forge-cw 0.1.13 → 0.1.15

package/dist/index.js

@@ -2657,6 +2657,40 @@ function splitPluginId(id) {
   const at = id.lastIndexOf("@");
   return { name: id.slice(0, at), marketplace: id.slice(at + 1) };
 }
+function catalogVersion(configDir, marketplaces, marketplace, name) {
+  const known = marketplaces[marketplace];
+  const location = isRecord(known) && typeof known["installLocation"] === "string" ? known["installLocation"] : join8(configDir, "plugins", "marketplaces", marketplace);
+  const entries = readJson(join8(location, ".claude-plugin", "marketplace.json"))["plugins"];
+  if (!Array.isArray(entries))
+    return void 0;
+  const entry = entries.find((e) => isRecord(e) && e["name"] === name);
+  if (!entry)
+    return void 0;
+  if (typeof entry["version"] === "string")
+    return entry["version"];
+  const source = entry["source"];
+  if (typeof source !== "string")
+    return void 0;
+  const dir = resolve2(location, source);
+  if (!inside(location, dir))
+    return void 0;
+  const version = readJson(join8(dir, ".claude-plugin", "plugin.json"))["version"];
+  return typeof version === "string" ? version : void 0;
+}
+function hasUpdate({ latest, version }) {
+  if (!latest || latest === version)
+    return false;
+  const a = numeric(latest);
+  const b = numeric(version);
+  if (!a || !b)
+    return true;
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const d = (a[i] ?? 0) - (b[i] ?? 0);
+    if (d !== 0)
+      return d > 0;
+  }
+  return false;
+}
 function projectSkillNames(projectPath) {
   const dir = join8(projectPath, ".claude", "skills");
   if (!existsSync6(dir))
@@ -2678,16 +2712,21 @@ async function listPlugins(reader, remoteOf) {
       const user = entries.find((e) => isRecord(e) && e["scope"] === "user" && typeof e["installPath"] === "string");
       if (!user)
         continue;
+      const { name, marketplace } = splitPluginId(id);
+      const version = String(user["version"] ?? "");
+      const latest = catalogVersion(configDir, marketplaces, marketplace, name);
       const install = {
         scope,
         scopeRef,
-        version: String(user["version"] ?? ""),
+        version,
         enabled: !isRecord(enabledPlugins) || enabledPlugins[id] !== false,
         installPath: String(user["installPath"]),
-        lastUpdated: typeof user["lastUpdated"] === "string" ? user["lastUpdated"] : void 0
+        lastUpdated: typeof user["lastUpdated"] === "string" ? user["lastUpdated"] : void 0,
+        latest,
+        update: hasUpdate({ latest, version })
       };
       const list = found.get(id) ?? [];
-      list.push({ install, repo: marketplaceSource(marketplaces[splitPluginId(id).marketplace]) });
+      list.push({ install, repo: marketplaceSource(marketplaces[marketplace]) });
       found.set(id, list);
     }
   }
@@ -2757,7 +2796,7 @@ function marketplaceSourceOf(reader, marketplace) {
   }
   return void 0;
 }
-var isRecord, inside, pluginScopes, knownMarketplaces, knowsMarketplace;
+var isRecord, inside, pluginScopes, knownMarketplaces, numeric, knowsMarketplace;
 var init_plugins = __esm({
   "../core/dist/plugins.js"() {
     "use strict";
@@ -2772,6 +2811,7 @@ var init_plugins = __esm({
       ...reader.getAccounts().map((a) => ({ scope: "account", scopeRef: a }))
     ];
     knownMarketplaces = (configDir) => readJson(join8(configDir, "plugins", "known_marketplaces.json"));
+    numeric = (v) => /^\d+(\.\d+)*$/.test(v) ? v.split(".").map(Number) : null;
     knowsMarketplace = (configDir, marketplace) => isRecord(knownMarketplaces(configDir)[marketplace]);
   }
 });
@@ -4896,13 +4936,13 @@ var require_parse_options = __commonJS({
 var require_identifiers = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/internal/identifiers.js"(exports, module) {
     "use strict";
-    var numeric = /^[0-9]+$/;
+    var numeric2 = /^[0-9]+$/;
     var compareIdentifiers = (a, b) => {
       if (typeof a === "number" && typeof b === "number") {
         return a === b ? 0 : a < b ? -1 : 1;
       }
-      const anum = numeric.test(a);
-      const bnum = numeric.test(b);
+      const anum = numeric2.test(a);
+      const bnum = numeric2.test(b);
       if (anum && bnum) {
         a = +a;
         b = +b;
@@ -7173,7 +7213,7 @@ var init_module_context = __esm({
 
 // ../core/dist/module-host.js
 import { existsSync as existsSync13, readdirSync as readdirSync7, readFileSync as readFileSync11, statSync as statSync4, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename as basename4, dirname as dirname7, join as join16, resolve as resolve6 } from "node:path";
+import { basename as basename4, dirname as dirname7, join as join16, resolve as resolve6, sep as sep4 } from "node:path";
 import { pathToFileURL } from "node:url";
 function disabled(id, c, reason, m) {
   const text = (v, fallback) => typeof v === "string" && v ? v : fallback;
@@ -7268,6 +7308,7 @@ var init_module_host = __esm({
       opts;
       statuses = [];
       loaded = /* @__PURE__ */ new Map();
+      origins = /* @__PURE__ */ new Map();
       constructor(opts) {
         this.opts = opts;
       }
@@ -7277,6 +7318,16 @@ var init_module_host = __esm({
       get(id) {
         return this.loaded.get(id);
       }
+      // where a listed module was found, loaded or not; the first one found wins
+      locate(id) {
+        const c = this.origins.get(id);
+        return c && { dir: c.dir, removable: this.removable(c) };
+      }
+      // only what was installed into the modules folder; bundled, dev and Forge's own packages stay
+      removable(c) {
+        const { modulesDir } = this.opts;
+        return c.source === "installed" && dirname7(c.dir) === modulesDir || c.dir.startsWith(join16(modulesDir, "node_modules") + sep4);
+      }
       // scans, reloads and dev changes run one at a time: each one awaits imports midway
       queue = Promise.resolve();
       serial(fn) {
@@ -7293,12 +7344,17 @@ var init_module_host = __esm({
           this.unload(id);
         const statuses = [];
         const seen = /* @__PURE__ */ new Map();
+        const origins = /* @__PURE__ */ new Map();
         for (const candidate of this.candidates()) {
-          const status = await this.loadCandidate(candidate, seen);
-          if (status)
-            statuses.push(status);
+          const status = await this.load(candidate, seen);
+          if (!status)
+            continue;
+          statuses.push(status);
+          if (!origins.has(status.id))
+            origins.set(status.id, candidate);
         }
         this.statuses = statuses;
+        this.origins = origins;
         return statuses;
       }
       // only this module is unloaded and loaded again; the others keep running
@@ -7312,7 +7368,7 @@ var init_module_host = __esm({
         } else {
           this.unload(id);
           const seen = new Map([...this.loaded.values()].map((m) => [m.status.id, m.dir]));
-          const status = await this.loadCandidate(mod.candidate, seen);
+          const status = await this.load(mod.candidate, seen);
           this.statuses = this.statuses.flatMap((s) => s === mod.status ? status ? [status] : [] : [s]);
         }
       }
@@ -7394,6 +7450,12 @@ var init_module_host = __esm({
           out.push(...packages(this.opts.forgeNodeModules, "node_modules", false));
         return out;
       }
+      async load(c, seen) {
+        const status = await this.loadCandidate(c, seen);
+        if (status && this.removable(c))
+          status.removable = true;
+        return status;
+      }
       async loadCandidate(c, seen) {
         const fallbackId = basename4(c.dir);
         if (!existsSync13(c.manifestFile)) {
@@ -7534,9 +7596,186 @@ var init_module_confirmations = __esm({
   }
 });
 
+// ../core/dist/module-install.js
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync3 } from "node:fs";
+import { homedir as homedir7, tmpdir } from "node:os";
+import { isAbsolute as isAbsolute2, join as join17, resolve as resolve7, sep as sep5 } from "node:path";
+async function previewManifest(spec, opts) {
+  if (isPathSpec(spec, opts.cwd))
+    return readFolder(expand(spec, opts.cwd));
+  const tmp = mkdtempSync(join17(tmpdir(), "forge-module-pack-"));
+  try {
+    const packed = await opts.run("npm", ["pack", spec, "--pack-destination", tmp, "--ignore-scripts", "--json"], opts.cwd);
+    if (packed.code !== 0)
+      throw new Error(npmPackError(spec, packed.stderr || packed.stdout));
+    const info = JSON.parse(packed.stdout)[0];
+    const filename = info?.filename;
+    if (!filename)
+      throw new Error(`npm pack ${spec} produced no tarball`);
+    const untar = await opts.run("tar", ["-xzf", join17(tmp, filename), "-C", tmp], opts.cwd);
+    if (untar.code !== 0)
+      throw new Error(`could not unpack ${filename}: ${untar.stderr.trim()}`);
+    const preview = readFolder(join17(tmp, "package"));
+    return info.name && info.version ? { ...preview, packed: { name: info.name, version: info.version } } : preview;
+  } finally {
+    rmSync3(tmp, { recursive: true, force: true });
+  }
+}
+function npmPackError(spec, output) {
+  if (/\bE404\b/.test(output))
+    return `${spec} is not on npm`;
+  const lines2 = output.trim().split("\n").filter((l) => !l.includes("A complete log of this run"));
+  return `npm pack ${spec} failed: ${lines2.join("\n")}`;
+}
+function readFolder(dir) {
+  const manifestFile = manifestFileFor(dir).file;
+  if (!existsSync14(manifestFile))
+    throw new Error(`${dir} has no forge-module.json`);
+  const raw = JSON.parse(readFileSync12(manifestFile, "utf-8"));
+  const check = checkManifest(raw, dir);
+  if (check.kind === "invalid")
+    throw new Error(`invalid manifest: ${check.reason}`);
+  return check;
+}
+function permissionLines(manifest) {
+  const p = "permissions" in manifest ? manifest.permissions ?? {} : {};
+  const lines2 = [];
+  for (const kind of ["network", "fs:read", "fs:write", "shell"]) {
+    for (const value of p[kind] ?? [])
+      lines2.push({ kind, value });
+  }
+  if (p.pty)
+    lines2.push({ kind: "pty", value: "yes" });
+  const legacy = "actions" in manifest && (manifest.actions ?? []).some((a) => "command" in a);
+  if (legacy)
+    lines2.push({ kind: "shell", value: "runs the shell commands in its manifest" });
+  return lines2;
+}
+function describePermissions(manifest) {
+  const lines2 = permissionLines(manifest).map((l) => `  ${l.kind.padEnd(9)} ${l.value}`);
+  return [lines2.length ? "It asks for:" : "It asks for no permissions.", ...lines2, "", TRUST_NOTE].join("\n");
+}
+function installArgs(spec, prefix) {
+  return ["install", "--ignore-scripts", "--prefix", prefix, spec];
+}
+function packageName(dir) {
+  try {
+    const name = JSON.parse(readFileSync12(join17(dir, "package.json"), "utf-8")).name;
+    return typeof name === "string" ? name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var TRUST_NOTE, isPathSpec, expand, InstallError, PREVIEW_TTL_MS, REGISTRY_SPEC, ModuleInstaller;
+var init_module_install = __esm({
+  "../core/dist/module-install.js"() {
+    "use strict";
+    init_module_manifest();
+    init_output();
+    init_state_log();
+    TRUST_NOTE = "Modules run inside Forge with your access. Forge checks every call against these permissions, but it is not a sandbox: install only modules you trust.";
+    isPathSpec = (spec, cwd) => spec.startsWith(".") || spec.startsWith("~") || isAbsolute2(spec) || existsSync14(resolve7(cwd, spec)) && !spec.startsWith("@");
+    expand = (spec, cwd) => resolve7(cwd, expandHome(spec));
+    InstallError = class extends Error {
+      code;
+      constructor(code, message) {
+        super(message);
+        this.code = code;
+      }
+    };
+    PREVIEW_TTL_MS = 10 * 6e4;
+    REGISTRY_SPEC = /^(@[^/@\s]+\/)?[^/@\s:]+(@[^\s/:]*)?$/;
+    ModuleInstaller = class {
+      opts;
+      previews = /* @__PURE__ */ new Map();
+      busy = false;
+      constructor(opts) {
+        this.opts = opts;
+      }
+      get now() {
+        return (this.opts.now ?? Date.now)();
+      }
+      async preview(spec) {
+        const cwd = this.opts.cwd ?? homedir7();
+        const trimmed = spec.trim();
+        if (!trimmed)
+          throw new InstallError("bad_request", "Give an npm package, a folder or a git url");
+        let preview;
+        try {
+          preview = await previewManifest(trimmed, { cwd, run: this.opts.run });
+        } catch (err) {
+          throw new InstallError("bad_request", err.message);
+        }
+        const m = preview.manifest;
+        const pinned = isPathSpec(trimmed, cwd) ? expand(trimmed, cwd) : preview.packed && REGISTRY_SPEC.test(trimmed) ? `${preview.packed.name}@${preview.packed.version}` : trimmed;
+        for (const [t, p] of this.previews)
+          if (p.expires < this.now)
+            this.previews.delete(t);
+        const token = randomBytes2(24).toString("base64url");
+        this.previews.set(token, { spec: pinned, name: m.name, expires: this.now + PREVIEW_TTL_MS });
+        return {
+          token,
+          kind: preview.kind,
+          name: m.name,
+          version: m.version,
+          displayName: m.displayName,
+          description: "description" in m && typeof m.description === "string" ? m.description : void 0,
+          spec: pinned,
+          permissions: permissionLines(m),
+          trustNote: TRUST_NOTE
+        };
+      }
+      async install(token) {
+        const p = this.previews.get(token);
+        this.previews.delete(token);
+        if (!p || p.expires < this.now)
+          throw new InstallError("confirmation_required", "Preview the module again before installing it");
+        return this.exclusive(async () => {
+          mkdirSync5(this.opts.modulesDir, { recursive: true });
+          const res = await this.opts.run("npm", installArgs(p.spec, this.opts.modulesDir), this.opts.modulesDir);
+          if (res.code !== 0)
+            throw new InstallError("install_failed", `npm install failed: ${tailOutput(res.stderr || res.stdout, 6)}`);
+          const list = await this.opts.host.scan();
+          return list.find((s) => s.name === p.name);
+        });
+      }
+      remove(id) {
+        return this.exclusive(async () => {
+          const found = this.opts.host.locate(id);
+          if (!found)
+            throw new InstallError("not_found", `No module ${id}`);
+          if (!found.removable)
+            throw new InstallError("bad_request", `${id} was not installed into Forge's modules folder; a dev folder unloads when forge module dev stops`);
+          const packages2 = join17(this.opts.modulesDir, "node_modules") + sep5;
+          if (found.dir.startsWith(packages2)) {
+            const name = packageName(found.dir) ?? found.dir.slice(packages2.length);
+            const res = await this.opts.run("npm", ["uninstall", "--prefix", this.opts.modulesDir, name], this.opts.modulesDir);
+            if (res.code !== 0)
+              throw new InstallError("install_failed", `npm uninstall failed: ${tailOutput(res.stderr || res.stdout, 6)}`);
+          } else {
+            rmSync3(found.dir, { recursive: true, force: true });
+          }
+          await this.opts.host.scan();
+        });
+      }
+      async exclusive(fn) {
+        if (this.busy)
+          throw new InstallError("busy", "Another module is being installed or removed");
+        this.busy = true;
+        try {
+          return await fn();
+        } finally {
+          this.busy = false;
+        }
+      }
+    };
+  }
+});
+
 // ../core/dist/module-routes.js
 import { readFile as readFile2 } from "node:fs/promises";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 import { Hono as Hono5 } from "hono";
 function moduleRoutes(host, opts) {
   const { db } = opts;
@@ -7560,6 +7799,26 @@ function moduleRoutes(host, opts) {
       await host.removeDev(path);
     return c.json(host.list());
   });
+  const installing = async (c, fn) => {
+    if (!opts.installer)
+      return c.json({ code: "local_only", message: "Modules are installed only in local mode" }, 403);
+    try {
+      return await fn(opts.installer);
+    } catch (err) {
+      if (err instanceof InstallError)
+        return c.json({ code: err.code, message: err.message }, STATUS_BY_CODE[err.code]);
+      throw err;
+    }
+  };
+  app.post("/install/preview", (c) => installing(c, async (installer) => {
+    const { spec } = await c.req.json();
+    return c.json(await installer.preview(typeof spec === "string" ? spec : ""));
+  }));
+  app.post("/install", (c) => installing(c, async (installer) => {
+    const { token } = await c.req.json();
+    const status = await installer.install(typeof token === "string" ? token : "");
+    return c.json({ status, modules: host.list() });
+  }));
   app.get("/notifications", (c) => c.json({
     items: db.listNotifications().map((n) => ({
       moduleId: n.moduleId,
@@ -7581,6 +7840,10 @@ function moduleRoutes(host, opts) {
     await host.reload(c.req.param("id"));
     return c.json(host.list().find((s) => s.id === c.req.param("id")) ?? removed(c.req.param("id")));
   });
+  app.delete("/:id", (c) => installing(c, async (installer) => {
+    await installer.remove(c.req.param("id"));
+    return c.json(host.list());
+  }));
   app.get("/:id/status", (c) => {
     const status = host.list().find((s) => s.id === c.req.param("id"));
     return status ? c.json(status) : c.json(removed(c.req.param("id")), 404);
@@ -7605,7 +7868,7 @@ function moduleRoutes(host, opts) {
     if (!mod?.manifest.view)
       return c.json(removed(c.req.param("id")), 404);
     try {
-      const code = await readFile2(resolve7(mod.dir, mod.manifest.view.entry), "utf-8");
+      const code = await readFile2(resolve8(mod.dir, mod.manifest.view.entry), "utf-8");
       return c.body(code, 200, { "Content-Type": "text/javascript; charset=utf-8", "Cache-Control": "no-cache" });
     } catch (err) {
       return c.json({ code: "not_found", message: `view bundle missing: ${err.message}` }, 404);
@@ -7806,12 +8069,16 @@ var init_module_routes = __esm({
     init_dist();
     init_module_manifest();
     init_module_confirmations();
+    init_module_install();
     STATUS_BY_CODE = {
       bad_request: 400,
       unauthorized: 401,
       not_found: 404,
       unreachable: 502,
-      upstream: 502
+      upstream: 502,
+      busy: 409,
+      confirmation_required: 409,
+      install_failed: 502
     };
   }
 });
@@ -7949,12 +8216,12 @@ var init_module_events = __esm({
 // ../core/dist/server.js
 import { Hono as Hono6 } from "hono";
 import { cors } from "hono/cors";
-import { join as join17, basename as basename5, resolve as resolve8 } from "node:path";
-import { readdirSync as readdirSync8, existsSync as existsSync14 } from "node:fs";
+import { join as join18, basename as basename5, resolve as resolve9 } from "node:path";
+import { readdirSync as readdirSync8, existsSync as existsSync15 } from "node:fs";
 function createForgeServer(options) {
   const { dataDir, db: externalDb, authToken, localOnly = true } = options;
-  const dbPath = join17(dataDir, "forge.db");
-  const modulesDir = join17(dataDir, "modules");
+  const dbPath = join18(dataDir, "forge.db");
+  const modulesDir = join18(dataDir, "modules");
   const db = externalDb ?? new ForgeDB(dbPath);
   const loader = new ModuleLoader(modulesDir, options.bundledModulesDir);
   const runner = new ActionRunner();
@@ -7967,7 +8234,7 @@ function createForgeServer(options) {
   const cwReader = new CWReader(options.cwDir);
   const loginManager = new LoginManager(resolveCwBin(cwReader.cwHome));
   app.route("/api/cw", cwRoutes(cwReader, { loginManager, localOnly, events: { emit: (name, payload) => moduleEvents.emit(name, payload) } }));
-  app.route("/api/skills", skillRoutes(cwReader, { backupDir: join17(dataDir, "skill-backups") }));
+  app.route("/api/skills", skillRoutes(cwReader, { backupDir: join18(dataDir, "skill-backups") }));
   const { remote, shadow, warning } = remoteClassifierFromEnv();
   if (warning)
     console.warn(`[state] ${warning}`);
@@ -7987,7 +8254,7 @@ function createForgeServer(options) {
     }
   });
   const ptyManager = new PTYManager(states);
-  const generalSessions = new GeneralSessions(join17(dataDir, "general-sessions.json"));
+  const generalSessions = new GeneralSessions(join18(dataDir, "general-sessions.json"));
   const terminalWss = createTerminalWss(ptyManager, cwReader, { localOnly, general: generalSessions });
   app.route("/api/liveframe", liveframeRoutes());
   const kioku = new Kioku({ projects: () => cwReader.getProjects() });
@@ -8021,7 +8288,7 @@ function createForgeServer(options) {
     modulesDir,
     bundledDir: options.bundledModulesDir,
     forgeNodeModules: options.forgeNodeModules,
-    devFile: join17(dataDir, "dev-modules.json"),
+    devFile: join18(dataDir, "dev-modules.json"),
     localOnly,
     deps: { db, reader: cwReader, runner },
     hooks: {
@@ -8052,7 +8319,8 @@ function createForgeServer(options) {
   });
   ptyManager.onLifecycle = (event, session) => moduleEvents.emit(event === "started" ? "session.started" : "session.ended", sessionEvent(session));
   const modulesReady = moduleHost.scan().catch((err) => console.error(`[modules] scan failed: ${err.message}`));
-  app.route("/api/modules", moduleRoutes(moduleHost, { db, ready: modulesReady }));
+  const installer = localOnly ? new ModuleInstaller({ modulesDir, host: moduleHost, run: createRunner(void 0, 5 * 6e4) }) : void 0;
+  app.route("/api/modules", moduleRoutes(moduleHost, { db, ready: modulesReady, installer }));
   app.get("/api/cw/session-states", (c) => c.json({ classifier: states.remoteName ?? "local", shadow: states.isShadow, states: states.snapshot() }));
   app.post("/api/cw/terminal/kill", async (c) => {
     const { project, sessionDir } = await c.req.json();
@@ -8184,25 +8452,25 @@ data: ${JSON.stringify(data)}
   });
   app.get("/api/filesystem/browse", (c) => {
     const home = process.env.HOME ?? "/tmp";
-    const dir = resolve8(c.req.query("path") ?? process.cwd());
+    const dir = resolve9(c.req.query("path") ?? process.cwd());
     if (!dir.startsWith(home)) {
       return c.json({ error: "Access denied: path must be within home directory" }, 403);
     }
-    if (!existsSync14(dir)) {
+    if (!existsSync15(dir)) {
       return c.json({ error: "Directory not found" }, 404);
     }
     try {
       const entries = readdirSync8(dir, { withFileTypes: true });
       const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({
         name: e.name,
-        path: join17(dir, e.name),
-        hasPackageJson: existsSync14(join17(dir, e.name, "package.json")),
-        hasGit: existsSync14(join17(dir, e.name, ".git"))
+        path: join18(dir, e.name),
+        hasPackageJson: existsSync15(join18(dir, e.name, "package.json")),
+        hasGit: existsSync15(join18(dir, e.name, ".git"))
       })).sort((a, b) => a.name.localeCompare(b.name));
       return c.json({
         current: dir,
         name: basename5(dir),
-        parent: join17(dir, ".."),
+        parent: join18(dir, ".."),
         directories: dirs
       });
     } catch {
@@ -8249,6 +8517,8 @@ var init_server = __esm({
     init_kioku_routes();
     init_module_host();
     init_module_routes();
+    init_module_install();
+    init_task_review();
     init_module_jobs();
     init_module_events();
     init_kioku();
@@ -8415,22 +8685,22 @@ var init_db_factory = __esm({
 });
 
 // ../core/dist/init.js
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join18 } from "node:path";
-import { homedir as homedir7 } from "node:os";
+import { existsSync as existsSync16, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join19 } from "node:path";
+import { homedir as homedir8 } from "node:os";
 function getForgeDir() {
-  return join18(homedir7(), ".forge");
+  return join19(homedir8(), ".forge");
 }
 function ensureForgeDir() {
   const forgeDir = getForgeDir();
-  if (existsSync15(forgeDir)) {
+  if (existsSync16(forgeDir)) {
     return { forgeDir, created: false };
   }
-  mkdirSync5(forgeDir, { recursive: true });
+  mkdirSync6(forgeDir, { recursive: true });
   for (const d of FORGE_SUBDIRS) {
-    mkdirSync5(join18(forgeDir, d), { recursive: true });
+    mkdirSync6(join19(forgeDir, d), { recursive: true });
   }
-  writeFileSync6(join18(forgeDir, "config.json"), JSON.stringify({
+  writeFileSync6(join19(forgeDir, "config.json"), JSON.stringify({
     port: 3e3,
     theme: "dark",
     openBrowser: true,
@@ -8492,68 +8762,6 @@ var init_port_in_use = __esm({
   }
 });
 
-// ../core/dist/module-install.js
-import { existsSync as existsSync16, mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync3 } from "node:fs";
-import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute2, join as join19, resolve as resolve9 } from "node:path";
-async function previewManifest(spec, opts) {
-  if (isPathSpec(spec, opts.cwd))
-    return readFolder(expand(spec, opts.cwd));
-  const tmp = mkdtempSync(join19(tmpdir(), "forge-module-pack-"));
-  try {
-    const packed = await opts.run("npm", ["pack", spec, "--pack-destination", tmp, "--ignore-scripts", "--json"], opts.cwd);
-    if (packed.code !== 0)
-      throw new Error(`npm pack ${spec} failed: ${(packed.stderr || packed.stdout).trim()}`);
-    const filename = JSON.parse(packed.stdout)[0]?.filename;
-    if (!filename)
-      throw new Error(`npm pack ${spec} produced no tarball`);
-    const untar = await opts.run("tar", ["-xzf", join19(tmp, filename), "-C", tmp], opts.cwd);
-    if (untar.code !== 0)
-      throw new Error(`could not unpack ${filename}: ${untar.stderr.trim()}`);
-    return readFolder(join19(tmp, "package"));
-  } finally {
-    rmSync3(tmp, { recursive: true, force: true });
-  }
-}
-function readFolder(dir) {
-  const manifestFile = manifestFileFor(dir).file;
-  if (!existsSync16(manifestFile))
-    throw new Error(`${dir} has no forge-module.json`);
-  const raw = JSON.parse(readFileSync12(manifestFile, "utf-8"));
-  const check = checkManifest(raw, dir);
-  if (check.kind === "invalid")
-    throw new Error(`invalid manifest: ${check.reason}`);
-  return check;
-}
-function describePermissions(manifest) {
-  const p = "permissions" in manifest ? manifest.permissions ?? {} : {};
-  const lines2 = [];
-  for (const key of ["network", "fs:read", "fs:write", "shell"]) {
-    for (const value of p[key] ?? [])
-      lines2.push(`  ${key.padEnd(9)} ${value}`);
-  }
-  if (p.pty)
-    lines2.push(`  ${"pty".padEnd(9)} yes`);
-  const legacy = "actions" in manifest && (manifest.actions ?? []).some((a) => "command" in a);
-  if (legacy)
-    lines2.push("  shell     runs the shell commands in its manifest");
-  return [lines2.length ? "It asks for:" : "It asks for no permissions.", ...lines2, "", TRUST_NOTE].join("\n");
-}
-function installArgs(spec, prefix) {
-  return ["install", "--ignore-scripts", "--prefix", prefix, spec];
-}
-var TRUST_NOTE, isPathSpec, expand;
-var init_module_install = __esm({
-  "../core/dist/module-install.js"() {
-    "use strict";
-    init_module_manifest();
-    init_state_log();
-    TRUST_NOTE = "Modules run inside Forge with your access. Forge checks every call against these permissions, but it is not a sandbox: install only modules you trust.";
-    isPathSpec = (spec, cwd) => spec.startsWith(".") || spec.startsWith("~") || isAbsolute2(spec) || existsSync16(resolve9(cwd, spec)) && !spec.startsWith("@");
-    expand = (spec, cwd) => resolve9(cwd, expandHome(spec));
-  }
-});
-
 // ../core/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -8630,7 +8838,7 @@ var init_dist2 = __esm({
 
 // src/index.ts
 import { existsSync as existsSync17, readFileSync as readFileSync13 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 import { join as join20 } from "node:path";
 function parseArgs(argv) {
   const out = { open: true };
@@ -8655,7 +8863,7 @@ async function main() {
   if (created) {
     console.log("First run \u2014 initialized Forge.");
   }
-  const cwHome = join20(process.env.HOME ?? homedir8(), ".cw");
+  const cwHome = join20(process.env.HOME ?? homedir9(), ".cw");
   const cw = isCheckout ? { action: "skipped", message: "a checkout does not install CW" } : await ensureCw2({ cwHome, bundleDir: join20(packageRoot, "cw") });
   if (cw.action === "installed") console.log(`  Installed CW ${cw.version} in ${cwHome}`);
   else if (cw.action === "updated") console.log(`  Updated ${cw.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forge-cw",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "A visual dashboard for your coding agents on Claude Code, Codex, Pi or OpenCode. Installs CW for you.",
   "license": "MIT",
   "type": "module",
@@ -40,8 +40,8 @@
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "typescript": "^5.8.0",
-    "@forge-dev/core": "0.1.0",
-    "@forge-dev/console": "0.1.0"
+    "@forge-dev/console": "0.1.0",
+    "@forge-dev/core": "0.1.0"
   },
   "scripts": {
     "build": "tsc",