forge-workflow 0.0.10 → 0.1.0-beta.2

package/scripts/forge-team/tests/workload.test.sh

@@ -7,7 +7,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TEST_TMP="$(mktemp -d)"
 trap 'rm -rf "$TEST_TMP"' EXIT
 
-# Override TEAM_MAP_ROOT so tests don't touch real .beads/
+# Override TEAM_MAP_ROOT so tests don't touch real .forge/
 export TEAM_MAP_ROOT="$TEST_TMP"
 
 # Fix "now" so stale detection is deterministic
@@ -27,75 +27,41 @@ esac
 MOCK
 chmod +x "$mock_dir/gh"
 
-# ── Create mock bd ───────────────────────────────────────────────────────
-cat > "$mock_dir/bd" << 'MOCK'
+# ── Create mock forge ─────────────────────────────────────────────────────
+# Emits Kernel-shaped JSON ({"data":{"issues":[...]}}) for `issue list`.
+cat > "$mock_dir/forge" << 'MOCK'
 #!/usr/bin/env bash
-case "$1 $2" in
-  "list --status=open,in_progress")
-    exit 1
-    ;;
-  "list --status=open")
-    echo "○ forge-bbb · Feature B"
-    ;;
-  "list --status=in_progress")
-    echo "◐ forge-aaa · Feature A"
-    echo "◐ forge-ccc · Feature C"
-    echo "◐ forge-m1n8.6 · Sub-feature X (dotted ID)"
-    ;;
-  "show forge-aaa")
-    echo "◐ forge-aaa · Feature A [● P2 · IN_PROGRESS]"
-    echo "Owner: devone"
-    echo "Updated: 2026-03-27T10:00:00Z"
-    ;;
-  "show forge-bbb")
-    echo "○ forge-bbb · Feature B [● P2 · OPEN]"
-    echo "Owner: devtwo"
-    echo "Updated: 2026-03-25T10:00:00Z"
-    ;;
-  "show forge-ccc")
-    echo "◐ forge-ccc · Feature C [● P1 · IN_PROGRESS]"
-    echo "Owner: devone"
-    echo "Updated: 2026-03-27T09:00:00Z"
-    echo ""
-    echo "DEPENDS ON"
-    echo "  → forge-aaa: Feature A"
-    ;;
-  "show forge-m1n8.6")
-    # Dotted sub-ID — bd show must receive the full ID including .6
-    echo "◐ forge-m1n8.6 · Sub-feature X [● P2 · IN_PROGRESS]"
-    echo "Owner: devthree"
-    echo "Updated: 2026-03-27T08:00:00Z"
-    ;;
-  "show forge-m1n8")
-    # Parent epic — if a buggy parser truncates forge-m1n8.6 to forge-m1n8,
-    # the workload would get this WRONG owner and trigger the guard below.
-    echo "◐ forge-m1n8 · PARENT EPIC (WRONG — dotted ID was truncated)"
-    echo "Owner: WRONG_OWNER_DO_NOT_USE"
-    echo "Updated: 2026-03-20T10:00:00Z"
-    ;;
-esac
+args="$*"
+emit() { printf '{"data":{"issues":%s}}\n' "$1"; }
+
+# forge-aaa BLOCKS forge-ccc (kernel: the blocker carries the dependency edge),
+# so forge-ccc is the blocked one — blocked_by resolves to forge-aaa by reverse scan.
+aaa='{"id":"forge-aaa","title":"Feature A","status":"in_progress","assignee":"devone","updated_at":"2026-03-27T10:00:00Z","dependencies":["forge-ccc"]}'
+bbb='{"id":"forge-bbb","title":"Feature B","status":"open","assignee":"devtwo","updated_at":"2026-03-25T10:00:00Z","dependencies":[]}'
+ccc='{"id":"forge-ccc","title":"Feature C","status":"in_progress","assignee":"devone","updated_at":"2026-03-27T09:00:00Z","dependencies":[]}'
+# Dotted sub-ID: the id flows through verbatim from JSON, never truncated.
+m1n8='{"id":"forge-m1n8.6","title":"Sub-feature X (dotted ID)","status":"in_progress","assignee":"devthree","updated_at":"2026-03-27T08:00:00Z","dependencies":[]}'
+
+if [[ "$args" == *"issue list"* ]]; then
+  if [[ "$args" == *"--status=open"* ]]; then emit "[$bbb]"
+  elif [[ "$args" == *"--status=in_progress"* ]]; then emit "[$aaa,$ccc,$m1n8]"
+  else emit "[]"; fi
+  exit 0
+fi
+exit 0
 MOCK
-chmod +x "$mock_dir/bd"
+chmod +x "$mock_dir/forge"
 
-# ── Create mock bd with no issues ────────────────────────────────────────
-cat > "$mock_dir/bd-empty" << 'MOCK'
+# ── Create mock forge with no issues ──────────────────────────────────────
+cat > "$mock_dir/forge-empty" << 'MOCK'
 #!/usr/bin/env bash
-case "$1 $2" in
-  "list --status=open,in_progress")
-    echo ""
-    ;;
-  "list --status=open")
-    echo "○ forge-should-not-appear · Open fallback sentinel"
-    ;;
-  "list --status=in_progress")
-    echo "◐ forge-should-not-appear-2 · In-progress fallback sentinel"
-    ;;
-esac
+printf '{"data":{"issues":[]}}\n'
+exit 0
 MOCK
-chmod +x "$mock_dir/bd-empty"
+chmod +x "$mock_dir/forge-empty"
 
 export GH_CMD="$mock_dir/gh"
-export BD_CMD="$mock_dir/bd"
+export FORGE_CMD="$mock_dir/forge"
 
 # Source the library under test
 source "$SCRIPT_DIR/lib/workload.sh"
@@ -183,13 +149,13 @@ assert_not_contains "excludes devtwo" "Developer: devtwo" "$output"
 echo ""
 echo "── Test 4: No issues → No active work ──"
 unset _GITHUB_USER_CACHE
-export BD_CMD="$mock_dir/bd-empty"
+export FORGE_CMD="$mock_dir/forge-empty"
 rc=0
 output="$(cmd_workload 2>/dev/null)" || rc=$?
 assert_exit "exits 0" 0 "$rc"
 assert_contains "shows no active work message" "No active work" "$output"
-assert_not_contains "does not fall back when combined query succeeds with no issues" "forge-should-not-appear" "$output"
-export BD_CMD="$mock_dir/bd"
+assert_not_contains "empty issue lists yield no issue entries" "forge-" "$output"
+export FORGE_CMD="$mock_dir/forge"
 
 # ── Test 5: Stale assignment flagged (>48h) ──────────────────────────────
 echo ""

package/scripts/gen-command-manifest.js

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Generate the static command manifest — scripts/gen-command-manifest.js
+ *
+ * Static bundlers (`bun build --compile`) need a static require graph, but the
+ * command registry discovers commands at runtime via `fs.readdirSync` +
+ * `require(filePath)`. This generator walks `lib/commands/*.js` and emits
+ * `lib/commands/_manifest.js`, a checked-in module that `require`s every command
+ * module by a *static* relative path. The registry loads the manifest as its
+ * fast, bundleable path and keeps readdir auto-discovery as a dev/extension
+ * fallback (see lib/commands/_registry.js).
+ *
+ * The output is deterministic (sorted by filename) and timestamp-free, and the
+ * file is only rewritten when its content actually changes, so no-op
+ * regeneration never dirties the working tree.
+ *
+ * Usage:
+ *   node scripts/gen-command-manifest.js            # write if changed
+ *   node scripts/gen-command-manifest.js --check    # exit 1 if out of date
+ *
+ * @module scripts/gen-command-manifest
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const COMMANDS_DIR = path.resolve(__dirname, '..', 'lib', 'commands');
+const MANIFEST_PATH = path.join(COMMANDS_DIR, '_manifest.js');
+
+/**
+ * List the command module filenames the manifest should enumerate.
+ *
+ * Mirrors the registry's own filter: `.js` files that do not start with `_`
+ * (underscore-prefixed files are registry internals, not commands), sorted for
+ * deterministic output.
+ *
+ * @param {string} [commandsDir] - Directory to scan (defaults to lib/commands)
+ * @returns {string[]} Sorted command filenames (e.g. `['add.js', 'audit.js']`)
+ */
+function listCommandFiles(commandsDir = COMMANDS_DIR) {
+  return fs
+    .readdirSync(commandsDir)
+    .filter(f => f.endsWith('.js') && !f.startsWith('_'))
+    .sort();
+}
+
+/**
+ * Render the manifest source from a list of command filenames.
+ *
+ * @param {string[]} files - Sorted command filenames
+ * @returns {string} Full source text for lib/commands/_manifest.js
+ */
+function renderManifest(files) {
+  const header = [
+    '/**',
+    ' * Static Command Manifest — GENERATED FILE, DO NOT EDIT.',
+    ' *',
+    ' * Regenerate with: node scripts/gen-command-manifest.js',
+    ' * Drift is enforced by test/structural/command-manifest-drift.test.js.',
+    ' *',
+    ' * This module `require`s every command by a static relative path so',
+    ' * `bun build --compile` can statically bundle the command graph. The registry',
+    ' * (lib/commands/_registry.js) consumes `commands` as its fast, bundleable path',
+    ' * and falls back to `fs.readdirSync` auto-discovery for dev/extension commands.',
+    ' *',
+    ' * @module commands/_manifest',
+    ' */',
+    '',
+    "'use strict';",
+    '',
+    '/**',
+    ' * @typedef {Object} ManifestEntry',
+    ' * @property {string} file - Command filename (e.g. `status.js`)',
+    ' * @property {import("./_registry").CommandModule} module - The required command module',
+    ' */',
+    '',
+    '/** @type {ManifestEntry[]} */',
+    'const commands = [',
+  ];
+
+  const entries = files.map(file => {
+    const modPath = `./${file.replace(/\.js$/, '')}`;
+    return `  { file: ${JSON.stringify(file)}, module: require(${JSON.stringify(modPath)}) },`;
+  });
+
+  const footer = [
+    '];',
+    '',
+    'module.exports = {',
+    '  // Absolute path of the canonical commands directory this manifest describes.',
+    '  // The registry applies the manifest only when asked to load this exact dir.',
+    '  dir: __dirname,',
+    '  commands,',
+    '};',
+    '',
+  ];
+
+  return [...header, ...entries, ...footer].join('\n');
+}
+
+/**
+ * Generate (or check) the manifest.
+ *
+ * @param {{ check?: boolean, commandsDir?: string, manifestPath?: string }} [opts]
+ * @returns {{ changed: boolean, files: string[], path: string }}
+ */
+function generate(opts = {}) {
+  const commandsDir = opts.commandsDir ?? COMMANDS_DIR;
+  const manifestPath = opts.manifestPath ?? MANIFEST_PATH;
+  const files = listCommandFiles(commandsDir);
+  const next = renderManifest(files);
+
+  const current = fs.existsSync(manifestPath)
+    ? fs.readFileSync(manifestPath, 'utf8')
+    : null;
+
+  const changed = current !== next;
+
+  if (changed && !opts.check) {
+    fs.writeFileSync(manifestPath, next, 'utf8');
+  }
+
+  return { changed, files, path: manifestPath };
+}
+
+module.exports = { listCommandFiles, renderManifest, generate, COMMANDS_DIR, MANIFEST_PATH };
+
+// CLI entry point
+if (require.main === module) {
+  const check = process.argv.includes('--check');
+  const result = generate({ check });
+
+  if (check && result.changed) {
+    console.error(
+      '[gen-command-manifest] lib/commands/_manifest.js is out of date.\n' +
+      'Run: node scripts/gen-command-manifest.js'
+    );
+    process.exit(1);
+  }
+
+  if (result.changed) {
+    console.log(
+      `[gen-command-manifest] wrote ${path.relative(process.cwd(), result.path)} ` +
+      `(${result.files.length} commands)`
+    );
+  } else {
+    console.log(
+      `[gen-command-manifest] up to date (${result.files.length} commands)`
+    );
+  }
+}

package/scripts/gen-embedded-assets.mjs

@@ -0,0 +1,129 @@
+// Generate lib/embedded-assets.generated.mjs — a Bun-embeddable manifest that
+// statically imports every runtime asset (with { type: "file" }) and maps its
+// real relative POSIX path to the embedded-file path Bun resolves at compile time.
+//
+// WHY a generated per-file map instead of `bun build --compile ... skills/**`:
+// Bun's `embeddedFiles` exposes only a HASHED, directory-less `blob.name`
+// (e.g. `SKILL-a1b2c3.md`), so every skill's `SKILL.md` would collide and the
+// tree could not be reconstructed. A generated map keyed by the true relative
+// path preserves the directory structure exactly; each value is that specific
+// file's `/$bunfs/…` path, so `Bun.file(value)` / `fs` reads the right bytes.
+//
+// The output is gitignored and regenerated by the `build:binary` script right
+// before `bun build --compile`, so it can never drift from the source tree. The
+// completeness test (test/embedded-assets-drift.test.js) walks the same roots and
+// asserts the embed set == the on-disk asset set, both ways.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import pkgRoot from '../lib/package-root.js';
+
+const { ASSET_ROOTS } = pkgRoot;
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(__dirname, '..');
+const OUT_FILE = path.join(REPO_ROOT, 'lib', 'embedded-assets.generated.mjs');
+
+// Deterministic, locale-INDEPENDENT codepoint comparator. Locale-default sort would
+// diverge by machine locale and produce different embed bytes across the step-3
+// cross-compile targets, so sorting is pinned to codepoint order everywhere.
+const byteCompare = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+
+/** True when the asset needs the executable bit restored on extraction (files-only embedding drops mode). */
+export function isExecutableAsset(relPosixPath) {
+  return relPosixPath.endsWith('.sh') || relPosixPath.startsWith('.forge/hooks/');
+}
+
+/** Recursively list files under an absolute path, returning repo-relative posix paths. Symlinks are skipped (materialize content, never embed links). */
+function walk(absPath, relPath, out) {
+  const stat = fs.lstatSync(absPath);
+  if (stat.isSymbolicLink()) return;
+  if (stat.isDirectory()) {
+    for (const entry of fs.readdirSync(absPath).sort(byteCompare)) {
+      walk(path.join(absPath, entry), `${relPath}/${entry}`, out);
+    }
+  } else if (stat.isFile()) {
+    out.push(relPath);
+  }
+}
+
+/** Collect every embeddable asset as a sorted list of repo-relative posix paths. */
+export function collectAssetFiles(repoRoot = REPO_ROOT, roots = ASSET_ROOTS) {
+  const files = [];
+  for (const root of roots) {
+    const abs = path.join(repoRoot, root);
+    if (!fs.existsSync(abs)) {
+      // Fail CLOSED: a configured asset root that is absent would silently ship an
+      // incomplete manifest. Error instead so the build stops loudly.
+      throw new Error(
+        `Configured ASSET_ROOT does not exist: ${root} (looked in ${abs}). ` +
+          'Fix ASSET_ROOTS in lib/package-root.js or restore the missing path.'
+      );
+    }
+    walk(abs, root.split(path.sep).join('/'), files);
+  }
+  return [...new Set(files)].sort(byteCompare);
+}
+
+/**
+ * Content fingerprint over the asset SET: sha256 of each relpath + its bytes, in
+ * sorted order. Emitted into the manifest so the runtime cache dir identity
+ * changes whenever any asset content or the set changes (invalidates stale
+ * same-version extractions). Deterministic across machines.
+ */
+export function assetFingerprint(repoRoot = REPO_ROOT, files = collectAssetFiles(repoRoot)) {
+  const h = crypto.createHash('sha256');
+  for (const rel of files) {
+    h.update(rel);
+    h.update('\0');
+    h.update(fs.readFileSync(path.join(repoRoot, ...rel.split('/'))));
+  }
+  return h.digest('hex');
+}
+
+function render(files, fingerprint) {
+  const imports = [];
+  const entries = [];
+  const execEntries = [];
+  files.forEach((rel, i) => {
+    const ident = `a${i}`;
+    // Specifier is relative to lib/embedded-assets.generated.mjs → prefix `../`.
+    const specifier = JSON.stringify(`../${rel}`);
+    imports.push(`import ${ident} from ${specifier} with { type: "file" };`);
+    entries.push(`  ${JSON.stringify(rel)}: ${ident},`);
+    if (isExecutableAsset(rel)) execEntries.push(`  ${JSON.stringify(rel)},`);
+  });
+  return [
+    '// AUTO-GENERATED by scripts/gen-embedded-assets.mjs — DO NOT EDIT.',
+    '// Gitignored; regenerated before every `bun build --compile`.',
+    ...imports,
+    '',
+    'export const EMBEDDED_ASSETS = {',
+    ...entries,
+    '};',
+    '',
+    'export const EXECUTABLE_ASSETS = [',
+    ...execEntries,
+    '];',
+    '',
+    `export const ASSET_FINGERPRINT = ${JSON.stringify(fingerprint)};`,
+    '',
+  ].join('\n');
+}
+
+function main() {
+  const files = collectAssetFiles();
+  const fingerprint = assetFingerprint(REPO_ROOT, files);
+  fs.mkdirSync(path.dirname(OUT_FILE), { recursive: true });
+  fs.writeFileSync(OUT_FILE, render(files, fingerprint), 'utf8');
+  const execCount = files.filter(isExecutableAsset).length;
+  console.log(
+    `Embedded ${files.length} asset file(s) (${execCount} executable), fingerprint ${fingerprint.slice(0, 16)} → ${path.relative(REPO_ROOT, OUT_FILE)}`
+  );
+}
+
+if (import.meta.main || process.argv[1] === fileURLToPath(import.meta.url)) {
+  main();
+}

package/scripts/install.ps1

@@ -0,0 +1,139 @@
+<#
+.SYNOPSIS
+  Forge single-binary installer for Windows (x64).
+
+.DESCRIPTION
+  Downloads the forge-windows-x64.exe binary from the GitHub Release, installs it
+  to %LOCALAPPDATA%\Programs\forge\forge.exe, and prints a PATH note plus the next
+  step. The binary bundles Forge's JavaScript but NOT its external prerequisites:
+  git, gh (GitHub CLI) and Git Bash must still be installed separately.
+
+.PARAMETER Version
+  Release tag to install (default: latest), e.g. v1.2.3.
+
+.PARAMETER Dir
+  Install directory (default: $env:LOCALAPPDATA\Programs\forge).
+
+.PARAMETER PrintAsset
+  Print the resolved asset name and exit (used for verification/testing).
+
+.EXAMPLE
+  irm https://raw.githubusercontent.com/harshanandak/forge/master/scripts/install.ps1 | iex
+
+.EXAMPLE
+  # Pin a version (download the script, then run it with an argument):
+  $s = irm https://raw.githubusercontent.com/harshanandak/forge/master/scripts/install.ps1
+  & ([scriptblock]::Create($s)) -Version v1.2.3
+#>
+[CmdletBinding()]
+param(
+	[string]$Version = 'latest',
+	[string]$Dir = (Join-Path $env:LOCALAPPDATA 'Programs\forge'),
+	[switch]$PrintAsset,
+	[switch]$SkipChecksum
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+$Repo = if ($env:FORGE_REPO) { $env:FORGE_REPO } else { 'harshanandak/forge' }
+if ($Version -eq 'latest' -and $env:FORGE_VERSION) { $Version = $env:FORGE_VERSION }
+
+# Canonical asset-name mapping for Windows - the only target this script installs.
+# Mirrors scripts/lib/release-asset.mjs (forge-<os>-<arch>[.exe]).
+$Arch = if ($env:FORGE_ARCH) { $env:FORGE_ARCH } else { 'x64' }
+if ($Arch -ne 'x64') {
+	throw "forge-install: unsupported architecture '$Arch'. Only windows-x64 is published."
+}
+$Asset = "forge-windows-$Arch.exe"
+
+if ($PrintAsset) {
+	Write-Output $Asset
+	return
+}
+
+# Resolve version + URL. The /releases/latest/download/<asset> path redirects to
+# the newest release, so no JSON API call is needed to download.
+if ($Version -eq 'latest') {
+	$Url = "https://github.com/$Repo/releases/latest/download/$Asset"
+	try {
+		$rel = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases/latest" `
+			-Headers @{ 'User-Agent' = 'forge-install' }
+		$ResolvedVersion = $rel.tag_name
+	} catch {
+		$ResolvedVersion = 'latest'
+	}
+} else {
+	$Url = "https://github.com/$Repo/releases/download/$Version/$Asset"
+	$ResolvedVersion = $Version
+}
+
+Write-Host "forge-install: platform windows / $Arch -> asset $Asset"
+Write-Host "forge-install: downloading $Asset ($ResolvedVersion)"
+
+New-Item -ItemType Directory -Force -Path $Dir | Out-Null
+$Dest = Join-Path $Dir 'forge.exe'
+$Tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("forge-install-" + [System.Guid]::NewGuid().ToString('N') + ".exe")
+
+try {
+	Invoke-WebRequest -Uri $Url -OutFile $Tmp -UseBasicParsing -TimeoutSec 300
+} catch {
+	throw "forge-install: download failed from $Url - is the release published for windows-x64? ($_)"
+}
+if (-not (Test-Path $Tmp) -or (Get-Item $Tmp).Length -eq 0) {
+	throw "forge-install: downloaded file is empty - asset '$Asset' may not exist in release '$ResolvedVersion'."
+}
+
+# Integrity verification (SHA-256) BEFORE installing. A mismatch is fatal
+# (corrupted or substituted download). If the manifest cannot be fetched we warn
+# and continue; pass -SkipChecksum or set FORGE_SKIP_CHECKSUM=1 to bypass.
+if ($SkipChecksum -or $env:FORGE_SKIP_CHECKSUM -eq '1') {
+	Write-Host "forge-install: skipping integrity check (requested)."
+} else {
+	$SumsUrl = $Url.Substring(0, $Url.LastIndexOf('/') + 1) + 'checksums.txt'
+	$SumsTmp = Join-Path ([System.IO.Path]::GetTempPath()) ("forge-install-" + [System.Guid]::NewGuid().ToString('N') + ".txt")
+	$expected = $null
+	$manifestFetched = $false
+	try {
+		Invoke-WebRequest -Uri $SumsUrl -OutFile $SumsTmp -UseBasicParsing -TimeoutSec 30
+		$manifestFetched = $true
+		foreach ($line in (Get-Content $SumsTmp)) {
+			# Lines are "<hash>  <name>" (text) or "<hash> *<name>" (binary).
+			if ($line -match '^\s*([0-9a-fA-F]{64})\s+\*?(.+?)\s*$' -and $Matches[2] -eq $Asset) {
+				$expected = $Matches[1].ToLower()
+				break
+			}
+		}
+	} catch {
+		Write-Host "forge-install: could not download checksums.txt - skipping integrity check."
+	} finally {
+		if (Test-Path $SumsTmp) { Remove-Item -Force $SumsTmp }
+	}
+	if ($expected) {
+		$actual = (Get-FileHash -Algorithm SHA256 -Path $Tmp).Hash.ToLower()
+		if ($actual -ne $expected) {
+			Remove-Item -Force $Tmp
+			throw "forge-install: checksum mismatch for $Asset`n  expected: $expected`n  actual:   $actual`nThe download may be corrupted or tampered with - aborting."
+		}
+		Write-Host "forge-install: checksum verified (sha256)."
+	} elseif ($manifestFetched) {
+		Write-Host "forge-install: $Asset not listed in checksums.txt - skipping integrity check."
+	}
+}
+
+Move-Item -Force -Path $Tmp -Destination $Dest
+
+Write-Host ""
+Write-Host "forge-install: installed forge $ResolvedVersion -> $Dest"
+
+# PATH note: check the user PATH, not just the current process.
+$userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
+if (-not ($userPath -and ($userPath -split ';' | Where-Object { $_ -eq $Dir }))) {
+	Write-Host ""
+	Write-Host "$Dir is not on your PATH. Add it (new terminals will pick it up):"
+	Write-Host "  [Environment]::SetEnvironmentVariable('Path', `"$Dir;`$([Environment]::GetEnvironmentVariable('Path','User'))`", 'User')"
+}
+
+Write-Host ""
+Write-Host "Next: run 'forge setup' in a git repo to wire up Forge."
+Write-Host "Note: git, gh (GitHub CLI) and Git Bash must be installed separately - the binary bundles Forge, not those tools."