forge-workflow 1.4.0 → 1.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,860 @@
1
+ # Forge
2
+
3
+ A 9-stage TDD-first workflow for **ALL AI coding agents**. Ship features with confidence using test-driven development, research-first planning, and comprehensive documentation.
4
+
5
+ ```
6
+ /status -> /research -> /plan -> /dev -> /check -> /ship -> /review -> /merge -> /verify
7
+ ```
8
+
9
+ ## Why Forge?
10
+
11
+ - **TDD-First**: Write tests before code (RED-GREEN-REFACTOR)
12
+ - **Research-First**: Understand before building, document decisions
13
+ - **Security Built-In**: OWASP Top 10 analysis for every feature
14
+ - **Multi-Session**: Track work across sessions with Beads
15
+ - **Strategic Planning**: Use OpenSpec for architecture changes
16
+ - **Universal**: Works with 11+ AI coding agents
17
+
18
+ ## Supported AI Coding Agents
19
+
20
+ Forge works with **all major AI coding agents** using the universal AGENTS.md standard:
21
+
22
+ | Agent | Status | Primary Config | Commands Location |
23
+ |-------|--------|----------------|-------------------|
24
+ | **Claude Code** | Full | `CLAUDE.md` | `.claude/commands/` |
25
+ | **Google Antigravity** | Full | `GEMINI.md` | `.agent/workflows/` |
26
+ | **Cursor** | Full | `.cursorrules` | `.cursor/rules/` |
27
+ | **Windsurf** | Full | `.windsurfrules` | `.windsurf/workflows/` |
28
+ | **Kilo Code** | Full | `AGENTS.md` | `.kilocode/workflows/` |
29
+ | **OpenCode** | Full | `AGENTS.md` | `.opencode/commands/` |
30
+ | **Continue** | Full | `.continuerules` | `.continue/prompts/` |
31
+ | **GitHub Copilot** | Full | `.github/copilot-instructions.md` | `.github/prompts/` |
32
+ | **Cline** | Full | `.clinerules` | Via instructions |
33
+ | **Roo Code** | Full | `.clinerules` | `.roo/commands/` |
34
+ | **Aider** | Full | `AGENTS.md` | Via instructions |
35
+
36
+ ## Installation
37
+
38
+ ### Option 1: npm (Recommended)
39
+
40
+ ```bash
41
+ # Step 1: Install the package (minimal: AGENTS.md + docs)
42
+ npm install forge-workflow
43
+
44
+ # Step 2: Configure for your agents (interactive)
45
+ npx forge setup
46
+ ```
47
+
48
+ Or specify agents directly:
49
+
50
+ ```bash
51
+ # Install for specific agents
52
+ npx forge setup --agents claude,cursor,windsurf
53
+
54
+ # Install for all agents
55
+ npx forge setup --all
56
+ ```
57
+
58
+ ### Option 2: curl (Interactive)
59
+
60
+ ```bash
61
+ curl -fsSL https://raw.githubusercontent.com/harshanandak/forge/main/install.sh | bash
62
+ ```
63
+
64
+ ### Option 3: bun
65
+
66
+ ```bash
67
+ bun add forge-workflow
68
+ bunx forge setup
69
+ ```
70
+
71
+ ## The Toolchain
72
+
73
+ Forge integrates with three powerful tools for complete workflow management:
74
+
75
+ ```
76
+ ┌─────────────────────────────────────────────────────────────────┐
77
+ │ FORGE TOOLCHAIN │
78
+ ├─────────────────────────────────────────────────────────────────┤
79
+ │ │
80
+ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────────────┐ │
81
+ │ │ BEADS │ │ OPENSPEC │ │ CLAUDE TASKS │ │
82
+ │ │ │ │ │ │ │ │
83
+ │ │ Issue │ │ Proposal │ │ Save/Resume │ │
84
+ │ │ Tracking │ │ System │ │ Task State │ │
85
+ │ │ │ │ │ │ │ │
86
+ │ │ bd create │ │ openspec │ │ /tasks save │ │
87
+ │ │ bd ready │ │ proposal │ │ /tasks resume │ │
88
+ │ │ bd close │ │ create │ │ /tasks list │ │
89
+ │ └─────────────┘ └─────────────┘ └─────────────────────┘ │
90
+ │ │ │ │ │
91
+ │ └─────────────────┴─────────────────────┘ │
92
+ │ │ │
93
+ │ ┌─────▼─────┐ │
94
+ │ │ FORGE │ │
95
+ │ │ 9-Stage │ │
96
+ │ │ Workflow │ │
97
+ │ └───────────┘ │
98
+ │ │
99
+ └─────────────────────────────────────────────────────────────────┘
100
+ ```
101
+
102
+ ### Beads - Issue Tracking Across Sessions
103
+
104
+ [Beads](https://github.com/steveyegge/beads) provides git-backed, distributed issue tracking designed for AI coding agents.
105
+
106
+ ```bash
107
+ # Install
108
+ npm install -g @beads/bd
109
+
110
+ # Initialize in your project
111
+ bd init
112
+
113
+ # Find work ready to start (no blockers!)
114
+ bd ready
115
+
116
+ # Create an issue
117
+ bd create "Add user authentication" --type feature --priority 2
118
+
119
+ # View issue details
120
+ bd show <id>
121
+
122
+ # Update status
123
+ bd update <id> --status in_progress
124
+
125
+ # Add dependencies (child depends on parent)
126
+ bd dep add <child> <parent>
127
+
128
+ # Add comments during work
129
+ bd comments <id> "Progress: login working, starting signup"
130
+
131
+ # Complete work
132
+ bd close <id> --reason "Implemented with JWT"
133
+
134
+ # Sync with git (ALWAYS at session end!)
135
+ bd sync
136
+ ```
137
+
138
+ **Why Beads?**
139
+ - **Persists across sessions** - Issues survive context clearing, compaction, new chats
140
+ - **Git-backed** - Version controlled like code, mergeable, team-shareable
141
+ - **Dependency tracking** - Know what blocks what with `bd blocked`
142
+ - **Ready detection** - `bd ready` finds unblocked work automatically
143
+ - **AI-optimized** - JSON output, semantic compaction, audit trails
144
+
145
+ See [docs/TOOLCHAIN.md](docs/TOOLCHAIN.md) for complete Beads command reference.
146
+
147
+ ### OpenSpec - Spec-Driven Development
148
+
149
+ [OpenSpec](https://github.com/Fission-AI/OpenSpec) provides spec-driven development for AI-assisted workflows.
150
+
151
+ ```bash
152
+ # Install (requires Node.js 20.19+)
153
+ npm install -g @fission-ai/openspec
154
+
155
+ # Initialize
156
+ openspec init
157
+
158
+ # In AI assistant (Claude Code, Cursor, Windsurf):
159
+ /opsx:new # Start a new change
160
+ /opsx:ff # Fast-forward: generate all planning docs
161
+ /opsx:apply # Implement tasks
162
+ /opsx:verify # Validate implementation
163
+ /opsx:archive # Complete and archive
164
+
165
+ # Creates:
166
+ # openspec/changes/[name]/
167
+ # ├── proposal.md # Intent, scope, rationale
168
+ # ├── design.md # Technical approach
169
+ # ├── tasks.md # Implementation checklist
170
+ # └── specs/ # Delta specifications (ADDED/MODIFIED/REMOVED)
171
+ ```
172
+
173
+ **When to use OpenSpec:**
174
+
175
+ | Scope | Use OpenSpec? | Example |
176
+ |-------|---------------|---------|
177
+ | **Tactical** (< 1 day) | No | Bug fix, small feature |
178
+ | **Strategic** (architecture) | Yes | New service, major refactor |
179
+ | **Breaking changes** | Yes | API changes, schema migrations |
180
+ | **Multi-session work** | Yes | Large features |
181
+
182
+ **Workflow:**
183
+ ```bash
184
+ # 1. Start change (in AI assistant)
185
+ /opsx:new
186
+ # Describe: "Add payment processing with Stripe"
187
+
188
+ # 2. Generate all planning docs
189
+ /opsx:ff
190
+ # Creates proposal.md, design.md, tasks.md, specs/
191
+
192
+ # 3. Implement
193
+ /opsx:apply
194
+ # AI writes code following tasks.md
195
+
196
+ # 4. Validate and finalize
197
+ /opsx:verify # Confirm implementation matches specs
198
+ openspec sync # Merge deltas into main specs
199
+ openspec archive name # Move to archive
200
+ ```
201
+
202
+ See [docs/TOOLCHAIN.md](docs/TOOLCHAIN.md) for complete OpenSpec reference.
203
+
204
+ ### Claude Tasks - Save and Resume Work
205
+
206
+ Claude Code's built-in task system lets you save work state and resume later.
207
+
208
+ ```bash
209
+ # Save current task state
210
+ /tasks save "implementing auth flow"
211
+
212
+ # List saved tasks
213
+ /tasks list
214
+
215
+ # Resume a saved task
216
+ /tasks resume <task-id>
217
+
218
+ # Delete a task
219
+ /tasks delete <task-id>
220
+ ```
221
+
222
+ **When to use Claude Tasks:**
223
+ - Taking a break mid-implementation
224
+ - Switching between features
225
+ - Preserving context before `/clear`
226
+ - Handoff to another session
227
+
228
+ ## The 9 Stages
229
+
230
+ | Stage | Command | What It Does | Tools Used |
231
+ |-------|---------|--------------|------------|
232
+ | 1 | `/status` | Check current context | Beads, Git |
233
+ | 2 | `/research` | Deep research, document findings | Web search, Codebase |
234
+ | 3 | `/plan` | Create plan, branch, tracking | Beads, OpenSpec |
235
+ | 4 | `/dev` | TDD development (RED-GREEN-REFACTOR) | Tests, Code |
236
+ | 5 | `/check` | Validation (type/lint/security/tests) | CI tools |
237
+ | 6 | `/ship` | Create PR with documentation | GitHub CLI |
238
+ | 7 | `/review` | Address ALL PR feedback | GitHub, Greptile |
239
+ | 8 | `/merge` | Update docs, merge, cleanup | Git |
240
+ | 9 | `/verify` | Final documentation check | Docs |
241
+
242
+ ## Complete Workflow Example
243
+
244
+ ```bash
245
+ # ═══════════════════════════════════════════════════════════
246
+ # STAGE 1: STATUS - Where are we?
247
+ # ═══════════════════════════════════════════════════════════
248
+ /status
249
+
250
+ # Checks:
251
+ # - bd ready (Beads issues ready to work)
252
+ # - bd list --status in_progress (active work)
253
+ # - git status (branch state)
254
+ # - openspec list --active (pending proposals)
255
+
256
+ # ═══════════════════════════════════════════════════════════
257
+ # STAGE 2: RESEARCH - Understand before building
258
+ # ═══════════════════════════════════════════════════════════
259
+ /research user-authentication
260
+
261
+ # Creates: docs/research/user-authentication.md
262
+ # Contains:
263
+ # - Codebase analysis (existing patterns)
264
+ # - Web research (best practices, security)
265
+ # - OWASP Top 10 analysis
266
+ # - Key decisions with reasoning
267
+ # - TDD test scenarios (identified UPFRONT)
268
+
269
+ # ═══════════════════════════════════════════════════════════
270
+ # STAGE 3: PLAN - Create formal plan
271
+ # ═══════════════════════════════════════════════════════════
272
+ /plan user-authentication
273
+
274
+ # If TACTICAL (< 1 day):
275
+ bd create "Add user authentication"
276
+ git checkout -b feat/user-authentication
277
+
278
+ # If STRATEGIC (architecture change):
279
+ openspec proposal create user-authentication
280
+ # Write proposal.md, tasks.md, design.md
281
+ openspec validate user-authentication --strict
282
+ bd create "User auth (see openspec/changes/user-authentication)"
283
+ git checkout -b feat/user-authentication
284
+ # Create PR for proposal approval first!
285
+
286
+ # ═══════════════════════════════════════════════════════════
287
+ # STAGE 4: DEV - TDD Implementation
288
+ # ═══════════════════════════════════════════════════════════
289
+ /dev
290
+
291
+ # TDD Cycle (repeat for each feature):
292
+ # RED: Write failing test
293
+ # GREEN: Make it pass (minimal code)
294
+ # REFACTOR: Clean up
295
+ # COMMIT: git commit after each GREEN
296
+
297
+ bd update <id> --status in_progress
298
+
299
+ # If taking a break:
300
+ /tasks save "auth flow - completed login, starting signup"
301
+
302
+ # ═══════════════════════════════════════════════════════════
303
+ # STAGE 5: CHECK - Validate everything
304
+ # ═══════════════════════════════════════════════════════════
305
+ /check
306
+
307
+ # Runs:
308
+ # - Type checking (tsc/typecheck)
309
+ # - Linting (eslint)
310
+ # - Unit tests
311
+ # - Integration tests
312
+ # - E2E tests
313
+ # - Security scan
314
+
315
+ # If fails:
316
+ bd update <id> --status blocked --comment "Type errors in auth.ts"
317
+
318
+ # ═══════════════════════════════════════════════════════════
319
+ # STAGE 6: SHIP - Create PR
320
+ # ═══════════════════════════════════════════════════════════
321
+ /ship
322
+
323
+ bd update <id> --status done
324
+ git push -u origin feat/user-authentication
325
+
326
+ gh pr create --title "feat: user authentication" --body "
327
+ ## Summary
328
+ - JWT-based auth with refresh tokens
329
+ - Login/signup/logout flows
330
+ - Password reset via email
331
+
332
+ ## Research
333
+ See: docs/research/user-authentication.md
334
+
335
+ ## Beads Issue
336
+ Closes: beads-abc123
337
+
338
+ ## Test Coverage
339
+ - 45 unit tests
340
+ - 12 integration tests
341
+ - 8 E2E tests
342
+ "
343
+
344
+ # ═══════════════════════════════════════════════════════════
345
+ # STAGE 7: REVIEW - Address ALL feedback
346
+ # ═══════════════════════════════════════════════════════════
347
+ /review 123
348
+
349
+ # Address:
350
+ # - GitHub Actions failures
351
+ # - Greptile comments
352
+ # - SonarCloud issues
353
+ # - Human reviewer comments
354
+
355
+ # Fix, commit, push
356
+ git commit -m "fix: address PR review feedback"
357
+ git push
358
+
359
+ # ═══════════════════════════════════════════════════════════
360
+ # STAGE 8: MERGE - Complete the work
361
+ # ═══════════════════════════════════════════════════════════
362
+ /merge 123
363
+
364
+ # Update docs BEFORE merge:
365
+ # - docs/planning/PROGRESS.md
366
+ # - API documentation
367
+ # - README if user-facing
368
+
369
+ gh pr merge 123 --squash --delete-branch
370
+
371
+ # If OpenSpec was used:
372
+ openspec archive user-authentication
373
+
374
+ bd sync
375
+ git checkout main && git pull
376
+
377
+ # ═══════════════════════════════════════════════════════════
378
+ # STAGE 9: VERIFY - Final documentation check
379
+ # ═══════════════════════════════════════════════════════════
380
+ /verify
381
+
382
+ # Verify:
383
+ # - PROGRESS.md updated
384
+ # - API docs current
385
+ # - README examples work
386
+ # - Cross-references valid
387
+
388
+ # Done! Back to /status for next task
389
+ ```
390
+
391
+ ## Directory Structure
392
+
393
+ After running `npx forge setup`, only selected agents are configured:
394
+
395
+ ```
396
+ your-project/
397
+ ├── AGENTS.md # Universal standard (always created)
398
+ ├── CLAUDE.md # -> linked to AGENTS.md (if Claude selected)
399
+ ├── GEMINI.md # -> linked (if Antigravity selected)
400
+ ├── .cursorrules # -> linked (if Cursor selected)
401
+ ├── .windsurfrules # -> linked (if Windsurf selected)
402
+ ├── .clinerules # -> linked (if Cline/Roo selected)
403
+
404
+ ├── .beads/ # Beads issue tracking (if bd init)
405
+ │ └── issues/
406
+
407
+ ├── openspec/ # OpenSpec proposals (if openspec init)
408
+ │ ├── specs/
409
+ │ └── changes/
410
+
411
+ ├── .claude/ # Claude Code (if selected)
412
+ │ ├── commands/ # 9 workflow commands
413
+ │ ├── rules/
414
+ │ └── skills/forge-workflow/
415
+
416
+ ├── .cursor/ # Cursor (if selected)
417
+ │ ├── rules/forge-workflow.mdc
418
+ │ └── skills/forge-workflow/
419
+
420
+ ├── .windsurf/ # Windsurf (if selected)
421
+ │ ├── workflows/
422
+ │ └── skills/forge-workflow/
423
+
424
+ └── docs/
425
+ ├── planning/PROGRESS.md # Project progress
426
+ ├── research/ # Research documents
427
+ │ └── TEMPLATE.md
428
+ └── WORKFLOW.md # Complete guide
429
+ ```
430
+
431
+ ## External Services & API Tokens
432
+
433
+ Forge integrates with external services for enhanced capabilities. **Most tools have FREE alternatives!**
434
+
435
+ ### Code Review Options (Choose One)
436
+
437
+ | Tool | Pricing | Best For | Setup |
438
+ |------|---------|----------|-------|
439
+ | **GitHub Code Quality** | FREE | All GitHub repos | Built-in, zero setup ✓ |
440
+ | **CodeRabbit** | FREE (OSS) | Open source | GitHub App |
441
+ | **Greptile** | $99+/mo | Enterprise | API key |
442
+
443
+ **Recommended**: Start with GitHub Code Quality (free, already enabled).
444
+
445
+ ### Code Quality Options (Choose One)
446
+
447
+ | Tool | Pricing | Best For | Setup |
448
+ |------|---------|----------|-------|
449
+ | **ESLint** | FREE | All projects | Built-in ✓ |
450
+ | **SonarCloud** | 50k LoC free | Cloud-first | API key |
451
+ | **SonarQube Community** | FREE | Self-hosted | Docker |
452
+
453
+ **Recommended**: Start with ESLint (free, already in your project).
454
+
455
+ Store API tokens in `.env.local`:
456
+
457
+ ```bash
458
+ # .env.local (add to .gitignore!)
459
+
460
+ # Code Review Tool Selection
461
+ CODE_REVIEW_TOOL=github-code-quality # or: coderabbit, greptile, none
462
+
463
+ # Code Quality Tool Selection
464
+ CODE_QUALITY_TOOL=eslint # or: sonarcloud, sonarqube, none
465
+
466
+ # Required for PR workflow
467
+ GITHUB_TOKEN=ghp_xxxxxxxxxxxx
468
+
469
+ # Parallel AI - Deep web research (/research stage, optional)
470
+ PARALLEL_API_KEY=your-parallel-ai-key
471
+
472
+ # Greptile - AI code review (only if CODE_REVIEW_TOOL=greptile)
473
+ GREPTILE_API_KEY=your-greptile-key
474
+
475
+ # SonarCloud (only if CODE_QUALITY_TOOL=sonarcloud)
476
+ SONAR_TOKEN=your-sonarcloud-token
477
+ SONAR_ORGANIZATION=your-org
478
+ SONAR_PROJECT_KEY=your-project-key
479
+
480
+ # SonarQube Self-Hosted (only if CODE_QUALITY_TOOL=sonarqube)
481
+ SONARQUBE_URL=http://localhost:9000
482
+ SONARQUBE_TOKEN=your-token
483
+
484
+ ```
485
+
486
+ ### Service Setup
487
+
488
+ | Service | Pricing | Purpose | Get Token | Used In |
489
+ |---------|---------|---------|-----------|---------|
490
+ | **GitHub CLI** | FREE | PR workflow | `gh auth login` | `/ship`, `/review`, `/merge` |
491
+ | **GitHub Code Quality** | FREE | Code review | Built-in | `/review` |
492
+ | **CodeRabbit** | FREE (OSS) | AI code review | [coderabbit.ai](https://coderabbit.ai) | `/review` |
493
+ | **Greptile** | $99+/mo | Enterprise review | [greptile.com](https://greptile.com) | `/review` |
494
+ | **ESLint** | FREE | Linting | Built-in | `/check` |
495
+ | **SonarCloud** | 50k LoC free | Cloud quality | [sonarcloud.io](https://sonarcloud.io) | `/check` |
496
+ | **SonarQube** | FREE | Self-hosted quality | Docker | `/check` |
497
+ | **Parallel AI** | Paid | Web research | [platform.parallel.ai](https://platform.parallel.ai) | `/research` |
498
+
499
+ ### Code Review Setup
500
+
501
+ **Option 1: GitHub Code Quality (FREE, Recommended)**
502
+
503
+ Zero setup required - GitHub's built-in code quality features are already enabled.
504
+
505
+ **Option 2: CodeRabbit (FREE for Open Source)**
506
+
507
+ ```bash
508
+ # 1. Go to https://coderabbit.ai
509
+ # 2. Install the GitHub App
510
+ # 3. Enable for your repositories
511
+ # That's it! CodeRabbit will review PRs automatically.
512
+ ```
513
+
514
+ **Option 3: Greptile (Paid - Enterprise)**
515
+
516
+ ```bash
517
+ # 1. Get API key from https://app.greptile.com
518
+ # 2. Add to .env.local
519
+ GREPTILE_API_KEY=your-key
520
+
521
+ # 3. Index your repository (one-time)
522
+ curl -X POST "https://api.greptile.com/v2/repositories" \
523
+ -H "Authorization: Bearer $GREPTILE_API_KEY" \
524
+ -H "Content-Type: application/json" \
525
+ -d '{"remote": "github", "repository": "owner/repo"}'
526
+ ```
527
+
528
+ ### Code Quality Setup
529
+
530
+ **Option 1: ESLint Only (FREE, Recommended)**
531
+
532
+ Already configured in your project - no additional setup needed.
533
+
534
+ ```bash
535
+ npm run lint # or bun run lint
536
+ ```
537
+
538
+ **Option 2: SonarCloud (Cloud-Hosted)**
539
+
540
+ ```bash
541
+ # 1. Create project at https://sonarcloud.io
542
+ # 2. Get token from Security settings
543
+ # 3. Add to .env.local
544
+ SONAR_TOKEN=your-token
545
+ SONAR_ORGANIZATION=your-org
546
+ SONAR_PROJECT_KEY=your-project
547
+
548
+ # 4. Add sonar-project.properties
549
+ echo "sonar.organization=$SONAR_ORGANIZATION
550
+ sonar.projectKey=$SONAR_PROJECT_KEY
551
+ sonar.sources=src" > sonar-project.properties
552
+
553
+ # 5. Run analysis (in CI or locally)
554
+ npx sonarqube-scanner
555
+ ```
556
+
557
+ **Option 3: SonarQube Community (FREE, Self-Hosted)**
558
+
559
+ ```bash
560
+ # 1. Start SonarQube with Docker
561
+ docker run -d --name sonarqube -p 9000:9000 sonarqube:community
562
+
563
+ # 2. Access at http://localhost:9000 (admin/admin)
564
+ # 3. Generate token in SonarQube UI
565
+ # 4. Add to .env.local
566
+ SONARQUBE_URL=http://localhost:9000
567
+ SONARQUBE_TOKEN=your-token
568
+
569
+ # 5. Add sonar-project.properties
570
+ echo "sonar.host.url=http://localhost:9000
571
+ sonar.login=your-token
572
+ sonar.projectKey=your-project
573
+ sonar.sources=src" > sonar-project.properties
574
+
575
+ # 6. Run analysis
576
+ npx sonarqube-scanner
577
+ ```
578
+
579
+ ### Research Tool Setup
580
+
581
+ **Parallel AI (Optional - Paid)**
582
+
583
+ ```bash
584
+ # 1. Get API key from https://platform.parallel.ai
585
+ # 2. Add to .env.local
586
+ PARALLEL_API_KEY=your-key
587
+
588
+ # 3. Test with curl
589
+ API_KEY=$(grep "^PARALLEL_API_KEY=" .env.local | cut -d= -f2)
590
+ curl -s -X POST "https://api.parallel.ai/v1beta/search" \
591
+ -H "x-api-key: $API_KEY" \
592
+ -H "Content-Type: application/json" \
593
+ -H "parallel-beta: search-extract-2025-10-10" \
594
+ -d '{"objective": "test query"}'
595
+ ```
596
+
597
+ ### Loading Tokens
598
+
599
+ Forge includes a helper script:
600
+
601
+ ```bash
602
+ # .claude/scripts/load-env.sh
603
+ source .claude/scripts/load-env.sh
604
+
605
+ # Or manually
606
+ export $(grep -v '^#' .env.local | xargs)
607
+ ```
608
+
609
+ ### Security Notes
610
+
611
+ - **NEVER commit `.env.local`** - add to `.gitignore`
612
+ - Use GitHub Secrets for CI/CD
613
+ - Rotate tokens periodically
614
+ - Use least-privilege tokens where possible
615
+
616
+ ## Prerequisites
617
+
618
+ ### Required
619
+
620
+ - **Git** - Version control
621
+ - **GitHub CLI** - For PR workflow
622
+ ```bash
623
+ # macOS
624
+ brew install gh && gh auth login
625
+
626
+ # Windows
627
+ winget install GitHub.cli && gh auth login
628
+
629
+ # Linux
630
+ sudo apt install gh && gh auth login
631
+ ```
632
+
633
+ ### Recommended
634
+
635
+ - **Beads** - Issue tracking across sessions
636
+ ```bash
637
+ npm install -g @beads/bd
638
+ bd init
639
+ ```
640
+
641
+ ### Optional
642
+
643
+ - **OpenSpec** - Spec-driven development (requires Node.js 20.19+)
644
+ ```bash
645
+ npm install -g @fission-ai/openspec
646
+ openspec init
647
+ ```
648
+
649
+ ## Quick Reference
650
+
651
+ ### Beads Commands
652
+
653
+ ```bash
654
+ bd init # Initialize in project
655
+ bd ready # Show work with no blockers (start here!)
656
+ bd create "title" -p 2 # Create issue with priority
657
+ bd show <id> # View issue details + audit trail
658
+ bd list --status open # List open issues
659
+ bd update <id> --status X # Update status
660
+ bd dep add <child> <parent> # child depends on parent
661
+ bd comments <id> "note" # Add comment
662
+ bd close <id> # Complete issue
663
+ bd blocked # Show blocked issues
664
+ bd sync # Sync with git (always at session end!)
665
+ ```
666
+
667
+ ### OpenSpec Commands (AI Slash Commands)
668
+
669
+ ```bash
670
+ /opsx:new # Start new change
671
+ /opsx:ff # Fast-forward: generate all docs
672
+ /opsx:apply # Implement tasks
673
+ /opsx:verify # Validate implementation
674
+ /opsx:sync # Merge delta specs
675
+ /opsx:archive # Complete and archive
676
+ ```
677
+
678
+ ### OpenSpec Commands (CLI)
679
+
680
+ ```bash
681
+ openspec init # Initialize
682
+ openspec list # List changes/specs
683
+ openspec validate <name> # Validate change
684
+ openspec status # Show progress
685
+ openspec archive <name> # Archive completed
686
+ ```
687
+
688
+ ### Claude Tasks Commands
689
+
690
+ ```bash
691
+ /tasks save "description" # Save current state
692
+ /tasks list # List saved tasks
693
+ /tasks resume <id> # Resume a task
694
+ /tasks delete <id> # Delete a task
695
+ ```
696
+
697
+ ### Forge Commands
698
+
699
+ ```bash
700
+ /status # Check current state
701
+ /research <feature> # Research a feature
702
+ /plan <feature> # Create implementation plan
703
+ /dev # TDD development
704
+ /check # Run all validations
705
+ /ship # Create PR
706
+ /review <pr> # Address PR feedback
707
+ /merge <pr> # Merge PR
708
+ /verify # Final doc check
709
+ ```
710
+
711
+ ## Core Principles
712
+
713
+ ### TDD-First
714
+
715
+ Every feature starts with tests:
716
+
717
+ ```
718
+ RED -> Write a failing test
719
+ GREEN -> Write minimal code to pass
720
+ REFACTOR -> Clean up, commit
721
+ REPEAT -> Next test case
722
+ ```
723
+
724
+ ### Research-First
725
+
726
+ Before building, understand:
727
+
728
+ 1. **Codebase** - Existing patterns, affected modules
729
+ 2. **Best practices** - Web research, official docs
730
+ 3. **Security** - OWASP Top 10 analysis
731
+ 4. **Decisions** - Document WHY, not just WHAT
732
+
733
+ ### Security Built-In
734
+
735
+ Every feature includes:
736
+
737
+ - OWASP Top 10 analysis in research
738
+ - Security test scenarios in TDD
739
+ - Automated scans in `/check`
740
+ - Security review in PR
741
+
742
+ ### Documentation Progressive
743
+
744
+ Update docs at each stage:
745
+
746
+ - `/research` -> Research document
747
+ - `/plan` -> Beads issue, OpenSpec (if strategic)
748
+ - `/ship` -> PR description
749
+ - `/merge` -> PROGRESS.md, API docs
750
+ - `/verify` -> Cross-check everything
751
+
752
+ ## Agent Compatibility
753
+
754
+ Forge is designed for Claude Code's extensive features but adapts to all agents:
755
+
756
+ ### Feature Availability by Agent
757
+
758
+ | Feature | Claude Code | Cursor | Windsurf | Kilo | Others |
759
+ |---------|-------------|--------|----------|------|--------|
760
+ | **Slash Commands** | `/status` etc. | Via rules | `/status` etc. | `/status.md` | AGENTS.md |
761
+ | **Skills (SKILL.md)** | Full | Full | Full | Full | Partial |
762
+ | **Rules** | `.claude/rules/` | `.mdc` | `.windsurf/rules/` | `.kilocode/rules/` | AGENTS.md |
763
+ | **Tasks Save/Resume** | `/tasks` | Memory | Memories | Memory Bank | Manual |
764
+ | **Issue Tracking** | Beads | Beads | Beads | Memory Bank | Beads |
765
+ | **Proposals** | OpenSpec | OpenSpec | OpenSpec | OpenSpec | OpenSpec |
766
+
767
+ ### How Forge Adapts
768
+
769
+ **Claude Code** (Full Support):
770
+ ```bash
771
+ /status # Native slash command
772
+ /tasks save # Built-in task persistence
773
+ bd ready # Beads integration
774
+ ```
775
+
776
+ **Cursor/Windsurf** (Near-Full Support):
777
+ ```bash
778
+ # Read AGENTS.md instructions
779
+ # Use Memories/Memory for persistence
780
+ # Same Beads/OpenSpec workflow
781
+ ```
782
+
783
+ **Other Agents** (AGENTS.md Fallback):
784
+ ```
785
+ The agent reads AGENTS.md and follows the 9-stage workflow.
786
+ Users describe what stage they're at: "I'm at the /dev stage"
787
+ Agent follows the documented process.
788
+ ```
789
+
790
+ ### The Universal Principle
791
+
792
+ Even without slash commands, the **workflow principles** work everywhere:
793
+
794
+ 1. **Check status before starting** - Review active work, git state
795
+ 2. **Research before building** - Document decisions
796
+ 3. **Plan formally** - Create tracking issue, branch
797
+ 4. **TDD development** - RED-GREEN-REFACTOR
798
+ 5. **Validate thoroughly** - Type/lint/test/security
799
+ 6. **Document in PR** - Link research, list tests
800
+ 7. **Address ALL feedback** - CI failures, reviews
801
+ 8. **Update docs before merge** - PROGRESS.md, API docs
802
+ 9. **Verify completeness** - Cross-check everything
803
+
804
+ ### Persistence Across Agents
805
+
806
+ | Agent | How to Persist Context |
807
+ |-------|------------------------|
808
+ | **Claude Code** | `/tasks save`, Beads issues |
809
+ | **Cursor** | Composer memory, Beads |
810
+ | **Windsurf** | Cascade Memories, Beads |
811
+ | **Kilo Code** | Memory Bank, Beads |
812
+ | **Cline** | Memory Bank, Beads |
813
+ | **Others** | Beads (git-backed, universal) |
814
+
815
+ **Beads is the universal solution** - it works with ANY agent because it's git-backed.
816
+
817
+ ### Why This Architecture?
818
+
819
+ ```
820
+ ┌─────────────────────────────────────────────────────────────┐
821
+ │ FORGE ARCHITECTURE │
822
+ ├─────────────────────────────────────────────────────────────┤
823
+ │ │
824
+ │ AGENTS.md (Universal) │
825
+ │ ├── Works with EVERY agent │
826
+ │ ├── Plain markdown, no special features needed │
827
+ │ └── Contains full workflow documentation │
828
+ │ │
829
+ │ Agent-Specific Enhancements (Optional) │
830
+ │ ├── .claude/commands/ -> Native slash commands │
831
+ │ ├── .cursor/rules/ -> Cursor MDC rules │
832
+ │ ├── .windsurf/workflows/ -> Windsurf workflows │
833
+ │ └── etc. │
834
+ │ │
835
+ │ External Tools (Universal) │
836
+ │ ├── Beads -> Issue tracking (git-backed) │
837
+ │ ├── OpenSpec -> Architectural proposals │
838
+ │ └── GitHub CLI -> PR workflow │
839
+ │ │
840
+ └─────────────────────────────────────────────────────────────┘
841
+ ```
842
+
843
+ The workflow **degrades gracefully**:
844
+ - Full features in Claude Code
845
+ - Most features in Cursor/Windsurf/Kilo
846
+ - Core workflow in ANY agent via AGENTS.md
847
+
848
+ ## License
849
+
850
+ MIT
851
+
852
+ ## Contributing
853
+
854
+ Contributions welcome! Please read `docs/WORKFLOW.md` before submitting PRs.
855
+
856
+ ---
857
+
858
+ **Start with:** `npm install forge-workflow && npx forge setup`
859
+
860
+ **Then:** `/status` to see where to begin!