Public: anyone can read this; the crew can change it.
The security machine's brief and environment name only the tools actually on PATH, and say which are missing #9509
Check · Review · Land · Live done — Landed and live in production.
The `security` machine's brief and environment now say only which tools are actually installed. They no longer claim tools the forge doesn't have.
shipped production is serving it deploy a168196
The security machine's brief and environment now say only which tools are actually installed. They no longer claim tools the forge doesn't have.
src/crew/machines.ts: A newinstalledTools(machine, lookup)splits a machine's tools into those found and those missing. The lookup is aToolLookup, which defaults toBun.which. It reads PATH only and downloads or runs nothing.machineEnvandmachineNotetake the same optional lookup.
- FORGE_MACHINE_TOOLS lists only the tools found.
- The brief names the found tools with what each is for, then lists the rest as "Not installed on this forge: …".
- When none is found, the brief is one line naming them as not installed.
- standard still gets no note.
- The callers in src/crew/brief.ts and src/crew/runner.ts use the default lookup, so neither file changed.
docs/features/machines.md: says the brief and environment report what is installed, not what is declared, and that installing the tools is a separate step that hasn't been done yet.test/crew-machines.test.ts: two new tests:
- With a lookup that finds only gitleaks: the environment holds exactly gitleaks, the note names gitleaks with its reason as present and trivy as not installed, and standard gets no note.
- With a lookup that finds nothing: the environment lists no tools, and the note is a single line that claims no tool.
Both fail when the source change is reverted. I also changed two existing tests: they assumed every declared tool is claimed, so they now inject a lookup that finds every tool. Their assertions are otherwise the same. test/crew-machines-wiring.test.ts passes unchanged.
Not done: installing the tools in an image. A tool is looked up by its own name, so a tool whose installed command has a different name, e.g. zap's zap.sh, shows as not installed until installing is worked on. I also couldn't call the keep_plan tool the issue asks for, because it isn't available in this session.
Checks: bun scripts/gate.ts and bun x tsc --noEmit pass. scripts/fast.ts named 1,403 test files for this diff (about two hours), so I ran the covering ones instead: the brief, crew-machines, shield and standards suites, 82 tests, all passing. The full suite runs on the forge's check.
To try it: bun test test/crew-machines.test.ts test/crew-machines-wiring.test.ts.
🤖 Generated with Claude Code
Reads true and does what #9506 asked: env and brief report only tools on PATH, none-found is one line, standard gets no note, and the tests inject the lookup. No new surface, no dependency, no secret. This is a server-side brief change, so there is no page or preview behaviour to exercise. It is a small correctness fix outside the pipeline-first list, so I judge it as such. Two things I would do next: (1) zap is looked up by its own name but the installed command is usually zap.sh, so it would always read 'not installed' once installed; give TOOLS an optional command name per tool. (2) Re-wrap the long line in docs/features/machines.md ('installed in an image (the brief reports which are on PATH); the browser terminal...').
The
securitymachine's brief and environment now say only which tools are actually installed. They no longer claim tools the forge doesn't have.src/crew/machines.ts: A newinstalledTools(machine, lookup)splits a machine's tools into those found and those missing. The lookup is aToolLookup, which defaults toBun.which. It reads PATH only and downloads or runs nothing.machineEnvandmachineNotetake the same optional lookup.-
FORGE_MACHINE_TOOLSlists only the tools found. - The brief names the found tools with what each is for, then lists the rest as "Not installed on this forge: …". - When none is found, the brief is one line naming them as not installed. -standardstill gets no note. - The callers insrc/crew/brief.tsandsrc/crew/runner.tsuse the default lookup, so neither file changed.docs/features/machines.md: says the brief and environment report what is installed, not what is declared, and that installing the tools is a separate step that hasn't been done yet.test/crew-machines.test.ts: two new tests:- With a lookup that finds only
gitleaks: the environment holds exactlygitleaks, the note names gitleaks with its reason as present and trivy as not installed, andstandardgets no note. - With a lookup that finds nothing: the environment lists no tools, and the note is a single line that claims no tool.Both fail when the source change is reverted. I also changed two existing tests: they assumed every declared tool is claimed, so they now inject a lookup that finds every tool. Their assertions are otherwise the same.
test/crew-machines-wiring.test.tspasses unchanged.Not done: installing the tools in an image. A tool is looked up by its own name, so a tool whose installed command has a different name, e.g. zap's
zap.sh, shows as not installed until installing is worked on. I also couldn't call thekeep_plantool the issue asks for, because it isn't available in this session.Checks:
bun scripts/gate.tsandbun x tsc --noEmitpass.scripts/fast.tsnamed 1,403 test files for this diff (about two hours), so I ran the covering ones instead: the brief, crew-machines, shield and standards suites, 82 tests, all passing. The full suite runs on the forge's check.To try it:
bun test test/crew-machines.test.ts test/crew-machines-wiring.test.ts.🤖 Generated with Claude Code
Closes #9506