@aion0/forge 0.5.49 → 0.5.50

package/RELEASE_NOTES.md

@@ -1,13 +1,54 @@
-# Forge v0.5.49
+# Forge v0.5.50
 
-Released: 2026-04-27
+Released: 2026-04-28
 
-## Changes since v0.5.48
+## Changes since v0.5.49
+
+### Features
+- feat: API migration cockpit MVP for legacy → new parity testing
+
+### Refactoring
+- refactor: remove Migration Cockpit from Forge core (replaced by craft)
+
+### Documentation
+- feat: API migration cockpit MVP for legacy → new parity testing
 
 ### Other
-- perf(tasks): paginated log endpoint with per-entry truncation
-- perf(tasks): /api/tasks list ships only metadata, TaskDetail lazy-fetches body
-- fix(tasks): TaskDetail freezes browser on large session logs
+- ui(crafts): move hide/close buttons into the terminal panel toolbar
+- feat(crafts): multi-file support — recursive bundle + nested file links
+- fix(crafts): kill stale-registry display after publish + auto-bust on mutations
+- fix(crafts): widen manifest editor 640px → 900px
+- feat(crafts): in-Forge manifest editor (bump version etc. without leaving the UI)
+- feat(crafts): in-place update + reminder badge in dropdown
+- refactor(crafts): drop redundant outer + Craft button
+- feat(crafts): add Crafts category to global Marketplace panel
+- feat(crafts): one-click publish PR via gh CLI
+- fix(crafts): publish flow always uses PR, not direct push
+- feat(crafts): publish via GitHub auto-fork (no write access required)
+- feat(crafts): marketplace + project-type requires + publish flow
+- refactor(crafts): drop file-counter sample, collapse craft tabs into dropdown
+- fix(crafts): keep craft tabs (incl. terminal panel) mounted across tab switches
+- fix(crafts): list sessions scoped to the craft's cwd, not the project root
+- fix(crafts): resume sessionId actually applied — closure staleness
+- fix(crafts): always show picker on open + hide vs close split
+- fix(crafts): picker re-creates tmux session with chosen --resume
+- fix(crafts): keep craft tmux sessions alive across tab switches + restarts
+- feat(crafts): terminal closed by default + agent/session picker on first open
+- feat(crafts): integrated terminal at bottom of every craft tab
+- fix(crafts): agent picker reads agents[] from /api/agents response
+- fix(tasks): truncate long task prompt in detail view, click to expand
+- feat(crafts): name + agent picker + terminal session as default builder mode
+- fix(crafts): bundle SDK inline + cache-bust transpile output
+- fix(crafts): move system routes out of _ namespace + delete + better builder
+- feat(crafts): project-scoped mini-apps with AI builder
+- feat(migration): per-endpoint flag for known deviations
+- feat(migration): smart prompt + lenient nullable + per-violation ignore
+- feat(migration): editable diagnosis prompt before send
+- feat(migration): inline request/response inspector for debugging
+- feat(migration): default Fix actions to inject into bound terminal
+- feat(migration): rich diagnosis context + connectivity banner + fix-task hand-off
+- feat(migration): OpenAPI as primary source + shape diff mode
+- fix(migration): parser missed 159 per-controller docs and dropped stubbed endpoints
 
 
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.5.48...v0.5.49
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.5.49...v0.5.50

package/app/api/craft-system/build/route.ts

@@ -0,0 +1,78 @@
+import { NextResponse } from 'next/server';
+import { existsSync, readFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { createTask } from '@/lib/task-manager';
+import { getCraft } from '@/lib/crafts/loader';
+
+interface BuildRequest {
+  projectPath: string;
+  projectName?: string;
+  request: string;       // user's natural-language description
+  craftName?: string;    // for refine — existing craft to modify
+}
+
+function buildPrompt(req: BuildRequest, refining?: boolean, existing?: { manifest?: string; ui?: string; server?: string; promptHistory?: string }) {
+  const lines: string[] = [];
+  lines.push(refining
+    ? `# Refine Forge Craft \`${req.craftName}\``
+    : `# Build a new Forge Craft for project ${req.projectName || req.projectPath}`);
+  lines.push('');
+  lines.push('Use the **craft-builder** skill loaded in your environment. Follow its rules exactly.');
+  lines.push('');
+  lines.push('## User request');
+  lines.push('');
+  lines.push('```');
+  lines.push(req.request);
+  lines.push('```');
+  lines.push('');
+  if (refining && existing) {
+    lines.push('## Existing craft files');
+    lines.push('');
+    if (existing.manifest) { lines.push('### craft.yaml'); lines.push('```yaml'); lines.push(existing.manifest); lines.push('```'); lines.push(''); }
+    if (existing.ui) { lines.push('### ui.tsx'); lines.push('```tsx'); lines.push(existing.ui); lines.push('```'); lines.push(''); }
+    if (existing.server) { lines.push('### server.ts'); lines.push('```ts'); lines.push(existing.server); lines.push('```'); lines.push(''); }
+    if (existing.promptHistory) { lines.push('### prompt.md (history)'); lines.push('```markdown'); lines.push(existing.promptHistory); lines.push('```'); lines.push(''); }
+    lines.push('Apply the user request as a **minimal change** to the existing craft. Preserve everything that works. Append the refine request to `prompt.md`.');
+  } else {
+    lines.push(`Write the craft into \`${req.projectPath}/.forge/crafts/<chosen-name>/\`.`);
+    lines.push('Pick a kebab-case name based on what the user wants. After writing files, the new tab will show up automatically.');
+  }
+  lines.push('');
+  lines.push('Reference: see the "Minimum viable example" in the `craft-builder` skill for file shape + SDK use.');
+  return lines.join('\n');
+}
+
+export async function POST(req: Request) {
+  const body = await req.json() as BuildRequest;
+  const { projectPath, projectName, request, craftName } = body;
+  if (!projectPath || !request) return NextResponse.json({ error: 'projectPath + request required' }, { status: 400 });
+
+  let refining = false;
+  let existing: any = undefined;
+  if (craftName) {
+    const c = getCraft(projectPath, craftName);
+    if (c && c.__scope === 'project') {
+      refining = true;
+      const dir = c.__dir;
+      const read = (f: string) => existsSync(join(dir, f)) ? readFileSync(join(dir, f), 'utf8') : undefined;
+      existing = {
+        manifest: read('craft.yaml'),
+        ui: read('ui.tsx'),
+        server: read('server.ts'),
+        promptHistory: read('prompt.md'),
+      };
+    }
+  }
+
+  // Ensure project crafts dir exists so the AI has somewhere to write.
+  const craftsDir = join(projectPath, '.forge', 'crafts');
+  if (!existsSync(craftsDir)) mkdirSync(craftsDir, { recursive: true });
+
+  const prompt = buildPrompt(body, refining, existing);
+  const task = createTask({
+    projectName: projectName || projectPath.split('/').filter(Boolean).pop() || 'project',
+    projectPath,
+    prompt,
+  });
+  return NextResponse.json({ ok: true, taskId: task.id, refining });
+}

package/app/api/craft-system/delete/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server';
+import { rmSync, existsSync } from 'node:fs';
+import { join, normalize } from 'node:path';
+import { getCraft } from '@/lib/crafts/loader';
+
+// DELETE /api/craft-system/delete?projectPath=...&name=...
+// Deletes <project>/.forge/crafts/<name>/. Cannot delete builtin crafts.
+export async function DELETE(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  const name = u.searchParams.get('name');
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+
+  const c = getCraft(projectPath, name);
+  if (!c) return NextResponse.json({ error: 'craft not found' }, { status: 404 });
+  if (c.__scope === 'builtin') return NextResponse.json({ error: 'builtin crafts cannot be deleted (only project-local ones)' }, { status: 400 });
+
+  const target = join(projectPath, '.forge', 'crafts', name);
+  // Path-traversal guard
+  const normalized = normalize(target);
+  if (!normalized.startsWith(join(projectPath, '.forge', 'crafts'))) {
+    return NextResponse.json({ error: 'invalid path' }, { status: 400 });
+  }
+  if (!existsSync(normalized)) return NextResponse.json({ ok: true, alreadyMissing: true });
+
+  rmSync(normalized, { recursive: true, force: true });
+  return NextResponse.json({ ok: true });
+}

package/app/api/craft-system/helpers/file/route.ts

@@ -0,0 +1,20 @@
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join, normalize } from 'node:path';
+
+// GET /api/crafts/_helpers/file?projectPath=...&path=src/foo.ts
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  const path = u.searchParams.get('path');
+  if (!projectPath || !path) return new Response('missing args', { status: 400 });
+
+  const full = normalize(join(projectPath, path));
+  if (!full.startsWith(projectPath)) return new Response('invalid path', { status: 400 });
+  if (!existsSync(full)) return new Response('not found', { status: 404 });
+  if (statSync(full).isDirectory()) return new Response('is a directory', { status: 400 });
+
+  // Cap at 1MB to avoid blowing up the client
+  const buf = readFileSync(full);
+  if (buf.length > 1024 * 1024) return new Response(buf.subarray(0, 1024 * 1024).toString('utf8') + '\n…(truncated)', { headers: { 'Content-Type': 'text/plain' } });
+  return new Response(buf.toString('utf8'), { headers: { 'Content-Type': 'text/plain' } });
+}

package/app/api/craft-system/helpers/openapi/route.ts

@@ -0,0 +1,27 @@
+import { NextResponse } from 'next/server';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, normalize } from 'node:path';
+
+// GET /api/crafts/_helpers/openapi?projectPath=...&path=docs/openapi.json
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  const path = u.searchParams.get('path');
+  if (!projectPath || !path) return NextResponse.json({ error: 'projectPath + path required' }, { status: 400 });
+
+  // Path traversal guard
+  const full = normalize(join(projectPath, path));
+  if (!full.startsWith(projectPath)) return NextResponse.json({ error: 'invalid path' }, { status: 400 });
+  if (!existsSync(full)) return NextResponse.json({ spec: null, paths: [], schemas: {} });
+
+  try {
+    const spec = JSON.parse(readFileSync(full, 'utf8'));
+    return NextResponse.json({
+      spec,
+      paths: Object.keys(spec.paths || {}),
+      schemas: spec.components?.schemas || {},
+    });
+  } catch (e: any) {
+    return NextResponse.json({ error: e?.message || String(e) }, { status: 500 });
+  }
+}

package/app/api/craft-system/helpers/shell/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'node:child_process';
+
+// POST /api/crafts/_helpers/shell?projectPath=...   body: { cmd, timeout? }
+export async function POST(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  if (!projectPath) return NextResponse.json({ error: 'projectPath required' }, { status: 400 });
+  const { cmd, timeout } = await req.json() as { cmd: string; timeout?: number };
+  if (!cmd) return NextResponse.json({ error: 'cmd required' }, { status: 400 });
+  try {
+    const stdout = execSync(cmd, {
+      cwd: projectPath,
+      timeout: timeout ?? 30000,
+      encoding: 'utf8',
+      maxBuffer: 10 * 1024 * 1024,
+    }).toString();
+    return NextResponse.json({ stdout, stderr: '', code: 0 });
+  } catch (e: any) {
+    return NextResponse.json({
+      stdout: (e?.stdout || '').toString(),
+      stderr: (e?.stderr || e?.message || '').toString(),
+      code: e?.status ?? 1,
+    });
+  }
+}

package/app/api/craft-system/inject/route.ts

@@ -0,0 +1,41 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { writeFileSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+
+// POST /api/craft-system/inject  body: { projectPath, text, sessionName? }
+// Pastes text into a tmux session and presses Enter. Used by the SDK
+// useInject() hook so crafts can hand prompts to the project's bound terminal.
+
+function findBoundSession(projectPath: string): string | null {
+  try {
+    const sessions = execSync(`tmux list-sessions -F '#{session_name}'`, { encoding: 'utf8', timeout: 2000 })
+      .trim().split('\n').filter(Boolean).filter(n => /^mw[a-z0-9]*-/.test(n));
+    for (const s of sessions) {
+      try {
+        const cwd = execSync(`tmux display-message -p -t '${s}' '#{pane_current_path}'`, { encoding: 'utf8', timeout: 2000 }).trim();
+        if (cwd === projectPath || cwd.startsWith(projectPath + '/')) return s;
+      } catch {}
+    }
+  } catch {}
+  return null;
+}
+
+export async function POST(req: Request) {
+  const { projectPath, text, sessionName } = await req.json() as { projectPath: string; text: string; sessionName?: string };
+  if (!projectPath || !text) return NextResponse.json({ error: 'projectPath + text required' }, { status: 400 });
+
+  const target = sessionName || findBoundSession(projectPath);
+  if (!target) return NextResponse.json({ ok: false, error: 'no bound session' }, { status: 404 });
+
+  try {
+    const buf = join(tmpdir(), `forge-craft-inject-${Date.now()}.txt`);
+    writeFileSync(buf, text);
+    execSync(`tmux load-buffer -t "${target}" "${buf}" && tmux paste-buffer -t "${target}" && sleep 0.2 && tmux send-keys -t "${target}" Enter`, { timeout: 5000 });
+    try { unlinkSync(buf); } catch {}
+    return NextResponse.json({ ok: true, sessionName: target });
+  } catch (e: any) {
+    return NextResponse.json({ ok: false, error: e?.message || String(e) }, { status: 500 });
+  }
+}

package/app/api/craft-system/kill-session/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'node:child_process';
+
+// POST /api/craft-system/kill-session  body: { sessionName }
+// Used when the user re-picks an agent/session for a craft and wants the
+// existing tmux session torn down so CraftTerminal can recreate it with
+// the new --resume flag.
+export async function POST(req: Request) {
+  const { sessionName } = await req.json() as { sessionName?: string };
+  if (!sessionName) return NextResponse.json({ error: 'sessionName required' }, { status: 400 });
+  // Safety: only craft sessions can be killed via this route.
+  if (!sessionName.startsWith('mw-craft-')) {
+    return NextResponse.json({ error: 'refusing to kill non-craft session' }, { status: 400 });
+  }
+  try {
+    execSync(`tmux kill-session -t "${sessionName}" 2>/dev/null`, { timeout: 3000 });
+  } catch {}
+  return NextResponse.json({ ok: true });
+}

package/app/api/craft-system/manifest/route.ts

@@ -0,0 +1,71 @@
+import { NextResponse } from 'next/server';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import * as YAML from 'yaml';
+import { getCraft } from '@/lib/crafts/loader';
+
+// GET /api/craft-system/manifest?projectPath=...&name=...
+// Returns the raw craft.yaml + parsed object so the editor can show both.
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  const name = u.searchParams.get('name');
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+
+  const c = getCraft(projectPath, name);
+  if (!c || c.__scope !== 'project') return NextResponse.json({ error: 'craft not found in this project' }, { status: 404 });
+
+  const file = join(c.__dir, 'craft.yaml');
+  if (!existsSync(file)) return NextResponse.json({ error: 'craft.yaml missing' }, { status: 404 });
+
+  const raw = readFileSync(file, 'utf8');
+  let parsed: any = null;
+  try { parsed = YAML.parse(raw); } catch (e: any) {
+    return NextResponse.json({ raw, parsed: null, parseError: e?.message });
+  }
+  return NextResponse.json({ raw, parsed });
+}
+
+// PUT /api/craft-system/manifest   body: { projectPath, name, raw } OR { projectPath, name, patch: {...} }
+// `raw` overwrites the whole file. `patch` shallow-merges fields into the parsed manifest
+// then re-serializes (preserves any unknown keys in the existing yaml).
+export async function PUT(req: Request) {
+  const body = await req.json() as { projectPath: string; name: string; raw?: string; patch?: any };
+  const { projectPath, name, raw, patch } = body;
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+  if (!raw && !patch) return NextResponse.json({ error: 'raw or patch required' }, { status: 400 });
+
+  const c = getCraft(projectPath, name);
+  if (!c || c.__scope !== 'project') return NextResponse.json({ error: 'craft not found in this project' }, { status: 404 });
+
+  const file = join(c.__dir, 'craft.yaml');
+
+  let nextRaw: string;
+  if (raw) {
+    // Validate the raw YAML still parses + has a name field
+    try {
+      const m = YAML.parse(raw);
+      if (!m || typeof m !== 'object' || m.name !== name) {
+        return NextResponse.json({ error: 'craft.yaml must keep the same name field' }, { status: 400 });
+      }
+    } catch (e: any) {
+      return NextResponse.json({ error: `YAML parse error: ${e?.message}` }, { status: 400 });
+    }
+    nextRaw = raw;
+  } else {
+    // Patch mode — read current, merge, re-serialize
+    const current = existsSync(file) ? (YAML.parse(readFileSync(file, 'utf8')) || {}) : {};
+    if (patch.name && patch.name !== name) {
+      return NextResponse.json({ error: 'cannot rename a craft via patch (delete + recreate instead)' }, { status: 400 });
+    }
+    const merged = { ...current, ...patch, name };  // name pinned
+    // Drop empty arrays/strings that user explicitly cleared so yaml stays clean
+    for (const k of Object.keys(merged)) {
+      if (merged[k] === '' || (Array.isArray(merged[k]) && merged[k].length === 0)) delete merged[k];
+    }
+    nextRaw = YAML.stringify(merged);
+  }
+
+  writeFileSync(file, nextRaw, 'utf8');
+  return NextResponse.json({ ok: true, raw: nextRaw });
+}

package/app/api/craft-system/marketplace/install/route.ts

@@ -0,0 +1,11 @@
+import { NextResponse } from 'next/server';
+import { installCraft, invalidateRegistry } from '@/lib/crafts/registry';
+
+// POST /api/craft-system/marketplace/install   body: { projectPath, name }
+export async function POST(req: Request) {
+  const { projectPath, name } = await req.json() as { projectPath: string; name: string };
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+  invalidateRegistry();           // bust cache so the next listMarketplace sees fresh state
+  const r = await installCraft(name, projectPath);
+  return NextResponse.json(r, { status: r.ok ? 200 : 400 });
+}

package/app/api/craft-system/marketplace/route.ts

@@ -0,0 +1,18 @@
+import { NextResponse } from 'next/server';
+import { listMarketplace, fetchRegistry } from '@/lib/crafts/registry';
+
+// GET /api/craft-system/marketplace?projectPath=...
+// Returns the registry entries with per-project install + compatibility info.
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  const refresh = u.searchParams.get('refresh') === '1';
+  if (!projectPath) return NextResponse.json({ error: 'projectPath required' }, { status: 400 });
+  if (refresh) await fetchRegistry(true);
+  try {
+    const items = await listMarketplace(projectPath);
+    return NextResponse.json({ items });
+  } catch (e: any) {
+    return NextResponse.json({ error: e?.message || String(e), items: [] }, { status: 500 });
+  }
+}

package/app/api/craft-system/marketplace/uninstall/route.ts

@@ -0,0 +1,11 @@
+import { NextResponse } from 'next/server';
+import { uninstallCraft, invalidateRegistry } from '@/lib/crafts/registry';
+
+// POST /api/craft-system/marketplace/uninstall   body: { projectPath, name }
+export async function POST(req: Request) {
+  const { projectPath, name } = await req.json() as { projectPath: string; name: string };
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+  invalidateRegistry();
+  const r = uninstallCraft(name, projectPath);
+  return NextResponse.json(r, { status: r.ok ? 200 : 400 });
+}

package/app/api/craft-system/marketplace/update/route.ts

@@ -0,0 +1,10 @@
+import { NextResponse } from 'next/server';
+import { updateCraft } from '@/lib/crafts/registry';
+
+// POST /api/craft-system/marketplace/update   body: { projectPath, name }
+export async function POST(req: Request) {
+  const { projectPath, name } = await req.json() as { projectPath: string; name: string };
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+  const r = await updateCraft(name, projectPath);
+  return NextResponse.json(r, { status: r.ok ? 200 : 400 });
+}

package/app/api/craft-system/marketplace/updates/route.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import { listAvailableUpdates } from '@/lib/crafts/registry';
+
+// GET /api/craft-system/marketplace/updates?projectPath=...
+// Returns the (potentially empty) list of installed crafts with newer versions.
+// Cheap — used by the Crafts dropdown badge.
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  if (!projectPath) return NextResponse.json({ updates: [] });
+  try {
+    const updates = await listAvailableUpdates(projectPath);
+    return NextResponse.json({ updates });
+  } catch (e: any) {
+    return NextResponse.json({ updates: [], error: e?.message || String(e) });
+  }
+}

package/app/api/craft-system/publish/auto/route.ts

@@ -0,0 +1,173 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'node:child_process';
+import { existsSync, mkdtempSync, rmSync, writeFileSync, mkdirSync, readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { tmpdir } from 'node:os';
+import { bundleCraftForPublish } from '@/lib/crafts/registry';
+import { loadSettings } from '@/lib/settings';
+
+// One-click publish via the user's gh CLI: fork → clone → write files →
+// append registry entry → push → open PR. Falls back to the manual flow
+// (existing /api/craft-system/publish) when gh isn't available.
+
+interface AutoPublishRequest {
+  projectPath: string;
+  name: string;
+}
+
+function exec(cmd: string, cwd?: string, timeout = 60000): string {
+  return execSync(cmd, { cwd, timeout, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 10 * 1024 * 1024 });
+}
+
+export async function POST(req: Request) {
+  const { projectPath, name } = (await req.json()) as AutoPublishRequest;
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+
+  // ── Pre-flight ────────────────────────────────────
+  let me: string;
+  try {
+    exec('gh auth status', undefined, 5000);
+    me = exec('gh api user --jq .login', undefined, 5000).trim();
+  } catch (e: any) {
+    return NextResponse.json({
+      error: 'gh CLI is not authenticated. Run `gh auth login` in a terminal, then retry.',
+      gh: false,
+    }, { status: 400 });
+  }
+
+  const bundle = bundleCraftForPublish(projectPath, name);
+  if (bundle.error || !bundle.entry) {
+    return NextResponse.json({ error: bundle.error || 'failed to bundle craft' }, { status: 400 });
+  }
+
+  const repo = (loadSettings() as any).craftsRepoUrl || 'https://raw.githubusercontent.com/aiwatching/forge-crafts/main';
+  const repoMatch = repo.match(/github\.com\/([^/]+)\/([^/]+)|raw\.githubusercontent\.com\/([^/]+)\/([^/]+)/);
+  if (!repoMatch) return NextResponse.json({ error: `cannot parse craftsRepoUrl: ${repo}` }, { status: 400 });
+  const ownerRepo = `${repoMatch[1] || repoMatch[3]}/${(repoMatch[2] || repoMatch[4]).replace(/\.git$/, '')}`;
+
+  const branch = `craft/${name}-${bundle.entry.version}-${Date.now().toString(36).slice(-4)}`;
+  const prTitle = `Add ${bundle.entry.displayName || bundle.entry.name} v${bundle.entry.version}`;
+  const tmp = mkdtempSync(join(tmpdir(), 'forge-craft-pr-'));
+  const repoDir = join(tmp, 'forge-crafts');
+
+  const log: string[] = [];
+  const step = (msg: string) => { log.push(msg); };
+
+  try {
+    // ── 1. Fork (idempotent — succeeds whether or not fork exists) ────
+    step(`Forking ${ownerRepo}…`);
+    try {
+      exec(`gh repo fork ${ownerRepo} --clone=false --default-branch-only`, tmp, 30000);
+    } catch {
+      // Fork may already exist — gh exits non-zero in that case but still works
+    }
+
+    // ── 2. Clone the fork ────────────────────────────────────────
+    step(`Cloning your fork ${me}/${ownerRepo.split('/')[1]}…`);
+    exec(`gh repo clone ${me}/${ownerRepo.split('/')[1]} forge-crafts`, tmp, 60000);
+
+    // Add upstream, sync from upstream main to avoid stale fork
+    exec(`git remote add upstream https://github.com/${ownerRepo}.git`, repoDir, 5000);
+    try {
+      exec(`git fetch upstream main`, repoDir, 30000);
+      exec(`git checkout main`, repoDir, 5000);
+      exec(`git merge upstream/main --ff-only`, repoDir, 10000);
+      exec(`git push origin main`, repoDir, 30000);
+    } catch (e: any) {
+      // Empty upstream repo or already in sync — both fine
+      step(`(sync skipped: ${e?.message?.split('\n')[0] || ''})`);
+    }
+
+    // ── 3. New branch ────────────────────────────────────────────
+    step(`Creating branch ${branch}…`);
+    exec(`git checkout -b ${branch}`, repoDir, 5000);
+
+    // ── 4. Write craft files ────────────────────────────────────
+    const craftDir = join(repoDir, name);
+    mkdirSync(craftDir, { recursive: true });
+    for (const f of bundle.files) {
+      const dest = join(craftDir, f.path);
+      mkdirSync(dirname(dest), { recursive: true });
+      writeFileSync(dest, f.content, 'utf8');
+    }
+    step(`Wrote ${bundle.files.length} files into ${name}/`);
+
+    // ── 5. Update registry.json ─────────────────────────────────
+    const regPath = join(repoDir, 'registry.json');
+    let registry: { version: number; crafts: any[] };
+    if (existsSync(regPath)) {
+      try {
+        registry = JSON.parse(readFileSync(regPath, 'utf8'));
+        if (!Array.isArray(registry.crafts)) registry.crafts = [];
+      } catch {
+        registry = { version: 1, crafts: [] };
+      }
+    } else {
+      registry = { version: 1, crafts: [] };
+    }
+
+    // Replace existing entry with same name (republish/update path)
+    registry.crafts = registry.crafts.filter((c: any) => c?.name !== bundle.entry.name);
+    registry.crafts.push(bundle.entry);
+    registry.crafts.sort((a: any, b: any) => (a.name || '').localeCompare(b.name || ''));
+    writeFileSync(regPath, JSON.stringify(registry, null, 2) + '\n', 'utf8');
+    step(`Updated registry.json (${registry.crafts.length} crafts)`);
+
+    // ── 6. Commit + push ───────────────────────────────────────
+    exec(`git add .`, repoDir, 5000);
+    // Configure committer if not set globally — required for fresh containers
+    try { exec('git config user.email', repoDir, 2000); } catch {
+      exec(`git config user.email "${me}@users.noreply.github.com"`, repoDir, 2000);
+      exec(`git config user.name "${me}"`, repoDir, 2000);
+    }
+    exec(`git commit -m "${prTitle.replace(/"/g, '\\"')}"`, repoDir, 10000);
+    step(`Pushing branch…`);
+    exec(`git push -u origin ${branch}`, repoDir, 60000);
+
+    // ── 7. Open PR against upstream ────────────────────────────
+    step(`Opening PR…`);
+    const body = [
+      `Submitted via Forge's one-click craft publish.`,
+      ``,
+      `**Craft**: \`${bundle.entry.name}\` v${bundle.entry.version}`,
+      bundle.entry.description ? `**Description**: ${bundle.entry.description}` : '',
+      bundle.entry.tags?.length ? `**Tags**: ${bundle.entry.tags.join(', ')}` : '',
+      bundle.entry.author ? `**Author**: ${bundle.entry.author}` : '',
+      ``,
+      `Files:`,
+      ...bundle.files.map(f => `- \`${name}/${f.path}\``),
+      `- \`registry.json\` (entry added/updated)`,
+    ].filter(Boolean).join('\n');
+    const bodyFile = join(tmp, 'pr-body.md');
+    writeFileSync(bodyFile, body, 'utf8');
+    const prOut = exec(
+      `gh pr create --repo ${ownerRepo} --base main --head ${me}:${branch} --title "${prTitle.replace(/"/g, '\\"')}" --body-file "${bodyFile}"`,
+      repoDir, 30000
+    ).trim();
+
+    // gh prints the PR URL on the last line
+    const prUrl = prOut.split('\n').filter(l => l.startsWith('http')).pop() || prOut;
+
+    return NextResponse.json({ ok: true, prUrl, branch, log });
+  } catch (e: any) {
+    const stderr = (e?.stderr || '').toString();
+    return NextResponse.json({
+      error: e?.message?.split('\n')[0] || String(e),
+      stderr: stderr.slice(0, 2000),
+      log,
+    }, { status: 500 });
+  } finally {
+    try { rmSync(tmp, { recursive: true, force: true }); } catch {}
+  }
+}
+
+// GET — quick probe so the UI can decide whether to show the one-click button
+export async function GET() {
+  try {
+    exec('gh auth status', undefined, 5000);
+    const me = exec('gh api user --jq .login', undefined, 5000).trim();
+    return NextResponse.json({ available: true, user: me });
+  } catch {
+    return NextResponse.json({ available: false });
+  }
+}