@openforge-ai/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Forge AI Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -0,0 +1,627 @@
+#!/usr/bin/env node
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/index.ts
+var import_commander = require("commander");
+
+// src/commands/deploy.ts
+var import_chalk2 = __toESM(require("chalk"), 1);
+
+// src/parser/validate.ts
+var import_yaml = require("yaml");
+
+// src/parser/schema.ts
+var import_zod = require("zod");
+var modelProviderSchema = import_zod.z.enum(["anthropic", "openai", "google", "ollama", "bedrock"]);
+var modelConfigSchema = import_zod.z.object({
+  provider: modelProviderSchema,
+  name: import_zod.z.string().min(1),
+  temperature: import_zod.z.number().min(0).max(2).optional(),
+  max_tokens: import_zod.z.number().int().positive().optional()
+});
+var systemPromptSchema = import_zod.z.object({
+  file: import_zod.z.string().optional(),
+  inline: import_zod.z.string().optional()
+}).refine(
+  (data) => data.file || data.inline,
+  { message: "system_prompt must specify either 'file' or 'inline'" }
+);
+var mcpServerSchema = import_zod.z.object({
+  name: import_zod.z.string().min(1),
+  command: import_zod.z.string().min(1),
+  args: import_zod.z.array(import_zod.z.string()).optional(),
+  env: import_zod.z.record(import_zod.z.string()).optional()
+});
+var toolsConfigSchema = import_zod.z.object({
+  mcp_servers: import_zod.z.array(mcpServerSchema).optional()
+});
+var memoryTypeSchema = import_zod.z.enum(["none", "in-context", "vector"]);
+var memoryProviderSchema = import_zod.z.enum(["chroma", "pinecone", "weaviate"]);
+var memoryConfigSchema = import_zod.z.object({
+  type: memoryTypeSchema,
+  provider: memoryProviderSchema.optional(),
+  collection: import_zod.z.string().optional()
+}).refine(
+  (data) => data.type !== "vector" || data.provider,
+  { message: "vector memory type requires a provider" }
+);
+var hookStepSchema = import_zod.z.object({
+  run: import_zod.z.string().min(1)
+});
+var hooksConfigSchema = import_zod.z.object({
+  pre_deploy: import_zod.z.array(hookStepSchema).optional(),
+  post_deploy: import_zod.z.array(hookStepSchema).optional()
+});
+var environmentOverrideSchema = import_zod.z.object({
+  model: modelConfigSchema.partial().optional(),
+  tools: toolsConfigSchema.optional(),
+  memory: memoryConfigSchema.optional()
+});
+var agentConfigSchema = import_zod.z.object({
+  name: import_zod.z.string().min(1).regex(/^[a-z0-9-]+$/, "Agent name must be lowercase alphanumeric with hyphens"),
+  description: import_zod.z.string().optional()
+});
+var forgeConfigSchema = import_zod.z.object({
+  version: import_zod.z.literal("1"),
+  agent: agentConfigSchema,
+  model: modelConfigSchema,
+  system_prompt: systemPromptSchema.optional(),
+  tools: toolsConfigSchema.optional(),
+  memory: memoryConfigSchema.optional(),
+  environments: import_zod.z.record(environmentOverrideSchema).optional(),
+  hooks: hooksConfigSchema.optional()
+});
+
+// src/parser/validate.ts
+function parseForgeYaml(raw) {
+  let parsed;
+  try {
+    parsed = (0, import_yaml.parse)(raw);
+  } catch (err) {
+    return {
+      success: false,
+      errors: [`YAML parse error: ${err instanceof Error ? err.message : String(err)}`]
+    };
+  }
+  const result = forgeConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    return {
+      success: false,
+      errors: result.error.issues.map(
+        (issue) => `${issue.path.join(".")}: ${issue.message}`
+      )
+    };
+  }
+  return {
+    success: true,
+    config: result.data
+  };
+}
+function resolveEnvironment(config, env) {
+  if (!config.environments?.[env]) {
+    return config;
+  }
+  const override = config.environments[env];
+  const resolved = { ...config };
+  if (override.model) {
+    resolved.model = { ...config.model, ...override.model };
+  }
+  if (override.tools) {
+    resolved.tools = override.tools;
+  }
+  if (override.memory) {
+    resolved.memory = override.memory;
+  }
+  return resolved;
+}
+
+// src/parser/load.ts
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
+var import_chalk = __toESM(require("chalk"), 1);
+async function loadConfig(configPath) {
+  const resolved = (0, import_node_path.resolve)(configPath);
+  console.log(import_chalk.default.blue("\u2192 Reading configuration from"), resolved);
+  let raw;
+  try {
+    raw = await (0, import_promises.readFile)(resolved, "utf-8");
+  } catch {
+    console.error(import_chalk.default.red("\u2717 Could not read config file:"), resolved);
+    process.exit(1);
+  }
+  const result = parseForgeYaml(raw);
+  if (!result.success || !result.config) {
+    console.error(import_chalk.default.red("\u2717 Validation errors:"));
+    for (const err of result.errors ?? []) {
+      console.error(import_chalk.default.red(`  \u2022 ${err}`));
+    }
+    process.exit(1);
+  }
+  return result.config;
+}
+
+// src/engine/state.ts
+var import_promises2 = require("fs/promises");
+var import_node_crypto = require("crypto");
+var import_node_path2 = require("path");
+var STATE_FILE = "state.json";
+function sortDeep(obj) {
+  if (Array.isArray(obj)) return obj.map(sortDeep);
+  if (obj !== null && typeof obj === "object") {
+    const record = obj;
+    return Object.fromEntries(
+      Object.keys(record).sort().map((key) => [key, sortDeep(record[key])])
+    );
+  }
+  return obj;
+}
+function hashConfig(config) {
+  const normalized = JSON.stringify(sortDeep(config));
+  return (0, import_node_crypto.createHash)("sha256").update(normalized).digest("hex");
+}
+async function readState(stateDir) {
+  const statePath = (0, import_node_path2.join)(stateDir, STATE_FILE);
+  try {
+    const raw = await (0, import_promises2.readFile)(statePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || typeof parsed.configHash !== "string" || typeof parsed.agentName !== "string") {
+      console.warn("Warning: State file has invalid structure. Treating as no prior state.");
+      return null;
+    }
+    return parsed;
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+      return null;
+    }
+    console.warn("Warning: Failed to read state file. Treating as no prior state.");
+    return null;
+  }
+}
+async function writeState(stateDir, state) {
+  const statePath = (0, import_node_path2.join)(stateDir, STATE_FILE);
+  await (0, import_promises2.mkdir)(stateDir, { recursive: true, mode: 448 });
+  await (0, import_promises2.writeFile)(statePath, JSON.stringify(state, null, 2), {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+function redactConfig(config) {
+  const cloned = JSON.parse(JSON.stringify(config));
+  if (cloned.tools?.mcp_servers) {
+    for (const server of cloned.tools.mcp_servers) {
+      if (server.env) {
+        for (const [key, value] of Object.entries(server.env)) {
+          if (!/^\$\{.+\}$/.test(value)) {
+            server.env[key] = "[REDACTED]";
+          }
+        }
+      }
+    }
+  }
+  return cloned;
+}
+function createState(config, environment) {
+  return {
+    configHash: hashConfig(config),
+    lastDeployed: (/* @__PURE__ */ new Date()).toISOString(),
+    environment,
+    agentName: config.agent.name,
+    config: redactConfig(config)
+  };
+}
+
+// src/engine/planner.ts
+function plan(desired, actual) {
+  const result = {
+    toCreate: [],
+    toUpdate: [],
+    toDelete: [],
+    noChange: [],
+    hasChanges: false
+  };
+  if (!actual) {
+    result.toCreate.push({
+      resource: "agent",
+      newValue: desired.agent,
+      summary: `Create agent "${desired.agent.name}"`
+    });
+    result.toCreate.push({
+      resource: "model",
+      newValue: desired.model,
+      summary: `Configure model ${desired.model.provider}/${desired.model.name}`
+    });
+    if (desired.system_prompt) {
+      result.toCreate.push({
+        resource: "system_prompt",
+        newValue: desired.system_prompt,
+        summary: `Set system prompt from ${desired.system_prompt.file ?? "inline"}`
+      });
+    }
+    if (desired.tools?.mcp_servers) {
+      for (const server of desired.tools.mcp_servers) {
+        result.toCreate.push({
+          resource: "mcp_server",
+          field: server.name,
+          newValue: server,
+          summary: `Add MCP server "${server.name}"`
+        });
+      }
+    }
+    if (desired.memory && desired.memory.type !== "none") {
+      result.toCreate.push({
+        resource: "memory",
+        newValue: desired.memory,
+        summary: `Configure ${desired.memory.type} memory`
+      });
+    }
+    result.hasChanges = result.toCreate.length > 0;
+    return result;
+  }
+  const desiredHash = hashConfig(desired);
+  if (desiredHash === actual.configHash) {
+    result.noChange.push({
+      resource: "agent",
+      summary: `Agent "${desired.agent.name}" is up to date (hash: ${desiredHash.slice(0, 8)})`
+    });
+    return result;
+  }
+  const actualConfig = actual.config;
+  if (desired.agent.name !== actualConfig.agent.name) {
+    result.toUpdate.push({
+      resource: "agent",
+      field: "name",
+      oldValue: actualConfig.agent.name,
+      newValue: desired.agent.name,
+      summary: `Rename agent "${actualConfig.agent.name}" \u2192 "${desired.agent.name}"`
+    });
+  }
+  if (desired.agent.description !== actualConfig.agent.description) {
+    result.toUpdate.push({
+      resource: "agent",
+      field: "description",
+      oldValue: actualConfig.agent.description,
+      newValue: desired.agent.description,
+      summary: `Update agent description`
+    });
+  }
+  if (desired.model.provider !== actualConfig.model.provider) {
+    result.toUpdate.push({
+      resource: "model",
+      field: "provider",
+      oldValue: actualConfig.model.provider,
+      newValue: desired.model.provider,
+      summary: `Change model provider: ${actualConfig.model.provider} \u2192 ${desired.model.provider}`
+    });
+  }
+  if (desired.model.name !== actualConfig.model.name) {
+    result.toUpdate.push({
+      resource: "model",
+      field: "name",
+      oldValue: actualConfig.model.name,
+      newValue: desired.model.name,
+      summary: `Change model: ${actualConfig.model.name} \u2192 ${desired.model.name}`
+    });
+  }
+  if (desired.model.temperature !== actualConfig.model.temperature) {
+    result.toUpdate.push({
+      resource: "model",
+      field: "temperature",
+      oldValue: actualConfig.model.temperature,
+      newValue: desired.model.temperature,
+      summary: `Change temperature: ${actualConfig.model.temperature} \u2192 ${desired.model.temperature}`
+    });
+  }
+  if (desired.model.max_tokens !== actualConfig.model.max_tokens) {
+    result.toUpdate.push({
+      resource: "model",
+      field: "max_tokens",
+      oldValue: actualConfig.model.max_tokens,
+      newValue: desired.model.max_tokens,
+      summary: `Change max_tokens: ${actualConfig.model.max_tokens} \u2192 ${desired.model.max_tokens}`
+    });
+  }
+  const desiredServers = desired.tools?.mcp_servers ?? [];
+  const actualServers = actualConfig.tools?.mcp_servers ?? [];
+  const actualServerMap = new Map(actualServers.map((s) => [s.name, s]));
+  const desiredServerMap = new Map(desiredServers.map((s) => [s.name, s]));
+  for (const server of desiredServers) {
+    if (!actualServerMap.has(server.name)) {
+      result.toCreate.push({
+        resource: "mcp_server",
+        field: server.name,
+        newValue: server,
+        summary: `Add MCP server "${server.name}"`
+      });
+    } else {
+      const existing = actualServerMap.get(server.name);
+      if (JSON.stringify(server) !== JSON.stringify(existing)) {
+        result.toUpdate.push({
+          resource: "mcp_server",
+          field: server.name,
+          oldValue: existing,
+          newValue: server,
+          summary: `Update MCP server "${server.name}"`
+        });
+      }
+    }
+  }
+  for (const server of actualServers) {
+    if (!desiredServerMap.has(server.name)) {
+      result.toDelete.push({
+        resource: "mcp_server",
+        field: server.name,
+        oldValue: server,
+        summary: `Remove MCP server "${server.name}"`
+      });
+    }
+  }
+  result.hasChanges = result.toCreate.length > 0 || result.toUpdate.length > 0 || result.toDelete.length > 0;
+  return result;
+}
+function formatPlan(planResult) {
+  const lines = [];
+  if (!planResult.hasChanges) {
+    lines.push("No changes. Infrastructure is up to date.");
+    for (const item of planResult.noChange) {
+      lines.push(`  ${item.summary}`);
+    }
+    return lines.join("\n");
+  }
+  if (planResult.toCreate.length > 0) {
+    lines.push("Resources to CREATE:");
+    for (const item of planResult.toCreate) {
+      lines.push(`  + ${item.summary}`);
+    }
+  }
+  if (planResult.toUpdate.length > 0) {
+    lines.push("Resources to UPDATE:");
+    for (const item of planResult.toUpdate) {
+      lines.push(`  ~ ${item.summary}`);
+    }
+  }
+  if (planResult.toDelete.length > 0) {
+    lines.push("Resources to DELETE:");
+    for (const item of planResult.toDelete) {
+      lines.push(`  - ${item.summary}`);
+    }
+  }
+  lines.push(
+    `
+Plan: ${planResult.toCreate.length} to add, ${planResult.toUpdate.length} to change, ${planResult.toDelete.length} to destroy.`
+  );
+  return lines.join("\n");
+}
+
+// src/engine/applier.ts
+async function apply(plan2, config, opts) {
+  const stateDir = opts.stateDir ?? ".forge";
+  if (!plan2.hasChanges) {
+    const state2 = createState(config, opts.environment);
+    return {
+      success: true,
+      applied: [],
+      skipped: plan2.noChange,
+      state: state2
+    };
+  }
+  if (opts.dryRun) {
+    const state2 = createState(config, opts.environment);
+    return {
+      success: true,
+      applied: [],
+      skipped: [...plan2.toCreate, ...plan2.toUpdate, ...plan2.toDelete],
+      state: state2
+    };
+  }
+  const applied = [...plan2.toCreate, ...plan2.toUpdate, ...plan2.toDelete];
+  const state = createState(config, opts.environment);
+  await writeState(stateDir, state);
+  return {
+    success: true,
+    applied,
+    skipped: plan2.noChange,
+    state
+  };
+}
+
+// src/commands/deploy.ts
+async function deployCommand(opts) {
+  const baseConfig = await loadConfig(opts.config);
+  const config = resolveEnvironment(baseConfig, opts.env);
+  console.log(
+    import_chalk2.default.blue("\u2192 Agent:"),
+    config.agent.name,
+    import_chalk2.default.blue("| Environment:"),
+    opts.env,
+    import_chalk2.default.blue("| Model:"),
+    `${config.model.provider}/${config.model.name}`
+  );
+  const currentState = await readState(".forge");
+  const planResult = plan(config, currentState);
+  console.log("\n" + formatPlan(planResult));
+  if (!planResult.hasChanges) {
+    return;
+  }
+  if (opts.dryRun) {
+    console.log(import_chalk2.default.yellow("\n\u26A0 Dry run \u2014 no changes applied."));
+    return;
+  }
+  if (!opts.autoApprove) {
+    console.log(import_chalk2.default.yellow("\nDo you want to apply these changes?"));
+    console.log(import_chalk2.default.dim("  Use --auto-approve to skip this prompt.\n"));
+  }
+  const preHooks = config.hooks?.pre_deploy ?? [];
+  const postHooks = config.hooks?.post_deploy ?? [];
+  if (preHooks.length > 0 || postHooks.length > 0) {
+    console.log(import_chalk2.default.yellow("\n\u26A0 Hooks detected in configuration:"));
+    for (const hook of preHooks) {
+      console.log(import_chalk2.default.yellow(`  pre_deploy:  ${hook.run}`));
+    }
+    for (const hook of postHooks) {
+      console.log(import_chalk2.default.yellow(`  post_deploy: ${hook.run}`));
+    }
+    if (!opts.allowHooks) {
+      console.log(
+        import_chalk2.default.yellow("  Hooks will NOT be executed. Pass --allow-hooks to enable hook execution.\n")
+      );
+    }
+  }
+  const applyOpts = {
+    dryRun: opts.dryRun,
+    environment: opts.env,
+    autoApprove: opts.autoApprove
+  };
+  const result = await apply(planResult, config, applyOpts);
+  if (result.success) {
+    console.log(import_chalk2.default.green(`
+\u2713 Successfully deployed "${config.agent.name}" to ${opts.env}`));
+    console.log(import_chalk2.default.dim(`  State written to .forge/state.json`));
+    console.log(import_chalk2.default.dim(`  Config hash: ${result.state.configHash.slice(0, 12)}...`));
+  } else {
+    console.error(import_chalk2.default.red(`
+\u2717 Deploy failed: ${result.error}`));
+    process.exit(1);
+  }
+}
+
+// src/commands/diff.ts
+var import_chalk3 = __toESM(require("chalk"), 1);
+async function diffCommand(opts) {
+  const baseConfig = await loadConfig(opts.config);
+  const config = resolveEnvironment(baseConfig, opts.env);
+  const currentState = await readState(".forge");
+  const planResult = plan(config, currentState);
+  if (!planResult.hasChanges) {
+    console.log(import_chalk3.default.green("\u2713 No changes. Infrastructure matches configuration."));
+    return;
+  }
+  for (const item of planResult.toCreate) {
+    console.log(import_chalk3.default.green(`+ ${item.summary}`));
+    if (item.newValue) {
+      const lines = JSON.stringify(item.newValue, null, 2).split("\n");
+      for (const line of lines) {
+        console.log(import_chalk3.default.green(`  + ${line}`));
+      }
+    }
+  }
+  for (const item of planResult.toUpdate) {
+    console.log(import_chalk3.default.yellow(`~ ${item.summary}`));
+    if (item.oldValue !== void 0) {
+      console.log(import_chalk3.default.red(`  - ${JSON.stringify(item.oldValue)}`));
+    }
+    if (item.newValue !== void 0) {
+      console.log(import_chalk3.default.green(`  + ${JSON.stringify(item.newValue)}`));
+    }
+  }
+  for (const item of planResult.toDelete) {
+    console.log(import_chalk3.default.red(`- ${item.summary}`));
+  }
+}
+
+// src/commands/rollback.ts
+var import_chalk4 = __toESM(require("chalk"), 1);
+async function rollbackCommand(opts) {
+  const currentState = await readState(".forge");
+  if (!currentState) {
+    console.error(import_chalk4.default.red("\u2717 No state found. Nothing to roll back."));
+    process.exit(1);
+  }
+  console.log(import_chalk4.default.blue("\u2192 Current state:"));
+  console.log(import_chalk4.default.dim(`  Agent: ${currentState.agentName}`));
+  console.log(import_chalk4.default.dim(`  Environment: ${currentState.environment}`));
+  console.log(import_chalk4.default.dim(`  Deployed: ${currentState.lastDeployed}`));
+  console.log(import_chalk4.default.dim(`  Hash: ${currentState.configHash.slice(0, 12)}...`));
+  if (opts.targetHash) {
+    console.log(import_chalk4.default.yellow(`
+\u26A0 Rollback to ${opts.targetHash} is not yet implemented.`));
+    console.log(import_chalk4.default.dim("  State history tracking coming in a future release."));
+  } else {
+    console.log(import_chalk4.default.yellow("\n\u26A0 Specify a target hash to roll back to."));
+    console.log(import_chalk4.default.dim("  Usage: forge rollback --target <hash>"));
+  }
+}
+
+// src/commands/validate.ts
+var import_promises3 = require("fs/promises");
+var import_node_path3 = require("path");
+var import_chalk5 = __toESM(require("chalk"), 1);
+async function validateCommand(opts) {
+  const configPath = (0, import_node_path3.resolve)(opts.config);
+  let raw;
+  try {
+    raw = await (0, import_promises3.readFile)(configPath, "utf-8");
+  } catch {
+    console.error(import_chalk5.default.red("\u2717 Could not read config file:"), configPath);
+    process.exit(1);
+  }
+  const result = parseForgeYaml(raw);
+  if (result.success) {
+    const config = result.config;
+    console.log(import_chalk5.default.green("\u2713 Configuration is valid."));
+    console.log(import_chalk5.default.dim(`  Agent: ${config.agent.name}`));
+    console.log(import_chalk5.default.dim(`  Model: ${config.model.provider}/${config.model.name}`));
+    if (config.environments) {
+      const envs = Object.keys(config.environments);
+      console.log(import_chalk5.default.dim(`  Environments: ${envs.join(", ")}`));
+    }
+  } else {
+    console.error(import_chalk5.default.red("\u2717 Validation failed:"));
+    for (const err of result.errors ?? []) {
+      console.error(import_chalk5.default.red(`  \u2022 ${err}`));
+    }
+    process.exit(1);
+  }
+}
+
+// src/index.ts
+var program = new import_commander.Command();
+program.name("forge").description("Agent infrastructure as code \u2014 the Terraform for AI agents").version("0.1.0");
+program.command("deploy").description("Deploy an agent from a forge.yaml configuration").option("-c, --config <path>", "Path to forge.yaml", "forge.yaml").option("-e, --env <environment>", "Target environment", "dev").option("--auto-approve", "Skip confirmation prompt", false).option("--dry-run", "Show plan without applying changes", false).option("--allow-hooks", "Allow execution of pre_deploy and post_deploy hooks", false).action((opts) => {
+  return deployCommand({
+    config: opts.config,
+    env: opts.env,
+    autoApprove: opts.autoApprove,
+    dryRun: opts.dryRun,
+    allowHooks: opts.allowHooks
+  });
+});
+program.command("diff").description("Show what would change between config and deployed state").option("-c, --config <path>", "Path to forge.yaml", "forge.yaml").option("-e, --env <environment>", "Target environment", "dev").action((opts) => {
+  return diffCommand({
+    config: opts.config,
+    env: opts.env
+  });
+});
+program.command("rollback").description("Roll back to a previous deployment state").option("--target <hash>", "Target state hash to roll back to").action((opts) => {
+  return rollbackCommand({
+    targetHash: opts.target
+  });
+});
+program.command("validate").description("Validate a forge.yaml configuration file").option("-c, --config <path>", "Path to forge.yaml", "forge.yaml").action((opts) => {
+  return validateCommand({
+    config: opts.config
+  });
+});
+program.parse();

package/dist/index.d.cts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/index.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/index.js

@@ -0,0 +1,604 @@
+#!/usr/bin/env node
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/commands/deploy.ts
+import chalk2 from "chalk";
+
+// src/parser/validate.ts
+import { parse as parseYaml } from "yaml";
+
+// src/parser/schema.ts
+import { z } from "zod";
+var modelProviderSchema = z.enum(["anthropic", "openai", "google", "ollama", "bedrock"]);
+var modelConfigSchema = z.object({
+  provider: modelProviderSchema,
+  name: z.string().min(1),
+  temperature: z.number().min(0).max(2).optional(),
+  max_tokens: z.number().int().positive().optional()
+});
+var systemPromptSchema = z.object({
+  file: z.string().optional(),
+  inline: z.string().optional()
+}).refine(
+  (data) => data.file || data.inline,
+  { message: "system_prompt must specify either 'file' or 'inline'" }
+);
+var mcpServerSchema = z.object({
+  name: z.string().min(1),
+  command: z.string().min(1),
+  args: z.array(z.string()).optional(),
+  env: z.record(z.string()).optional()
+});
+var toolsConfigSchema = z.object({
+  mcp_servers: z.array(mcpServerSchema).optional()
+});
+var memoryTypeSchema = z.enum(["none", "in-context", "vector"]);
+var memoryProviderSchema = z.enum(["chroma", "pinecone", "weaviate"]);
+var memoryConfigSchema = z.object({
+  type: memoryTypeSchema,
+  provider: memoryProviderSchema.optional(),
+  collection: z.string().optional()
+}).refine(
+  (data) => data.type !== "vector" || data.provider,
+  { message: "vector memory type requires a provider" }
+);
+var hookStepSchema = z.object({
+  run: z.string().min(1)
+});
+var hooksConfigSchema = z.object({
+  pre_deploy: z.array(hookStepSchema).optional(),
+  post_deploy: z.array(hookStepSchema).optional()
+});
+var environmentOverrideSchema = z.object({
+  model: modelConfigSchema.partial().optional(),
+  tools: toolsConfigSchema.optional(),
+  memory: memoryConfigSchema.optional()
+});
+var agentConfigSchema = z.object({
+  name: z.string().min(1).regex(/^[a-z0-9-]+$/, "Agent name must be lowercase alphanumeric with hyphens"),
+  description: z.string().optional()
+});
+var forgeConfigSchema = z.object({
+  version: z.literal("1"),
+  agent: agentConfigSchema,
+  model: modelConfigSchema,
+  system_prompt: systemPromptSchema.optional(),
+  tools: toolsConfigSchema.optional(),
+  memory: memoryConfigSchema.optional(),
+  environments: z.record(environmentOverrideSchema).optional(),
+  hooks: hooksConfigSchema.optional()
+});
+
+// src/parser/validate.ts
+function parseForgeYaml(raw) {
+  let parsed;
+  try {
+    parsed = parseYaml(raw);
+  } catch (err) {
+    return {
+      success: false,
+      errors: [`YAML parse error: ${err instanceof Error ? err.message : String(err)}`]
+    };
+  }
+  const result = forgeConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    return {
+      success: false,
+      errors: result.error.issues.map(
+        (issue) => `${issue.path.join(".")}: ${issue.message}`
+      )
+    };
+  }
+  return {
+    success: true,
+    config: result.data
+  };
+}
+function resolveEnvironment(config, env) {
+  if (!config.environments?.[env]) {
+    return config;
+  }
+  const override = config.environments[env];
+  const resolved = { ...config };
+  if (override.model) {
+    resolved.model = { ...config.model, ...override.model };
+  }
+  if (override.tools) {
+    resolved.tools = override.tools;
+  }
+  if (override.memory) {
+    resolved.memory = override.memory;
+  }
+  return resolved;
+}
+
+// src/parser/load.ts
+import { readFile } from "fs/promises";
+import { resolve } from "path";
+import chalk from "chalk";
+async function loadConfig(configPath) {
+  const resolved = resolve(configPath);
+  console.log(chalk.blue("\u2192 Reading configuration from"), resolved);
+  let raw;
+  try {
+    raw = await readFile(resolved, "utf-8");
+  } catch {
+    console.error(chalk.red("\u2717 Could not read config file:"), resolved);
+    process.exit(1);
+  }
+  const result = parseForgeYaml(raw);
+  if (!result.success || !result.config) {
+    console.error(chalk.red("\u2717 Validation errors:"));
+    for (const err of result.errors ?? []) {
+      console.error(chalk.red(`  \u2022 ${err}`));
+    }
+    process.exit(1);
+  }
+  return result.config;
+}
+
+// src/engine/state.ts
+import { readFile as readFile2, writeFile, mkdir } from "fs/promises";
+import { createHash } from "crypto";
+import { join } from "path";
+var STATE_FILE = "state.json";
+function sortDeep(obj) {
+  if (Array.isArray(obj)) return obj.map(sortDeep);
+  if (obj !== null && typeof obj === "object") {
+    const record = obj;
+    return Object.fromEntries(
+      Object.keys(record).sort().map((key) => [key, sortDeep(record[key])])
+    );
+  }
+  return obj;
+}
+function hashConfig(config) {
+  const normalized = JSON.stringify(sortDeep(config));
+  return createHash("sha256").update(normalized).digest("hex");
+}
+async function readState(stateDir) {
+  const statePath = join(stateDir, STATE_FILE);
+  try {
+    const raw = await readFile2(statePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || typeof parsed.configHash !== "string" || typeof parsed.agentName !== "string") {
+      console.warn("Warning: State file has invalid structure. Treating as no prior state.");
+      return null;
+    }
+    return parsed;
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+      return null;
+    }
+    console.warn("Warning: Failed to read state file. Treating as no prior state.");
+    return null;
+  }
+}
+async function writeState(stateDir, state) {
+  const statePath = join(stateDir, STATE_FILE);
+  await mkdir(stateDir, { recursive: true, mode: 448 });
+  await writeFile(statePath, JSON.stringify(state, null, 2), {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+function redactConfig(config) {
+  const cloned = JSON.parse(JSON.stringify(config));
+  if (cloned.tools?.mcp_servers) {
+    for (const server of cloned.tools.mcp_servers) {
+      if (server.env) {
+        for (const [key, value] of Object.entries(server.env)) {
+          if (!/^\$\{.+\}$/.test(value)) {
+            server.env[key] = "[REDACTED]";
+          }
+        }
+      }
+    }
+  }
+  return cloned;
+}
+function createState(config, environment) {
+  return {
+    configHash: hashConfig(config),
+    lastDeployed: (/* @__PURE__ */ new Date()).toISOString(),
+    environment,
+    agentName: config.agent.name,
+    config: redactConfig(config)
+  };
+}
+
+// src/engine/planner.ts
+function plan(desired, actual) {
+  const result = {
+    toCreate: [],
+    toUpdate: [],
+    toDelete: [],
+    noChange: [],
+    hasChanges: false
+  };
+  if (!actual) {
+    result.toCreate.push({
+      resource: "agent",
+      newValue: desired.agent,
+      summary: `Create agent "${desired.agent.name}"`
+    });
+    result.toCreate.push({
+      resource: "model",
+      newValue: desired.model,
+      summary: `Configure model ${desired.model.provider}/${desired.model.name}`
+    });
+    if (desired.system_prompt) {
+      result.toCreate.push({
+        resource: "system_prompt",
+        newValue: desired.system_prompt,
+        summary: `Set system prompt from ${desired.system_prompt.file ?? "inline"}`
+      });
+    }
+    if (desired.tools?.mcp_servers) {
+      for (const server of desired.tools.mcp_servers) {
+        result.toCreate.push({
+          resource: "mcp_server",
+          field: server.name,
+          newValue: server,
+          summary: `Add MCP server "${server.name}"`
+        });
+      }
+    }
+    if (desired.memory && desired.memory.type !== "none") {
+      result.toCreate.push({
+        resource: "memory",
+        newValue: desired.memory,
+        summary: `Configure ${desired.memory.type} memory`
+      });
+    }
+    result.hasChanges = result.toCreate.length > 0;
+    return result;
+  }
+  const desiredHash = hashConfig(desired);
+  if (desiredHash === actual.configHash) {
+    result.noChange.push({
+      resource: "agent",
+      summary: `Agent "${desired.agent.name}" is up to date (hash: ${desiredHash.slice(0, 8)})`
+    });
+    return result;
+  }
+  const actualConfig = actual.config;
+  if (desired.agent.name !== actualConfig.agent.name) {
+    result.toUpdate.push({
+      resource: "agent",
+      field: "name",
+      oldValue: actualConfig.agent.name,
+      newValue: desired.agent.name,
+      summary: `Rename agent "${actualConfig.agent.name}" \u2192 "${desired.agent.name}"`
+    });
+  }
+  if (desired.agent.description !== actualConfig.agent.description) {
+    result.toUpdate.push({
+      resource: "agent",
+      field: "description",
+      oldValue: actualConfig.agent.description,
+      newValue: desired.agent.description,
+      summary: `Update agent description`
+    });
+  }
+  if (desired.model.provider !== actualConfig.model.provider) {
+    result.toUpdate.push({
+      resource: "model",
+      field: "provider",
+      oldValue: actualConfig.model.provider,
+      newValue: desired.model.provider,
+      summary: `Change model provider: ${actualConfig.model.provider} \u2192 ${desired.model.provider}`
+    });
+  }
+  if (desired.model.name !== actualConfig.model.name) {
+    result.toUpdate.push({
+      resource: "model",
+      field: "name",
+      oldValue: actualConfig.model.name,
+      newValue: desired.model.name,
+      summary: `Change model: ${actualConfig.model.name} \u2192 ${desired.model.name}`
+    });
+  }
+  if (desired.model.temperature !== actualConfig.model.temperature) {
+    result.toUpdate.push({
+      resource: "model",
+      field: "temperature",
+      oldValue: actualConfig.model.temperature,
+      newValue: desired.model.temperature,
+      summary: `Change temperature: ${actualConfig.model.temperature} \u2192 ${desired.model.temperature}`
+    });
+  }
+  if (desired.model.max_tokens !== actualConfig.model.max_tokens) {
+    result.toUpdate.push({
+      resource: "model",
+      field: "max_tokens",
+      oldValue: actualConfig.model.max_tokens,
+      newValue: desired.model.max_tokens,
+      summary: `Change max_tokens: ${actualConfig.model.max_tokens} \u2192 ${desired.model.max_tokens}`
+    });
+  }
+  const desiredServers = desired.tools?.mcp_servers ?? [];
+  const actualServers = actualConfig.tools?.mcp_servers ?? [];
+  const actualServerMap = new Map(actualServers.map((s) => [s.name, s]));
+  const desiredServerMap = new Map(desiredServers.map((s) => [s.name, s]));
+  for (const server of desiredServers) {
+    if (!actualServerMap.has(server.name)) {
+      result.toCreate.push({
+        resource: "mcp_server",
+        field: server.name,
+        newValue: server,
+        summary: `Add MCP server "${server.name}"`
+      });
+    } else {
+      const existing = actualServerMap.get(server.name);
+      if (JSON.stringify(server) !== JSON.stringify(existing)) {
+        result.toUpdate.push({
+          resource: "mcp_server",
+          field: server.name,
+          oldValue: existing,
+          newValue: server,
+          summary: `Update MCP server "${server.name}"`
+        });
+      }
+    }
+  }
+  for (const server of actualServers) {
+    if (!desiredServerMap.has(server.name)) {
+      result.toDelete.push({
+        resource: "mcp_server",
+        field: server.name,
+        oldValue: server,
+        summary: `Remove MCP server "${server.name}"`
+      });
+    }
+  }
+  result.hasChanges = result.toCreate.length > 0 || result.toUpdate.length > 0 || result.toDelete.length > 0;
+  return result;
+}
+function formatPlan(planResult) {
+  const lines = [];
+  if (!planResult.hasChanges) {
+    lines.push("No changes. Infrastructure is up to date.");
+    for (const item of planResult.noChange) {
+      lines.push(`  ${item.summary}`);
+    }
+    return lines.join("\n");
+  }
+  if (planResult.toCreate.length > 0) {
+    lines.push("Resources to CREATE:");
+    for (const item of planResult.toCreate) {
+      lines.push(`  + ${item.summary}`);
+    }
+  }
+  if (planResult.toUpdate.length > 0) {
+    lines.push("Resources to UPDATE:");
+    for (const item of planResult.toUpdate) {
+      lines.push(`  ~ ${item.summary}`);
+    }
+  }
+  if (planResult.toDelete.length > 0) {
+    lines.push("Resources to DELETE:");
+    for (const item of planResult.toDelete) {
+      lines.push(`  - ${item.summary}`);
+    }
+  }
+  lines.push(
+    `
+Plan: ${planResult.toCreate.length} to add, ${planResult.toUpdate.length} to change, ${planResult.toDelete.length} to destroy.`
+  );
+  return lines.join("\n");
+}
+
+// src/engine/applier.ts
+async function apply(plan2, config, opts) {
+  const stateDir = opts.stateDir ?? ".forge";
+  if (!plan2.hasChanges) {
+    const state2 = createState(config, opts.environment);
+    return {
+      success: true,
+      applied: [],
+      skipped: plan2.noChange,
+      state: state2
+    };
+  }
+  if (opts.dryRun) {
+    const state2 = createState(config, opts.environment);
+    return {
+      success: true,
+      applied: [],
+      skipped: [...plan2.toCreate, ...plan2.toUpdate, ...plan2.toDelete],
+      state: state2
+    };
+  }
+  const applied = [...plan2.toCreate, ...plan2.toUpdate, ...plan2.toDelete];
+  const state = createState(config, opts.environment);
+  await writeState(stateDir, state);
+  return {
+    success: true,
+    applied,
+    skipped: plan2.noChange,
+    state
+  };
+}
+
+// src/commands/deploy.ts
+async function deployCommand(opts) {
+  const baseConfig = await loadConfig(opts.config);
+  const config = resolveEnvironment(baseConfig, opts.env);
+  console.log(
+    chalk2.blue("\u2192 Agent:"),
+    config.agent.name,
+    chalk2.blue("| Environment:"),
+    opts.env,
+    chalk2.blue("| Model:"),
+    `${config.model.provider}/${config.model.name}`
+  );
+  const currentState = await readState(".forge");
+  const planResult = plan(config, currentState);
+  console.log("\n" + formatPlan(planResult));
+  if (!planResult.hasChanges) {
+    return;
+  }
+  if (opts.dryRun) {
+    console.log(chalk2.yellow("\n\u26A0 Dry run \u2014 no changes applied."));
+    return;
+  }
+  if (!opts.autoApprove) {
+    console.log(chalk2.yellow("\nDo you want to apply these changes?"));
+    console.log(chalk2.dim("  Use --auto-approve to skip this prompt.\n"));
+  }
+  const preHooks = config.hooks?.pre_deploy ?? [];
+  const postHooks = config.hooks?.post_deploy ?? [];
+  if (preHooks.length > 0 || postHooks.length > 0) {
+    console.log(chalk2.yellow("\n\u26A0 Hooks detected in configuration:"));
+    for (const hook of preHooks) {
+      console.log(chalk2.yellow(`  pre_deploy:  ${hook.run}`));
+    }
+    for (const hook of postHooks) {
+      console.log(chalk2.yellow(`  post_deploy: ${hook.run}`));
+    }
+    if (!opts.allowHooks) {
+      console.log(
+        chalk2.yellow("  Hooks will NOT be executed. Pass --allow-hooks to enable hook execution.\n")
+      );
+    }
+  }
+  const applyOpts = {
+    dryRun: opts.dryRun,
+    environment: opts.env,
+    autoApprove: opts.autoApprove
+  };
+  const result = await apply(planResult, config, applyOpts);
+  if (result.success) {
+    console.log(chalk2.green(`
+\u2713 Successfully deployed "${config.agent.name}" to ${opts.env}`));
+    console.log(chalk2.dim(`  State written to .forge/state.json`));
+    console.log(chalk2.dim(`  Config hash: ${result.state.configHash.slice(0, 12)}...`));
+  } else {
+    console.error(chalk2.red(`
+\u2717 Deploy failed: ${result.error}`));
+    process.exit(1);
+  }
+}
+
+// src/commands/diff.ts
+import chalk3 from "chalk";
+async function diffCommand(opts) {
+  const baseConfig = await loadConfig(opts.config);
+  const config = resolveEnvironment(baseConfig, opts.env);
+  const currentState = await readState(".forge");
+  const planResult = plan(config, currentState);
+  if (!planResult.hasChanges) {
+    console.log(chalk3.green("\u2713 No changes. Infrastructure matches configuration."));
+    return;
+  }
+  for (const item of planResult.toCreate) {
+    console.log(chalk3.green(`+ ${item.summary}`));
+    if (item.newValue) {
+      const lines = JSON.stringify(item.newValue, null, 2).split("\n");
+      for (const line of lines) {
+        console.log(chalk3.green(`  + ${line}`));
+      }
+    }
+  }
+  for (const item of planResult.toUpdate) {
+    console.log(chalk3.yellow(`~ ${item.summary}`));
+    if (item.oldValue !== void 0) {
+      console.log(chalk3.red(`  - ${JSON.stringify(item.oldValue)}`));
+    }
+    if (item.newValue !== void 0) {
+      console.log(chalk3.green(`  + ${JSON.stringify(item.newValue)}`));
+    }
+  }
+  for (const item of planResult.toDelete) {
+    console.log(chalk3.red(`- ${item.summary}`));
+  }
+}
+
+// src/commands/rollback.ts
+import chalk4 from "chalk";
+async function rollbackCommand(opts) {
+  const currentState = await readState(".forge");
+  if (!currentState) {
+    console.error(chalk4.red("\u2717 No state found. Nothing to roll back."));
+    process.exit(1);
+  }
+  console.log(chalk4.blue("\u2192 Current state:"));
+  console.log(chalk4.dim(`  Agent: ${currentState.agentName}`));
+  console.log(chalk4.dim(`  Environment: ${currentState.environment}`));
+  console.log(chalk4.dim(`  Deployed: ${currentState.lastDeployed}`));
+  console.log(chalk4.dim(`  Hash: ${currentState.configHash.slice(0, 12)}...`));
+  if (opts.targetHash) {
+    console.log(chalk4.yellow(`
+\u26A0 Rollback to ${opts.targetHash} is not yet implemented.`));
+    console.log(chalk4.dim("  State history tracking coming in a future release."));
+  } else {
+    console.log(chalk4.yellow("\n\u26A0 Specify a target hash to roll back to."));
+    console.log(chalk4.dim("  Usage: forge rollback --target <hash>"));
+  }
+}
+
+// src/commands/validate.ts
+import { readFile as readFile3 } from "fs/promises";
+import { resolve as resolve2 } from "path";
+import chalk5 from "chalk";
+async function validateCommand(opts) {
+  const configPath = resolve2(opts.config);
+  let raw;
+  try {
+    raw = await readFile3(configPath, "utf-8");
+  } catch {
+    console.error(chalk5.red("\u2717 Could not read config file:"), configPath);
+    process.exit(1);
+  }
+  const result = parseForgeYaml(raw);
+  if (result.success) {
+    const config = result.config;
+    console.log(chalk5.green("\u2713 Configuration is valid."));
+    console.log(chalk5.dim(`  Agent: ${config.agent.name}`));
+    console.log(chalk5.dim(`  Model: ${config.model.provider}/${config.model.name}`));
+    if (config.environments) {
+      const envs = Object.keys(config.environments);
+      console.log(chalk5.dim(`  Environments: ${envs.join(", ")}`));
+    }
+  } else {
+    console.error(chalk5.red("\u2717 Validation failed:"));
+    for (const err of result.errors ?? []) {
+      console.error(chalk5.red(`  \u2022 ${err}`));
+    }
+    process.exit(1);
+  }
+}
+
+// src/index.ts
+var program = new Command();
+program.name("forge").description("Agent infrastructure as code \u2014 the Terraform for AI agents").version("0.1.0");
+program.command("deploy").description("Deploy an agent from a forge.yaml configuration").option("-c, --config <path>", "Path to forge.yaml", "forge.yaml").option("-e, --env <environment>", "Target environment", "dev").option("--auto-approve", "Skip confirmation prompt", false).option("--dry-run", "Show plan without applying changes", false).option("--allow-hooks", "Allow execution of pre_deploy and post_deploy hooks", false).action((opts) => {
+  return deployCommand({
+    config: opts.config,
+    env: opts.env,
+    autoApprove: opts.autoApprove,
+    dryRun: opts.dryRun,
+    allowHooks: opts.allowHooks
+  });
+});
+program.command("diff").description("Show what would change between config and deployed state").option("-c, --config <path>", "Path to forge.yaml", "forge.yaml").option("-e, --env <environment>", "Target environment", "dev").action((opts) => {
+  return diffCommand({
+    config: opts.config,
+    env: opts.env
+  });
+});
+program.command("rollback").description("Roll back to a previous deployment state").option("--target <hash>", "Target state hash to roll back to").action((opts) => {
+  return rollbackCommand({
+    targetHash: opts.target
+  });
+});
+program.command("validate").description("Validate a forge.yaml configuration file").option("-c, --config <path>", "Path to forge.yaml", "forge.yaml").action((opts) => {
+  return validateCommand({
+    config: opts.config
+  });
+});
+program.parse();

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@openforge-ai/cli",
+  "version": "0.1.0",
+  "description": "Agent infrastructure as code — the Terraform for AI agents",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/seanfraserio/forge.git",
+    "directory": "packages/cli"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "forge",
+    "ai",
+    "agents",
+    "infrastructure-as-code",
+    "mcp",
+    "cli",
+    "terraform"
+  ],
+  "bin": {
+    "forge": "./dist/index.js"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "yaml": "^2.4.0",
+    "zod": "^3.22.0",
+    "@openforge-ai/sdk": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.4.0",
+    "vitest": "^1.4.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "dev": "tsup src/index.ts --format esm,cjs --dts --watch",
+    "typecheck": "tsc --noEmit"
+  }
+}