forgedock 1.19.0 → 1.21.0

package/scripts/selfreview-plan.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# selfreview-plan.sh — build-time self-review plan: run or skip, and which roster (forge#3971).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Pure decision script: flags in, key=value lines out. No network, no git, no eval; every flag value is data.
+# It calls scripts/review-roster.sh (resolved through forge_resolve, never from the repo under build) on the staged
+# diff's file list so the self-review roster equals the roster /review-pr would pick for the same diff.
+#
+# Usage: selfreview-plan.sh --files-file PATH|- [--changed-lines N] [--changed-files N] [--contract-flags "HIGH_RISK ..."]
+#          [--spec-cli true|false] [--review-depth STANDARD|EXTENDED] [--scores "AUTH=n ..."]
+#          [--agent-available true|false] [--tree HASH] [--done-trees "HASH HASH ..."]
+# Env:   FORGE_SELFREVIEW=off|0|false|disabled   operator off switch
+# Output (stdout, always all four lines):
+#          SELFREVIEW=run|skip   SKIP_REASON=<reason or empty>   TIER=<roster tier or empty>   SELECTED_AGENTS=<domains>
+# Skip reasons (first match wins): disabled, empty-diff, docs-only, no-agent-tool, already-done, roster-unavailable,
+#          small-security-only (small tier, Security-only roster, no path or contract trigger fired).
+# Exit: 0 for every parseable call, including every degrade-to-skip path (self-review never blocks build); 2 on an unknown flag.
+# Bash 3.2 portable (no mapfile, associative arrays, grep -P).
+set -u
+
+FILES_FILE=""; LINES=""; NFILES=""; CFLAGS=""; SPEC_CLI=false; DEPTH=STANDARD; SCORES=""
+AGENT_AVAILABLE=true; TREE=""; DONE_TREES=""
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --files-file) FILES_FILE="${2:-}"; shift 2 ;;
+        --changed-lines) LINES="${2:-}"; shift 2 ;;
+        --changed-files) NFILES="${2:-}"; shift 2 ;;
+        --contract-flags) CFLAGS="${2:-}"; shift 2 ;;
+        --spec-cli) SPEC_CLI="${2:-false}"; shift 2 ;;
+        --review-depth) DEPTH="${2:-STANDARD}"; shift 2 ;;
+        --scores) SCORES="${2:-}"; shift 2 ;;
+        --agent-available) AGENT_AVAILABLE="${2:-true}"; shift 2 ;;
+        --tree) TREE="${2:-}"; shift 2 ;;
+        --done-trees) DONE_TREES="${2:-}"; shift 2 ;;
+        *) echo "selfreview-plan: unknown argument: $1" >&2; exit 2 ;;
+    esac
+done
+
+emit() { # <run|skip> <skip reason> <tier> <agents>
+    printf 'SELFREVIEW=%s\nSKIP_REASON=%s\nTIER=%s\nSELECTED_AGENTS=%s\n' "$1" "$2" "$3" "$4"
+    exit 0
+}
+
+case "$(printf '%s' "${FORGE_SELFREVIEW:-}" | tr '[:upper:]' '[:lower:]')" in
+    off|0|false|disabled|no) emit skip disabled "" "" ;;
+esac
+
+FILES=""
+if [ "$FILES_FILE" = "-" ]; then FILES=$(cat)
+elif [ -n "$FILES_FILE" ] && [ -f "$FILES_FILE" ]; then FILES=$(cat "$FILES_FILE"); fi
+FILES=$(printf '%s\n' "$FILES" | grep -v '^[[:space:]]*$' || true)
+
+[ -n "$FILES" ] || emit skip empty-diff "" ""
+
+# Docs-only: every file is documentation. commands/**, .agents/** and skills/** are executable spec, never docs.
+CODE_FILES=$(printf '%s\n' "$FILES" | grep -vE '^(docs/|README|CHANGELOG|LICENSE|NOTICE)|\.(md|txt|rst)$' || true)
+SPEC_FILES=$(printf '%s\n' "$FILES" | grep -E '^(commands|\.agents|skills)/.*\.md$' || true)
+[ -n "$CODE_FILES" ] || [ -n "$SPEC_FILES" ] || emit skip docs-only "" ""
+
+[ "$AGENT_AVAILABLE" = "true" ] || emit skip no-agent-tool "" ""
+
+if [ -n "$TREE" ]; then
+    for _t in $DONE_TREES; do
+        [ "$_t" = "$TREE" ] && emit skip already-done "" ""
+    done
+fi
+
+type forge_resolve >/dev/null 2>&1 || { setopt nonomatch 2>/dev/null || true; _SELF_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd -P)"; for _r in "$(cygpath -u "${FORGEDOCK_HOME:-}" 2>/dev/null || printf %s "${FORGEDOCK_HOME:-}")" "${CLAUDE_PLUGIN_ROOT:-}" "${FORGE_ROOT:-}" "${FORGE_HOME:-}" "$(readlink -f "$HOME/.claude/commands/work-on.md" 2>/dev/null | sed 's|/commands/work-on\.md$||')" "$(head -n 1 "${CODEX_HOME:-$HOME/.codex}/forge-home" 2>/dev/null)" "$HOME/.claude/plugins/marketplaces/forgedock" "${CLAUDE_CONFIG_DIR:-$HOME/.claude}"/plugins/cache/forgedock/forgedock/* "$HOME/.claude"/plugins/cache/forgedock/forgedock/* "$_SELF_ROOT"; do case "$_r" in /*) [ -f "$_r/scripts/lib/forge-resolve.sh" ] && { . "$_r/scripts/lib/forge-resolve.sh"; break; };; esac; done; type forge_resolve >/dev/null 2>&1 || forge_resolve() { :; }; }  # allowlist:portability — canonical resolver block; readlink -f is guarded (2>/dev/null) and optional
+ROSTER_SCRIPT=$(forge_resolve review-roster.sh)
+[ -n "$ROSTER_SCRIPT" ] && [ -f "$ROSTER_SCRIPT" ] || emit skip roster-unavailable "" ""
+
+set -- --files-file - --contract-flags "$CFLAGS" --spec-cli "$SPEC_CLI" --review-depth "$DEPTH"
+[ -n "$LINES" ] && set -- "$@" --changed-lines "$LINES"
+[ -n "$NFILES" ] && set -- "$@" --changed-files "$NFILES"
+[ -n "$SCORES" ] && set -- "$@" --scores "$SCORES"
+OUT=$(printf '%s\n' "$FILES" | bash "$ROSTER_SCRIPT" "$@" 2>/dev/null) || emit skip roster-unavailable "" ""
+
+SEL=$(printf '%s\n' "$OUT" | sed -n 's/^SELECTED_AGENTS=//p' | head -n 1)
+TIER=$(printf '%s\n' "$OUT" | sed -n 's/^TIER=//p' | head -n 1)
+[ -n "$SEL" ] && [ -n "$TIER" ] || emit skip roster-unavailable "" ""
+
+# Cost guard: the small tier runs only when a path or contract trigger widened the roster past Security.
+if [ "$TIER" = "small" ] && [ "$SEL" = "security" ]; then emit skip small-security-only "$TIER" "$SEL"; fi
+emit run "" "$TIER" "$SEL"

package/scripts/selfreview-plan.test.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Tests for scripts/selfreview-plan.sh (build-time self-review plan, forge#3971). Run: bash scripts/selfreview-plan.test.sh
+# (bash 3.2 compatible)
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "$DIR/.." && pwd)
+SCRIPT="$DIR/selfreview-plan.sh"
+pass=0; fail=0
+ok() { pass=$((pass+1)); }
+bad() { fail=$((fail+1)); echo "FAIL: $1"; }
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/selfreview-plan.XXXXXX")
+trap 'rm -rf "$WORK"' EXIT
+export FORGEDOCK_HOME="$ROOT"   # the resolver must not pick up an ambient install
+unset FORGE_SELFREVIEW
+
+PLAN=""; RC=0
+# run <files, newline separated> <flags...>
+run() {
+  printf '%s\n' "$1" > "$WORK/files"; shift
+  PLAN=$(bash "$SCRIPT" --files-file "$WORK/files" "$@" 2>/dev/null); RC=$?
+}
+field() { printf '%s\n' "$PLAN" | sed -n "s/^$1=//p"; }
+expect() { # name key want
+  local got; got=$(field "$2")
+  if [ "$got" = "$3" ]; then ok; else bad "$1: $2='$got', want '$3'"; fi
+}
+has_agent() { case " $(field SELECTED_AGENTS) " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+
+# e1: docs-only and empty diffs skip with a recorded reason
+run "docs/GUIDE.md
+README.md" --changed-lines 40
+expect "docs-only skips" SELFREVIEW skip; expect "docs-only reason" SKIP_REASON docs-only
+run "" --changed-lines 0
+expect "empty diff skips" SELFREVIEW skip; expect "empty reason" SKIP_REASON empty-diff
+run "commands/work-on/build.md" --changed-lines 40 --changed-files 1
+expect "spec markdown is not docs" SELFREVIEW skip
+if [ "$(field SKIP_REASON)" = "docs-only" ]; then bad "commands/*.md treated as docs"; else ok; fi
+
+# e2: small tier, Security-only roster, no trigger: skipped; the same size with an auth path runs
+run "scripts/foo.sh" --changed-lines 30 --changed-files 1
+expect "small security-only skips" SELFREVIEW skip; expect "small reason" SKIP_REASON small-security-only; expect "small tier" TIER small
+run "src/auth/session.py
+src/util.py" --changed-lines 30 --changed-files 2
+expect "small + auth path runs" SELFREVIEW run; expect "small + auth tier" TIER small
+has_agent auth && ok || bad "auth path did not add auth"
+has_agent security && ok || bad "security floor missing"
+run "scripts/foo.sh
+scripts/bar.sh" --changed-lines 30 --changed-files 2 --contract-flags "HIGH_RISK"
+expect "small + HIGH_RISK runs" SELFREVIEW run; expect "HIGH_RISK lifts tier" TIER standard
+
+# standard tier runs
+run "scripts/foo.sh
+scripts/bar.sh" --changed-lines 400 --changed-files 2
+expect "standard runs" SELFREVIEW run; expect "standard tier" TIER standard; expect "standard no reason" SKIP_REASON ""
+has_agent security && ok || bad "standard roster lacks security"
+
+# EXTENDED depth lifts a small roster
+run "scripts/foo.sh" --changed-lines 20 --changed-files 1 --review-depth EXTENDED
+expect "extended depth runs" SELFREVIEW run; expect "extended tier" TIER standard
+
+# e3: off switch, no Agent tool, unresolvable roster degrade to skip and exit 0
+FORGE_SELFREVIEW=off run "scripts/a.sh
+scripts/b.sh" --changed-lines 400
+[ "$RC" = 0 ] && ok || bad "off exit code $RC"
+expect "off skips" SELFREVIEW skip; expect "off reason" SKIP_REASON disabled
+run "scripts/a.sh
+scripts/b.sh" --changed-lines 400 --agent-available false
+[ "$RC" = 0 ] && ok || bad "no-agent exit code $RC"
+expect "no agent skips" SELFREVIEW skip; expect "no agent reason" SKIP_REASON no-agent-tool
+FORGEDOCK_HOME=/nonexistent-forge-home run "scripts/a.sh
+scripts/b.sh" --changed-lines 400
+[ "$RC" = 0 ] && ok || bad "unresolvable exit code $RC"
+expect "unresolvable roster skips" SELFREVIEW skip; expect "unresolvable reason" SKIP_REASON roster-unavailable
+
+# e4: a tree that already has a completed self-review is not dispatched again
+run "scripts/a.sh
+scripts/b.sh" --changed-lines 400 --tree aaa --done-trees "bbb aaa"
+expect "same tree skips" SELFREVIEW skip; expect "same tree reason" SKIP_REASON already-done
+run "scripts/a.sh
+scripts/b.sh" --changed-lines 400 --tree ccc --done-trees "bbb aaa"
+expect "new tree runs" SELFREVIEW run
+
+# usage: unknown flag exits 2
+bash "$SCRIPT" --nope >/dev/null 2>&1; [ "$?" = 2 ] && ok || bad "unknown flag should exit 2"
+
+echo "selfreview-plan: ${pass} passed, ${fail} failed"
+[ "$fail" -eq 0 ]

package/scripts/spawn-depth-check.sh

@@ -1,13 +1,14 @@
 #!/usr/bin/env bash
-# spawn-depth-check.sh — will a /work-on dispatching phase (review, remediate) have the Agent tool?
+# spawn-depth-check.sh — will a /work-on dispatching phase (build self-review, review, remediate) have the Agent tool?
 # SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
 # SPDX-License-Identifier: AGPL-3.0-or-later
 #
 # Claude Code grants the Agent tool to sub-agents down to CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH layers
 # below the main conversation (default 3 since 2.1.219; 5 for 2.1.172-2.1.216; 1 for 2.1.217-2.1.218).
-# A sub-agent at layer L can spawn only when L < depth. The router invokes review/remediate at
+# A sub-agent at layer L can spawn only when L < depth. The router invokes build/review/remediate at
 # router layer + 1, so they can spawn reviewers only when router layer + 2 <= depth (forge#3398,
-# docs/WORK-ON-RUNTIME.md).
+# docs/WORK-ON-RUNTIME.md). build (B5.6 self-review, forge#3971) uses the same arithmetic but degrades to a recorded
+# skip on FAIL instead of stopping the run.
 #
 # Usage: spawn-depth-check.sh [--router-layer N]      (N = 0 solo, 1 under /orchestrate; default 0)
 # Env:   CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH  explicit limit (wins over the version default)
@@ -69,5 +70,5 @@ if [ "$DEPTH" -ge "$REQUIRED" ]; then
   echo "SPAWN_DEPTH: OK depth=${DEPTH} required=${REQUIRED} (${SOURCE})"
   exit 0
 fi
-echo "SPAWN_DEPTH: FAIL depth=${DEPTH} required=${REQUIRED} (${SOURCE}) — review/remediate would run without the Agent tool and could not spawn /review-pr reviewers. Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH>=${REQUIRED}."
+echo "SPAWN_DEPTH: FAIL depth=${DEPTH} required=${REQUIRED} (${SOURCE}) — build/review/remediate would run without the Agent tool and could not spawn self-review or /review-pr reviewers. Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH>=${REQUIRED}."
 exit 1

package/scripts/spawn-depth-check.test.sh

@@ -43,5 +43,8 @@ t "env depth 09 decimal"           0 "SPAWN_DEPTH: OK"      CLAUDE_CODE_MAX_SUBA
 # Usage errors.
 t "bad router layer"              2 "spawn-depth-check:"   -- --router-layer x
 t "unknown flag"                  2 "usage:"               -- --nope
+# forge#3971: build is a dispatching phase too, and the FAIL text names it (exit codes unchanged)
+out=$(env -u CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH -u FORGE_RUNTIME FORGE_CLAUDE_VERSION=2.1.217 bash "$S" 2>&1)
+case "$out" in *build/review/remediate*) PASS=$((PASS+1)) ;; *) FAILN=$((FAILN+1)); echo "FAIL: FAIL text does not name build ($out)" ;; esac
 echo "spawn-depth-check: ${PASS} passed, ${FAILN} failed"
 [ "$FAILN" -eq 0 ]

package/scripts/telemetry.test.sh

@@ -61,6 +61,14 @@ check "finding_disposition carries scope" "$(grep '^{' "$TD/posted" | jq -r '.sc
 reset; FORGE_PR=9 forge_emit review_panel mode=FULL; grep -q 'issues/9/comments' "$TD/calls" && ok || bad "review_panel targets PR"
 reset; FORGE_PR=9 forge_emit diff_size lines=1; grep -q 'issues/5/comments' "$TD/calls" && ok || bad "diff_size targets issue"
 
+# build_selfreview (forge#3971) is a build-side event: posted to the issue even when a PR number is set; ids and counts only
+reset; FORGE_PR=9 forge_emit build_selfreview tier=standard agents=3 findings=4 fixed=2 declined=1 skipped=
+grep -q 'issues/5/comments' "$TD/calls" && ok || bad "build_selfreview targets issue"
+REC=$(grep '^{' "$TD/posted")
+check "build_selfreview event" "$(printf '%s' "$REC" | jq -r '.event')" "build_selfreview"
+check "build_selfreview counts typed" "$(printf '%s' "$REC" | jq -r '.agents + .findings + .fixed + .declined')" "10"
+check "build_selfreview skip reason" "$(reset; forge_emit build_selfreview skipped=small-security-only tier=small; grep '^{' "$TD/posted" | jq -r '.skipped')" "small-security-only"
+
 # 2. Sanitising: reserved keys, bad keys, backticks and newlines never reach the record.
 reset
 forge_emit x repo=evil 'a b=1' ok='a`b

package/scripts/transition-label.sh

@@ -278,6 +278,32 @@ fi
 # ---------------------------------------------------------------------------
 # Add target label
 # ---------------------------------------------------------------------------
+# forge#3567: `gh issue edit --add-label` fails when the label is absent from the repo (a
+# consumer repo not re-synced via `forgedock labels setup`), aborting the transition under
+# `set -e`. Best-effort ensure first: `--force` is a create-or-update, a failure (permissions,
+# rate limit, concurrent create) is ignored so the add below surfaces its own error. Only
+# ForgeDock-managed names are created (fixed table mirroring bin/labels.json, kept in sync by
+# bin/tests/label-bootstrap.test.mjs); a custom FORGE_LABEL_MAP name is never created.
+ensure_label() {
+  local name="$1" LBL_COLOR="" LBL_DESC=""
+  case "$name" in
+    "workflow:investigating") LBL_COLOR="1D76DB"; LBL_DESC="Pipeline: investigation phase in progress. Managed by ForgeDock." ;;
+    "workflow:ready-to-build") LBL_COLOR="0075CA"; LBL_DESC="Pipeline: investigation complete, ready for build. Managed by ForgeDock." ;;
+    "workflow:building") LBL_COLOR="0052CC"; LBL_DESC="Pipeline: implementation in progress. Managed by ForgeDock." ;;
+    "workflow:in-review") LBL_COLOR="5319E7"; LBL_DESC="Pipeline: PR created, under review. Managed by ForgeDock." ;;
+    "workflow:remediating") LBL_COLOR="C5DEF5"; LBL_DESC="Pipeline: autonomous remediation pending (no human action needed). Managed by ForgeDock." ;;
+    "workflow:awaiting-merge") LBL_COLOR="FF8C00"; LBL_DESC="Pipeline: remediated + re-reviewed, awaiting a human merge decision. Managed by ForgeDock." ;;
+    "workflow:merged") LBL_COLOR="0E8A16"; LBL_DESC="Pipeline: PR merged, issue closed. Managed by ForgeDock." ;;
+    "workflow:decomposed") LBL_COLOR="BFD4F2"; LBL_DESC="Pipeline: decomposed into sub-issues. Managed by ForgeDock." ;;
+    "workflow:invalid") LBL_COLOR="CCCCCC"; LBL_DESC="Pipeline: issue closed as invalid after investigation. Managed by ForgeDock." ;;
+    "needs-human") LBL_COLOR="E4E669"; LBL_DESC="Pipeline stalled — requires human intervention. Managed by ForgeDock." ;;
+    "workflow:engine-error") LBL_COLOR="B60205"; LBL_DESC="Pipeline stalled — engine/tool failure (not a genuine human-judgment block). Managed by ForgeDock." ;;
+    *) return 0 ;;
+  esac
+  gh label create "$name" --color "$LBL_COLOR" --description "$LBL_DESC" --force "${GH_ARGS[@]}" >/dev/null 2>&1 || true
+}
+ensure_label "$EFFECTIVE_LABEL"
+
 echo "Adding $EFFECTIVE_LABEL to issue #$ISSUE_NUMBER..."
 gh issue edit "$ISSUE_NUMBER" "${GH_ARGS[@]}" --add-label "$EFFECTIVE_LABEL"
 

package/scripts/verify-phase-trail.test.sh

@@ -58,6 +58,7 @@ mk() {
       FP_*) items+=("{\"body\":\"<!-- FORGE:FAST_PATH -->\\n**COMPLEXITY_BAND**: ${k#FP_}\"}") ;;
       QUOTED) items+=('{"body":"see `<!-- FORGE:CONTRACT -->` `<!-- FORGE:CONTEXT -->` `<!-- FORGE:ARCHITECT -->` `<!-- FORGE:QUALITY_GATE -->` **Result**: PASS"}') ;;
       INV_INVALID) items+=('{"body":"<!-- FORGE:INVESTIGATOR -->\nInvalid\n<!-- INVESTIGATION:INVALID -->"}') ;;
+      SR) items+=('{"body":"<!-- FORGE:SELFREVIEW-AGENT:security -->\nTree: abc\n<!-- REVIEW-FINDINGS-START -->\n<!-- REVIEW-FINDINGS-END -->"}' '{"body":"<!-- FORGE:SELFREVIEW -->\n## Self-review\nTree: abc"}') ;;
       PROSE) items+=('{"body":"I ran the architect and context inline; FORGE:CONTEXT FORGE:ARCHITECT FORGE:QUALITY_GATE done"}') ;;
     esac
   done
@@ -82,6 +83,11 @@ expect_pass "lowercase band is accepted" "$(mk lower INV CONTRACT FP_trivial QG_
 expect_pass "Investigation band passes with only INVESTIGATOR+FAST_PATH" "$(mk invest INV FP_INVESTIGATION)"
 expect_pass "docs-only waives QUALITY_GATE" "$(mk docs INV CONTRACT FP_TRIVIAL)" --docs-only
 
+# forge#3971: build-time self-review comments are tolerated but never satisfy a required phase marker
+expect_pass "self-review comments do not disturb a full trail" "$(mk sr1 INV CONTRACT FP_COMPLEX CONTEXT ARCH QG_PASS SR)"
+expect_fail "self-review comments do not stand in for QUALITY_GATE" "$(mk sr2 INV CONTRACT FP_COMPLEX CONTEXT ARCH SR)" QUALITY_GATE
+expect_fail "self-review comments do not stand in for CONTEXT" "$(mk sr3 INV CONTRACT FP_STANDARD ARCH QG_PASS SR)" CONTEXT
+
 expect_fail "missing INVESTIGATOR" "$(mk a CONTRACT FP_COMPLEX CONTEXT ARCH QG_PASS)" INVESTIGATOR
 expect_fail "partial investigation (no COMPLETE) fails" "$(mk b INV_PARTIAL CONTRACT FP_COMPLEX CONTEXT ARCH QG_PASS)" INVESTIGATOR
 expect_fail "missing CONTRACT" "$(mk c INV FP_COMPLEX CONTEXT ARCH QG_PASS)" CONTRACT