/.well-known/mcp.json and llms.txt offer the harness plugins only when their source repository is readable without a token #8450

The branch was already pushed with this change last run, and nothing new has been added to the issue since. The card and llms.txt now offer the harness plugins only while trevato/forge exists on the forge and is public. I didn't run anything again this turn.

What changed

• MCP card (src/core/mcp_card.ts): a new pluginsOffered(db) checks that trevato/forge exists and is public. mcpCard(origin, offered, now) takes that answer as its second argument, and plugins is [] when the repository is private or missing.
• llms.txt (src/web/standards.ts): when the source is not public, it prints "Harness plugins: not offered on this forge (their source is private)". When it is public, each plugin line is as before, minus the "needs that repository to be public" clause.
• Cache: the cached body and ETag are now also invalidated when the plugin source goes public or private.

Tests

• Private source: a new test in test/mcp-card-plugins.test.ts checks that the card has plugins: [] and llms.txt has the "not offered" line.
• Public source: the existing test now makes the repository public first and still checks both install lines.
• Visibility change: a new test flips the repository public then private and checks that llms.txt and the card follow.
• Other tests: test/standards.test.ts now expects the "not offered" line, because that fixture has no trevato/forge. test/mcp-card.test.ts passes the new argument.

Checks: tsc, the gate script, and the card, standards and test/mcp-size.test.ts tests all passed before the push.

Not done: I didn't make the plugin repository name configurable. trevato/forge stays hard-coded as before.

Try it: curl $URL/.well-known/mcp.json and curl $URL/llms.txt on a forge where trevato/forge is private. Make it public and both show the two install commands.

Closes #8431

The branch was already pushed with this change last run, and nothing new has been added to the issue since. The card and llms.txt now offer the harness plugins only while trevato/forge exists on the forge and is public. I didn't run anything again this turn.

What changed

• MCP card (src/core/mcp_card.ts): a new pluginsOffered(db) checks that trevato/forge exists and is public. mcpCard(origin, offered, now) takes that answer as its second argument, and plugins is [] when the repository is private or missing.
• llms.txt (src/web/standards.ts): when the source is not public, it prints "Harness plugins: not offered on this forge (their source is private)". When it is public, each plugin line is as before, minus the "needs that repository to be public" clause.
• Cache: the cached body and ETag are now also invalidated when the plugin source goes public or private.

Tests

• Private source: a new test in test/mcp-card-plugins.test.ts checks that the card has plugins: [] and llms.txt has the "not offered" line.
• Public source: the existing test now makes the repository public first and still checks both install lines.
• Visibility change: a new test flips the repository public then private and checks that llms.txt and the card follow.
• Other tests: test/standards.test.ts now expects the "not offered" line, because that fixture has no trevato/forge. test/mcp-card.test.ts passes the new argument.

Checks: tsc, the gate script, and the card, standards and test/mcp-size.test.ts tests all passed before the push.

Not done: I didn't make the plugin repository name configurable. trevato/forge stays hard-coded as before.

Try it: curl $URL/.well-known/mcp.json and curl $URL/llms.txt on a forge where trevato/forge is private. Make it public and both show the two install commands.

Left #8431 open: 3 unticked items remain (plugins in the MCP card (src/core/mcp_card.ts) and the plugin lines in llms.txt (src/web/standards.ts) are present only when the plugin source repository exists and is public on this forge; otherwise plugins is [] and llms.txt says "Harness plugins: not offered on this forge (their source is private)".; The "needs that repository to be public" clause goes, since what is printed now always works.; Tests: a forge whose source repository is private serves no plugins in either; a public one serves both with today's commands.).