@aion0/forge 0.5.49 → 0.6.0

package/RELEASE_NOTES.md

@@ -1,13 +1,8 @@
-# Forge v0.5.49
+# Forge v0.6.0
 
-Released: 2026-04-27
+Released: 2026-04-28
 
-## Changes since v0.5.48
+## Changes since v0.5.50
 
-### Other
-- perf(tasks): paginated log endpoint with per-entry truncation
-- perf(tasks): /api/tasks list ships only metadata, TaskDetail lazy-fetches body
-- fix(tasks): TaskDetail freezes browser on large session logs
 
-
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.5.48...v0.5.49
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.5.50...v0.6.0

package/app/api/craft-system/build/route.ts

@@ -0,0 +1,78 @@
+import { NextResponse } from 'next/server';
+import { existsSync, readFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { createTask } from '@/lib/task-manager';
+import { getCraft } from '@/lib/crafts/loader';
+
+interface BuildRequest {
+  projectPath: string;
+  projectName?: string;
+  request: string;       // user's natural-language description
+  craftName?: string;    // for refine — existing craft to modify
+}
+
+function buildPrompt(req: BuildRequest, refining?: boolean, existing?: { manifest?: string; ui?: string; server?: string; promptHistory?: string }) {
+  const lines: string[] = [];
+  lines.push(refining
+    ? `# Refine Forge Craft \`${req.craftName}\``
+    : `# Build a new Forge Craft for project ${req.projectName || req.projectPath}`);
+  lines.push('');
+  lines.push('Use the **craft-builder** skill loaded in your environment. Follow its rules exactly.');
+  lines.push('');
+  lines.push('## User request');
+  lines.push('');
+  lines.push('```');
+  lines.push(req.request);
+  lines.push('```');
+  lines.push('');
+  if (refining && existing) {
+    lines.push('## Existing craft files');
+    lines.push('');
+    if (existing.manifest) { lines.push('### craft.yaml'); lines.push('```yaml'); lines.push(existing.manifest); lines.push('```'); lines.push(''); }
+    if (existing.ui) { lines.push('### ui.tsx'); lines.push('```tsx'); lines.push(existing.ui); lines.push('```'); lines.push(''); }
+    if (existing.server) { lines.push('### server.ts'); lines.push('```ts'); lines.push(existing.server); lines.push('```'); lines.push(''); }
+    if (existing.promptHistory) { lines.push('### prompt.md (history)'); lines.push('```markdown'); lines.push(existing.promptHistory); lines.push('```'); lines.push(''); }
+    lines.push('Apply the user request as a **minimal change** to the existing craft. Preserve everything that works. Append the refine request to `prompt.md`.');
+  } else {
+    lines.push(`Write the craft into \`${req.projectPath}/.forge/crafts/<chosen-name>/\`.`);
+    lines.push('Pick a kebab-case name based on what the user wants. After writing files, the new tab will show up automatically.');
+  }
+  lines.push('');
+  lines.push('Reference: see the "Minimum viable example" in the `craft-builder` skill for file shape + SDK use.');
+  return lines.join('\n');
+}
+
+export async function POST(req: Request) {
+  const body = await req.json() as BuildRequest;
+  const { projectPath, projectName, request, craftName } = body;
+  if (!projectPath || !request) return NextResponse.json({ error: 'projectPath + request required' }, { status: 400 });
+
+  let refining = false;
+  let existing: any = undefined;
+  if (craftName) {
+    const c = getCraft(projectPath, craftName);
+    if (c && c.__scope === 'project') {
+      refining = true;
+      const dir = c.__dir;
+      const read = (f: string) => existsSync(join(dir, f)) ? readFileSync(join(dir, f), 'utf8') : undefined;
+      existing = {
+        manifest: read('craft.yaml'),
+        ui: read('ui.tsx'),
+        server: read('server.ts'),
+        promptHistory: read('prompt.md'),
+      };
+    }
+  }
+
+  // Ensure project crafts dir exists so the AI has somewhere to write.
+  const craftsDir = join(projectPath, '.forge', 'crafts');
+  if (!existsSync(craftsDir)) mkdirSync(craftsDir, { recursive: true });
+
+  const prompt = buildPrompt(body, refining, existing);
+  const task = createTask({
+    projectName: projectName || projectPath.split('/').filter(Boolean).pop() || 'project',
+    projectPath,
+    prompt,
+  });
+  return NextResponse.json({ ok: true, taskId: task.id, refining });
+}

package/app/api/craft-system/delete/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server';
+import { rmSync, existsSync } from 'node:fs';
+import { join, normalize } from 'node:path';
+import { getCraft } from '@/lib/crafts/loader';
+
+// DELETE /api/craft-system/delete?projectPath=...&name=...
+// Deletes <project>/.forge/crafts/<name>/. Cannot delete builtin crafts.
+export async function DELETE(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  const name = u.searchParams.get('name');
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+
+  const c = getCraft(projectPath, name);
+  if (!c) return NextResponse.json({ error: 'craft not found' }, { status: 404 });
+  if (c.__scope === 'builtin') return NextResponse.json({ error: 'builtin crafts cannot be deleted (only project-local ones)' }, { status: 400 });
+
+  const target = join(projectPath, '.forge', 'crafts', name);
+  // Path-traversal guard
+  const normalized = normalize(target);
+  if (!normalized.startsWith(join(projectPath, '.forge', 'crafts'))) {
+    return NextResponse.json({ error: 'invalid path' }, { status: 400 });
+  }
+  if (!existsSync(normalized)) return NextResponse.json({ ok: true, alreadyMissing: true });
+
+  rmSync(normalized, { recursive: true, force: true });
+  return NextResponse.json({ ok: true });
+}

package/app/api/craft-system/helpers/file/route.ts

@@ -0,0 +1,20 @@
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join, normalize } from 'node:path';
+
+// GET /api/crafts/_helpers/file?projectPath=...&path=src/foo.ts
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  const path = u.searchParams.get('path');
+  if (!projectPath || !path) return new Response('missing args', { status: 400 });
+
+  const full = normalize(join(projectPath, path));
+  if (!full.startsWith(projectPath)) return new Response('invalid path', { status: 400 });
+  if (!existsSync(full)) return new Response('not found', { status: 404 });
+  if (statSync(full).isDirectory()) return new Response('is a directory', { status: 400 });
+
+  // Cap at 1MB to avoid blowing up the client
+  const buf = readFileSync(full);
+  if (buf.length > 1024 * 1024) return new Response(buf.subarray(0, 1024 * 1024).toString('utf8') + '\n…(truncated)', { headers: { 'Content-Type': 'text/plain' } });
+  return new Response(buf.toString('utf8'), { headers: { 'Content-Type': 'text/plain' } });
+}

package/app/api/craft-system/helpers/openapi/route.ts

@@ -0,0 +1,27 @@
+import { NextResponse } from 'next/server';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, normalize } from 'node:path';
+
+// GET /api/crafts/_helpers/openapi?projectPath=...&path=docs/openapi.json
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  const path = u.searchParams.get('path');
+  if (!projectPath || !path) return NextResponse.json({ error: 'projectPath + path required' }, { status: 400 });
+
+  // Path traversal guard
+  const full = normalize(join(projectPath, path));
+  if (!full.startsWith(projectPath)) return NextResponse.json({ error: 'invalid path' }, { status: 400 });
+  if (!existsSync(full)) return NextResponse.json({ spec: null, paths: [], schemas: {} });
+
+  try {
+    const spec = JSON.parse(readFileSync(full, 'utf8'));
+    return NextResponse.json({
+      spec,
+      paths: Object.keys(spec.paths || {}),
+      schemas: spec.components?.schemas || {},
+    });
+  } catch (e: any) {
+    return NextResponse.json({ error: e?.message || String(e) }, { status: 500 });
+  }
+}

package/app/api/craft-system/helpers/shell/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'node:child_process';
+
+// POST /api/crafts/_helpers/shell?projectPath=...   body: { cmd, timeout? }
+export async function POST(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  if (!projectPath) return NextResponse.json({ error: 'projectPath required' }, { status: 400 });
+  const { cmd, timeout } = await req.json() as { cmd: string; timeout?: number };
+  if (!cmd) return NextResponse.json({ error: 'cmd required' }, { status: 400 });
+  try {
+    const stdout = execSync(cmd, {
+      cwd: projectPath,
+      timeout: timeout ?? 30000,
+      encoding: 'utf8',
+      maxBuffer: 10 * 1024 * 1024,
+    }).toString();
+    return NextResponse.json({ stdout, stderr: '', code: 0 });
+  } catch (e: any) {
+    return NextResponse.json({
+      stdout: (e?.stdout || '').toString(),
+      stderr: (e?.stderr || e?.message || '').toString(),
+      code: e?.status ?? 1,
+    });
+  }
+}

package/app/api/craft-system/inject/route.ts

@@ -0,0 +1,41 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { writeFileSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+
+// POST /api/craft-system/inject  body: { projectPath, text, sessionName? }
+// Pastes text into a tmux session and presses Enter. Used by the SDK
+// useInject() hook so crafts can hand prompts to the project's bound terminal.
+
+function findBoundSession(projectPath: string): string | null {
+  try {
+    const sessions = execSync(`tmux list-sessions -F '#{session_name}'`, { encoding: 'utf8', timeout: 2000 })
+      .trim().split('\n').filter(Boolean).filter(n => /^mw[a-z0-9]*-/.test(n));
+    for (const s of sessions) {
+      try {
+        const cwd = execSync(`tmux display-message -p -t '${s}' '#{pane_current_path}'`, { encoding: 'utf8', timeout: 2000 }).trim();
+        if (cwd === projectPath || cwd.startsWith(projectPath + '/')) return s;
+      } catch {}
+    }
+  } catch {}
+  return null;
+}
+
+export async function POST(req: Request) {
+  const { projectPath, text, sessionName } = await req.json() as { projectPath: string; text: string; sessionName?: string };
+  if (!projectPath || !text) return NextResponse.json({ error: 'projectPath + text required' }, { status: 400 });
+
+  const target = sessionName || findBoundSession(projectPath);
+  if (!target) return NextResponse.json({ ok: false, error: 'no bound session' }, { status: 404 });
+
+  try {
+    const buf = join(tmpdir(), `forge-craft-inject-${Date.now()}.txt`);
+    writeFileSync(buf, text);
+    execSync(`tmux load-buffer -t "${target}" "${buf}" && tmux paste-buffer -t "${target}" && sleep 0.2 && tmux send-keys -t "${target}" Enter`, { timeout: 5000 });
+    try { unlinkSync(buf); } catch {}
+    return NextResponse.json({ ok: true, sessionName: target });
+  } catch (e: any) {
+    return NextResponse.json({ ok: false, error: e?.message || String(e) }, { status: 500 });
+  }
+}

package/app/api/craft-system/kill-session/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'node:child_process';
+
+// POST /api/craft-system/kill-session  body: { sessionName }
+// Used when the user re-picks an agent/session for a craft and wants the
+// existing tmux session torn down so CraftTerminal can recreate it with
+// the new --resume flag.
+export async function POST(req: Request) {
+  const { sessionName } = await req.json() as { sessionName?: string };
+  if (!sessionName) return NextResponse.json({ error: 'sessionName required' }, { status: 400 });
+  // Safety: only craft sessions can be killed via this route.
+  if (!sessionName.startsWith('mw-craft-')) {
+    return NextResponse.json({ error: 'refusing to kill non-craft session' }, { status: 400 });
+  }
+  try {
+    execSync(`tmux kill-session -t "${sessionName}" 2>/dev/null`, { timeout: 3000 });
+  } catch {}
+  return NextResponse.json({ ok: true });
+}

package/app/api/craft-system/manifest/route.ts

@@ -0,0 +1,71 @@
+import { NextResponse } from 'next/server';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import * as YAML from 'yaml';
+import { getCraft } from '@/lib/crafts/loader';
+
+// GET /api/craft-system/manifest?projectPath=...&name=...
+// Returns the raw craft.yaml + parsed object so the editor can show both.
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  const name = u.searchParams.get('name');
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+
+  const c = getCraft(projectPath, name);
+  if (!c || c.__scope !== 'project') return NextResponse.json({ error: 'craft not found in this project' }, { status: 404 });
+
+  const file = join(c.__dir, 'craft.yaml');
+  if (!existsSync(file)) return NextResponse.json({ error: 'craft.yaml missing' }, { status: 404 });
+
+  const raw = readFileSync(file, 'utf8');
+  let parsed: any = null;
+  try { parsed = YAML.parse(raw); } catch (e: any) {
+    return NextResponse.json({ raw, parsed: null, parseError: e?.message });
+  }
+  return NextResponse.json({ raw, parsed });
+}
+
+// PUT /api/craft-system/manifest   body: { projectPath, name, raw } OR { projectPath, name, patch: {...} }
+// `raw` overwrites the whole file. `patch` shallow-merges fields into the parsed manifest
+// then re-serializes (preserves any unknown keys in the existing yaml).
+export async function PUT(req: Request) {
+  const body = await req.json() as { projectPath: string; name: string; raw?: string; patch?: any };
+  const { projectPath, name, raw, patch } = body;
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+  if (!raw && !patch) return NextResponse.json({ error: 'raw or patch required' }, { status: 400 });
+
+  const c = getCraft(projectPath, name);
+  if (!c || c.__scope !== 'project') return NextResponse.json({ error: 'craft not found in this project' }, { status: 404 });
+
+  const file = join(c.__dir, 'craft.yaml');
+
+  let nextRaw: string;
+  if (raw) {
+    // Validate the raw YAML still parses + has a name field
+    try {
+      const m = YAML.parse(raw);
+      if (!m || typeof m !== 'object' || m.name !== name) {
+        return NextResponse.json({ error: 'craft.yaml must keep the same name field' }, { status: 400 });
+      }
+    } catch (e: any) {
+      return NextResponse.json({ error: `YAML parse error: ${e?.message}` }, { status: 400 });
+    }
+    nextRaw = raw;
+  } else {
+    // Patch mode — read current, merge, re-serialize
+    const current = existsSync(file) ? (YAML.parse(readFileSync(file, 'utf8')) || {}) : {};
+    if (patch.name && patch.name !== name) {
+      return NextResponse.json({ error: 'cannot rename a craft via patch (delete + recreate instead)' }, { status: 400 });
+    }
+    const merged = { ...current, ...patch, name };  // name pinned
+    // Drop empty arrays/strings that user explicitly cleared so yaml stays clean
+    for (const k of Object.keys(merged)) {
+      if (merged[k] === '' || (Array.isArray(merged[k]) && merged[k].length === 0)) delete merged[k];
+    }
+    nextRaw = YAML.stringify(merged);
+  }
+
+  writeFileSync(file, nextRaw, 'utf8');
+  return NextResponse.json({ ok: true, raw: nextRaw });
+}

package/app/api/craft-system/marketplace/install/route.ts

@@ -0,0 +1,11 @@
+import { NextResponse } from 'next/server';
+import { installCraft, invalidateRegistry } from '@/lib/crafts/registry';
+
+// POST /api/craft-system/marketplace/install   body: { projectPath, name }
+export async function POST(req: Request) {
+  const { projectPath, name } = await req.json() as { projectPath: string; name: string };
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+  invalidateRegistry();           // bust cache so the next listMarketplace sees fresh state
+  const r = await installCraft(name, projectPath);
+  return NextResponse.json(r, { status: r.ok ? 200 : 400 });
+}

package/app/api/craft-system/marketplace/route.ts

@@ -0,0 +1,18 @@
+import { NextResponse } from 'next/server';
+import { listMarketplace, fetchRegistry } from '@/lib/crafts/registry';
+
+// GET /api/craft-system/marketplace?projectPath=...
+// Returns the registry entries with per-project install + compatibility info.
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  const refresh = u.searchParams.get('refresh') === '1';
+  if (!projectPath) return NextResponse.json({ error: 'projectPath required' }, { status: 400 });
+  if (refresh) await fetchRegistry(true);
+  try {
+    const items = await listMarketplace(projectPath);
+    return NextResponse.json({ items });
+  } catch (e: any) {
+    return NextResponse.json({ error: e?.message || String(e), items: [] }, { status: 500 });
+  }
+}

package/app/api/craft-system/marketplace/uninstall/route.ts

@@ -0,0 +1,11 @@
+import { NextResponse } from 'next/server';
+import { uninstallCraft, invalidateRegistry } from '@/lib/crafts/registry';
+
+// POST /api/craft-system/marketplace/uninstall   body: { projectPath, name }
+export async function POST(req: Request) {
+  const { projectPath, name } = await req.json() as { projectPath: string; name: string };
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+  invalidateRegistry();
+  const r = uninstallCraft(name, projectPath);
+  return NextResponse.json(r, { status: r.ok ? 200 : 400 });
+}

package/app/api/craft-system/marketplace/update/route.ts

@@ -0,0 +1,10 @@
+import { NextResponse } from 'next/server';
+import { updateCraft } from '@/lib/crafts/registry';
+
+// POST /api/craft-system/marketplace/update   body: { projectPath, name }
+export async function POST(req: Request) {
+  const { projectPath, name } = await req.json() as { projectPath: string; name: string };
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+  const r = await updateCraft(name, projectPath);
+  return NextResponse.json(r, { status: r.ok ? 200 : 400 });
+}

package/app/api/craft-system/marketplace/updates/route.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import { listAvailableUpdates } from '@/lib/crafts/registry';
+
+// GET /api/craft-system/marketplace/updates?projectPath=...
+// Returns the (potentially empty) list of installed crafts with newer versions.
+// Cheap — used by the Crafts dropdown badge.
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const projectPath = u.searchParams.get('projectPath');
+  if (!projectPath) return NextResponse.json({ updates: [] });
+  try {
+    const updates = await listAvailableUpdates(projectPath);
+    return NextResponse.json({ updates });
+  } catch (e: any) {
+    return NextResponse.json({ updates: [], error: e?.message || String(e) });
+  }
+}

package/app/api/craft-system/publish/auto/route.ts

@@ -0,0 +1,173 @@
+import { NextResponse } from 'next/server';
+import { execSync } from 'node:child_process';
+import { existsSync, mkdtempSync, rmSync, writeFileSync, mkdirSync, readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { tmpdir } from 'node:os';
+import { bundleCraftForPublish } from '@/lib/crafts/registry';
+import { loadSettings } from '@/lib/settings';
+
+// One-click publish via the user's gh CLI: fork → clone → write files →
+// append registry entry → push → open PR. Falls back to the manual flow
+// (existing /api/craft-system/publish) when gh isn't available.
+
+interface AutoPublishRequest {
+  projectPath: string;
+  name: string;
+}
+
+function exec(cmd: string, cwd?: string, timeout = 60000): string {
+  return execSync(cmd, { cwd, timeout, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: 10 * 1024 * 1024 });
+}
+
+export async function POST(req: Request) {
+  const { projectPath, name } = (await req.json()) as AutoPublishRequest;
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+
+  // ── Pre-flight ────────────────────────────────────
+  let me: string;
+  try {
+    exec('gh auth status', undefined, 5000);
+    me = exec('gh api user --jq .login', undefined, 5000).trim();
+  } catch (e: any) {
+    return NextResponse.json({
+      error: 'gh CLI is not authenticated. Run `gh auth login` in a terminal, then retry.',
+      gh: false,
+    }, { status: 400 });
+  }
+
+  const bundle = bundleCraftForPublish(projectPath, name);
+  if (bundle.error || !bundle.entry) {
+    return NextResponse.json({ error: bundle.error || 'failed to bundle craft' }, { status: 400 });
+  }
+
+  const repo = (loadSettings() as any).craftsRepoUrl || 'https://raw.githubusercontent.com/aiwatching/forge-crafts/main';
+  const repoMatch = repo.match(/github\.com\/([^/]+)\/([^/]+)|raw\.githubusercontent\.com\/([^/]+)\/([^/]+)/);
+  if (!repoMatch) return NextResponse.json({ error: `cannot parse craftsRepoUrl: ${repo}` }, { status: 400 });
+  const ownerRepo = `${repoMatch[1] || repoMatch[3]}/${(repoMatch[2] || repoMatch[4]).replace(/\.git$/, '')}`;
+
+  const branch = `craft/${name}-${bundle.entry.version}-${Date.now().toString(36).slice(-4)}`;
+  const prTitle = `Add ${bundle.entry.displayName || bundle.entry.name} v${bundle.entry.version}`;
+  const tmp = mkdtempSync(join(tmpdir(), 'forge-craft-pr-'));
+  const repoDir = join(tmp, 'forge-crafts');
+
+  const log: string[] = [];
+  const step = (msg: string) => { log.push(msg); };
+
+  try {
+    // ── 1. Fork (idempotent — succeeds whether or not fork exists) ────
+    step(`Forking ${ownerRepo}…`);
+    try {
+      exec(`gh repo fork ${ownerRepo} --clone=false --default-branch-only`, tmp, 30000);
+    } catch {
+      // Fork may already exist — gh exits non-zero in that case but still works
+    }
+
+    // ── 2. Clone the fork ────────────────────────────────────────
+    step(`Cloning your fork ${me}/${ownerRepo.split('/')[1]}…`);
+    exec(`gh repo clone ${me}/${ownerRepo.split('/')[1]} forge-crafts`, tmp, 60000);
+
+    // Add upstream, sync from upstream main to avoid stale fork
+    exec(`git remote add upstream https://github.com/${ownerRepo}.git`, repoDir, 5000);
+    try {
+      exec(`git fetch upstream main`, repoDir, 30000);
+      exec(`git checkout main`, repoDir, 5000);
+      exec(`git merge upstream/main --ff-only`, repoDir, 10000);
+      exec(`git push origin main`, repoDir, 30000);
+    } catch (e: any) {
+      // Empty upstream repo or already in sync — both fine
+      step(`(sync skipped: ${e?.message?.split('\n')[0] || ''})`);
+    }
+
+    // ── 3. New branch ────────────────────────────────────────────
+    step(`Creating branch ${branch}…`);
+    exec(`git checkout -b ${branch}`, repoDir, 5000);
+
+    // ── 4. Write craft files ────────────────────────────────────
+    const craftDir = join(repoDir, name);
+    mkdirSync(craftDir, { recursive: true });
+    for (const f of bundle.files) {
+      const dest = join(craftDir, f.path);
+      mkdirSync(dirname(dest), { recursive: true });
+      writeFileSync(dest, f.content, 'utf8');
+    }
+    step(`Wrote ${bundle.files.length} files into ${name}/`);
+
+    // ── 5. Update registry.json ─────────────────────────────────
+    const regPath = join(repoDir, 'registry.json');
+    let registry: { version: number; crafts: any[] };
+    if (existsSync(regPath)) {
+      try {
+        registry = JSON.parse(readFileSync(regPath, 'utf8'));
+        if (!Array.isArray(registry.crafts)) registry.crafts = [];
+      } catch {
+        registry = { version: 1, crafts: [] };
+      }
+    } else {
+      registry = { version: 1, crafts: [] };
+    }
+
+    // Replace existing entry with same name (republish/update path)
+    registry.crafts = registry.crafts.filter((c: any) => c?.name !== bundle.entry.name);
+    registry.crafts.push(bundle.entry);
+    registry.crafts.sort((a: any, b: any) => (a.name || '').localeCompare(b.name || ''));
+    writeFileSync(regPath, JSON.stringify(registry, null, 2) + '\n', 'utf8');
+    step(`Updated registry.json (${registry.crafts.length} crafts)`);
+
+    // ── 6. Commit + push ───────────────────────────────────────
+    exec(`git add .`, repoDir, 5000);
+    // Configure committer if not set globally — required for fresh containers
+    try { exec('git config user.email', repoDir, 2000); } catch {
+      exec(`git config user.email "${me}@users.noreply.github.com"`, repoDir, 2000);
+      exec(`git config user.name "${me}"`, repoDir, 2000);
+    }
+    exec(`git commit -m "${prTitle.replace(/"/g, '\\"')}"`, repoDir, 10000);
+    step(`Pushing branch…`);
+    exec(`git push -u origin ${branch}`, repoDir, 60000);
+
+    // ── 7. Open PR against upstream ────────────────────────────
+    step(`Opening PR…`);
+    const body = [
+      `Submitted via Forge's one-click craft publish.`,
+      ``,
+      `**Craft**: \`${bundle.entry.name}\` v${bundle.entry.version}`,
+      bundle.entry.description ? `**Description**: ${bundle.entry.description}` : '',
+      bundle.entry.tags?.length ? `**Tags**: ${bundle.entry.tags.join(', ')}` : '',
+      bundle.entry.author ? `**Author**: ${bundle.entry.author}` : '',
+      ``,
+      `Files:`,
+      ...bundle.files.map(f => `- \`${name}/${f.path}\``),
+      `- \`registry.json\` (entry added/updated)`,
+    ].filter(Boolean).join('\n');
+    const bodyFile = join(tmp, 'pr-body.md');
+    writeFileSync(bodyFile, body, 'utf8');
+    const prOut = exec(
+      `gh pr create --repo ${ownerRepo} --base main --head ${me}:${branch} --title "${prTitle.replace(/"/g, '\\"')}" --body-file "${bodyFile}"`,
+      repoDir, 30000
+    ).trim();
+
+    // gh prints the PR URL on the last line
+    const prUrl = prOut.split('\n').filter(l => l.startsWith('http')).pop() || prOut;
+
+    return NextResponse.json({ ok: true, prUrl, branch, log });
+  } catch (e: any) {
+    const stderr = (e?.stderr || '').toString();
+    return NextResponse.json({
+      error: e?.message?.split('\n')[0] || String(e),
+      stderr: stderr.slice(0, 2000),
+      log,
+    }, { status: 500 });
+  } finally {
+    try { rmSync(tmp, { recursive: true, force: true }); } catch {}
+  }
+}
+
+// GET — quick probe so the UI can decide whether to show the one-click button
+export async function GET() {
+  try {
+    exec('gh auth status', undefined, 5000);
+    const me = exec('gh api user --jq .login', undefined, 5000).trim();
+    return NextResponse.json({ available: true, user: me });
+  } catch {
+    return NextResponse.json({ available: false });
+  }
+}

package/app/api/craft-system/publish/route.ts

@@ -0,0 +1,50 @@
+import { NextResponse } from 'next/server';
+import { bundleCraftForPublish } from '@/lib/crafts/registry';
+import { loadSettings } from '@/lib/settings';
+
+// POST /api/craft-system/publish   body: { projectPath, name }
+// Bundles the craft files + a registry-entry snippet ready to drop into the
+// forge-crafts registry repo. Returns { entry, files, instructions }.
+export async function POST(req: Request) {
+  const { projectPath, name } = await req.json() as { projectPath: string; name: string };
+  if (!projectPath || !name) return NextResponse.json({ error: 'projectPath + name required' }, { status: 400 });
+
+  const bundle = bundleCraftForPublish(projectPath, name);
+  if (bundle.error) return NextResponse.json({ error: bundle.error }, { status: 400 });
+
+  const repo = (loadSettings() as any).craftsRepoUrl || 'https://raw.githubusercontent.com/aiwatching/forge-crafts/main';
+  const repoMatch = repo.match(/github\.com\/([^/]+)\/([^/]+)|raw\.githubusercontent\.com\/([^/]+)\/([^/]+)/);
+  const ownerRepo = repoMatch ? `${repoMatch[1] || repoMatch[3]}/${(repoMatch[2] || repoMatch[4]).replace(/\.git$/, '')}` : 'aiwatching/forge-crafts';
+
+  // GitHub web-edit deep links — clicking "create file" without write access
+  // makes GitHub auto-fork the repo into the user's account, create the file
+  // in the fork, and prompt to open a PR. Zero local-clone required.
+  const ghBase = `https://github.com/${ownerRepo}`;
+  const editFileUrl = (path: string) => `${ghBase}/edit/main/${encodeURIComponent(path)}`;
+
+  // GitHub's /new/<branch>/<dir>?filename=<name>&value=<...> — dir + filename
+  // are independent so we split nested paths into prefix dir / leaf name.
+  const fileLinks = bundle.files.map(f => {
+    const lastSlash = f.path.lastIndexOf('/');
+    const subdir = lastSlash >= 0 ? f.path.slice(0, lastSlash) : '';
+    const filename = lastSlash >= 0 ? f.path.slice(lastSlash + 1) : f.path;
+    const dirPath = subdir ? `${bundle.entry.name}/${subdir}` : bundle.entry.name;
+    const githubUrl = `${ghBase}/new/main/${dirPath.split('/').map(encodeURIComponent).join('/')}?filename=${encodeURIComponent(filename)}&value=${encodeURIComponent(f.content)}`;
+    return { path: f.path, githubUrl };
+  });
+
+  return NextResponse.json({
+    entry: bundle.entry,
+    files: bundle.files,
+    fileLinks,
+    repo: { owner: ownerRepo.split('/')[0], name: ownerRepo.split('/')[1], url: ghBase },
+    registryEditUrl: editFileUrl('registry.json'),
+    instructions: [
+      `All publishes go through a pull request — direct pushes to main are not accepted, even from maintainers.`,
+      `1. Click each file's "Open in GitHub" button. GitHub auto-forks ${ownerRepo} into your account (if you don't have write access) and creates the file there.`,
+      `2. After all files are created, open registry.json and append the JSON entry from the "registry.json entry" tab.`,
+      `3. In each commit dialog, pick "Create a new branch for this commit and start a pull request" — never commit to main directly.`,
+      `4. After the last commit, GitHub takes you straight to the PR. Submit it; once merged, the craft appears in every Forge user's marketplace.`,
+    ],
+  });
+}

package/app/api/craft-system/registry/route.ts

@@ -0,0 +1,16 @@
+import { NextResponse } from 'next/server';
+import { fetchRegistry } from '@/lib/crafts/registry';
+
+// GET /api/craft-system/registry?refresh=1
+// Project-agnostic — returns the raw registry. Used by the global Marketplace
+// browser where there's no single project context.
+export async function GET(req: Request) {
+  const u = new URL(req.url);
+  const refresh = u.searchParams.get('refresh') === '1';
+  try {
+    const items = await fetchRegistry(refresh);
+    return NextResponse.json({ items });
+  } catch (e: any) {
+    return NextResponse.json({ items: [], error: e?.message || String(e) });
+  }
+}