@entelligentsia/forgecli 1.0.21 → 1.0.36

package/CHANGELOG.md

@@ -7,6 +7,352 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **`4ge uninstall claude [dir] [--purge] [--yes]`** — the counterpart to
+  `4ge init claude`. Deterministically reverses the bootstrap: removes the
+  vendored Forge scaffold (`.forge/{tools,schemas,init,.base-pack,meta,
+  .claude-plugin,cache}`, `.bootstrap-manifest.json`, `.claude/commands/forge`,
+  `.claude/workflows`, and the payload's agents/skills), un-merges the Forge
+  hooks from `.claude/settings.json`, and un-appends the Forge block from
+  `.gitignore`. Safety: **preserves user data by default** (`.forge/config.json`,
+  `.forge/store/**`, the KB folder); `--purge` also removes config + store (KB
+  is never auto-removed). Refuses to act without a `.bootstrap-manifest.json`
+  (proof the project was forge-bootstrapped), edits `settings.json`/`.gitignore`
+  rather than deleting them, preserves user-authored agents/skills not in the
+  payload, and is idempotent. A `[y/N]` confirm guards it unless `--yes`/`-y` or
+  `FORGE_NON_INTERACTIVE=1`.
+
+## [1.0.36] — 2026-06-09
+
+Orchestrator dashboard logs + autonomous run-sprint + KB-refresh, re-landed onto
+the modular-orchestrator decomposition.
+
+### Added
+
+- **Orchestrator decision logs on the dashboard.** The shared
+  `withOrchestratorTranscript` notify-interception now mirrors every
+  orchestrator notify onto its root node (`tree.appendTail(entityId, …)`), and
+  the dashboard renders the Activity log for ALL node kinds (not just leaf). The
+  task/sprint/bug root node now carries the orchestrator's own narrative — gate
+  results, review verdicts, escalations, halts — alongside the per-phase leaf
+  nodes' subagent tool-call activity. New granular per-phase lines: `〇 preflight
+  ok`, `dispatch persona/model`, resolved `verdict`, `〇 postflight ok`.
+- **KB-link refresh is orchestrator-owned in run-task.** After the writeback
+  phase, the pipeline calls `runRefreshKbLinks(cwd)` directly (forge-cli
+  subagents run via the Pi runtime and have no Skill tool, so the prior
+  `forge:refresh-kb-links` Skill-tool instruction caused a multi-call probe
+  loop).
+
+### Changed
+
+- **`/forge:run-sprint` runs to completion.** Removed the per-task "Continue to
+  next task?" confirm and the partial-ceremony-on-decline branch. A sprint
+  command now runs all of its tasks, then the single clean-complete ceremony.
+  The mid-sprint modal previously turned any UI hiccup into a premature partial
+  ceremony (ceremony firing after task 1 with later tasks still draft).
+  Deliberate cancellation (abort signal / task halt) still stops the sprint.
+
+### Fixed
+
+- Dispatch line printed `model=[object Object]` — `modelResolution.model` is a
+  `{provider, model}` object; now formatted as `provider:model`.
+
+## [1.0.35] — 2026-06-07
+
+Re-bundle forge-plugin 1.4.4 — CLI-first field-test gap fixes: paths.commands
+no longer prefix-derived (always `.claude/commands/forge`), explicit
+`paths.forgeRoot=".forge"` write, dev-only tools excluded from the
+structure manifest (instance expectation 49/49, no false /forge:health gaps).
+
+## [1.0.34] — 2026-06-07
+
+No-dead-vendored-references gate (closes the forge#112 failure class).
+
+### Added
+
+- **`tools/check-vendored-refs.cjs`** — scans every vendored text file
+  (commands, drivers, rulebooks, settings, agents, skills) for
+  `.forge/…` / `$FORGE_ROOT/…` path references and fails on any whose
+  target doesn't exist post-bootstrap. Wired in twice: vitest
+  (`vendored-refs.test.ts`, against the real payload) and `tmp-smoke.sh`
+  BOOTSTRAP-9.
+
+### Fixed
+
+- Two dead references the new gate caught immediately:
+  **`forge-preflight.cjs`** (referenced by the run-task driver +
+  meta-fix-bug/meta-orchestrate — /forge:run-task would have hit a dead tool
+  on first use) added to `TOOLS_TO_COPY`, and
+  **`init/workflow-gen-plan.json`** (referenced by rebuild.md) bundled.
+
+## [1.0.33] — 2026-06-07
+
+Re-bundle forge-plugin 1.4.3 — wfl-init.js Phase 2 verify invocations carry
+the required `--kb-path` ([forge#112](https://github.com/Entelligentsia/forge/issues/112) follow-up).
+
+## [1.0.32] — 2026-06-07
+
+Re-bundle forge-plugin 1.4.2 — wfl-init.js Workflow-API rewrite
+([forge#112](https://github.com/Entelligentsia/forge/issues/112): phase
+callbacks silently discarded → init ran 0 agents but reported success;
+parallel() thunks; agent(prompt, opts) arg order; missing schema opts).
+
+### Fixed
+
+- **`build-payload` bundles the full `init/` rulebook tree** — `discovery/`
+  (5 prompts) and `generation/` (11 rulebooks) join `phases/`. Bundling only
+  `phases/` left wfl-init.js discovery/KB-doc subagents with dead rulebook
+  references in vendored projects.
+
+## [1.0.31] — 2026-06-07
+
+Re-bundle forge-plugin 1.4.1 — wfl-init.js Workflow-harness parse fix
+(`export default` wrapper stripped; every `/forge:init` dispatch previously
+failed at launch with "SyntaxError: Unexpected keyword 'export'").
+Projects bootstrapped with the broken driver: re-run `4ge init claude .`
+(idempotent repair overwrites `.claude/workflows/wfl-init.js`).
+
+## [1.0.30] — 2026-06-07
+
+Fixed `/forge:*` command namespace — full project vendoring (bundles forge-plugin 1.4.0).
+
+### Changed
+
+- **Bootstrap Step 4 — full `/forge:*` command surface vendored.** Replaces the
+  init.md-only install: the union of `.base-pack/commands/` (17 sprint-workflow
+  shims, now static `/forge:*` files) and `commands/` (utility commands) vendors
+  into `.claude/commands/forge/`. On name collision (`init.md`, `check-agent.md`,
+  `enhance.md`) the `.base-pack` version wins. Project-prefix namespaces
+  (`/acme:*`, `/hello:*`) are retired — wfl:init no longer generates them
+  (plugin 1.4.0 `getCommandsSubdir()` is fixed to `forge`).
+
+- **Bootstrap Step 4c — Forge-root content vendored into `.forge/`.** `init/`
+  (wfl:init phase rulebooks), `.base-pack/` (Phase 3 materialization source —
+  substitute-placeholders probes it first), `meta/` (rebuild/migrate sources +
+  skill-recommendations), and `.claude-plugin/plugin.json` (version source).
+  The vendored `.forge/` now serves as a complete Forge root for the
+  `${CLAUDE_PLUGIN_ROOT:-$(pwd)/.forge}` fallback every command carries.
+
+- **Bootstrap Step 4d — Claude Code assets vendored into `.claude/`.**
+  `agents/` (store-query-validator, tomoshibi) and `skills/` (4 skill dirs).
+
+- **`forge.bundledVersion`** corrected to track the actually-bundled plugin
+  (1.4.0; had drifted at 1.2.21).
+
+### Fixed
+
+- **`composeUpdateKickoff` directive patch** handles both the plugin ≥ 1.4.0
+  `${CLAUDE_PLUGIN_ROOT:-$(pwd)/.forge}` form and the legacy
+  `${CLAUDE_PLUGIN_ROOT}` form when retargeting `update.md`.
+
+## [1.0.29] — 2026-06-07
+
+`4ge init claude` bootstrap repair, round 2 — hook runtime deps (PostToolUse MODULE_NOT_FOUND in 1.0.28).
+
+### Fixed
+
+- **`hooks/lib/` vendored (bootstrap Step 3b + build-payload 2e4).** Hook scripts
+  require `./lib/common.cjs` / `./lib/write-registry.js` at runtime; neither the
+  payload nor the bootstrap shipped `hooks/lib/`, so `validate-write`, `post-init`,
+  and `post-sprint` failed with MODULE_NOT_FOUND on every matching tool call
+  (fail-open, but noisy in the Claude Code UI).
+
+- **`query-logger.cjs` added to `TOOLS_TO_COPY`.** The settings.json PostToolUse:Bash
+  hook points at `.forge/tools/query-logger.cjs`, but the tool was never bundled into
+  the payload — a hard exit-1 hook error on every Bash call in a bootstrapped project.
+
+- **`tools/package.json` CJS scope marker vendored (FORGE-BUG-030 parity).** The
+  bootstrap copy filter (`*.cjs`/`*.js` only) dropped the `{"type":"commonjs"}`
+  marker build-payload writes into `tools/` — vendored `lib/*.js` would resolve as
+  ESM and crash in `"type":"module"` host projects.
+
+## [1.0.28] — 2026-06-07
+
+`4ge init claude` bootstrap repair — vendor hook scripts + schemas (first-field-test regressions in 1.0.27).
+
+### Fixed
+
+- **Bootstrap Step 3b — hook scripts vendored.** `bootstrapClaudeProject()` now copies
+  `payload/hooks/*.cjs` into `.forge/tools/hooks/` — the exact paths the Step 7 settings
+  wiring points at. In 1.0.27 the copy step was missing entirely, so every wired hook
+  (SessionStart, PreToolUse, PostToolUse, PermissionRequest) fired `node` against a
+  nonexistent file and failed with MODULE_NOT_FOUND on session start.
+
+- **Bootstrap Step 3c — schemas vendored.** `payload/schemas/*.json` + `schemas/_defs/`
+  are now copied into `.forge/schemas/` (previously scaffolded empty), per the
+  cli-first-bootstrap ADR ("vendor tools → `.forge/tools/` + schemas").
+
+- **`settings-merge.ts` — query-logger retarget.** `query-logger.cjs` is a tool, not a
+  hook script (plugin `hooks.json` points it at `tools/query-logger.cjs`); the settings
+  block now targets `$CLAUDE_PROJECT_DIR/.forge/tools/query-logger.cjs` instead of the
+  nonexistent `tools/hooks/query-logger.cjs`.
+
+- Bootstrap manifest `steps` now records `vendor-hooks` and `vendor-schemas`.
+
+## [1.0.27] — 2026-06-07
+
+`4ge init claude` — settings hooks wiring, gitignore, preflight, hand-off UX (FORGE-S31-T03).
+
+### Added
+
+- **`settings-merge.ts`** — new `mergeForgeHooks()` + `buildForgeHooksBlock()` module with
+  merge-not-clobber semantics for wiring Forge hooks into project `.claude/settings.json`.
+  Handles 6 branches: absent file (create), empty object (add hooks key), existing without hooks
+  (merge in), unrelated hooks (merge Forge entries without overwriting), already-present (no-op),
+  malformed JSON (error, never overwrites). Fully idempotent: second run returns `"already-present"`.
+
+- **Bootstrap Step 7** — `bootstrapClaudeProject()` now wires Forge hooks into project
+  `.claude/settings.json` via `mergeForgeHooks()`. All 8 hook entries (7 task-workflow hooks +
+  `forge-permissions`) are written with commands pointing at
+  `$CLAUDE_PROJECT_DIR/.forge/tools/hooks/<name>.cjs`. Outcome (`created`/`skipped`/`warnings`)
+  reported in `BootstrapResult` per existing conventions.
+
+- **Bootstrap Step 8** — idempotent `.gitignore` append. Ported `updateGitignore()` from
+  `phase4-register.ts` as a pure standalone function (no `ctx.ui`). If `.gitignore` is present
+  and does not already contain a `.forge/store/events/` parent pattern, appends the standard
+  Forge gitignore block. Skips silently when absent or already covered.
+
+- **Bootstrap Step 9** — preflight check for Claude Code availability (`runPreflight()`). Detects
+  `claude` binary reachability via `execFileSync("claude", ["--version"])`. Non-fatal: adds an
+  actionable warning to `result.warnings` if unavailable, but does not flip `result.ok`. Returns
+  `BootstrapPreflight { claudeAvailable, workflowToolChecked, warnings }` attached to `BootstrapResult`.
+
+- **`BootstrapPreflight` type** — new sub-object on `BootstrapResult` with `claudeAvailable: boolean`,
+  `workflowToolChecked: boolean` (always `false` in T03 — no reliable offline check), and `warnings: string[]`.
+  Additive change — T02 tests remain green.
+
+- **Hand-off UX** — `init.ts` now prints a structured multi-line message naming `/forge:init`,
+  explaining the one-time hooks-approval prompt, and listing all 7 task-workflow hooks by name
+  and event type. Prepends a warning line if Claude Code was not found on PATH.
+
+- **Test suite** — 9-fixture `settings-merge.test.ts` covering all merge branches; 11 new assertions
+  in `bootstrap.test.ts` for Steps 7–9 and idempotency.
+
+## [1.0.26] — 2026-06-07
+
+CLI-first bootstrap: new `4ge init claude [dir]` bin subcommand (FORGE-S31-T02).
+
+### Added
+
+- **`forge init claude [dir]` subcommand** — new bin route that deterministically
+  bootstraps a Claude Code project from the bundled forge-payload in seconds.
+  Zero LLM tokens, zero network access, pure fs. Scaffolds `.forge/` skeleton
+  + store dirs, vendors tools+lib into `.forge/tools/`, installs
+  `.claude/commands/forge/init.md` from payload, and installs all four
+  `.claude/workflows/wfl-*.js` drivers. Writes `.forge/.bootstrap-manifest.json`
+  with payload version and integrity hash. Idempotent repair: a second consecutive
+  run is a byte-identical no-op; partial bootstraps are repaired file-by-file.
+  `.forge/config.json` and `.forge/store/**` are never touched.
+
+- **`src/extensions/forgecli/claude-bootstrap/bootstrap.ts`** — the pure-fs
+  bootstrap module (`bootstrapClaudeProject(opts)`) with clean/partial/complete
+  idempotency, fast-fail payload validation, and structured `BootstrapResult`
+  (created/skipped/warnings). Grep-negative: no fetch/network, no store writes,
+  no sendUserMessage, no ctx.ui.
+
+- **Vitest tests** in
+  `test/extensions/forgecli/claude-bootstrap/bootstrap.test.ts` — 17 tests
+  covering clean / partial / complete (no-op) / non-writable / payload-validation
+  / init.md install / wfl-drivers / grep-negative ACs branches. All integration-
+  style against the real function (no fs mocking).
+
+- **argv.ts**: extended `ForgeAction` union with `"init"`; added `init claude [dir]`
+  parse branch before the fast-path subcommand block.
+
+- **`src/bin/init.ts`** — `parseInitArgs()` + `runInit()` handler following the
+  `runDoctor` / `runUpdate` / `runConfig` structural convention.
+
+- **forge.ts**: wired `forgeAction === "init"` dispatch branch; updated help text.
+
+## [1.0.25] — 2026-06-06
+
+Coordinated release matching forge plugin **v1.2.21**. Both changes come from
+the first live firing of the deterministic commit phase (HELLO-BUG-002
+transcript analysis).
+
+### Added
+
+- **`forge_commit` named tool** — the commit phase's primary invocation
+  surface on forgecli: typed TypeBox params (`entity`, `id`, `message`,
+  `trailer`, `also[]`, `dryRun`, `skipGate`; deliberately **no `force`** —
+  operator-gated, never reachable from a subagent), argv-array spawn of
+  `commit-task.cjs` (no shell-quoting of the commit message), terminal-status
+  phase-ownership guard, full hook/governor visibility. Injected into every
+  subagent via the standard `ForgeToolDefs` surface.
+
+### Fixed
+
+- **fix-bug pipeline now performs the orchestrator-owned post-triage status
+  transitions** (`reported → triaged → in-progress`, per `meta-fix-bug.md`
+  step 2). Previously unimplemented: every bug reached the commit phase still
+  `reported`, tripping `commit-task`'s status guard and sending the subagent
+  through an illegal-transition recovery loop. Idempotent on resume
+  (`postTriageTransitions` helper, unit-tested).
+- Re-vendored plugin payload at **v1.2.21** (commit-task check-ignore
+  pre-filter + nothing-to-commit no-op success).
+
+## [1.0.24] — 2026-06-06
+
+### Added
+
+- **`forgeRoot` self-heal** (testbench clone-portability). A git-tracked
+  `.forge/config.json` may carry a `paths.forgeRoot` stamped on another
+  machine (global npm prefix, Claude plugin cache). When the configured path
+  does not exist, `discoverForgeConfig` now falls back to this forgecli's
+  bundled payload instead of handing callers a dangling root that breaks
+  `forge_store` (and every Forge command) on a fresh clone. The original
+  path is preserved in `healedFrom` for diagnostics. Enables the
+  forge-testbench *clone → main → run* contract.
+
+## [1.0.23] — 2026-06-06
+
+Coordinated release matching forge plugin **v1.2.20** (deterministic commit
+choreography — forge-engineering#40).
+
+### Changed
+
+- **Commit phase cost collapse.** `forge.bundledVersion` 1.2.18 → 1.2.20:
+  the bundled `commit_task.md` now routes the entire commit choreography
+  through the new `commit-task.cjs` (added to `TOOLS_TO_COPY`) — preflight
+  gate, status precondition, staging from `files_changed` provenance,
+  commit-boundary guard, `git commit`, terminal transition in ONE tool call.
+  The commit phase, previously the most expensive phase of the pipeline
+  (15–31% of run input tokens; 25–55 turns on glm-4.7), shrinks to
+  inspect-once → craft message → one tool call. The generated workflow also
+  shrank 5.2KB → 3.9KB of per-turn context.
+- New allowlist pin: workflow-referenced tools (invisible to the TS
+  source-scan) are now asserted present in `TOOLS_TO_COPY` —
+  `commit-task.cjs` is the first entry.
+
+## [1.0.22] — 2026-06-06
+
+Coordinated release matching forge plugin **v1.2.18** (event-type vocabulary
+spec owner — forge-engineering#39).
+
+### Fixed
+
+- **Bug-pipeline fail events are no longer dropped.** `BUG_TYPE_TOKENS`'
+  `fix-revision-requested` (approve fail) and `bug-commit-failed` (commit
+  fail) were rejected by the bundled event schema since their introduction —
+  every fix-bug approve-revision/commit-failure event and its token telemetry
+  was silently discarded (warn-and-continue). The re-vendored v1.2.18 payload
+  accepts them; `forge.bundledVersion` pin moved 1.0.10 → 1.2.18.
+
+### Added
+
+- **Sprint-grain lifecycle events.** `forge:run-sprint` now store-emits
+  `sprint-start` (once, before the task loop, fresh starts only) and
+  `task-dispatch` (before each task dispatch), completing the four-token
+  sprint vocabulary it already half-emitted (`sprint-complete`/
+  `sprint-halted`) — parity with the `wfl:run-sprint` JS driver.
+- **Event-vocabulary contract test**
+  (`test/extensions/forgecli/event-vocabulary-contract.test.ts`): every
+  store-emitted `type` token in the orchestrators and skill-curation
+  emitters must be a member of the vendored schema enum. This is the
+  recurrence guard for the #39 drift class — an invented token now fails CI
+  instead of silently dropping events at runtime.
+
 ## [1.0.21] — 2026-06-05
 
 The transcript-archive release: every orchestrator run is now permanently

package/README.md

@@ -18,6 +18,8 @@
 
 forge-cli generates a project-specific engineering knowledge base, sprint workflows, agent personas, and an SDLC pipeline — then drives them from your terminal on the [pi-coding-agent] runtime. Model-agnostic. No editor lock-in.
 
+> **Two ways to run Forge.** Drive it headless in your terminal on the pi runtime (this README), **or** scaffold Forge into a Claude Code project with `4ge init claude .` and run the `/forge:*` slash commands inside Claude Code — remove it with `4ge uninstall claude`. The `4ge init` path is the supported way to add Forge to Claude Code and **replaces the deprecated marketplace plugin install** ([why](https://github.com/Entelligentsia/forge#distribution)).
+
 ## Why
 
 - **Structured SDLC, in any terminal.** Plan → implement → review → validate → commit chains, gated by your own personas and audience rules.

package/dist/CHANGELOG-forge-plugin.md

@@ -5,6 +5,287 @@ Format: newest first. Breaking changes are marked **△ Breaking**.
 
 ---
 
+## [1.4.5] — 2026-06-09
+
+Collate-workflow KB-link refresh is orchestrator-owned under forge-cli. The
+generated collate workflow no longer instructs the collator subagent to invoke
+the `forge:refresh-kb-links` Skill tool — forge-cli subagents run via the Pi
+runtime, which has no Skill tool, so the instruction triggered a multi-call
+bash-probe loop before falling back. The Claude Code TUI standalone path still
+uses the Skill tool; under forge-cli the run-task orchestrator owns the KB
+refresh after the writeback phase. Prose-only change to `collator_agent.md`
+(base-pack) and `meta-collate.md`.
+
+**Regenerate:** workflows:collator_agent
+
+> Manual: run `/forge:update` (or `/forge:rebuild`) to regenerate the collate workflow.
+
+---
+
+## [1.4.4] — 2026-06-07
+
+First full CLI-first field test (git.git, ~500 source files) — `/forge:init`
+passed all phases; gap analysis surfaced three config/manifest defects.
+
+### Fixed
+
+- **`paths.commands` config drift** — `phase-1-collect.md` still carried a
+  prefix-derived instruction ("if prefix is `HELLO`, write
+  `.claude/commands/hello`") that survived the 1.4.0 namespace redesign; the
+  config-writer followed it and check-structure reported commands 0/14. The
+  path is ALWAYS `.claude/commands/forge`.
+- **`paths.forgeRoot` written as an absolute npm-global payload path** — no
+  rulebook said what to write, so the register agent improvised. New explicit
+  `generate-tools.md` step: `paths.forgeRoot = ".forge"` (the vendored
+  `.forge/` IS the Forge root; absolute paths break on upgrades/nvm switches).
+- **False "missing tools" gaps (49/59)** — `build-manifest.cjs` now excludes
+  the 10 plugin-development tools (`build-manifest`, `gen-integrity`,
+  `token-forensics`, …) from the `tools` namespace: the structure manifest
+  describes project instances, and dev tools are never vendored.
+  `structure-manifest.json` regenerated; instance expectation is now 49/49.
+
+## [1.4.3] — 2026-06-07
+
+### Fixed
+
+- **`wfl-init.js` Phase 2 verify invocations matched the tool's real CLI**
+  ([forge#112](https://github.com/Entelligentsia/forge/issues/112) follow-up).
+  Prompts said `verify-phase.cjs --phase 2` bare; the tool requires
+  `--phase 2 --kb-path <path>` and exits 2 without it. Both invocations now
+  pass `--kb-path "${kbFolder}"`. Contract gates added: every driver
+  verify-phase invocation must use a supported phase (1–3) and `--phase 2`
+  must carry `--kb-path`.
+
+## [1.4.2] — 2026-06-07
+
+### Fixed
+
+- **`wfl-init.js` ran zero agents but reported fabricated success
+  ([forge#112](https://github.com/Entelligentsia/forge/issues/112)).** Four
+  Workflow-API misuses: `phase(title, callback)` callbacks (containing every
+  phase body) were silently discarded by the harness; `parallel()` received
+  in-flight promises instead of thunks; `agent()` got the model tier as first
+  arg instead of `opts.model`; structured results lacked `opts.schema` so
+  `.ok` reads were undefined. `/forge:init` "completed" in ~3 ms with 0 agents
+  and hardcoded `ok: true`. Phase bodies now run inline, fan-outs use thunks,
+  every agent call is `agent(prompt, { model, label, phase, schema })`, and
+  the final report reflects real phase results (halts return `ok: false` with
+  the failure reason). Rulebook reads use vendored `.forge/init/...` paths
+  with a direct-analysis fallback for absent prompt files. Fix ported from
+  the field-validated patch authored against the live testbench run.
+
+### Added
+
+- **`wfl-drivers-parse.test.cjs` API-contract gates** — all drivers checked
+  for phase-callback misuse, promise-instead-of-thunk `parallel()` calls,
+  reversed `agent()` args, and dead `init/**.md` rulebook references.
+
+## [1.4.1] — 2026-06-07
+
+### Fixed
+
+- **`wfl-init.js` failed to launch — "SyntaxError: Unexpected keyword 'export'".**
+  The driver shipped wrapped in `export default async function wflInit(args)`,
+  but the Workflow harness permits exactly one export (the leading `meta`
+  literal) and evaluates the remainder as an async function body. The body now
+  runs at top level reading the `args` global, matching the other three
+  drivers. Every `/forge:init` → `workflow('wfl:init')` dispatch was dead on
+  arrival before this fix.
+
+### Added
+
+- **`wfl-drivers-parse.test.cjs`** — regression gate that parses all base-pack
+  `wfl-*.js` drivers exactly the way the Workflow harness does (single meta
+  export, body as async function body with workflow globals in scope).
+
+## [1.4.0] — 2026-06-07
+
+### Changed — △ Breaking
+
+- **Fixed `/forge:*` command namespace (CLI-first redesign).** Project-prefix
+  command namespaces (`/acme:*`, `/hello:*`) are retired — every project gets
+  the same `/forge:*` surface, with full parity between Claude Code and the
+  pure CLI (`4ge`):
+  - `tools/lib/paths.cjs` — `getCommandsSubdir()` returns `'forge'`
+    unconditionally (prefix arg is vestigial, kept for caller compat).
+  - `init/base-pack/commands/*.md` — `/{{PREFIX}}:` → literal `/forge:`
+    (26 occurrences, 17 files). Command templates are now fully static.
+  - `tools/substitute-placeholders.cjs` — materializes commands to
+    `.claude/commands/forge/` regardless of project prefix.
+  - Rulebooks updated: `generate-commands.md`, `phase-3-materialize.md`,
+    `phase-1-collect.md` (config `paths.commands` example), `meta-migrate.md`,
+    `migrate_structural.md`, `commands/add-task.md` next-steps text.
+  - The prefix-derived namespace existed to avoid collisions with the Forge
+    *plugin's* own `/forge:*` commands — moot now that the plugin mechanism
+    is retired in favour of project-vendored commands.
+  - **Migration:** existing projects keep working with their old
+    `.claude/commands/<prefix>/` files; re-materialize to get
+    `.claude/commands/forge/`, then delete the prefix directory.
+
+- **`FORGE_ROOT` vendored fallback in every command.** All 33 resolution
+  lines across `commands/*.md` and `init/base-pack/commands/*.md` change from
+  `${CLAUDE_PLUGIN_ROOT}` to `${CLAUDE_PLUGIN_ROOT:-$(pwd)/.forge}` — in a
+  plugin-installed session the plugin root still wins; in a plugin-less
+  project bootstrapped by `4ge init claude` the vendored `.forge/` (tools,
+  schemas, hooks, init, meta) serves as the Forge root.
+
+## [1.3.0] — 2026-06-07
+
+### Added
+
+- **`init/base-pack/commands/init.md`** — new project-local command wrapper
+  installed by `4ge init claude .` into `.claude/commands/forge/`. Contains
+  the full hoisted-prompt flow (KB folder prompt, CLAUDE.md offer, timestamp
+  minting), dispatches `workflow('wfl:init', args)`, handles the
+  Workflow-tool-missing error explicitly, presents the marketplace-skills offer
+  from `result.skillMatches` post-workflow, invokes `forge:refresh-kb-links`
+  via the Skill tool, and emits the final report (KB doc count, workflow count,
+  command count, accepted/skipped skills). Uses vendored `.forge/tools/` paths
+  only — no `$FORGE_ROOT` / `${CLAUDE_PLUGIN_ROOT}` references.
+
+### Changed
+
+- **`commands/init.md` (plugin-side)** — Execute section rewritten to dispatch
+  `workflow('wfl:init', args)` with hoisted interactive prompts (KB folder
+  prompt, CLAUDE.md offer, timestamp minting). Replaces the previous
+  `Read $FORGE_ROOT/init/sdlc-init.md` instruction. Includes the explicit
+  Workflow-tool-missing error halt (Iron Law 5 — no silent degradation or
+  fallback to `sdlc-init.md`).
+
+- **`init/phases/phase-1-collect.md`** — Pre-flight Knowledge Base Folder block
+  and Step 5 (Marketplace Skills) annotated as orchestrator-owned when the
+  orchestrator pre-supplies the values. Annotations are informational — no step
+  renames or renumbers (forge-cli `run-phases.ts` glob freeze maintained).
+
+- **`init/phases/phase-4-register.md`** — Step 11 (Tomoshibi/refresh-kb-links)
+  and Step 13 (CLAUDE.md prompt) annotated as orchestrator-owned. Same
+  semantics-preserving annotation policy.
+
+- **`init/sdlc-init.md`** — Body reduced to a spec-pointer paragraph: points
+  to `wfl-init.js` (orchestration), `commands/init.md` (dispatch surface), and
+  `init/phases/` (canonical per-phase contracts). Phase/verify table preserved
+  for human readers. File not deleted.
+
+---
+
+## [1.2.21] — 2026-06-06
+
+### Fixed
+
+- **`commit-task.cjs` hardened from its first live firing** (HELLO-BUG-002
+  transcript analysis, forge-engineering#40):
+  - Gitignored staging paths are pre-filtered (`git check-ignore`) and
+    warn-skipped — one ignored path no longer aborts the all-or-nothing
+    `git add` (the agent had retried the identical failing command).
+  - A clean staging set is now a **no-op success**: the tool still seals the
+    record's terminal status and returns
+    `{ok:true, committed:false, reason:"nothing-to-commit"}` — a bug whose
+    fix is already at HEAD ends `fixed` without the agent improvising manual
+    transitions. Result JSON gains an explicit `committed` flag.
+
+### Changed
+
+- **`meta-commit.md`: `forge_commit` named tool is the primary surface on
+  forgecli** — typed arguments, no shell-quoting of the commit message, full
+  hook/governor visibility. The `node .forge/tools/commit-task.cjs` bash form
+  remains the Claude Code fallback. The no-op outcome is documented as
+  success ("do not 'fix' a no-op by staging things yourself").
+
+---
+
+## [1.2.20] — 2026-06-06
+
+### Added
+
+- **`tools/commit-task.cjs` — deterministic commit choreography**
+  (forge-engineering#40). The commit phase was the most expensive phase of
+  the pipeline (15–31% of run input tokens across nine instrumented runs)
+  because an LLM re-derived deterministic choreography turn-by-turn. The new
+  tool owns the whole sequence in one call: preflight gate → status
+  precondition (task `approved` / bug `in-progress`) → staging-set derivation
+  (record artifact dir + implementation `files_changed` provenance +
+  validated `--also` extras) → commit-boundary guard (aborts loudly when the
+  index already has staged changes) → `git commit` → terminal transition
+  (task → `committed`, bug → `fixed`). `--dry-run` honored, argv-array
+  spawns only, `--force` operator-gated transitively via store-cli's
+  `FORGE_ALLOW_FORCE`. 11 tests.
+- **Implementation file provenance.** `PHASE_SUMMARY_SCHEMA` gains optional
+  `files_changed` (≤100 repo-relative paths); `meta-implement.md` instructs
+  recording every created/modified/deleted source path in
+  `IMPLEMENTATION-SUMMARY.json` — the commit phase no longer re-derives the
+  change surface from git.
+
+### Fixed
+
+- **`meta-commit.md` no longer commands an impossible store write.** The old
+  step 5 said *"Write the SUMMARY and return"* — but `commit` is not in
+  `VALID_SUMMARY_PHASES`, so obedient agents hunted for a format that doesn't
+  exist and then burned the 3-retry write-verification loop on a write that
+  can never validate. The workflow now states the no-summary contract
+  explicitly.
+- **Commit-phase flail loops closed at the prompt layer**: batched inspection
+  (`git diff --stat` once, one combined diff — never per-file), staging policy
+  owned by the tool (manual `git add`/`git commit`/`git reset` forbidden), and
+  the premature-commit/reset/redo loop explicitly banned.
+
+---
+
+## [1.2.19] — 2026-06-06
+
+### Fixed
+
+- **JS workflow drivers no longer let subagents guess event `type` tokens**
+  (forge-engineering#39 Phase 3). `wfl-run-task.js` / `wfl-fix-bug.js` now
+  carry `TASK_TYPE_TOKENS` / `BUG_TYPE_TOKENS` maps (verbatim ports of
+  `_fragments/event-vocabulary.md`) and inject explicit per-phase guidance
+  into the emit instructions: start events MUST NOT carry `type`, complete
+  events set the exact pass/fail token, and copying the action value
+  (`start`/`complete`) into `type` is explicitly forbidden — that guess-leak
+  produced the schema-rejected `type:"start"`/`type:"complete"` store
+  residue observed in `events/bugs/`.
+- **`wfl-run-task.js` `emitSkip()` skip events are no longer silently
+  rejected** — the event carried `iteration: 0` against the schema's
+  `minimum: 1`; every pre-task SKIP_STATUS event was dropped. Now `1`.
+
+---
+
+## [1.2.18] — 2026-06-06
+
+### Added
+
+- **Event-type vocabulary now has a spec owner** (forge-engineering#39). New
+  canonical fragment `_fragments/event-vocabulary.md` defines the phase→`type`
+  token tables for task, bug, and sprint events (pass/fail tokens per phase,
+  conditional field requirements, kebab-case convention). The schema enum in
+  `event.schema.json` mirrors the fragment; emitters never invent tokens.
+  `meta-fix-bug.md`, `meta-orchestrate.md`, `event-emission-schema.md`, and
+  the store-schema docs reference it.
+
+### Fixed
+
+- **Bug-pipeline fail events are no longer silently dropped.**
+  `event.schema.json` now accepts `fix-revision-requested` (approve fail) and
+  `bug-commit-failed` (commit fail) — the tokens forge-cli's fix-bug
+  orchestrator has emitted since 2026-05-15 but the enum rejected, discarding
+  the events and their token telemetry (observed live on testbench
+  CART-BUG-001).
+- **`bug-skipped` pre-loop skip event is now schema-valid.** New enum token +
+  conditional (requires `bugId`, no phase/iteration). The base-pack
+  `wfl-fix-bug.js` skip emit was triple-broken: underscore `bug_skipped`
+  token (not in enum), missing required `eventId`/`model`/`provider`, and an
+  undeclared `reason` key (`additionalProperties: false`). It now emits a
+  valid event with the skip reason in `notes` and `model`/`provider` `"n/a"`.
+  `meta-fix-bug.md` step 1 references the canonical shape.
+
+### Removed
+
+- **`bug-fixed` enum token retired** — defined since the bug-pipeline schema
+  landed, emitted by no surface, zero occurrences in any store. The
+  vocabulary fragment's invariant (every enum token has a named emitter)
+  forbids dead tokens.
+
+---
+
 ## [1.2.17] — 2026-06-04
 
 ### Fixed

package/dist/bin/argv.d.ts

@@ -1,5 +1,5 @@
-/** Parsed result when `--version`, `--help`, `doctor`, `update`, `config`, or a fast-path subcommand is requested. */
-export type ForgeAction = "version" | "help" | "doctor" | "update" | "config" | "subcommand" | null;
+/** Parsed result when `--version`, `--help`, `doctor`, `update`, `config`, `init`, or a fast-path subcommand is requested. */
+export type ForgeAction = "version" | "help" | "doctor" | "update" | "config" | "init" | "uninstall" | "subcommand" | null;
 /**
  * Whitelist of bare subcommands that bypass pi and exec a bundled cjs tool
  * directly. Each entry maps the user-typed subcommand to the cjs filename