@oomerevren/tryforge 0.1.2

package/dist/cli/src/commands/update.js

@@ -0,0 +1,119 @@
+import { readLinks } from "../core/store.js";
+import { loadIndex, loadPackageDetail, resolveVersion } from "../core/registry.js";
+import { compareSemver } from "../core/semver.js";
+import { ensurePackageContent } from "../core/installer.js";
+import { toSlug, ensureForgeDirs, writeLinks } from "../core/store.js";
+import { detectAdapters, addMcpServerToConfig, allAdapters } from "../adapters/index.js";
+import { loadConfig } from "../core/config.js";
+import { readLock, writeLock } from "../core/lock.js";
+import { findProjectToml, loadProjectToml } from "../core/project.js";
+import { resolve as resolvePath } from "path";
+function pickAdapters(harnesses) {
+    if (harnesses && harnesses.length > 0) {
+        const filtered = allAdapters.filter((a) => harnesses.includes(a.name));
+        if (filtered.length)
+            return filtered;
+    }
+    const cfg = loadConfig();
+    if (cfg.defaultHarnesses.length) {
+        const f = allAdapters.filter((a) => cfg.defaultHarnesses.includes(a.name));
+        if (f.length)
+            return f;
+    }
+    return detectAdapters();
+}
+export async function runOutdated(opts = {}) {
+    const t0 = Date.now();
+    const cwd = resolvePath(opts.cwd ?? process.cwd());
+    void cwd;
+    const links = readLinks();
+    const entries = Object.values(links);
+    if (entries.length === 0) {
+        console.log("[forge] no packages installed");
+        return;
+    }
+    // Faz 10 polish: index'i tek sefer yükle (20 pakette <10s hedefi için), semver-aware karşılaştır
+    const index = await loadIndex();
+    let outdated = 0;
+    for (const rec of entries) {
+        try {
+            const summary = index.packages[rec.pkg];
+            const latest = summary?.latest ?? (await loadPackageDetail(rec.pkg)).latest;
+            if (compareSemver(latest, rec.version) > 0) {
+                console.log(`${rec.pkg}  ${rec.version} → ${latest} (latest)`);
+                outdated++;
+            }
+        }
+        catch { }
+    }
+    const dt = ((Date.now() - t0) / 1000).toFixed(1);
+    if (outdated === 0)
+        console.log(`[forge] all packages up to date (${entries.length} checked in ${dt}s)`);
+    else
+        console.log(`\n[forge] ${outdated} package(s) outdated — run 'forge update' (${dt}s)`);
+}
+export async function runUpdate(pkgArg, opts = {}) {
+    const cwd = resolvePath(opts.cwd ?? process.cwd());
+    const links = readLinks();
+    const lock = readLock(cwd);
+    const tomlPath = findProjectToml(cwd);
+    let projectHarnesses;
+    if (tomlPath) {
+        try {
+            const proj = loadProjectToml(tomlPath);
+            projectHarnesses = proj.forge?.harnesses;
+        }
+        catch { }
+    }
+    const adapters = pickAdapters(projectHarnesses);
+    const targets = pkgArg ? [pkgArg] : Object.keys(links);
+    if (targets.length === 0) {
+        console.log("[forge] nothing to update — no installed packages");
+        return;
+    }
+    let updated = 0;
+    for (const name of targets) {
+        const rec = links[name];
+        if (!rec) {
+            console.warn(`[forge] ${name} not installed — skipping`);
+            continue;
+        }
+        try {
+            const detail = await loadPackageDetail(name);
+            const latest = detail.latest;
+            if (latest === rec.version) {
+                console.log(`  = ${name}@${rec.version} already latest`);
+                continue;
+            }
+            const { version, versionMeta } = await resolveVersion(name, latest);
+            const src = await ensurePackageContent(name, version, detail, versionMeta, { allowMock: opts.mock });
+            for (const adapter of adapters) {
+                await adapter.install(toSlug(name), src, detail.type);
+                if (detail.type === "mcp" && versionMeta.mcp) {
+                    const cfgPath = adapter.mcpConfigPath();
+                    if (cfgPath)
+                        addMcpServerToConfig(cfgPath, toSlug(name), versionMeta.mcp);
+                }
+            }
+            ensureForgeDirs();
+            links[name] = { ...rec, version, adapters: adapters.map((a) => a.name), installedAt: new Date().toISOString() };
+            writeLinks(links);
+            console.log(`  ✓ ${name} ${rec.version} → ${version}`);
+            updated++;
+        }
+        catch (e) {
+            console.warn(`  ✗ ${name} failed: ${e.message}`);
+        }
+    }
+    // Refresh lock if project has one
+    if (lock) {
+        const updatedEntries = Object.values(links).map((r) => ({ name: r.pkg, version: r.version, type: r.type ?? "skill" }));
+        updatedEntries.sort((a, b) => a.name.localeCompare(b.name));
+        writeLock(updatedEntries, cwd);
+        console.log(`[forge] lock refreshed: ${cwd}/forge.lock`);
+    }
+    if (updated === 0)
+        console.log("[forge] nothing updated");
+    else
+        console.log(`\n[forge] ✓ updated ${updated} package(s)`);
+}

package/dist/cli/src/core/config.js

@@ -0,0 +1,47 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { parse, stringify } from "smol-toml";
+import { forgeHome } from "./store.js";
+const DEFAULT_CONFIG = {
+    registry: "registry/index.json",
+    defaultHarnesses: [],
+    autoUpdate: false,
+    telemetry: false,
+};
+export function configPath() {
+    return join(forgeHome(), "config.toml");
+}
+export function loadConfig() {
+    const p = configPath();
+    if (!existsSync(p))
+        return { ...DEFAULT_CONFIG };
+    try {
+        const raw = readFileSync(p, "utf-8");
+        const parsed = parse(raw);
+        return {
+            registry: typeof parsed.registry === "string" ? parsed.registry : DEFAULT_CONFIG.registry,
+            defaultHarnesses: Array.isArray(parsed.defaultHarnesses) ? parsed.defaultHarnesses : [],
+            autoUpdate: typeof parsed.autoUpdate === "boolean" ? parsed.autoUpdate : false,
+            telemetry: typeof parsed.telemetry === "boolean" ? parsed.telemetry : false,
+        };
+    }
+    catch {
+        return { ...DEFAULT_CONFIG };
+    }
+}
+export function saveConfig(cfg) {
+    const dir = forgeHome();
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const content = stringify(cfg);
+    writeFileSync(configPath(), content);
+}
+export function ensureConfig() {
+    const p = configPath();
+    if (!existsSync(p)) {
+        const cfg = { ...DEFAULT_CONFIG };
+        saveConfig(cfg);
+        return cfg;
+    }
+    return loadConfig();
+}

package/dist/cli/src/core/installer.js

@@ -0,0 +1,279 @@
+import { existsSync, mkdirSync, writeFileSync, rmSync, readFileSync } from "fs";
+import { join, resolve, sep } from "path";
+import { createHash } from "crypto";
+import { tmpdir } from "os";
+import { execFileSync } from "child_process";
+import { packageDir, packagesDir, isPackageInstalled, toSlug, ensureForgeDirs, tarballsDir } from "./store.js";
+/**
+ * Ensure ~/.forge/packages/<slug>@<version>/ exists with package content.
+ * Fail-closed: download/hash errors throw (exit-1 path in callers), partial
+ * dirs are cleaned up. Mock generation requires opts.allowMock (`--mock`).
+ * Returns the source dir path.
+ */
+export async function ensurePackageContent(pkgName, version, detail, versionMeta, opts = {}) {
+    const slug = toSlug(pkgName);
+    const dest = packageDir(slug, version);
+    if (isPackageInstalled(slug, version)) {
+        // Empty-dir guard: a leftover/partial dir must never read as "installed".
+        try {
+            const { readdirSync } = await import("fs");
+            if (readdirSync(dest).length > 0)
+                return dest;
+            rmSync(dest, { recursive: true, force: true });
+        }
+        catch {
+            return dest;
+        }
+    }
+    ensureForgeDirs();
+    const tarballUrl = versionMeta.tarball ?? "";
+    const sha256 = versionMeta.sha256 ?? "";
+    const isPlaceholder = sha256.startsWith("placeholder") || tarballUrl.includes("placeholder");
+    // No verified tarball in registry: mock ONLY with explicit opt-in, else hard error.
+    if (isPlaceholder) {
+        if (!opts.allowMock) {
+            throw new Error(`[forge] ${pkgName}@${version} has no verified tarball yet (placeholder SHA).\n` +
+                `[forge] Re-run with --mock to install mock content, or run 'forge audit' to see verification status.`);
+        }
+        console.warn(`[forge] warning: installing MOCK content for ${pkgName}@${version} (--mock)`);
+        let createdMockDir = false;
+        if (!existsSync(dest)) {
+            mkdirSync(dest, { recursive: true });
+            createdMockDir = true;
+        }
+        try {
+            generateMockPackage(pkgName, version, detail, versionMeta, dest);
+        }
+        catch (err) {
+            if (createdMockDir) {
+                try {
+                    rmSync(dest, { recursive: true, force: true });
+                }
+                catch { }
+            }
+            throw err;
+        }
+        return dest;
+    }
+    // Real tarball: fail-closed. Any download/hash/extract error throws and
+    // cleans up the partial dir so a half-install never reads as "installed".
+    let createdDir = false;
+    if (!existsSync(dest)) {
+        mkdirSync(dest, { recursive: true });
+        createdDir = true;
+    }
+    try {
+        await downloadAndExtract(tarballUrl, sha256, dest, slug);
+        return dest;
+    }
+    catch (err) {
+        if (createdDir) {
+            try {
+                rmSync(dest, { recursive: true, force: true });
+            }
+            catch { }
+        }
+        throw new Error(`[forge] download/verify failed for ${pkgName}@${version}: ${err.message}\n` +
+            `[forge] Nothing was installed. Re-run with --mock to install mock content instead.`);
+    }
+}
+function generateMockPackage(pkgName, version, detail, versionMeta, dest) {
+    const type = detail.type;
+    const skillName = pkgName.split("/")[1] ?? pkgName;
+    // Faz 11: her tip gerçek iskelet üretir — forge add her tipi doğru yere kurar
+    if (type === "skill") {
+        const content = `# ${skillName} — ${detail.description}
+
+> Installed via Forge v0.1 — ${pkgName}@${version}
+> Source: ${detail.repository ?? detail.homepage ?? "registry"}
+> Type: ${type}
+
+## Usage
+This is a mock package generated by Forge when the real tarball is not yet available.
+Replace with real content when tarball download is enabled.
+
+## Info
+- Package: ${pkgName}
+- Version: ${version}
+- Type: ${type}
+- Keywords: ${(detail.keywords ?? []).join(", ")}
+
+## Forge
+\`\`\`bash
+forge info ${pkgName}
+forge list
+forge doctor
+\`\`\`
+`;
+        writeFileSync(join(dest, "SKILL.md"), content);
+    }
+    if (type === "agent") {
+        writeFileSync(join(dest, "agent.md"), `# ${skillName} — ${detail.description}\n\n> Installed via Forge — ${pkgName}@${version}\n\nDefine your agent's system prompt here.\n`);
+        writeFileSync(join(dest, "SKILL.md"), `# ${skillName} — agent\n\nSee agent.md for system prompt.\n`);
+    }
+    if (type === "command") {
+        writeFileSync(join(dest, "command.md"), `# ${skillName} — ${detail.description}\n\n> Installed via Forge — ${pkgName}@${version}\n\nSlash command: /${skillName}\n`);
+    }
+    if (type === "hook") {
+        writeFileSync(join(dest, "hook.json"), JSON.stringify({ name: pkgName, hooks: { "pre-tool": { entry: "./hook.js" } } }, null, 2) + "\n");
+        writeFileSync(join(dest, "hook.js"), `// ${pkgName} hook entry\nmodule.exports = {};\n`);
+    }
+    if (type === "plugin") {
+        writeFileSync(join(dest, "plugin.json"), JSON.stringify({ name: skillName, entry: "index.js", hooks: ["pre-tool", "post-tool"] }, null, 2) + "\n");
+        writeFileSync(join(dest, "index.js"), `// ${pkgName} plugin entry\nmodule.exports = {};\n`);
+    }
+    // MCP: also write a forge-mcp.json manifest for adapter use (Faz 11: mcp.json dahil)
+    if (type === "mcp" && versionMeta.mcp) {
+        writeFileSync(join(dest, "forge-mcp.json"), JSON.stringify(versionMeta.mcp, null, 2));
+        writeFileSync(join(dest, "mcp.json"), JSON.stringify({ mcpServers: { [skillName]: versionMeta.mcp } }, null, 2) + "\n");
+        // also SKILL.md for discoverability
+        writeFileSync(join(dest, "SKILL.md"), `# ${pkgName} — MCP Server\n\nMCP command: \`${versionMeta.mcp.command} ${(versionMeta.mcp.args ?? []).join(" ")}\`\n`);
+    }
+    // forge.toml manifest inside package (for debugging / audit)
+    const manifest = `# Generated by Forge — mock package
+[package]
+name = "${pkgName}"
+version = "${version}"
+type = "${type}"
+description = "${detail.description.replace(/"/g, '\\"')}"
+`;
+    writeFileSync(join(dest, "forge.toml"), manifest);
+    // Also write .forge-meta.json for tooling
+    writeFileSync(join(dest, ".forge-meta.json"), JSON.stringify({ name: pkgName, version, type, installedAt: new Date().toISOString(), tarball: versionMeta.tarball }, null, 2));
+    // Fail-closed marker: lets `forge audit` / `forge doctor` distinguish mock
+    // content from verified installs. Never write this for real tarballs.
+    writeFileSync(join(dest, ".forge-mock"), JSON.stringify({ mock: true, name: pkgName, version, installedAt: new Date().toISOString() }, null, 2) + "\n");
+}
+async function downloadAndExtract(url, expectedSha256, dest, slug) {
+    // Path-escape guard: dest must stay inside the packages store.
+    const storeRoot = resolve(packagesDir()) + sep;
+    if (!resolve(dest).startsWith(storeRoot)) {
+        throw new Error(`refusing to extract outside packages dir: ${dest}`);
+    }
+    const tmpFile = join(tmpdir(), `forge-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.tgz`);
+    // Prefer gh CLI for GitHub release assets (handles auth/redirects).
+    if (url.includes("github.com") && url.includes("/releases/download/")) {
+        try {
+            execFileSync("gh", ["release", "download", "--repo", "oomerevren-beep/forge", "--pattern", "*.tar.gz", "-D", tmpdir(), "--clobber"], { stdio: "pipe" });
+            // Find the downloaded file
+            const { readdirSync } = await import("fs");
+            const files = readdirSync(tmpdir()).filter(f => f.endsWith(".tar.gz") && f.startsWith(slug));
+            if (files.length > 0) {
+                const downloaded = join(tmpdir(), files[0]);
+                const buf = readFileSync(downloaded);
+                const sha256 = createHash("sha256").update(buf).digest("hex");
+                if (sha256 !== expectedSha256) {
+                    throw new Error(`sha256 mismatch: expected ${expectedSha256}, got ${sha256}`);
+                }
+                // Use Python tarfile for extraction (works reliably on Windows + Unix)
+                // Epoch 1e: filter='data' prevents tar-slip (../ path traversal) and symlink escapes
+                execFileSync("python", ["-c", `
+import tarfile, os, sys
+with tarfile.open(sys.argv[1], 'r:gz') as tf:
+    tf.extractall(sys.argv[2], filter='data')
+`, downloaded, dest], { stdio: "pipe" });
+                rmSync(downloaded, { force: true });
+                return;
+            }
+        }
+        catch (e) {
+            // fall through to fetch fallback
+        }
+    }
+    // Fallback: fetch (works for public URLs without auth)
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status} for ${url}`);
+    const buf = Buffer.from(await res.arrayBuffer());
+    // Verify sha256
+    if (expectedSha256 && !expectedSha256.startsWith("placeholder")) {
+        const hash = createHash("sha256").update(buf).digest("hex");
+        if (hash !== expectedSha256) {
+            throw new Error(`SHA256 mismatch: expected ${expectedSha256}, got ${hash}`);
+        }
+    }
+    // Save to cache (filename namespaced by slug to avoid collisions across scopes)
+    const rawName = url.split("/").pop() || "package.tgz";
+    const safeName = rawName.replace(/[^a-zA-Z0-9._-]/g, "_");
+    const cached = join(tarballsDir(), `${slug}--${safeName}`);
+    try {
+        const { writeFileSync } = await import("fs");
+        writeFileSync(cached, buf);
+    }
+    catch {
+        // ignore cache write fail
+    }
+    // Write to temp file for extraction
+    const { writeFileSync: wfs } = await import("fs");
+    wfs(tmpFile, buf);
+    // Extract via Python tarfile (works reliably on Windows + Unix)
+    // Epoch 1e: filter='data' prevents tar-slip (../ path traversal) and symlink escapes
+    try {
+        execFileSync("python", ["-c", `
+import tarfile, os, sys
+with tarfile.open(sys.argv[1], 'r:gz') as tf:
+    tf.extractall(sys.argv[2], filter='data')
+`, tmpFile, dest], { stdio: "pipe" });
+    }
+    catch (e) {
+        throw new Error(`tar extract failed: ${e.message}`);
+    }
+    finally {
+        try {
+            const { unlinkSync } = await import("fs");
+            unlinkSync(tmpFile);
+        }
+        catch { }
+    }
+    // Defense-in-depth: filter='data' already strips symlinks and ../ escapes,
+    // but we verify post-extraction as a safety net.
+    await assertNoSymlinks(dest);
+}
+/** Walk dest; throw on any symlink entry OR path that escapes the dest root.
+ *  Epoch 1e: symlinks that stay WITHIN the dest dir are safe (GitHub archives use them). */
+async function assertNoSymlinks(dest) {
+    const { readdirSync, lstatSync, realpathSync, readlinkSync } = await import("fs");
+    const destReal = realpathSync(dest);
+    const stack = [dest];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const full = join(dir, entry.name);
+            const stat = lstatSync(full);
+            if (stat.isSymbolicLink()) {
+                // Epoch 1e: allow symlinks that resolve within the package dir (GitHub archives)
+                try {
+                    const linkTarget = readlinkSync(full);
+                    const resolved = realpathSync(full);
+                    if (!resolved.startsWith(destReal + sep) && resolved !== destReal) {
+                        throw new Error(`tarball symlink escapes package dir: ${entry.name} → ${linkTarget}`);
+                    }
+                }
+                catch (e) {
+                    if (e.message?.includes("escapes"))
+                        throw e;
+                    // If we can't resolve, refuse
+                    throw new Error(`tarball contains unresolvable symlink (${entry.name}) — refusing to install`);
+                }
+            }
+            else {
+                // Epoch 1e: verify resolved path stays within dest (anti-tar-slip)
+                try {
+                    const fullReal = realpathSync(full);
+                    if (!fullReal.startsWith(destReal + sep) && fullReal !== destReal) {
+                        throw new Error(`tarball entry escapes package dir: ${entry.name}`);
+                    }
+                }
+                catch (e) {
+                    if (e.message?.includes("escapes"))
+                        throw e;
+                }
+                if (stat.isDirectory())
+                    stack.push(full);
+            }
+        }
+    }
+}
+export function isPlaceholderSha(sha) {
+    return sha.startsWith("placeholder");
+}

package/dist/cli/src/core/lock.js

@@ -0,0 +1,41 @@
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join, resolve } from "path";
+import { parse } from "smol-toml";
+export function lockPath(cwd = process.cwd()) {
+    return join(resolve(cwd), "forge.lock");
+}
+export function readLock(cwd = process.cwd()) {
+    const p = lockPath(cwd);
+    if (!existsSync(p))
+        return null;
+    try {
+        const raw = readFileSync(p, "utf-8");
+        const parsed = parse(raw);
+        const pkgs = parsed.packages;
+        if (!Array.isArray(pkgs))
+            return null;
+        const packages = pkgs.map((x) => ({
+            name: String(x.name),
+            version: String(x.version),
+            type: String(x.type ?? "skill"),
+        }));
+        return { packages };
+    }
+    catch {
+        return null;
+    }
+}
+export function writeLock(entries, cwd = process.cwd()) {
+    const p = lockPath(cwd);
+    // smol-toml stringify doesn't support array-of-tables well via object; craft manually
+    // Use [[packages]] TOML array of tables
+    const lines = ['# Generated by Forge — do not edit manually', ''];
+    for (const e of entries) {
+        lines.push("[[packages]]");
+        lines.push(`name = "${e.name}"`);
+        lines.push(`version = "${e.version}"`);
+        lines.push(`type = "${e.type}"`);
+        lines.push("");
+    }
+    writeFileSync(p, lines.join("\n"));
+}

package/dist/cli/src/core/permissions.js

@@ -0,0 +1,29 @@
+export const DEFAULT_PERMISSIONS = {
+    network: false,
+    filesystem: "read",
+    exec: false,
+    env: [],
+};
+export function validatePermissions(manifest) {
+    const errors = [];
+    if (manifest.network && typeof manifest.network !== "boolean") {
+        errors.push("network must be boolean");
+    }
+    if (manifest.filesystem && !["read", "write", "none"].includes(manifest.filesystem)) {
+        errors.push("filesystem must be 'read', 'write', or 'none'");
+    }
+    if (manifest.exec && typeof manifest.exec !== "boolean") {
+        errors.push("exec must be boolean");
+    }
+    return errors;
+}
+export function formatPermissions(manifest) {
+    const parts = [];
+    parts.push(`Network: ${manifest.network ? "allowed" : "denied"}`);
+    parts.push(`Filesystem: ${manifest.filesystem ?? "read"}`);
+    parts.push(`Exec: ${manifest.exec ? "allowed" : "denied"}`);
+    if (manifest.env && manifest.env.length > 0) {
+        parts.push(`Env: ${manifest.env.join(", ")}`);
+    }
+    return parts.join(" | ");
+}

package/dist/cli/src/core/plugin.js

@@ -0,0 +1,34 @@
+// cli/src/core/plugin.ts — Epoch 1e: adapter plugin sistemi
+// Adapter'ları CLI çekirdeğinden ayırarak dinamik yükleme
+import { existsSync, readdirSync } from "fs";
+import { join } from "path";
+/**
+ * Dynamically load adapter plugins from a directory.
+ * Each .ts/.js file must export a default Adapter or an `adapter` named export.
+ */
+export async function loadAdapterPlugins(pluginDir) {
+    if (!existsSync(pluginDir))
+        return [];
+    const plugins = [];
+    const files = readdirSync(pluginDir).filter((f) => f.endsWith(".ts") || f.endsWith(".js"));
+    for (const file of files) {
+        try {
+            const mod = await import(join(pluginDir, file));
+            const adapter = mod.default ?? mod.adapter;
+            if (adapter && typeof adapter.name === "string") {
+                plugins.push({ name: adapter.name, adapter });
+            }
+        }
+        catch (e) {
+            console.warn(`[forge] failed to load adapter plugin ${file}: ${e.message}`);
+        }
+    }
+    return plugins;
+}
+/**
+ * Load built-in adapters (bundled with CLI)
+ */
+export function loadBuiltInAdapters() {
+    // Dynamic imports for tree-shaking
+    return [];
+}

package/dist/cli/src/core/project.js

@@ -0,0 +1,60 @@
+import { existsSync, readFileSync } from "fs";
+import { join, resolve } from "path";
+import { parse } from "smol-toml";
+import { isValidRange } from "./semver.js";
+export const DEP_NAME_RE = /^[a-z0-9-]+\/[a-z0-9-]+$/;
+export function findProjectToml(cwd) {
+    const candidate = join(resolve(cwd), "forge.toml");
+    if (existsSync(candidate))
+        return candidate;
+    return null;
+}
+export function loadProjectToml(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf-8");
+    }
+    catch (e) {
+        throw new Error(`Cannot read ${path}: ${e.message}`);
+    }
+    let parsed;
+    try {
+        parsed = parse(raw);
+    }
+    catch (e) {
+        throw new Error(`${path}: invalid TOML — ${e.message}`);
+    }
+    // detect author [package] file (not a project install target)
+    if (parsed.package && !parsed.dependencies && !parsed.project) {
+        throw new Error(`${path} looks like a package manifest ([package]), not a project file. ` +
+            `Use 'forge add <pkg>' or create a project forge.toml with [dependencies].`);
+    }
+    const deps = (parsed.dependencies ?? {});
+    if (typeof deps !== "object" || Array.isArray(deps)) {
+        throw new Error(`${path}: [dependencies] must be a table`);
+    }
+    const dependencies = {};
+    for (const [k, v] of Object.entries(deps)) {
+        if (typeof v !== "string")
+            throw new Error(`${path}: dependency "${k}" must be a version string, got ${typeof v}`);
+        dependencies[k] = v;
+    }
+    const forge = parsed.forge;
+    const project = parsed.project;
+    return { project, dependencies, forge, package: parsed.package };
+}
+export function validateProjectToml(p, pathForMsg = "forge.toml") {
+    const errs = [];
+    for (const [name, range] of Object.entries(p.dependencies)) {
+        if (!DEP_NAME_RE.test(name))
+            errs.push(`Invalid dependency name "${name}" — expected scope/name (e.g. anthropics/plan)`);
+        if (!range || typeof range !== "string")
+            errs.push(`Invalid range for "${name}": ${String(range)}`);
+        else if (!isValidRange(range))
+            errs.push(`Invalid semver range for "${name}": "${range}"`);
+    }
+    if (p.forge?.harnesses !== undefined && !Array.isArray(p.forge.harnesses)) {
+        errs.push(`[forge].harnesses must be an array`);
+    }
+    return errs;
+}