@entelligentsia/forgecli 1.0.10 → 1.0.20

package/dist/forge-payload/commands/rebuild.md

@@ -84,6 +84,12 @@ with a colon delimiter (both forms are equivalent).
 /forge:rebuild workflows plan_task          # single workflow file only
 /forge:rebuild workflows:plan_task          # same — colon form (from migration entries)
 /forge:rebuild workflows sprint_plan        # single workflow file only
+/forge:rebuild workflows-js                  # .claude/workflows/ JS orchestration workflows (verbatim copy)
+/forge:rebuild workflows-js wfl-run-task     # single JS workflow file only
+/forge:rebuild workflows-js:wfl-run-task     # same — colon form (from migration entries)
+/forge:rebuild tools                        # .forge/tools/ verbatim re-copy from $FORGE_ROOT/tools/
+/forge:rebuild tools store-cli              # single tool file only (name with or without .cjs)
+/forge:rebuild tools:store-cli              # same — colon form (from migration entries)
 /forge:rebuild commands                     # .claude/commands/ slash command wrappers
 /forge:rebuild templates                    # document templates only
 /forge:rebuild templates PLAN_TEMPLATE      # single template file only
@@ -311,14 +317,14 @@ write, record hash.
      --kb "$(node "$FORGE_ROOT/tools/manage-config.cjs" get paths.engineering 2>/dev/null || echo engineering)" \
      --out .forge/init-context.md --json-out .forge/init-context.json
    ```
-2. Read `$FORGE_ROOT/init/workflow-gen-plan.json` (16-entry fan-out table).
+2. Read `$FORGE_ROOT/init/workflow-gen-plan.json` (15-entry fan-out table).
    Let `M_total` = the entry count.
 
 3. Render the workflows badge, then emit the count:
    ```sh
    node "$FORGE_ROOT/tools/banners.cjs" --badge ember
    ```
-   Then emit: `Generating workflows (<N> atomic + orchestration, parallel)...`
+   Then emit: `Generating workflows (<N> atomic, parallel)...`
 4. Check each file for manual modifications before any clearing:
    ```sh
    node "$FORGE_ROOT/tools/generation-manifest.cjs" check .forge/workflows/{filename}.md
@@ -334,27 +340,143 @@ write, record hash.
    `$FORGE_ROOT/init/generation/generate-workflows.md` as the per-subagent rulebook
    (same fan-out pattern as `/forge:init` Phase 7d). Spawn one per entry.
 7. Collect results. Retry failures once in a single Agent call.
-8. Spawn orchestration subagent:
-   ```
-   Read $FORGE_ROOT/init/generation/generate-orchestration.md and follow it.
-   FORGE_ROOT: {FORGE_ROOT}
-   Input: $FORGE_ROOT/meta/workflows/meta-orchestrate.md + .forge/workflows/
-   Output: .forge/workflows/orchestrate_task.md and .forge/workflows/run_sprint.md
-   ```
-9. **Replay user enhancements** (forge#107 / Approach A):
+
+   > **LLM orchestration retired.** `orchestrate_task` / `run_sprint` / `fix_bug`
+   > are no longer generated. The deterministic JS drivers in
+   > `.claude/workflows/wfl-*.js` (category `workflows-js`) are the only
+   > orchestration truth; `/forge:run-task`, `/forge:run-sprint`, and
+   > `/forge:fix-bug` dispatch to them via `workflow(wfl:*)`. The prose specs
+   > `meta-orchestrate.md` / `meta-fix-bug.md` remain in `meta/` as reference
+   > docs only — neither built into the base-pack nor regenerated here.
+
+8. **Replay user enhancements** (forge#107 / Approach A):
    ```sh
    node "$FORGE_ROOT/tools/manage-versions.cjs" replay --target workflows
    ```
    Walks snapshots; restores enhanced `workflows/<name>.md` files. Later
    snapshots win on collision.
-10. For each written file: record hash `node "$FORGE_ROOT/tools/generation-manifest.cjs" record .forge/workflows/{filename}.md`
+9. For each written file: record hash `node "$FORGE_ROOT/tools/generation-manifest.cjs" record .forge/workflows/{filename}.md`
     (this runs AFTER replay so the recorded hash reflects the restored content).
-11. Emit `  〇 workflows — <N> files written`.
+10. Emit `  〇 workflows — <N> files written`.
 
 **Do NOT touch:** `.claude/commands/`, `.forge/config.json`, or any knowledge base file.
 
 ---
 
+## Category: `workflows-js` — verbatim copy (full or single file)
+
+Re-materialise the JS orchestration workflows in `.claude/workflows/` from the
+plugin base-pack. Unlike the `workflows` category (LLM-generated `.forge/`
+markdown with placeholder substitution and KB enrichment), the
+`workflows-js` files are **deterministic verbatim copies** from
+`$FORGE_ROOT/init/base-pack/workflows-js/` — no LLM, no placeholder
+substitution, no enrichment. The output is byte-identical to the base-pack
+source (enforced by `workflows-js-drift.test.cjs`), so this category mirrors
+the `workflows:_fragments` copy pattern, not the generation pattern.
+
+Render a badge, then proceed:
+
+```sh
+node "$FORGE_ROOT/tools/banners.cjs" --badge ember
+```
+
+**If a sub-target is provided** (e.g. `/forge:rebuild workflows-js wfl-run-task`
+or the colon form `workflows-js:wfl-run-task`), copy only the single file. The
+sub-target may be given with or without the `.js` extension; normalise to
+`<sub-target>.js`.
+
+1. Verify `$FORGE_ROOT/init/base-pack/workflows-js/<sub-target>.js` exists. If
+   not, list the available files and exit cleanly.
+2. Ensure `.claude/workflows/` exists (create if absent).
+3. Copy verbatim (no substitution) to `.claude/workflows/<sub-target>.js`.
+4. Record a manifest hash:
+   ```sh
+   node "$FORGE_ROOT/tools/generation-manifest.cjs" record .claude/workflows/<sub-target>.js
+   ```
+5. Emit `  〇 workflows-js:<sub-target> — copied`.
+
+**If no sub-target** — full copy, directory fan-out:
+
+1. Enumerate all `.js` files in `$FORGE_ROOT/init/base-pack/workflows-js/`.
+   Let `N` = the count.
+2. Emit: `Copying workflows-js (<N> files)...`
+3. Ensure `.claude/workflows/` exists (create if absent).
+4. For each file, copy verbatim to `.claude/workflows/<filename>`, then record
+   a manifest hash:
+   ```sh
+   node "$FORGE_ROOT/tools/generation-manifest.cjs" record .claude/workflows/<filename>
+   ```
+5. Emit `  〇 workflows-js — <N> files copied`.
+
+> **Note:** Only the base-pack-sourced JS workflows (`wfl-*.js`) are written.
+> Custom or project-specific files in `.claude/workflows/` are never
+> overwritten or deleted. Verify with `ls .claude/workflows/`.
+
+---
+
+## Category: `tools` — verbatim copy (full or single file)
+
+Re-materialise the vendored plugin tools in `.forge/tools/` from the installed
+plugin. Unlike workflow and persona categories (LLM-generated with placeholder
+substitution), tools files are **deterministic verbatim copies** from
+`$FORGE_ROOT/tools/` — no LLM, no substitution, no enrichment. The output is
+byte-identical to the plugin source.
+
+**If a sub-target is provided** (e.g. `/forge:rebuild tools store-cli`
+or the colon form `tools:store-cli`), copy only the single file. The sub-target
+may be given with or without the `.cjs` extension; normalise to `<sub-target>.cjs`.
+Sub-targets in the `lib/` namespace may be specified with the `lib/` prefix
+(e.g. `tools:lib/schema-loader` or `tools:lib/schema-loader.cjs`).
+
+**Single-file steps:**
+
+1. Resolve the source path: if the sub-target starts with `lib/`, look in
+   `$FORGE_ROOT/tools/lib/<name>.cjs`; otherwise look in `$FORGE_ROOT/tools/<name>.cjs`.
+   If the source does not exist, list the available files and exit cleanly.
+2. Ensure the target directory exists (`.forge/tools/` or `.forge/tools/lib/`).
+3. Copy verbatim to the resolved `.forge/tools/` path.
+4. Record a manifest hash:
+   ```sh
+   node "$FORGE_ROOT/tools/generation-manifest.cjs" record .forge/tools/<sub-target>.cjs
+   ```
+5. Emit `  〇 tools:<sub-target> — copied`.
+
+**If no sub-target** — full re-copy, directory fan-out:
+
+1. Enumerate all `*.cjs` **and `*.js`** files in `$FORGE_ROOT/tools/` (top-level
+   only, exclude `*.test.cjs`/`*.test.js`). Let `N_top` = the count.
+   Enumerate all `*.cjs` **and `*.js`** files in `$FORGE_ROOT/tools/lib/` (exclude
+   `*.test.cjs`/`*.test.js`). Let `N_lib` = the count.
+   Both extensions are required: e.g. `store-cli.cjs` loads `lib/validate.js` and
+   `collate.cjs` loads `lib/result.js`; a `.cjs`-only copy breaks them.
+2. Emit: `Copying tools (<N_top> tool files + <N_lib> lib files)...`
+3. Ensure `.forge/tools/` and `.forge/tools/lib/` exist (create if absent).
+4. For each top-level file, copy verbatim to `.forge/tools/<filename>`, then
+   record a manifest hash:
+   ```sh
+   node "$FORGE_ROOT/tools/generation-manifest.cjs" record .forge/tools/<filename>
+   ```
+5. For each lib file, copy verbatim to `.forge/tools/lib/<filename>`, then
+   record a manifest hash:
+   ```sh
+   node "$FORGE_ROOT/tools/generation-manifest.cjs" record .forge/tools/lib/<filename>
+   ```
+6. Write (or overwrite) the version marker so `/forge:health` can detect staleness:
+   ```sh
+   ACTIVE_VERSION=$(node -e "console.log(require('$FORGE_ROOT/.claude-plugin/plugin.json').version)")
+   node -e "
+   const fs = require('fs');
+   fs.writeFileSync('.forge/tools/.forge-tools-version', JSON.stringify({ version: '${ACTIVE_VERSION}' }) + '\n');
+   "
+   ```
+7. Emit `  〇 tools — <N_top + N_lib> files copied`.
+
+> **Note:** This is a full re-copy of the plugin tools at the installed
+> `$FORGE_ROOT` version. Use `/forge:rebuild tools` after `/forge:update` to
+> refresh `.forge/tools/` to the new plugin version.
+
+---
+
 ## Category: `commands` — full rebuild
 
 Re-generate `.claude/commands/` slash command wrappers from the current
@@ -549,7 +671,7 @@ are not yet represented in review checklist items.
 
 ## Default (no argument)
 
-Run all five categories respecting dependencies — with maximum parallelism:
+Run all categories respecting dependencies — with maximum parallelism:
 
 1. **Build brief** (once, synchronous):
    ```sh
@@ -572,8 +694,14 @@ Run all five categories respecting dependencies — with maximum parallelism:
    Spawn orchestration and commands subagents in a **SINGLE Agent tool message**.
    Wait for both.
 
-This runs in 4 serial steps instead of 5 sequential category passes, with all
-fan-outs parallelised within each step.
+5. **workflows-js** (deterministic verbatim copy — no LLM, independent):
+   Run the `workflows-js` category (full copy) as described above: copy every
+   `.js` file from `$FORGE_ROOT/init/base-pack/workflows-js/` into
+   `.claude/workflows/` and record manifest hashes. This step has no
+   dependencies and can run alongside step 4.
+
+This runs in a handful of serial steps instead of sequential per-category
+passes, with all fan-outs parallelised within each step.
 
 ## Flag: `--enrich`
 

package/dist/forge-payload/commands/update.md

@@ -242,7 +242,7 @@ Now evaluate — **stop at the first matching row and follow only that row's act
 
 | # | Condition | Action |
 |---|-----------|--------|
-| 1 | `REMOTE_VERSION` == `LOCAL_VERSION` and `LOCAL_VERSION` == baseline | Print "Forge {LOCAL_VERSION} — up to date. No pending migrations." Then execute **Step 4 config refresh** (paths.forgeRoot, paths.forgeRef, backfill) and proceed to **Step 5**. |
+| 1 | `REMOTE_VERSION` == `LOCAL_VERSION` and `LOCAL_VERSION` == baseline | Print "Forge {LOCAL_VERSION} — up to date. No pending migrations." Then execute **Step 4 config refresh** (paths.forgeRef, backfill) and proceed to **Step 5**. |
 | 2 | `REMOTE_VERSION` == `LOCAL_VERSION` and `LOCAL_VERSION` != baseline | Jump to **Step 2B** (project migration — no install needed). |
 | 3 | `IS_CANARY` is true | Jump to **Step 2B** (canary — no install needed). |
 | 4 | `LOCAL_VERSION` > `REMOTE_VERSION` | Print "Local version ({LOCAL_VERSION}) is ahead of the release channel ({REMOTE_VERSION}). No install needed — applying any pending project migrations." then jump to **Step 2B**. |
@@ -459,27 +459,17 @@ path) — skip the re-derivation and keep the original value.
 node "$FORGE_ROOT/tools/banners.cjs" --phase 4 7 "Apply migrations" forge
 ```
 
-> **Sequencing note:** `paths.forgeRoot` is written at the very start of Step 4,
-> before any migration targets or regeneration commands execute. This ensures all
-> subsequent tool invocations in Step 4 (including `build-init-context.cjs` called
-> by regeneration sub-steps) use the current, correct plugin path.
->
-> **Config refresh always runs.** The Step 4 header section (forgeRoot, forgeRef,
-> backfill) executes regardless of whether migrations are pending — even Row 1
+> **Config refresh always runs.** The Step 4 header section (forgeRef, backfill)
+> executes regardless of whether migrations are pending — even Row 1
 > ("up to date") proceeds through this section before skipping to Step 5. The
 > "skip to Step 5" directive skips only the migration chain walk and regeneration.
 > Missing config fields can accumulate across version boundaries; backfill ensures
 > the config stays structurally complete after every `/forge:update` invocation.
 
-**Refresh `paths.forgeRoot` before applying migrations:**
-
-```sh
-node "$FORGE_ROOT/tools/manage-config.cjs" set paths.forgeRoot "$FORGE_ROOT"
-```
-
-**Write `paths.forgeRef` (FR-010):** Also write the installed plugin version
+**Write `paths.forgeRef` (FR-010):** Write the installed plugin version
 as `paths.forgeRef` to config. This makes the config portable across machines —
-`forgeRef` is a version string rather than an absolute path:
+`forgeRef` is a version string rather than an absolute path, and is used by
+`forge-preflight.cjs` to resolve the plugin root via cache lookup:
 
 ```sh
 LOCAL_VERSION=$(node -e "console.log(require('$FORGE_ROOT/.claude-plugin/plugin.json').version)")
@@ -491,7 +481,7 @@ required or recommended fields may have been added since the project was last
 initialized. `manage-config backfill` reads the config schema, compares it
 against the current `.forge/config.json`, and writes defaults for any missing
 fields with schema-defined defaults. It also stamps the top-level `version`
-field from the bundled plugin version. Run after setting forgeRoot/forgeRef:
+field from the bundled plugin version. Run after setting forgeRef:
 
 ```sh
 node "$FORGE_ROOT/tools/manage-config.cjs" backfill --forge-root "$FORGE_ROOT"
@@ -576,12 +566,14 @@ Execute regeneration targets in this order:
 | 5 | `commands` | Must run after `workflows` | — |
 | 6 | `knowledge-base` sub-targets | — (independent) | — |
 | 7 | `schemas` | — (independent) | **Run schema refresh inline** (see Schema Refresh below). Emit: `〇 Refreshing schemas…` |
+| 8 | `workflows-js` | — (independent) | Deterministic verbatim copy of `.claude/workflows/*.js` from base-pack via `/forge:rebuild workflows-js` (no LLM, no placeholder substitution). |
 
 > **Known special targets — note for migration authors:** `hooks` and `schemas` are
 > special-cased here. Future `migrations.json` entries should only use recognised
 > target names; using unknown bare-category targets will produce a warning and be
 > skipped. The recognised targets are: `hooks`, `tools`, `workflows`, `templates`,
-> `personas`, `commands`, `knowledge-base`, `skills`, `schemas`.
+> `personas`, `commands`, `knowledge-base`, `skills`, `schemas`, `workflows-js`.
+> `workflows-js` accepts granular sub-targets (e.g. `workflows-js:wfl-run-task`).
 
 `commands` depends on `workflows` because command wrappers reference workflow
 filenames. All other targets are independent and could run in parallel, but
@@ -666,16 +658,16 @@ reading and following `$FORGE_ROOT/commands/regenerate.md`:
 **Category-to-command mapping:** most categories are handled by
 `/forge:rebuild`, but the `tools` and `schemas` categories are special.
 
-When `tools` appears in the aggregated result, run the schema refresh inline
-(see **Schema Refresh** section below) instead of invoking `/forge:rebuild tools`.
-Tools ship with the plugin and are invoked directly via `$FORGE_ROOT/tools/`.
+When `tools` appears in the aggregated result, invoke `/forge:rebuild tools`
+to re-copy the current plugin's tools closure into `.forge/tools/`. This is
+the actual re-vendor step — do NOT run schema refresh inline instead.
 
 When `schemas` appears in the aggregated result, run the schema refresh inline
-(same **Schema Refresh** section). Do NOT delegate to the removed `/forge:update-tools` command.
+(see **Schema Refresh** section below). Do NOT delegate to the removed `/forge:update-tools` command.
 
 ### Schema Refresh
 
-When the migration chain includes a `schemas` or `tools` target, refresh schemas inline:
+When the migration chain includes a `schemas` target, refresh schemas inline:
 
 ```sh
 mkdir -p .forge/schemas
@@ -1004,8 +996,18 @@ engineer_update_implementation.md → renamed to update_implementation.md
 engineer_fix_bug.md          → renamed to fix_bug.md
 supervisor_review_plan.md    → renamed to review_plan.md
 supervisor_review_implementation.md → renamed to review_code.md
+orchestrate_task.md          → retired (v1.2.0); orchestration runs through .claude/workflows/wfl-run-task.js
+run_sprint.md                → retired (v1.2.0); orchestration runs through .claude/workflows/wfl-run-sprint.js
+fix_bug.md                   → retired (v1.2.0); orchestration runs through .claude/workflows/wfl-fix-bug.js
 ```
 
+> **Note:** `orchestrate_task.md` / `run_sprint.md` / `fix_bug.md` are LLM
+> orchestration prose retired in v1.2.0 — they are no longer generated, and the
+> deterministic JS drivers in `.claude/workflows/wfl-*.js` are the only
+> orchestration truth. They are listed here so `/forge:update` removes the
+> orphaned files from `.forge/workflows/` (the `/forge:rebuild` regeneration
+> only clears manifest entries, it does not delete files on disk).
+
 For each found workflow file, check manifest status:
 ```sh
 node "$FORGE_ROOT/tools/generation-manifest.cjs" check .forge/workflows/{old-name}.md
@@ -1314,12 +1316,12 @@ Proceed to **Step 6**.
 node "$FORGE_ROOT/tools/banners.cjs" --phase 6 7 "Record state" drift
 ```
 
-> **Note:** `paths.forgeRoot` and `paths.forgeRef` were already written at the start
-> of Step 4. Step 6 does not repeat those writes — it records migration state only.
+> **Note:** `paths.forgeRef` was already written at the start
+> of Step 4. Step 6 does not repeat that write — it records migration state only.
 
 **Write `.forge/update-check-cache.json`** to record the completed migration.
 Read the existing file if present, update `migratedFrom`, `localVersion`,
-`distribution`, `forgeRoot`, `forgeRef`, `updateStatus`, `pendingReason`, and
+`distribution`, `forgeRef`, `updateStatus`, `pendingReason`, and
 `pendingMigrations`, then write it back. Use the Write or Edit tool — do not run
 a shell command for this step. The `.forge/` directory always exists at this
 point (it was checked earlier), so no `mkdir -p` is needed.
@@ -1330,7 +1332,6 @@ If the file does not exist, create it with:
   "migratedFrom": "<LOCAL_VERSION>",
   "localVersion": "<LOCAL_VERSION>",
   "distribution": "<DISTRIBUTION>",
-  "forgeRoot": "<FORGE_ROOT>",
   "forgeRef": "<LOCAL_VERSION>",
   "updateStatus": "complete",
   "pendingReason": null,

package/dist/forge-payload/hooks/preflight-session.cjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+'use strict';
+
+// Forge hook: preflight-session (FORGE-S27-T01 / item A1).
+//
+// SessionStart hook that primes the orchestrator preflight cache blob
+// (.forge/cache/preflight-status.json) by running forge-preflight.cjs once.
+//
+// SCOPING NOTE: SessionStart fires BEFORE any command is invoked and its
+// envelope carries no per-command signal, so this hook is deliberately
+// command-name-INDEPENDENT. Authoritative scoping to run-task / fix-bug /
+// run-sprint lives in the orchestration command-preamble path (which reads the
+// blob). This hook only ever:
+//   - is a STRICT NO-OP when .forge/ is absent (never changes behavior for
+//     non-Forge projects or unrelated commands);
+//   - primes the blob when .forge/ is present;
+//   - is FRESHNESS-GUARDED (idempotent): if an existing blob already matches
+//     the current config mtime + MASTER_INDEX hash, it is left untouched;
+//   - FAILS OPEN: any error -> stderr warning + exit 0. A hook failure must
+//     never block session start.
+
+process.on('uncaughtException', (err) => {
+  try { process.stderr.write(`forge preflight-session: internal error (fail-open): ${err.message}\n`); } catch (_) {}
+  process.exit(0);
+});
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+// Read + discard the envelope on fd 0 (fail-open on any parse error).
+try { fs.readFileSync(0, 'utf8'); } catch (_) { /* envelope optional */ }
+
+// Strict no-op when .forge/ is absent.
+const forgeDir = path.join(process.cwd(), '.forge');
+const configPath = path.join(forgeDir, 'config.json');
+if (!fs.existsSync(forgeDir) || !fs.existsSync(configPath)) {
+  process.exit(0);
+}
+
+const cacheDir = path.join(forgeDir, 'cache');
+const blobPath = path.join(cacheDir, 'preflight-status.json');
+
+// Freshness guard (idempotency): if the existing blob was computed from the
+// current config mtime, leave it untouched. forge-preflight records configMtime
+// in the blob; MASTER_INDEX changes flow through masterIndexHash, which the
+// blob also records, but the config mtime is the cheap primary key here.
+function configMtimeMs() {
+  try { return fs.statSync(configPath).mtimeMs; } catch (_) { return null; }
+}
+
+try {
+  if (fs.existsSync(blobPath)) {
+    const existing = JSON.parse(fs.readFileSync(blobPath, 'utf8'));
+    const curMtime = configMtimeMs();
+    if (existing && typeof existing.configMtime === 'number' &&
+        curMtime !== null && existing.configMtime === curMtime) {
+      // Blob is current — no rewrite, no duplicated side effect.
+      process.exit(0);
+    }
+  }
+} catch (_) { /* corrupt blob -> fall through and recompute */ }
+
+// Resolve forge-preflight.cjs. Prefer CLAUDE_PLUGIN_ROOT (set by the runtime),
+// fall back to config.paths.forgeRoot.
+let forgeRoot = process.env.CLAUDE_PLUGIN_ROOT || null;
+if (!forgeRoot) {
+  try {
+    const cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    forgeRoot = cfg && cfg.paths && cfg.paths.forgeRoot;
+  } catch (_) { /* leave null */ }
+}
+if (!forgeRoot) process.exit(0); // cannot locate the tool — fail open
+
+const tool = path.join(forgeRoot, 'tools', 'forge-preflight.cjs');
+if (!fs.existsSync(tool)) process.exit(0);
+
+// Run preflight and capture its single JSON blob.
+const res = spawnSync('node', [tool, '--path', process.cwd()], {
+  cwd: process.cwd(),
+  encoding: 'utf8',
+  timeout: 8000,
+});
+if (res.status !== 0 || !res.stdout) process.exit(0); // fail open
+
+// Validate it parses before writing — never half-write a corrupt blob.
+let blob;
+try { blob = JSON.parse(res.stdout); } catch (_) { process.exit(0); }
+if (!blob || typeof blob !== 'object') process.exit(0);
+
+try {
+  fs.mkdirSync(cacheDir, { recursive: true });
+  // Atomic-ish write: tmp + rename so a crash never leaves a partial blob.
+  const tmpPath = blobPath + '.tmp';
+  fs.writeFileSync(tmpPath, JSON.stringify(blob, null, 2), 'utf8');
+  fs.renameSync(tmpPath, blobPath);
+} catch (_) { /* fail open */ }
+
+process.exit(0);

package/dist/forge-payload/init/phases/phase-3-materialize.md

@@ -63,11 +63,24 @@ node "$FORGE_ROOT/tools/substitute-placeholders.cjs" \
 ```
 
 Output directories (managed by the tool's `SUBDIR_OUTPUT_MAP`):
-- `base-pack/commands/`  → `.claude/commands/<prefix-lowercased>/`
-- `base-pack/personas/`  → `.forge/personas/`
-- `base-pack/skills/`    → `.forge/skills/`
-- `base-pack/workflows/` → `.forge/workflows/`
-- `base-pack/templates/` → `.forge/templates/`
+- `base-pack/commands/`     → `.claude/commands/<prefix-lowercased>/`
+- `base-pack/personas/`     → `.forge/personas/`
+- `base-pack/skills/`       → `.forge/skills/`
+- `base-pack/workflows/`    → `.forge/workflows/`
+- `base-pack/templates/`    → `.forge/templates/`
+- `base-pack/workflows-js/` → `.claude/workflows/` (JS orchestration workflows — FORGE-S28-T01)
+
+### Step 3a — Record generated JS workflows in the generation manifest
+
+After `substitute-placeholders.cjs` writes the JS workflows, record them in the generation
+manifest so `/forge:rebuild` and `/forge:health` can detect stale or missing copies:
+
+```sh
+node "$FORGE_ROOT/tools/generation-manifest.cjs" record .claude/workflows/wfl-run-task.js
+node "$FORGE_ROOT/tools/generation-manifest.cjs" record .claude/workflows/wfl-run-sprint.js
+```
+
+If either `record` call exits non-zero, the file was not written — re-run Step 3 and retry.
 
 If `project-context.json` is absent or missing required keys, halt Phase 3:
 ```

package/dist/forge-payload/integrity.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.0.10",
-  "generated": "2026-05-31",
+  "version": "1.2.14",
+  "generated": "2026-06-03",
   "note": "Tamper-evident only. Authoritative source: /forge:update from remote.",
   "files": {
     "commands/add-pipeline.md": "529a2fc01be49815efa2cf1147528827ff1bfc12ce2ac8663b5a3a9781f8682e",
@@ -9,27 +9,28 @@
     "commands/check-agent.md": "f92121cb150d4cf601654e25c28d0c13389039518d05433f1040d727054b127e",
     "commands/config.md": "e67185f98cf0b045890398083991b9d48f32bf0d53bafda1eaca3ce0337ce49c",
     "commands/enhance.md": "d28f6414119e84973809d32900bb7245b51f565aed86112bc7a994bc6941b547",
-    "commands/health.md": "29c3e5f9808d996f53a432c4b3aff1c3346d7a40fff54518d8ea2ac2c6ba9d12",
+    "commands/health.md": "8f8160d67c09eed9be12445674fc2ab76cf31d548c6268c71f9777dca30c4e47",
     "commands/init.md": "cf7a70d55f718304820c310465071d3eea9d14a43131623f46b686499f630d4d",
-    "commands/rebuild.md": "e6d1e0bc29fd21c4c9109d8f40045b782207dfa6db2d98a9bf8c7254a80f09c6",
+    "commands/rebuild.md": "9de3a3c1e41169e18758c8598e297c2f395f9daefdd9772783b9b676982cf1c2",
     "commands/remove.md": "0ca5ec94d52959afaadd74910bd2c81c9872b71c9cc1ce8b89e5af69c06b304f",
     "commands/repair.md": "22e21614eee31ee630ead3f587b0b948b8c537e54ecef3b65e7d819c55c0ebd4",
     "commands/report-bug.md": "af8a54bf8887b35e5c880898dd45783f6c2e80d3dc031d6479a6be613ac43053",
     "commands/search.md": "befc4ba9f3146e7599308b35b95ec315e16895c0c18c9c2bab7549619d79bf1c",
     "commands/status.md": "2fa82a0b11d493918781aec6d95c39411f84fa923662ff3152b6de0cc830d755",
-    "commands/update.md": "a7eac4362a927eae708ee3844ef8d920f3166d1eafde36323d2dd92789fbdec9",
+    "commands/update.md": "c8b69b43567fa5fc328bb3dde31f386d0f577bbcc65dafd525400ae2fb16b132",
     "agents/store-query-validator.md": "f4c3573edcf6e28809515705362df611806a805c5269404fb17e31433cf3a81c",
     "agents/tomoshibi.md": "0c1032df80dfc25a4f482b1276965b5318754d95ccde9f24820846d564e49a27",
     "hooks/check-update.cjs": "9607cc0c51bedcbc123f5ea1d7a492916f29ee1f838846eec64776d5df70bbea",
     "hooks/forge-permissions.cjs": "8de18fe7e6c9ee1751926275a37f4bb68a5a53090d366d2aa44157c106e7857e",
     "hooks/post-init.cjs": "b05d65e7192d126733995989998a0b480604e0cc152887e6d7d0807fba3cf70d",
     "hooks/post-sprint.cjs": "28ddbd2c49d8b746c35d23a90b02362bc684d188159536a971b2d650bb85f3a9",
+    "hooks/preflight-session.cjs": "7b1ad8f12f2a1bb94650e2b632da0ed21862071bf63f4e6452c88007be630fae",
     "hooks/triage-error.cjs": "e47fcb81fd0f99b8ecc449b38765cdc6929bde2461b5f1727d26bc31f76bfcfa",
     "hooks/validate-write.cjs": "3ec7bbbb2cc19f22c78da5a9e7b5031066f4b669c76a10c9f8a92a1a48fcea0a",
     "schemas/transitions/bug.json": "27b17da42d1cebffbd4f61ab3dcd432a0017aa71997d548ed80d22c2fc3fad6a",
     "schemas/transitions/sprint.json": "2e0a629396e687b0ca88e1814ac3e35d84533a5d55b25237ab67feddce3c9deb",
     "schemas/transitions/task.json": "4c71849747baa0d585756e57c56325ff6219c078178374e60815dff91e25e3e7",
-    "schemas/enum-catalog.json": "fe6c4b9d0b326a22ccbe2d2e6b8ea81c4f81ea827b9b46507a214cbeffcd45d3",
+    "schemas/enum-catalog.json": "14fa6c470292fb433a4e33503669f567bd53e3851b25000c05ddca0fdfdd6e58",
     "tools/verify-integrity.cjs": "3ec3c970dd3d7c3001f8f373bcc40556803eadd2fc2afafb14f1c232cba4cc3f"
   }
 }

package/dist/forge-payload/meta/fragments/tool-discipline.md

@@ -35,7 +35,7 @@ project config outside `.forge/store/` are fine to `read`/`grep` directly.
   Never construct artifact paths manually — the tool resolves them from entity IDs.
 - Use `forge_verify_apply` after applying edits to confirm changes landed on disk.
   If `unchanged` is non-empty, re-apply those edits.
-- Never `bash node "$FORGE_ROOT/tools/store-cli.cjs" ...` — use the named MCP tool instead.
+- Never `bash node .forge/tools/store-cli.cjs ...` — use the named MCP tool instead.
   The tool is schema-validated and shorter.
 - Workflow text saying `forge_store write sprint '<json>'` means: call the MCP tool
   `forge_store` with that 2-positional shape. Not a shell command.

package/dist/forge-payload/meta/personas/meta-architect.md

@@ -64,7 +64,7 @@ When generating a project-specific Architect persona, incorporate:
 
 **Persona block format** — every generated workflow for this persona must open by running the identity banner using the Bash tool:
 ```bash
-FORGE_ROOT=$(node -e "console.log(require('./.forge/config.json').paths.forgeRoot)") && node "$FORGE_ROOT/tools/banners.cjs" north
+node .forge/tools/banners.cjs north
 ```
 Use `--badge` for compact inline contexts. The plain-text fallback for non-terminal output is:
 `🗻 **{Project} Architect** — I hold the shape of the whole. I give final sign-off.`

package/dist/forge-payload/meta/personas/meta-bug-fixer.md

@@ -67,7 +67,7 @@ When generating a project-specific Bug Fixer, incorporate:
 
 **Persona block format** — every generated workflow for this persona must open by running the identity banner using the Bash tool:
 ```bash
-FORGE_ROOT=$(node -e "console.log(require('./.forge/config.json').paths.forgeRoot)") && node "$FORGE_ROOT/tools/banners.cjs" rift
+node .forge/tools/banners.cjs rift
 ```
 Use `--badge` for compact inline contexts. The plain-text fallback for non-terminal output is:
 `🍂 **{Project} Bug Fixer** — I find what has decayed and restore it.`

package/dist/forge-payload/meta/personas/meta-collator.md

@@ -42,9 +42,9 @@ invokes the generated tool or falls back to manual collation.
 
 ## Preferred Method
 
-Read `paths.forgeRoot` from `.forge/config.json` → set as `FORGE_ROOT`. Then run:
+Run the vendored collate tool:
 ```bash
-node "$FORGE_ROOT/tools/collate.cjs"
+node .forge/tools/collate.cjs
 ```
 
 ## Fallback Method
@@ -56,17 +56,17 @@ the same outputs following the collation algorithm in
 ## Generation Instructions
 
 When generating a project-specific Collator, incorporate:
-- Emit the runtime-read pattern exactly as shown above — do NOT substitute
-  `paths.forgeRoot` as a literal string at generation time. The `$FORGE_ROOT`
-  variable must remain in the generated file so the path resolves from
-  `.forge/config.json` when the workflow runs, not when it is generated.
+- Emit the vendored project-relative invocation exactly as shown above —
+  `node .forge/tools/collate.cjs`. The tools closure is vendored into
+  `.forge/tools/` by `/forge:rebuild`, so the path resolves at runtime
+  without any plugin-root lookup.
 - The project's language for invoking the tool
 - The store path (.forge/store/)
 - The project prefix for ID formatting
 
 **Persona block format** — every generated workflow for this persona must open by running the identity banner using the Bash tool:
 ```bash
-FORGE_ROOT=$(node -e "console.log(require('./.forge/config.json').paths.forgeRoot)") && node "$FORGE_ROOT/tools/banners.cjs" drift
+node .forge/tools/banners.cjs drift
 ```
 Use `--badge` for compact inline contexts. The plain-text fallback for non-terminal output is:
 `🍃 **{Project} Collator** — I gather what exists and arrange it into views.`

package/dist/forge-payload/meta/personas/meta-engineer.md

@@ -64,7 +64,7 @@ When generating a project-specific Engineer persona, incorporate:
 
 **Persona block format** — every generated workflow for this persona must open by running the identity banner using the Bash tool:
 ```bash
-FORGE_ROOT=$(node -e "console.log(require('./.forge/config.json').paths.forgeRoot)") && node "$FORGE_ROOT/tools/banners.cjs" forge
+node .forge/tools/banners.cjs forge
 ```
 Use `--badge` for compact inline contexts. The plain-text fallback for non-terminal output is:
 `🌱 **{Project} Engineer** — I plan and build. I do not move forward until the code is clean.`

package/dist/forge-payload/meta/personas/meta-orchestrator.md

@@ -65,7 +65,7 @@ When generating a project-specific Orchestrator, incorporate:
 
 **Persona block format** — every generated workflow for this persona must open by running the identity banner using the Bash tool:
 ```bash
-FORGE_ROOT=$(node -e "console.log(require('./.forge/config.json').paths.forgeRoot)") && node "$FORGE_ROOT/tools/banners.cjs" tide
+node .forge/tools/banners.cjs tide
 ```
 Use `--badge` for compact inline contexts. The plain-text fallback for non-terminal output is:
 `🌊 **{Project} Orchestrator** — I move tasks through their lifecycle. I do not do the work; I watch that it flows.`

package/dist/forge-payload/meta/personas/meta-supervisor.md

@@ -86,7 +86,7 @@ When generating a project-specific Supervisor persona, incorporate:
 
 **Persona block format** — every generated workflow for this persona must open by running the identity banner using the Bash tool:
 ```bash
-FORGE_ROOT=$(node -e "console.log(require('./.forge/config.json').paths.forgeRoot)") && node "$FORGE_ROOT/tools/banners.cjs" oracle
+node .forge/tools/banners.cjs oracle
 ```
 Use `--badge` for compact inline contexts. The plain-text fallback for non-terminal output is:
 `🌿 **{Project} Supervisor** — I review before things move forward. I read the actual code, not the report.`

package/dist/forge-payload/meta/tool-specs/store-cli.spec.md

@@ -10,7 +10,7 @@ needed.
 
 ## Inputs
 
-- `.forge/config.json` — paths (specifically `paths.forgeRoot` for schema resolution)
+- `.forge/config.json` — project paths and prefix
 - `.forge/schemas/*.schema.json` — canonical JSON Schema files (primary source)
 - `forge/schemas/*.schema.json` — in-tree source schemas (fallback for dogfooding)
 - CLI arguments — command, entity type, JSON payload, flags

package/dist/forge-payload/meta/workflows/_fragments/event-emission-schema.md

@@ -59,7 +59,7 @@ After the subagent returns, the orchestrator constructs the event from:
 The orchestrator then emits via:
 
 ```
-node "$FORGE_ROOT/tools/store-cli.cjs" emit {sprintId} '{complete-event-json}'
+node .forge/tools/store-cli.cjs emit {sprintId} '{complete-event-json}'
 ```
 
 ## Why no example record here