forgedock 1.15.0 → 1.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.15.0",
+  "version": "1.16.1",
   "description": "Autonomous development pipeline for coding agents. GitHub as institutional memory, with native Claude Code and OpenCode entrypoints.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"

package/scripts/check-spec-size.sh

@@ -0,0 +1,122 @@
+#!/usr/bin/env bash
+# check-spec-size.sh — PR spec-size budget (forge#3762).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Usage: check-spec-size.sh [base_ref]     (default: $BASE_REF, else origin/staging)
+# Env:   PR_LABELS  comma-separated PR label names (untrusted; grep-matched only)
+#        PR_HEAD_REF / PR_BASE_REF  PR head and base branch names; staging -> main
+#                   (a release PR) is skipped: cumulative growth is not judged here
+#        PR_SAME_REPO  must be "true" for the release skip (a fork branch named
+#                   staging must not bypass the budget)
+#        GITHUB_STEP_SUMMARY  summary file (stdout when unset)
+# Exit:  0 pass/exempt, 1 budget violation, 2 usage/base-ref error (fail closed)
+#
+# Rules (against the merge-base of HEAD and the PR base, compared in bytes):
+#   1. Budgeted specs may not grow by more than 2% or more than 4096 bytes.
+#   2. The NET count of canonical block markers across all of commands/**/*.md
+#      may not rise (moving a block between files, or replacing one with a stub,
+#      is allowed). Count-based until the shared helper lands (#3493).
+#   Shrinking or equal size always passes.
+# Exemption: the `spec-size-exempt` label only (needs triage rights; a PR-body
+# marker is NOT honoured). Failures are reported, exit 0.
+# Bash 3.2 portable: no assoc arrays, mapfile, grep -P.
+set -uo pipefail
+
+BASE="${1:-${BASE_REF:-origin/staging}}"
+PCT_NUM=2            # 2%
+ABS_MAX=4096         # bytes
+BUDGETED="commands/review-pr.md commands/review-pr-staging.md commands/work-on/remediate.md commands/work-on/review.md commands/work-on.md"
+
+SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/stdout}"
+out() { printf '%s\n' "$*" >> "$SUMMARY"; }
+
+if ! git rev-parse --verify -q "$BASE^{commit}" >/dev/null; then
+  echo "ERROR: base ref '$BASE' cannot be resolved (shallow checkout? need fetch-depth: 0)" >&2
+  exit 2
+fi
+
+# --- release PR skip (staging -> main) ---------------------------------------
+if [ "${PR_HEAD_REF:-}" = "staging" ] && [ "${PR_BASE_REF:-}" = "main" ] && [ "${PR_SAME_REPO:-}" = "true" ]; then
+  out "## Spec-size budget"
+  out ""
+  out "Result: SKIPPED (release PR staging -> main; growth was checked per PR)"
+  echo "spec-size: skipped for release PR staging -> main"
+  exit 0
+fi
+
+# Compare against the merge-base, not the base tip (base moves after branching).
+MB=$(git merge-base HEAD "$BASE" 2>/dev/null) || MB=""
+if [ -z "$MB" ]; then
+  echo "ERROR: no merge-base between HEAD and '$BASE' (need fetch-depth: 0)" >&2
+  exit 2
+fi
+BASE="$MB"
+
+# --- exemption: label only ---------------------------------------------------
+EXEMPT_REASON=""
+if printf '%s' "${PR_LABELS:-}" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -qxF 'spec-size-exempt'; then
+  EXEMPT_REASON="label spec-size-exempt"
+fi
+
+FAILURES=0
+base_size() { git cat-file -s "$BASE:$1" 2>/dev/null || echo 0; }
+MARKERS='FORGE_ROOT bootstrap \(canonical|TRUSTED_SCRIPT=""|HELPER_SCRIPT=""|mkdir -p "\$_SD".*# FENCE_BOOTSTRAP'
+
+out "## Spec-size budget (base: \`$BASE\`)"
+out ""
+out "| File | Base | Head | Delta | Delta % | Status |"
+out "|------|-----:|-----:|------:|--------:|--------|"
+for f in $BUDGETED; do
+  [ -f "$f" ] || [ "$(base_size "$f")" != 0 ] || continue
+  b=$(base_size "$f")
+  h=0; [ -f "$f" ] && h=$(wc -c < "$f" | tr -d ' ')
+  g=$((h - b))
+  status="ok"
+  if [ "$g" -gt 0 ] && { [ $((g * 100)) -gt $((b * PCT_NUM)) ] || [ "$g" -gt "$ABS_MAX" ]; }; then
+    status="OVER BUDGET"; FAILURES=$((FAILURES + 1))
+  fi
+  if [ "$b" -gt 0 ]; then
+    p=$(awk -v g="$g" -v b="$b" 'BEGIN{printf "%+.2f%%", g*100/b}')
+  else p="n/a"; fi
+  out "| \`$f\` | $b | $h | $g | $p | $status |"
+done
+
+# Net marker total across every commands/**/*.md: head (working tree, incl. new
+# files) vs base (incl. files deleted at head). Fail only when the total rises.
+HEAD_TOTAL=0; BASE_TOTAL=0; MARKER_ROWS=""
+HEAD_FILES=$(git ls-files 'commands/*.md' | sort -u)
+BASE_FILES=$(git ls-tree -r --name-only "$BASE" -- commands | grep -E '\.md$' | sort -u)
+for f in $(printf '%s\n%s\n' "$HEAD_FILES" "$BASE_FILES" | sort -u); do
+  [ -n "$f" ] || continue
+  hc=0; [ -f "$f" ] && hc=$(grep -cE "$MARKERS" "$f" 2>/dev/null || true); hc=${hc:-0}
+  bc=$(git show "$BASE:$f" 2>/dev/null | grep -cE "$MARKERS" 2>/dev/null || true); bc=${bc:-0}
+  HEAD_TOTAL=$((HEAD_TOTAL + hc)); BASE_TOTAL=$((BASE_TOTAL + bc))
+  [ "$hc" -ne "$bc" ] && MARKER_ROWS="$MARKER_ROWS| \`$f\` | $bc | $hc |
+"
+done
+if [ "$HEAD_TOTAL" -gt "$BASE_TOTAL" ]; then
+  FAILURES=$((FAILURES + 1))
+  out ""
+  out "### NEW CANONICAL BLOCK COPY: net marker total rose $BASE_TOTAL -> $HEAD_TOTAL (source the shared helper instead)"
+fi
+if [ -n "$MARKER_ROWS" ]; then
+  out ""
+  out "| File | Base markers | Head markers |"
+  out "|------|-----:|-----:|"
+  printf '%s' "$MARKER_ROWS" >> "$SUMMARY"
+fi
+
+out ""
+if [ "$FAILURES" -eq 0 ]; then
+  out "Result: PASS"
+  exit 0
+fi
+if [ -n "$EXEMPT_REASON" ]; then
+  out "Result: EXEMPT ($FAILURES violation(s) waived: $EXEMPT_REASON)"
+  echo "spec-size: $FAILURES violation(s) waived: $EXEMPT_REASON"
+  exit 0
+fi
+out "Result: FAIL ($FAILURES violation(s)). Shrink the spec, or ask a maintainer to add the spec-size-exempt label."
+echo "spec-size: FAIL ($FAILURES violation(s)); see job summary" >&2
+exit 1

package/scripts/check-spec-size.test.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# check-spec-size.test.sh — cases for scripts/check-spec-size.sh (forge#3762).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+S="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/check-spec-size.sh"
+PASS=0; FAILN=0
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+ok() { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+
+git init -q --bare "$TMP/origin.git"
+git clone -q "$TMP/origin.git" "$TMP/w" 2>/dev/null
+cd "$TMP/w" || exit 1
+git config user.email t@example.com; git config user.name t
+mkdir -p commands/work-on
+gen() { awk -v n="$1" 'BEGIN{for(i=0;i<n;i++) print "line of spec text number " i}'; }
+gen 4000 > commands/review-pr.md          # ~110 KB: 2% ~ 2.2 KB < 4 KB cap
+gen 20000 > commands/work-on.md           # ~560 KB: 2% ~ 11 KB, so the 4 KB cap binds
+gen 100 > commands/other.md
+printf 'HELPER_SCRIPT=""\n' > commands/donor.md
+gen 100 > commands/work-on/remediate.md
+git add -A; git commit -qm base; git branch -M staging; git push -q origin staging 2>/dev/null
+git checkout -q -b feat
+
+reset() { git reset -q --hard origin/staging; git clean -qfd; }
+run() { # name want_rc [env...]
+  local name="$1" want="$2"; shift 2
+  local sum="$TMP/summary"; : > "$sum"
+  env GITHUB_STEP_SUMMARY="$sum" PR_LABELS="" PR_HEAD_REF="" PR_BASE_REF="" "$@" bash "$S" origin/staging >"$TMP/out" 2>"$TMP/err"
+  local rc=$?
+  if [ "$rc" = "$want" ]; then ok; else bad "$name (rc=$rc want $want)"; cat "$TMP/err"; fi
+}
+has() { grep -qF "$2" "$TMP/summary" && ok || bad "$1 (summary lacks: $2)"; }
+
+reset; run "no change passes" 0
+has "summary shows delta table" "| File | Base | Head | Delta |"
+
+reset; gen 100 >> commands/review-pr.md   # +~2.8 KB on ~110 KB = ~2.5% (>2%, <4 KB)
+run "over 2% fails" 1; has "over-budget flagged" "OVER BUDGET"
+
+reset; gen 200 >> commands/work-on.md     # +~5.6 KB (<2% of 560 KB, >4 KB)
+run "over 4 KB fails" 1
+
+reset; gen 5 >> commands/review-pr.md     # small growth under both limits
+run "small growth passes" 0
+
+reset; gen 5000 >> commands/other.md      # not a budgeted spec
+run "non-budgeted growth passes" 0
+
+reset; gen 100 > commands/review-pr.md    # shrink
+run "shrink passes" 0
+
+reset; printf 'TRUSTED_SCRIPT=""\n' >> commands/other.md
+run "new TRUSTED_SCRIPT copy fails" 1; has "dup flagged" "NEW CANONICAL BLOCK COPY"
+
+reset; printf '_SD=x; mkdir -p "$_SD"   # FENCE_BOOTSTRAP\n' >> commands/other.md
+run "new FENCE_BOOTSTRAP anchor fails" 1
+
+reset; printf 'echo hi   # FENCE_BOOTSTRAP\n' >> commands/other.md
+run "non-anchor FENCE_BOOTSTRAP tag passes" 0
+
+reset; printf '# FORGE_ROOT bootstrap (canonical)\n' > commands/new-spec.md; git add -A
+run "new spec file with block fails" 1
+
+# Existing block, count unchanged or reduced, passes
+reset; printf 'HELPER_SCRIPT=""\n' >> commands/other.md; git commit -qam x; git push -q origin HEAD:staging 2>/dev/null
+git fetch -q origin staging
+run "unchanged count passes" 0
+: > commands/other.md; git add -A
+run "reduced count passes" 0
+
+# Exemption
+reset; gen 100 >> commands/review-pr.md
+run "exempt by label" 0 PR_LABELS="bug,spec-size-exempt"; has "label reported" "EXEMPT"
+run "body marker does not exempt" 1 PR_BODY=$'text\n<!-- spec-size-exempt: security fix -->\nmore'
+run "label substring not exempt" 1 PR_LABELS="spec-size-exempt-not"
+
+# Net counting: moves and stubs pass (the #3493 / #3590 shape)
+reset; : > commands/donor.md; printf 'HELPER_SCRIPT=""\n' >> commands/other.md
+run "net move between files passes" 0
+reset; : > commands/donor.md; printf 'HELPER_SCRIPT=""\n' > commands/new-spec.md; git add -A
+run "move to a new file passes" 0
+reset; git rm -q commands/donor.md; gen 5 > commands/review-pr.md; printf 'HELPER_SCRIPT=""\n' > commands/helper-stub.md; git add -A
+run "stub replaces deleted block passes" 0
+reset; printf 'HELPER_SCRIPT=""\n' >> commands/other.md
+run "copy without removal still fails" 1
+
+# Shared-helper stubs (forge#3778): the sourced-helper stub shape carries none of the markers, so converting an inlined block to a stub
+# is a net reduction, while re-pasting the full block still fails.
+STUB_LOC='type forge_resolve >/dev/null 2>&1 || for _r in "${FORGEDOCK_HOME:-}"; do . "$_r/scripts/lib/forge-resolve.sh"; done'
+reset; printf '%s\n' "$STUB_LOC" '. "$(forge_resolve lib/fence-bootstrap.sh)" || exit 1   # FENCE_BOOTSTRAP' 'HELPER_SCRIPT=$(forge_resolve x.sh)' >> commands/other.md
+run "one-tag-per-stub design passes" 0
+reset; : > commands/donor.md; printf '%s\n' "$STUB_LOC" 'HELPER_SCRIPT=$(forge_resolve x.sh)' >> commands/other.md
+run "block converted to a stub passes" 0
+reset; printf '%s\n' "$STUB_LOC" 'HELPER_SCRIPT=""' >> commands/other.md
+run "stub plus a re-pasted resolver block fails" 1
+
+# Release PR skip (staging -> main only)
+reset; gen 100 >> commands/review-pr.md
+run "release PR skipped" 0 PR_HEAD_REF=staging PR_BASE_REF=main PR_SAME_REPO=true; has "skip reported" "SKIPPED"
+run "fork branch named staging still checked" 1 PR_HEAD_REF=staging PR_BASE_REF=main PR_SAME_REPO=false
+run "release PR without same-repo flag still checked" 1 PR_HEAD_REF=staging PR_BASE_REF=main
+run "hotfix to main still checked" 1 PR_HEAD_REF=hotfix PR_BASE_REF=main
+run "staging to other base still checked" 1 PR_HEAD_REF=staging PR_BASE_REF=dev
+
+# Merge-base: base advancing after branching must not count against the PR
+reset; git checkout -q -b old-branch; git checkout -q staging 2>/dev/null || git checkout -q -B staging origin/staging
+gen 300 >> commands/review-pr.md; git commit -qam "base grows"; git push -q origin HEAD:staging 2>/dev/null
+git checkout -q old-branch; git fetch -q origin staging
+run "base tip growth ignored (merge-base)" 0
+git checkout -q feat; git branch -qD old-branch; git branch -qf staging origin/staging; reset
+
+# Script extracted from the base ref behaves the same
+git show origin/staging:scripts/check-spec-size.sh > "$TMP/base-script.sh" 2>/dev/null || cp "$S" "$TMP/base-script.sh"
+gen 100 >> commands/review-pr.md
+: > "$TMP/summary"
+GITHUB_STEP_SUMMARY="$TMP/summary" PR_LABELS="" bash "$TMP/base-script.sh" origin/staging >/dev/null 2>&1; rc=$?
+[ "$rc" = 1 ] && ok || bad "extracted base-ref script fails over-budget change (rc=$rc)"
+reset
+
+# Fail closed on unresolvable base
+: > "$TMP/summary"
+GITHUB_STEP_SUMMARY="$TMP/summary" bash "$S" origin/does-not-exist >/dev/null 2>&1; rc=$?
+[ "$rc" = 2 ] && ok || bad "unresolved base fails closed (rc=$rc)"
+
+echo "check-spec-size.test: pass=$PASS fail=$FAILN"
+[ "$FAILN" -eq 0 ]