   node scripts/validate-annotation-node.mjs <MARKER> [FILE]
+//   echo '<!-- FORGE:INVESTIGATOR -->...' | node scripts/validate-annotation-node.mjs INVESTIGATOR
+//
+// Arguments:
+//   MARKER  Annotation type to validate (e.g. INVESTIGATOR, CONTRACT, BUILDER).
+//           May include the FORGE: prefix — it will be stripped automatically.
+//   FILE    Path to a file containing the annotation body. If omitted (or '-'),
+//           reads from stdin.
+//
+// Exit codes:
+//   0 = annotation is well-formed, OR library is not yet installed (graceful degradation)
+//   1 = annotation is malformed (library reports a conformance error)
+//   2 = usage/argument error (bad MARKER, unreadable FILE, etc.)
+//
+// Integration notes:
+//   - When packages/protocol/ (issue #1291) is built and published, this script will
+//     work without any changes. The dynamic import path resolves relative to this script.
+//   - When forge-annotation.sh (issue #1267) is merged, its `validate` subcommand can
+//     shell out to this script for conformance checks: the Bash side handles sentinel
+//     and structure (AGPL, format rules), the Node side handles spec conformance (MIT).
+//   - Call-site wiring in commands/*.md is tracked separately in #1247.
+
+import { readFileSync, existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const SCRIPT_NAME = 'validate-annotation-node.mjs';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+// ---------------------------------------------------------------------------
+// Usage
+// ---------------------------------------------------------------------------
+function usage() {
+  process.stderr.write(
+    `Usage:\n` +
+    `  ${SCRIPT_NAME} <MARKER> [FILE]\n` +
+    `  echo '<body>' | ${SCRIPT_NAME} <MARKER>\n` +
+    `\n` +
+    `Arguments:\n` +
+    `  MARKER  Annotation type (e.g. INVESTIGATOR, FORGE:INVESTIGATOR, CONTRACT, BUILDER)\n` +
+    `  FILE    File containing the annotation body (reads stdin if omitted or '-')\n` +
+    `\n` +
+    `Exit codes:\n` +
+    `  0  Valid annotation, or library not yet installed (graceful degradation)\n` +
+    `  1  Invalid annotation (library conformance check failed)\n` +
+    `  2  Usage/argument error\n`
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Normalize marker: strip FORGE: prefix, uppercase
+// Mirrors forge-annotation.sh normalize_marker() so both tools agree on marker names.
+// ---------------------------------------------------------------------------
+function normalizeMarker(raw) {
+  return raw.toUpperCase().replace(/^FORGE:/, '');
+}
+
+// ---------------------------------------------------------------------------
+// Read body from file path or stdin
+// ---------------------------------------------------------------------------
+async function readBody(fileArg) {
+  if (!fileArg || fileArg === '-') {
+    // Read from stdin
+    return new Promise((resolve, reject) => {
+      const chunks = [];
+      process.stdin.on('data', (chunk) => chunks.push(chunk));
+      process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+      process.stdin.on('error', reject);
+    });
+  }
+
+  if (!existsSync(fileArg)) {
+    process.stderr.write(`ERROR: file not found: ${fileArg}\n`);
+    process.exit(2);
+  }
+
+  try {
+    return readFileSync(fileArg, 'utf8');
+  } catch (err) {
+    process.stderr.write(`ERROR: cannot read file '${fileArg}': ${err.message}\n`);
+    process.exit(2);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Locate the protocol library
+// Library expected at packages/protocol/src/index.js relative to the repo
+// root (per packages/protocol/package.json main/exports).
+// Repo root is two directories above this script (scripts/ → repo root).
+// ---------------------------------------------------------------------------
+function resolveLibraryPath() {
+  const repoRoot = resolve(__dirname, '..');
+  return resolve(repoRoot, 'packages', 'protocol', 'src', 'index.js');
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+async function main() {
+  const args = process.argv.slice(2);
+
+  if (args.length === 0 || args[0] === '-h' || args[0] === '--help') {
+    usage();
+    process.exit(args.length === 0 ? 2 : 0);
+  }
+
+  const markerRaw = args[0];
+  const fileArg = args[1] || null;
+  const marker = normalizeMarker(markerRaw);
+
+  if (!marker || !/^[A-Z_]+$/.test(marker)) {
+    process.stderr.write(`ERROR: invalid MARKER '${markerRaw}' — must be a non-empty string (letters and underscores only after prefix stripping)\n`);
+    usage();
+    process.exit(2);
+  }
+
+  const body = await readBody(fileArg);
+
+  if (!body.trim()) {
+    process.stderr.write(`ERROR: annotation body is empty — nothing to validate\n`);
+    process.exit(2);
+  }
+
+  // ---------------------------------------------------------------------------
+  // Attempt to load the protocol library (graceful degradation if absent)
+  // ---------------------------------------------------------------------------
+  const libraryPath = resolveLibraryPath();
+
+  if (!existsSync(libraryPath)) {
+    // Library not yet built (#1291 not merged) — exit 0 with a warning.
+    // This is the expected state until #1291 lands; the pipeline must not break.
+    process.stdout.write(
+      `WARN: forge-protocol library not found at packages/protocol/src/index.js\n` +
+      `  Conformance validation skipped — install the library from #1291 to enable spec-conformance checks.\n` +
+      `  Annotation posting will proceed without library validation.\n`
+    );
+    process.exit(0);
+  }
+
+  let library;
+  try {
+    // Dynamic import() requires a file:// URL for absolute paths on Windows
+    // (a bare "C:\..." path is misparsed as a URL with protocol "c:"). Using
+    // pathToFileURL() makes this work identically on Windows and POSIX.
+    library = await import(pathToFileURL(libraryPath));
+  } catch (err) {
+    // Library file exists but failed to load — log and degrade gracefully.
+    process.stdout.write(
+      `WARN: forge-protocol library found at packages/protocol/src/index.js but failed to load: ${err.message}\n` +
+      `  Conformance validation skipped. Check that the library is built correctly.\n`
+    );
+    process.exit(0);
+  }
+
+  // ---------------------------------------------------------------------------
+  // Parse the body into a structured annotation, then call library.validate().
+  // The library's validate() expects a ParsedAnnotation (the output of parse()),
+  // NOT a raw { type, body } literal — validate() reads annotation.isReserved,
+  // .fields, .sentinelState, etc., all of which only exist after parse() runs.
+  // Passing an unparsed literal makes validate() take its "unknown type, tolerate"
+  // early-return path (§7.2.4) and always report { valid: true }, silently
+  // skipping every real conformance check.
+  // ---------------------------------------------------------------------------
+  if (typeof library.parse !== 'function' || typeof library.validate !== 'function') {
+    process.stderr.write(
+      `ERROR: forge-protocol library does not export the expected 'parse' and 'validate' functions.\n` +
+      `  Found exports: ${Object.keys(library).join(', ') || '(none)'}\n`
+    );
+    process.exit(2);
+  }
+
+  let annotation;
+  try {
+    const parsed = library.parse(body);
+    annotation = parsed.find((a) => a.type === marker);
+  } catch (err) {
+    process.stderr.write(`ERROR: library.parse() threw an exception: ${err.message}\n`);
+    process.exit(1);
+  }
+
+  if (!annotation) {
+    process.stderr.write(
+      `ERROR: no '${marker}' annotation found in the provided body — expected an opening tag ` +
+      `like <!-- FORGE:${marker} --> somewhere in the input.\n`
+    );
+    process.exit(2);
+  }
+
+  let result;
+  try {
+    result = library.validate(annotation);
+  } catch (err) {
+    process.stderr.write(`ERROR: library.validate() threw an exception: ${err.message}\n`);
+    process.exit(1);
+  }
+
+  if (result && result.valid === true) {
+    process.stdout.write(`OK: '${marker}' annotation is well-formed (forge-protocol conformance check passed)\n`);
+    process.exit(0);
+  } else {
+    const errors = (result && Array.isArray(result.errors) && result.errors.length > 0)
+      ? result.errors.join('\n  - ')
+      : 'no error details returned by library';
+    process.stderr.write(
+      `ERROR: '${marker}' annotation failed forge-protocol conformance check:\n` +
+      `  - ${errors}\n`
+    );
+    process.exit(1);
+  }
+}
+
+main().catch((err) => {
+  process.stderr.write(`FATAL: ${err.message}\n`);
+  process.exit(2);
+});

package/scripts/verify-env-vars.sh

@@ -179,8 +179,24 @@ for var in $VAR_NAMES; do
     fi
 
     if [ -z "$FOUND_IN" ]; then
-        echo "BLOCKING: $var — not found in .env.example, docker-compose.yml, or env_validation.py"
-        BLOCKING=$((BLOCKING + 1))
+        # Determine whether any of the optional surfaces exist in this repo.
+        # If NONE of the known surfaces exist (not even .env.example), the repo
+        # uses a layout we can't validate — emit SKIP instead of a false BLOCKING.
+        # This is the verify-sops-chain.sh pattern: unknown layout → graceful skip,
+        # not a spurious failure. <!-- Added: forge#1349 -->
+        HAS_ANY_SURFACE=0
+        [ -f "$REPO_ROOT/.env.example" ] && HAS_ANY_SURFACE=1
+        [ -f "$REPO_ROOT/docker-compose.yml" ] && HAS_ANY_SURFACE=1
+        [ -f "$REPO_ROOT/docker-compose.prod.yml" ] && HAS_ANY_SURFACE=1
+        [ -f "$REPO_ROOT/services/api/app/core/env_validation.py" ] && HAS_ANY_SURFACE=1
+        [ -f "$REPO_ROOT/scripts/decrypt-secrets.sh" ] && HAS_ANY_SURFACE=1
+
+        if [ "$HAS_ANY_SURFACE" -eq 0 ]; then
+            echo "SKIP: $var — no known env-wiring surfaces found in repo (no .env.example, docker-compose, env_validation.py, or SOPS mapping). Configure verification.env_check_surfaces in forge.yaml or add .env.example to enable this check."
+        else
+            echo "BLOCKING: $var — not found in any detected env-wiring surface (.env.example, docker-compose.yml, env_validation.py, or decrypt-secrets.sh)"
+            BLOCKING=$((BLOCKING + 1))
+        fi
     else
         echo "OK: $var — found in:$FOUND_IN"
     fi

package/scripts/verify-host-headers.sh

@@ -67,9 +67,9 @@ while read -r f; do
         elif echo "$CONTENT" | grep -qE "\-\-header\s+[\"']Host:"; then
             echo "OK: $f:$LINENO — Host header explicitly set (--header)"
         else
-            echo "BLOCKING: $f:$LINENO — curl/wget to internal service without explicit Host header. TrustedHostMiddleware will reject raw IP as Host value."
+            echo "BLOCKING: $f:$LINENO — curl/wget to internal service without explicit Host header. Host-validation middleware will reject a raw IP as the Host value."
             echo "  Line: $CONTENT"
-            echo "  Fix: Add -H 'Host: localhost' (or appropriate allowed host from services/api/app/main.py allowed_hosts)"
+            echo "  Fix: Add -H 'Host: <allowed-hostname>' — check your service's allowed_hosts configuration for the correct value"
             BLOCKING=$((BLOCKING + 1))
         fi
     done < <(echo "$CURL_LINES")
@@ -96,11 +96,11 @@ if [ -n "$FRONTEND_FILES" ]; then
         fi
 
         if [ -n "$DIRECT_CALLS" ]; then
-            echo "BLOCKING: $f — direct /api/v1/ call bypasses Next.js proxy (auth will fail)"
+            echo "BLOCKING: $f — direct /api/v1/ call bypasses frontend proxy (auth middleware will be skipped)"
             while IFS= read -r match; do
                 echo "  $match"
             done < <(echo "$DIRECT_CALLS")
-            echo "  Fix: Use /api/* proxy routes instead of /api/v1/* direct FastAPI calls"
+            echo "  Fix: Use the frontend proxy route (e.g. /api/*) instead of calling the backend API directly"
             BLOCKING=$((BLOCKING + 1))
         else
             echo "OK: $f — no direct backend calls"

package/scripts/verify-route-registration.sh

@@ -5,7 +5,7 @@
 #   changed_files_file: path to a file listing changed files (one per line)
 #   repo_root: path to the repository root
 #
-# Layout path overrides (env vars — override defaults for non-AlterLab layouts):
+# Layout path overrides (env vars — override defaults for project-specific layouts):
 #   FORGE_PAGES_ROOT          Root of Next.js App Router pages dir (default: web/src/app)
 #   FORGE_API_ROUTERS_DIR     Dir containing FastAPI router .py files (default: services/api/app/routers)
 #   FORGE_API_MAIN            Path to API app entrypoint, relative to repo root (default: services/api/app/main.py)
@@ -35,7 +35,7 @@ else
     FILES=$(cat "$CHANGED_FILES")
 fi
 
-# Layout path configuration — read from env vars, fall back to AlterLab defaults
+# Layout path configuration — read from env vars, fall back to project defaults
 FORGE_PAGES_ROOT="${FORGE_PAGES_ROOT:-web/src/app}"
 FORGE_API_ROUTERS_DIR="${FORGE_API_ROUTERS_DIR:-services/api/app/routers}"
 FORGE_API_MAIN="${FORGE_API_MAIN:-services/api/app/main.py}"