forgeos 0.1.0-alpha.0

package/src/forge/compiler/guards/check-ai-usage.ts

@@ -0,0 +1,98 @@
+import { createDiagnostic } from "../diagnostics/create.ts";
+import {
+  FORGE_AI_DYNAMIC_PROVIDER,
+  FORGE_AI_FORBIDDEN_CONTEXT,
+  FORGE_AI_MODEL_MISSING,
+} from "../diagnostics/codes.ts";
+import type { AppGraph } from "../types/app-graph.ts";
+import type { Diagnostic } from "../types/diagnostic.ts";
+import type { RuntimeContext } from "../types/runtime.ts";
+import { detectCtxAiUsage, parseAiCallsFromSlice } from "../ai-registry/parse.ts";
+import { propagateContexts } from "./propagate-contexts.ts";
+
+const FORBIDDEN_AI_CONTEXTS: RuntimeContext[] = [
+  "command",
+  "client",
+  "query",
+  "liveQuery",
+  "shared",
+  "edge",
+];
+
+const DYNAMIC_PROVIDER_PATTERN =
+  /provider\s*:\s*(?:process\.env|ctx\.config|ctx\.secrets|\w+\[)/;
+
+function contextsForFile(
+  appGraph: AppGraph,
+  file: string,
+): RuntimeContext[] {
+  const node = appGraph.moduleGraph.nodes.find((candidate) => candidate.file === file);
+  return node?.effectiveContexts ?? [];
+}
+
+export function checkAiUsageInApp(appGraph: AppGraph): Diagnostic[] {
+  const diagnostics: Diagnostic[] = [];
+  const recorded = new Set<string>();
+
+  propagateContexts(appGraph.moduleGraph);
+
+  for (const symbol of appGraph.symbols) {
+    const contexts = contextsForFile(appGraph, symbol.file);
+    const sourceSlice =
+      typeof symbol.meta.sourceSlice === "string" ? symbol.meta.sourceSlice : "";
+
+    if (!detectCtxAiUsage(sourceSlice)) {
+      continue;
+    }
+
+    const forbidden = contexts.filter((ctx) => FORBIDDEN_AI_CONTEXTS.includes(ctx));
+    for (const ctx of forbidden) {
+      const key = `${symbol.file}:${ctx}:forbidden`;
+      if (recorded.has(key)) continue;
+      recorded.add(key);
+
+      diagnostics.push(
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_AI_FORBIDDEN_CONTEXT,
+          message: `ctx.ai is forbidden in '${ctx}' context`,
+          file: symbol.file,
+        }),
+      );
+    }
+
+    if (DYNAMIC_PROVIDER_PATTERN.test(sourceSlice)) {
+      const key = `${symbol.file}:dynamic`;
+      if (!recorded.has(key)) {
+        recorded.add(key);
+        diagnostics.push(
+          createDiagnostic({
+            severity: "warning",
+            code: FORGE_AI_DYNAMIC_PROVIDER,
+            message: "dynamic AI provider selection detected; prefer static provider literals",
+            file: symbol.file,
+          }),
+        );
+      }
+    }
+
+    for (const call of parseAiCallsFromSlice(sourceSlice)) {
+      if (!call.model) {
+        const key = `${symbol.file}:${call.method}:model`;
+        if (!recorded.has(key)) {
+          recorded.add(key);
+          diagnostics.push(
+            createDiagnostic({
+              severity: "warning",
+              code: FORGE_AI_MODEL_MISSING,
+              message: `ctx.ai.${call.method} missing explicit model`,
+              file: symbol.file,
+            }),
+          );
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}

package/src/forge/compiler/guards/check-import-guards.ts

@@ -0,0 +1,106 @@
+import { lookupMatrixEntry } from "../classifier/runtime-matrix.ts";
+import { forgeGuardViolation } from "../diagnostics/create.ts";
+import type { ModuleGraph } from "../types/app-graph.ts";
+import type { Diagnostic } from "../types/diagnostic.ts";
+import type { RuntimeContext } from "../types/runtime.ts";
+import type { RuntimeMatrix } from "../types/runtime-matrix.ts";
+import { comparePaths } from "../primitives/paths.ts";
+import { compareBytes } from "../primitives/compare.ts";
+import { propagateContexts } from "./propagate-contexts.ts";
+
+function compareDiagnostics(a: Diagnostic, b: Diagnostic): number {
+  let cmp = comparePaths(a.file ?? "", b.file ?? "");
+  if (cmp !== 0) {
+    return cmp;
+  }
+
+  cmp = (a.span?.start ?? 0) - (b.span?.start ?? 0);
+  if (cmp !== 0) {
+    return cmp;
+  }
+
+  const aPackage = extractPackageName(a.message);
+  const bPackage = extractPackageName(b.message);
+  cmp = compareBytes(aPackage, bPackage);
+  if (cmp !== 0) {
+    return cmp;
+  }
+
+  const aContext = extractContext(a.message);
+  const bContext = extractContext(b.message);
+  return compareBytes(aContext, bContext);
+}
+
+function extractPackageName(message: string): string {
+  const match = /^'([^']+)' is not allowed/.exec(message);
+  return match?.[1] ?? "";
+}
+
+function extractContext(message: string): string {
+  const match = /'([^']+)' context/.exec(message);
+  return match?.[1] ?? "";
+}
+
+/**
+ * Evaluate package imports against the runtime matrix after propagating effective contexts.
+ */
+export function checkImportGuards(
+  moduleGraph: ModuleGraph,
+  matrix: RuntimeMatrix,
+): Diagnostic[] {
+  propagateContexts(moduleGraph);
+
+  const diagnostics: Diagnostic[] = [];
+  const recorded = new Set<string>();
+
+  for (const node of moduleGraph.nodes) {
+    if (node.effectiveContexts.length === 0) {
+      continue;
+    }
+
+    for (const imp of node.directPackageImports) {
+      const entry = lookupMatrixEntry(matrix, imp.packageName);
+      if (entry == null) {
+        continue;
+      }
+
+      for (const context of node.effectiveContexts) {
+        if (!entry.compatible.includes(context)) {
+          const key = `${node.file}\0${imp.packageName}\0${context}\0${imp.span.start}`;
+          if (recorded.has(key)) {
+            continue;
+          }
+          recorded.add(key);
+
+          const rationale =
+            entry.rationale[context] ??
+            "package is incompatible with this runtime context";
+          diagnostics.push(
+            forgeGuardViolation(
+              imp.packageName,
+              context,
+              rationale,
+              node.file,
+              imp.span,
+            ),
+          );
+        }
+      }
+    }
+  }
+
+  diagnostics.sort(compareDiagnostics);
+  return diagnostics;
+}
+
+export function isContextViolating(
+  matrix: RuntimeMatrix,
+  packageName: string,
+  context: RuntimeContext,
+): boolean {
+  const entry = lookupMatrixEntry(matrix, packageName);
+  if (entry == null) {
+    return false;
+  }
+  return !entry.compatible.includes(context);
+}

package/src/forge/compiler/guards/check-process-env.ts

@@ -0,0 +1,98 @@
+import { join, relative } from "node:path";
+import { nodeFileSystem } from "../fs/index.ts";
+import { createDiagnostic } from "../diagnostics/create.ts";
+import { FORGE_SECRET_DIRECT_PROCESS_ENV } from "../diagnostics/codes.ts";
+import type { Diagnostic } from "../types/diagnostic.ts";
+import type { SecretRegistry } from "../types/secret-registry.ts";
+
+const PROCESS_ENV_PATTERN =
+  /process\.env\.([A-Z][A-Z0-9_]*)|process\.env\[["']([A-Z][A-Z0-9_]*)["']\]/g;
+
+const SKIP_DIRS = new Set([
+  "node_modules",
+  "_generated",
+  ".forge",
+  "dist",
+  "build",
+]);
+
+function shouldScanFile(relativePath: string): boolean {
+  const normalized = relativePath.replace(/\\/g, "/");
+  if (normalized.includes("/_generated/") || normalized.startsWith("_generated/")) {
+    return false;
+  }
+  if (normalized.includes("/src/forge/runtime/secrets/")) {
+    return false;
+  }
+  if (normalized.includes("/src/forge/runtime/telemetry/")) {
+    return false;
+  }
+  if (normalized.includes("/src/forge/runtime/ai/")) {
+    return false;
+  }
+  return normalized.endsWith(".ts") || normalized.endsWith(".tsx");
+}
+
+function collectSourceFiles(root: string, dir: string, files: string[]): void {
+  for (const entry of nodeFileSystem.readDir(dir)) {
+    const absolute = join(dir, entry.name);
+
+    if (entry.isDirectory) {
+      if (SKIP_DIRS.has(entry.name)) {
+        continue;
+      }
+      collectSourceFiles(root, absolute, files);
+      continue;
+    }
+
+    const rel = relative(root, absolute);
+    if (shouldScanFile(rel)) {
+      files.push(absolute);
+    }
+  }
+}
+
+export function checkDirectProcessEnvUsage(
+  workspaceRoot: string,
+  registry: SecretRegistry | null,
+  strictSecrets: boolean,
+): Diagnostic[] {
+  const secretNames = new Set(registry?.secrets.map((entry) => entry.name) ?? []);
+  const srcRoot = join(workspaceRoot, "src");
+  const files: string[] = [];
+  collectSourceFiles(workspaceRoot, srcRoot, files);
+
+  const diagnostics: Diagnostic[] = [];
+  const recorded = new Set<string>();
+
+  for (const file of files) {
+    const content = (nodeFileSystem.readText(file) ?? "");
+    let match: RegExpExecArray | null;
+    PROCESS_ENV_PATTERN.lastIndex = 0;
+
+    while ((match = PROCESS_ENV_PATTERN.exec(content)) !== null) {
+      const envName = match[1] ?? match[2];
+      if (!envName || !secretNames.has(envName)) {
+        continue;
+      }
+
+      const key = `${file}\0${envName}\0${match.index}`;
+      if (recorded.has(key)) {
+        continue;
+      }
+      recorded.add(key);
+
+      diagnostics.push(
+        createDiagnostic({
+          severity: strictSecrets ? "error" : "warning",
+          code: FORGE_SECRET_DIRECT_PROCESS_ENV,
+          message: `direct process.env access to secret '${envName}' — use ctx.secrets.get('${envName}') instead`,
+          file: relative(workspaceRoot, file).replace(/\\/g, "/"),
+          span: { start: match.index, end: match.index + match[0].length },
+        }),
+      );
+    }
+  }
+
+  return diagnostics.sort((a, b) => (a.file ?? "").localeCompare(b.file ?? ""));
+}

package/src/forge/compiler/guards/check-query-usage.ts

@@ -0,0 +1,76 @@
+import { createDiagnostic } from "../diagnostics/create.ts";
+import {
+  FORGE_QUERY_AI_FORBIDDEN,
+  FORGE_QUERY_EMIT_FORBIDDEN,
+  FORGE_QUERY_SECRET_FORBIDDEN,
+  FORGE_QUERY_WRITE_FORBIDDEN,
+} from "../diagnostics/codes.ts";
+import type { AppGraph } from "../types/app-graph.ts";
+import type { Diagnostic } from "../types/diagnostic.ts";
+
+const WRITE_PATTERN =
+  /ctx\.db(?:\.[\w$]+)?\.(insert|update|delete)\s*\(/;
+const EMIT_PATTERN = /ctx\.emit\s*\(/;
+const SECRETS_PATTERN = /ctx\.secrets\b/;
+const AI_PATTERN = /ctx\.ai\b/;
+
+export function checkQueryUsageInApp(appGraph: AppGraph): Diagnostic[] {
+  const diagnostics: Diagnostic[] = [];
+  const recorded = new Set<string>();
+
+  for (const symbol of appGraph.symbols) {
+    if (symbol.kind !== "query") {
+      continue;
+    }
+
+    const sourceSlice =
+      typeof symbol.meta.sourceSlice === "string" ? symbol.meta.sourceSlice : "";
+
+    const checks: Array<{ pattern: RegExp; code: Diagnostic["code"]; message: string }> = [
+      {
+        pattern: WRITE_PATTERN,
+        code: FORGE_QUERY_WRITE_FORBIDDEN,
+        message: "queries cannot perform write operations on ctx.db",
+      },
+      {
+        pattern: EMIT_PATTERN,
+        code: FORGE_QUERY_EMIT_FORBIDDEN,
+        message: "queries cannot call ctx.emit",
+      },
+      {
+        pattern: SECRETS_PATTERN,
+        code: FORGE_QUERY_SECRET_FORBIDDEN,
+        message: "queries cannot access ctx.secrets",
+      },
+      {
+        pattern: AI_PATTERN,
+        code: FORGE_QUERY_AI_FORBIDDEN,
+        message: "queries cannot access ctx.ai",
+      },
+    ];
+
+    for (const check of checks) {
+      if (!check.pattern.test(sourceSlice)) {
+        continue;
+      }
+
+      const key = `${symbol.file}:${check.code}`;
+      if (recorded.has(key)) {
+        continue;
+      }
+      recorded.add(key);
+
+      diagnostics.push(
+        createDiagnostic({
+          severity: "error",
+          code: check.code,
+          message: check.message,
+          file: symbol.file,
+          span: symbol.span,
+        }),
+      );
+    }
+  }
+
+  return diagnostics;
+}

package/src/forge/compiler/guards/index.ts

@@ -0,0 +1,11 @@
+export { propagateContexts } from "./propagate-contexts.ts";
+export {
+  checkImportGuards,
+  isContextViolating,
+} from "./check-import-guards.ts";
+export {
+  buildImportGuardsArtifact,
+  buildImportGuardsEmitFiles,
+  buildRuntimeMatrixEmitFiles,
+  buildGuardArtifactEmitFiles,
+} from "./artifacts.ts";

package/src/forge/compiler/guards/propagate-contexts.ts

@@ -0,0 +1,57 @@
+import type { ModuleGraph, ModuleNode } from "../types/app-graph.ts";
+import type { RuntimeContext } from "../types/runtime.ts";
+import { stableSortStrings } from "../primitives/sort.ts";
+
+function unionContexts(
+  existing: RuntimeContext[],
+  added: RuntimeContext[],
+): RuntimeContext[] {
+  const set = new Set<RuntimeContext>(existing);
+  for (const context of added) {
+    set.add(context);
+  }
+  return stableSortStrings([...set]) as RuntimeContext[];
+}
+
+/**
+ * Seed each module with its declared contexts, then propagate each Forge entrypoint's
+ * declared contexts over the local import graph (transitive closure via localImports).
+ */
+export function propagateContexts(moduleGraph: ModuleGraph): void {
+  const byId = new Map<string, ModuleNode>();
+  for (const node of moduleGraph.nodes) {
+    byId.set(node.id, node);
+    node.effectiveContexts = unionContexts([], node.declaredContexts);
+  }
+
+  for (const entry of moduleGraph.nodes) {
+    if (entry.declaredContexts.length === 0) {
+      continue;
+    }
+
+    const stack = [...entry.localImports.map((link) => link.toModuleId)];
+    const seen = new Set<string>();
+
+    while (stack.length > 0) {
+      const id = stack.pop()!;
+      if (seen.has(id)) {
+        continue;
+      }
+      seen.add(id);
+
+      const node = byId.get(id);
+      if (node == null) {
+        continue;
+      }
+
+      node.effectiveContexts = unionContexts(
+        node.effectiveContexts,
+        entry.declaredContexts,
+      );
+
+      for (const link of node.localImports) {
+        stack.push(link.toModuleId);
+      }
+    }
+  }
+}

package/src/forge/compiler/index.ts

@@ -0,0 +1,17 @@
+export * from "./types/index.ts";
+export * from "./diagnostics/index.ts";
+export * from "./primitives/index.ts";
+export * from "./app-graph/index.ts";
+export * from "./data-graph/index.ts";
+export * from "./action-subscriptions/index.ts";
+export * from "./runtime-graph/index.ts";
+export * from "./recipes/index.ts";
+export * from "./classifier/index.ts";
+export * from "./package-graph/index.ts";
+export * from "./cache/index.ts";
+export * from "./package-manager/index.ts";
+export * from "./sandbox/index.ts";
+export * from "./emitter/index.ts";
+export * from "./orchestrator/index.ts";
+export * from "./guards/index.ts";
+export * from "./integration/index.ts";