/.well-known/mcp.json and llms.txt offer the harness plugins only when their source repository is readable without a token #8444

The card and llms.txt now offer the harness plugins only while trevato/forge exists on the forge and is public. I ran the tsc check, the gate script, and the card, standards and MCP-size tests (including test/mcp-size.test.ts). All passed, and the branch is pushed.

What changed

• src/core/mcp_card.ts: a new pluginsOffered(db) checks that trevato/forge exists and is public. mcpCard(origin, offered, now) now takes that answer as its second argument, and plugins is [] when the repository is private or missing.
• src/web/standards.ts: when the source is not public, llms.txt prints "Harness plugins: not offered on this forge (their source is private)". When it is public, each plugin line is as before, minus the "needs that repository to be public" clause.
• Cache: the llms.txt cache now also checks whether the source is public, so the cached body and ETag are rebuilt when the repository changes visibility.

Tests

• Private source: a new test in test/mcp-card-plugins.test.ts checks that the card has plugins: [] and llms.txt has the "not offered" line.
• Public source: the existing test now makes the repository public first and still checks both install lines.
• Visibility change: a new test flips the repository public then private and checks that llms.txt and the card follow.
• Standards test: test/standards.test.ts now expects the "not offered" line, because that fixture has no trevato/forge.
• Card test: test/mcp-card.test.ts passes the new argument.

Not done: I didn't make the plugin repository name configurable. trevato/forge stays hard-coded as before.

Closes #8431

The card and llms.txt now offer the harness plugins only while trevato/forge exists on the forge and is public. I ran the tsc check, the gate script, and the card, standards and MCP-size tests (including test/mcp-size.test.ts). All passed, and the branch is pushed.

What changed

• src/core/mcp_card.ts: a new pluginsOffered(db) checks that trevato/forge exists and is public. mcpCard(origin, offered, now) now takes that answer as its second argument, and plugins is [] when the repository is private or missing.
• src/web/standards.ts: when the source is not public, llms.txt prints "Harness plugins: not offered on this forge (their source is private)". When it is public, each plugin line is as before, minus the "needs that repository to be public" clause.
• Cache: the llms.txt cache now also checks whether the source is public, so the cached body and ETag are rebuilt when the repository changes visibility.

Tests

• Private source: a new test in test/mcp-card-plugins.test.ts checks that the card has plugins: [] and llms.txt has the "not offered" line.
• Public source: the existing test now makes the repository public first and still checks both install lines.
• Visibility change: a new test flips the repository public then private and checks that llms.txt and the card follow.
• Standards test: test/standards.test.ts now expects the "not offered" line, because that fixture has no trevato/forge.
• Card test: test/mcp-card.test.ts passes the new argument.

Not done: I didn't make the plugin repository name configurable. trevato/forge stays hard-coded as before.

Left #8431 open: 3 unticked items remain (plugins in the MCP card (src/core/mcp_card.ts) and the plugin lines in llms.txt (src/web/standards.ts) are present only when the plugin source repository exists and is public on this forge; otherwise plugins is [] and llms.txt says "Harness plugins: not offered on this forge (their source is private)".; The "needs that repository to be public" clause goes, since what is printed now always works.; Tests: a forge whose source repository is private serves no plugins in either; a public one serves both with today's commands.).