forgedock 1.16.0 → 1.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.16.0",
+  "version": "1.16.1",
   "description": "Autonomous development pipeline for coding agents. GitHub as institutional memory, with native Claude Code and OpenCode entrypoints.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"

package/scripts/check-spec-size.sh

@@ -5,17 +5,21 @@
 #
 # Usage: check-spec-size.sh [base_ref]     (default: $BASE_REF, else origin/staging)
 # Env:   PR_LABELS  comma-separated PR label names (untrusted; grep-matched only)
-#        PR_BODY    PR body text (untrusted; grep-matched only)
+#        PR_HEAD_REF / PR_BASE_REF  PR head and base branch names; staging -> main
+#                   (a release PR) is skipped: cumulative growth is not judged here
+#        PR_SAME_REPO  must be "true" for the release skip (a fork branch named
+#                   staging must not bypass the budget)
 #        GITHUB_STEP_SUMMARY  summary file (stdout when unset)
 # Exit:  0 pass/exempt, 1 budget violation, 2 usage/base-ref error (fail closed)
 #
-# Rules (against the PR base, compared in bytes):
+# Rules (against the merge-base of HEAD and the PR base, compared in bytes):
 #   1. Budgeted specs may not grow by more than 2% or more than 4096 bytes.
-#   2. No commands/**/*.md file may gain a canonical block copy (per-file marker
-#      count may not rise). Count-based until the shared helper lands (#3493).
+#   2. The NET count of canonical block markers across all of commands/**/*.md
+#      may not rise (moving a block between files, or replacing one with a stub,
+#      is allowed). Count-based until the shared helper lands (#3493).
 #   Shrinking or equal size always passes.
-# Exemption: `spec-size-exempt` label, or a `<!-- spec-size-exempt: <reason> -->`
-# line with a non-empty reason in the PR body. Failures are reported, exit 0.
+# Exemption: the `spec-size-exempt` label only (needs triage rights; a PR-body
+# marker is NOT honoured). Failures are reported, exit 0.
 # Bash 3.2 portable: no assoc arrays, mapfile, grep -P.
 set -uo pipefail
 
@@ -32,15 +36,27 @@ if ! git rev-parse --verify -q "$BASE^{commit}" >/dev/null; then
   exit 2
 fi
 
-# --- exemption -------------------------------------------------------------
+# --- release PR skip (staging -> main) ---------------------------------------
+if [ "${PR_HEAD_REF:-}" = "staging" ] && [ "${PR_BASE_REF:-}" = "main" ] && [ "${PR_SAME_REPO:-}" = "true" ]; then
+  out "## Spec-size budget"
+  out ""
+  out "Result: SKIPPED (release PR staging -> main; growth was checked per PR)"
+  echo "spec-size: skipped for release PR staging -> main"
+  exit 0
+fi
+
+# Compare against the merge-base, not the base tip (base moves after branching).
+MB=$(git merge-base HEAD "$BASE" 2>/dev/null) || MB=""
+if [ -z "$MB" ]; then
+  echo "ERROR: no merge-base between HEAD and '$BASE' (need fetch-depth: 0)" >&2
+  exit 2
+fi
+BASE="$MB"
+
+# --- exemption: label only ---------------------------------------------------
 EXEMPT_REASON=""
 if printf '%s' "${PR_LABELS:-}" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -qxF 'spec-size-exempt'; then
   EXEMPT_REASON="label spec-size-exempt"
-else
-  R=$(printf '%s\n' "${PR_BODY:-}" | tr -d '\r' \
-    | sed -n 's/^[[:space:]]*<!--[[:space:]]*spec-size-exempt:[[:space:]]*\(.*\)-->[[:space:]]*$/\1/p' \
-    | head -n 1 | sed 's/[[:space:]]*$//')
-  [ -n "$R" ] && EXEMPT_REASON="PR body marker: $R"
 fi
 
 FAILURES=0
@@ -66,25 +82,29 @@ for f in $BUDGETED; do
   out "| \`$f\` | $b | $h | $g | $p | $status |"
 done
 
-DUP_ROWS=""
-# Every commands/**/*.md present at head (new files have base count 0).
-for f in $(git ls-files 'commands/*.md' 'commands/**/*.md' | sort -u); do
-  [ -f "$f" ] || continue
-  hc=$(grep -cE "$MARKERS" "$f" 2>/dev/null || true); hc=${hc:-0}
+# Net marker total across every commands/**/*.md: head (working tree, incl. new
+# files) vs base (incl. files deleted at head). Fail only when the total rises.
+HEAD_TOTAL=0; BASE_TOTAL=0; MARKER_ROWS=""
+HEAD_FILES=$(git ls-files 'commands/*.md' | sort -u)
+BASE_FILES=$(git ls-tree -r --name-only "$BASE" -- commands | grep -E '\.md$' | sort -u)
+for f in $(printf '%s\n%s\n' "$HEAD_FILES" "$BASE_FILES" | sort -u); do
+  [ -n "$f" ] || continue
+  hc=0; [ -f "$f" ] && hc=$(grep -cE "$MARKERS" "$f" 2>/dev/null || true); hc=${hc:-0}
   bc=$(git show "$BASE:$f" 2>/dev/null | grep -cE "$MARKERS" 2>/dev/null || true); bc=${bc:-0}
-  if [ "$hc" -gt "$bc" ]; then
-    DUP_ROWS="$DUP_ROWS| \`$f\` | $bc | $hc | NEW CANONICAL BLOCK COPY |
+  HEAD_TOTAL=$((HEAD_TOTAL + hc)); BASE_TOTAL=$((BASE_TOTAL + bc))
+  [ "$hc" -ne "$bc" ] && MARKER_ROWS="$MARKER_ROWS| \`$f\` | $bc | $hc |
 "
-    FAILURES=$((FAILURES + 1))
-  fi
 done
-if [ -n "$DUP_ROWS" ]; then
+if [ "$HEAD_TOTAL" -gt "$BASE_TOTAL" ]; then
+  FAILURES=$((FAILURES + 1))
   out ""
-  out "### Canonical block copies added (source the shared helper instead)"
+  out "### NEW CANONICAL BLOCK COPY: net marker total rose $BASE_TOTAL -> $HEAD_TOTAL (source the shared helper instead)"
+fi
+if [ -n "$MARKER_ROWS" ]; then
   out ""
-  out "| File | Base markers | Head markers | Status |"
-  out "|------|-----:|-----:|--------|"
-  printf '%s' "$DUP_ROWS" >> "$SUMMARY"
+  out "| File | Base markers | Head markers |"
+  out "|------|-----:|-----:|"
+  printf '%s' "$MARKER_ROWS" >> "$SUMMARY"
 fi
 
 out ""
@@ -97,6 +117,6 @@ if [ -n "$EXEMPT_REASON" ]; then
   echo "spec-size: $FAILURES violation(s) waived: $EXEMPT_REASON"
   exit 0
 fi
-out "Result: FAIL ($FAILURES violation(s)). Shrink the spec, or add the spec-size-exempt label / a \`<!-- spec-size-exempt: <reason> -->\` line to the PR body."
+out "Result: FAIL ($FAILURES violation(s)). Shrink the spec, or ask a maintainer to add the spec-size-exempt label."
 echo "spec-size: FAIL ($FAILURES violation(s)); see job summary" >&2
 exit 1

package/scripts/check-spec-size.test.sh

@@ -18,6 +18,7 @@ gen() { awk -v n="$1" 'BEGIN{for(i=0;i<n;i++) print "line of spec text number "
 gen 4000 > commands/review-pr.md          # ~110 KB: 2% ~ 2.2 KB < 4 KB cap
 gen 20000 > commands/work-on.md           # ~560 KB: 2% ~ 11 KB, so the 4 KB cap binds
 gen 100 > commands/other.md
+printf 'HELPER_SCRIPT=""\n' > commands/donor.md
 gen 100 > commands/work-on/remediate.md
 git add -A; git commit -qm base; git branch -M staging; git push -q origin staging 2>/dev/null
 git checkout -q -b feat
@@ -26,7 +27,7 @@ reset() { git reset -q --hard origin/staging; git clean -qfd; }
 run() { # name want_rc [env...]
   local name="$1" want="$2"; shift 2
   local sum="$TMP/summary"; : > "$sum"
-  env GITHUB_STEP_SUMMARY="$sum" PR_LABELS="" PR_BODY="" "$@" bash "$S" origin/staging >"$TMP/out" 2>"$TMP/err"
+  env GITHUB_STEP_SUMMARY="$sum" PR_LABELS="" PR_HEAD_REF="" PR_BASE_REF="" "$@" bash "$S" origin/staging >"$TMP/out" 2>"$TMP/err"
   local rc=$?
   if [ "$rc" = "$want" ]; then ok; else bad "$name (rc=$rc want $want)"; cat "$TMP/err"; fi
 }
@@ -72,10 +73,52 @@ run "reduced count passes" 0
 # Exemption
 reset; gen 100 >> commands/review-pr.md
 run "exempt by label" 0 PR_LABELS="bug,spec-size-exempt"; has "label reported" "EXEMPT"
-run "exempt by body marker" 0 PR_BODY=$'text\n<!-- spec-size-exempt: security fix -->\nmore'; has "reason reported" "security fix"
-run "empty-reason marker not exempt" 1 PR_BODY='<!-- spec-size-exempt:  -->'
+run "body marker does not exempt" 1 PR_BODY=$'text\n<!-- spec-size-exempt: security fix -->\nmore'
 run "label substring not exempt" 1 PR_LABELS="spec-size-exempt-not"
 
+# Net counting: moves and stubs pass (the #3493 / #3590 shape)
+reset; : > commands/donor.md; printf 'HELPER_SCRIPT=""\n' >> commands/other.md
+run "net move between files passes" 0
+reset; : > commands/donor.md; printf 'HELPER_SCRIPT=""\n' > commands/new-spec.md; git add -A
+run "move to a new file passes" 0
+reset; git rm -q commands/donor.md; gen 5 > commands/review-pr.md; printf 'HELPER_SCRIPT=""\n' > commands/helper-stub.md; git add -A
+run "stub replaces deleted block passes" 0
+reset; printf 'HELPER_SCRIPT=""\n' >> commands/other.md
+run "copy without removal still fails" 1
+
+# Shared-helper stubs (forge#3778): the sourced-helper stub shape carries none of the markers, so converting an inlined block to a stub
+# is a net reduction, while re-pasting the full block still fails.
+STUB_LOC='type forge_resolve >/dev/null 2>&1 || for _r in "${FORGEDOCK_HOME:-}"; do . "$_r/scripts/lib/forge-resolve.sh"; done'
+reset; printf '%s\n' "$STUB_LOC" '. "$(forge_resolve lib/fence-bootstrap.sh)" || exit 1   # FENCE_BOOTSTRAP' 'HELPER_SCRIPT=$(forge_resolve x.sh)' >> commands/other.md
+run "one-tag-per-stub design passes" 0
+reset; : > commands/donor.md; printf '%s\n' "$STUB_LOC" 'HELPER_SCRIPT=$(forge_resolve x.sh)' >> commands/other.md
+run "block converted to a stub passes" 0
+reset; printf '%s\n' "$STUB_LOC" 'HELPER_SCRIPT=""' >> commands/other.md
+run "stub plus a re-pasted resolver block fails" 1
+
+# Release PR skip (staging -> main only)
+reset; gen 100 >> commands/review-pr.md
+run "release PR skipped" 0 PR_HEAD_REF=staging PR_BASE_REF=main PR_SAME_REPO=true; has "skip reported" "SKIPPED"
+run "fork branch named staging still checked" 1 PR_HEAD_REF=staging PR_BASE_REF=main PR_SAME_REPO=false
+run "release PR without same-repo flag still checked" 1 PR_HEAD_REF=staging PR_BASE_REF=main
+run "hotfix to main still checked" 1 PR_HEAD_REF=hotfix PR_BASE_REF=main
+run "staging to other base still checked" 1 PR_HEAD_REF=staging PR_BASE_REF=dev
+
+# Merge-base: base advancing after branching must not count against the PR
+reset; git checkout -q -b old-branch; git checkout -q staging 2>/dev/null || git checkout -q -B staging origin/staging
+gen 300 >> commands/review-pr.md; git commit -qam "base grows"; git push -q origin HEAD:staging 2>/dev/null
+git checkout -q old-branch; git fetch -q origin staging
+run "base tip growth ignored (merge-base)" 0
+git checkout -q feat; git branch -qD old-branch; git branch -qf staging origin/staging; reset
+
+# Script extracted from the base ref behaves the same
+git show origin/staging:scripts/check-spec-size.sh > "$TMP/base-script.sh" 2>/dev/null || cp "$S" "$TMP/base-script.sh"
+gen 100 >> commands/review-pr.md
+: > "$TMP/summary"
+GITHUB_STEP_SUMMARY="$TMP/summary" PR_LABELS="" bash "$TMP/base-script.sh" origin/staging >/dev/null 2>&1; rc=$?
+[ "$rc" = 1 ] && ok || bad "extracted base-ref script fails over-budget change (rc=$rc)"
+reset
+
 # Fail closed on unresolvable base
 : > "$TMP/summary"
 GITHUB_STEP_SUMMARY="$TMP/summary" bash "$S" origin/does-not-exist >/dev/null 2>&1; rc=$?