forgedev 1.2.0 → 1.4.0

package/README.md

@@ -1,6 +1,6 @@
 # DevForge
 
-Universal, AI-first project scaffolding CLI. Describe what you're building, get the right stack recommended, and ship with Claude Code infrastructure pre-configured.
+AI-first project scaffolding CLI. Describe what you're building, get the right stack recommended, and ship with Claude Code infrastructure pre-configured.
 
 ## Quick Start
 
@@ -106,7 +106,7 @@ $ npx forgedev init
   ✓ CLAUDE.md — project context + rules
   ✓ .claude/hooks/ — auto-lint, quality gate, file protection
   ✓ .claude/agents/ — code quality, security, spec validator
-  ✓ .claude/commands/ — workflows, status, next, done, audit, pre-pr
+  ✓ .claude/commands/ — workflows, status, next, audit, pre-pr
   ✓ .claude/skills/ — framework-specific knowledge
   ✓ docs/uat/ — acceptance test templates
 
@@ -171,21 +171,21 @@ Every project includes:
 
 - **Project scaffold** with working code, configs, and dependencies
 - **Health check endpoints** (`/health`, `/healthz`)
-- **Graceful shutdown handlers**
+- **Graceful shutdown handlers** (SIGTERM/SIGINT)
 - **Database connection retry** with exponential backoff
-- **Structured error responses** (never leaks stack traces)
+- **Structured error responses** (custom error classes, no raw stack traces in responses)
 
 With Claude Code infrastructure enabled (default):
 
 - **CLAUDE.md** tailored to your stack (with pitfalls and agents quick-reference)
 - **Hooks** — cross-platform Node.js `.mjs` hooks (auto-lint on edit, quality gate, protected file guard)
-- **17 Agents** — verification, development, review, and orchestration (see below)
-- **20 Commands** — daily workflow, verification, release, development, session management
+- **22 Agents** — verification, development, review, enforcement, and orchestration (see below)
+- **27 Commands** — daily workflow, verification, release, development, strategy, session management
 - **8 Skills** — framework-specific + universal knowledge
 - **UAT templates** — scenario packs and CSV checklists
 - **Prompt library** — the complete development prompt library
 
-## Agents (18)
+## Agents (22)
 
 Every scaffolded project gets these agents in `.claude/agents/`:
 
@@ -196,14 +196,18 @@ Every scaffolded project gets these agents in `.claude/agents/`:
 | `chief-of-staff` | Orchestrate multiple agents for complex tasks | Write |
 | `code-quality-reviewer` | Code quality review | Read-only |
 | `database-reviewer` | Query optimization, schema review, N+1 detection | Read-only |
+| `deep-reviewer` | Line-by-line diff review with test case generation | Read-only |
 | `doc-updater` | Keep docs in sync with code changes | Write |
 | `docs-lookup` | Search framework docs for answers | Read-only |
 | `e2e-runner` | Generate and run Playwright E2E tests | Write |
+| `enforcement-gate` | Independently verify agent claims before phase transitions | Read-only |
+| `frontend-builder` | Build frontend UI with Google Stitch + UI UX Pro Max, preview for acceptance | Write |
 | `harness-optimizer` | Audit Claude Code setup, suggest optimizations | Read-only |
 | `loop-operator` | Autonomous improvement loops with stop conditions | Write |
 | `planner` | Create implementation plans before coding | Read-only |
 | `product-strategist` | Research competitors, evaluate maturity, recommend improvements | Read-only |
 | `production-readiness` | Production deployment readiness review | Read-only |
+| `prompt-auditor` | Audit agent prompts for clarity, consistency, and intent protocol compliance | Read-only |
 | `refactor-cleaner` | Dead code removal, duplicate elimination | Write |
 | `security-reviewer` | Security audit | Read-only |
 | `spec-validator` | Validate implementation matches specification | Read-only |
@@ -238,7 +242,9 @@ node bin/devforge.js update        # check for updates
 
 ```
 devforge/
-├── bin/devforge.js              # CLI entry point
+├── bin/
+│   ├── devforge.js              # DevForge CLI entry point
+│   └── chainproof.js            # ChainProof CLI entry point
 ├── src/
 │   ├── cli.js                   # Command router (new, init, doctor, update)
 │   ├── index.js                 # New project orchestrator (guided + developer)
@@ -255,7 +261,16 @@ devforge/
 │   ├── doctor-prompts.js        # Fix prompt generators
 │   ├── update-check.js          # npm registry version check
 │   ├── update.js                # Update command handler
+│   ├── chainproof-bridge.js     # ChainProof Node.js bridge (pure crypto)
+│   ├── ci-mode.js               # CI/CD health check mode
 │   └── utils.js                 # File ops, logging, colors
+├── chainproof/                  # Python backend (FastAPI + SQLAlchemy)
+│   ├── core/crypto.py           # Ed25519 + SHA-256 primitives
+│   ├── models/                  # SQLAlchemy models (NLL, CodeArtifact, TrustChain, AnomalyEvent)
+│   ├── schemas/                 # Pydantic request/response schemas
+│   ├── mcp/server.py            # MCP server stubs
+│   └── tests/                   # Pytest tests
+├── sdk/                         # @chainproof/sdk TypeScript types + client
 ├── templates/                   # Scaffold templates by category
 │   ├── base/                    # Every project gets this
 │   ├── frontend/nextjs/         # Next.js App Router
@@ -264,12 +279,13 @@ devforge/
 │   ├── auth/                    # NextAuth, JWT
 │   ├── testing/                 # Vitest, Playwright, Pytest
 │   ├── infra/                   # Docker Compose, GitHub Actions
+│   ├── chainproof/              # ChainProof per-stack configs
 │   └── claude-code/             # Hooks, CLAUDE.md, skills, agents, commands
 ├── tests/                       # Vitest tests
 └── docs/                        # Reference documentation
 ```
 
-## Claude Code Commands (20)
+## Claude Code Commands (27)
 
 After running `npx forgedev init`, these slash commands are available inside Claude Code:
 
@@ -280,7 +296,7 @@ After running `npx forgedev init`, these slash commands are available inside Cla
 | `/workflows` | Lists all available workflows |
 | `/status` | Project dashboard — tests, branch, changes |
 | `/next` | Figures out your next task |
-| `/done` | Verifies task completion |
+| `/help` | Interactive guide — tells you which workflow to use |
 
 **Verification:**
 
@@ -292,6 +308,7 @@ After running `npx forgedev init`, these slash commands are available inside Cla
 | `/audit-wiring` | Finds dead or unwired features |
 | `/audit-security` | Runs a security audit |
 | `/code-review` | Reviews uncommitted changes for security and quality |
+| `/verify-intent` | Verify all agents comply with Intent Verification Protocol |
 
 **Release:**
 
@@ -299,6 +316,7 @@ After running `npx forgedev init`, these slash commands are available inside Cla
 |---------|-------------|
 | `/pre-pr` | Runs the complete pre-PR checklist |
 | `/run-uat` | Executes UAT scenarios |
+| `/live-uat` | Interactive browser/API testing against a running app |
 
 **Development:**
 
@@ -306,10 +324,14 @@ After running `npx forgedev init`, these slash commands are available inside Cla
 |---------|-------------|
 | `/plan` | Invoke planner agent for implementation planning |
 | `/build-fix` | Incrementally fix build/lint/type errors |
+| `/fix-loop` | Automated fix-review-regression loop until green |
+| `/build-ui` | Build frontend UI with AI-powered generation (Google Stitch + UI UX Pro Max) |
 | `/tdd` | Enforce test-driven development cycle |
 | `/generate-prd` | Generates a PRD with Mermaid diagrams |
+| `/generate-sdd` | Generates a Software Design Document from codebase |
 | `/generate-uat` | Generates UAT scenarios from codebase |
 | `/optimize-claude-md` | Proposes splitting an oversized CLAUDE.md |
+| `/simplify` | Review code for reuse, quality, and structural hygiene |
 
 **Session:**
 
@@ -318,6 +340,12 @@ After running `npx forgedev init`, these slash commands are available inside Cla
 | `/save-session` | Save work context for later resumption |
 | `/resume-session` | Load saved session and continue where you left off |
 
+**Strategy:**
+
+| Command | What It Does |
+|---------|-------------|
+| `/product-strategist` | Competitive analysis against real competitors with scored benchmarks |
+
 ## Install
 
 ```bash
@@ -330,6 +358,25 @@ npm install -g forgedev
 
 Package name on npm: [`forgedev`](https://www.npmjs.com/package/forgedev)
 
+## ChainProof — Verified AI Software Delivery
+
+DevForge includes **ChainProof**, a trust chain system for tracking AI-generated code provenance.
+
+Every scaffolded project gets a `.chainproof/` directory with:
+- **Hash chain** — SHA-256 linked entries forming an immutable ledger
+- **Ed25519 signatures** — Cryptographic proof of each decision
+- **Code artifact tracking** — Who/what generated each file, when, with what prompt
+
+**Local CLI** (no server required):
+
+```bash
+chainproof status    # Show trust chain status
+chainproof verify    # Verify hash chain integrity
+chainproof log       # Show NLL (Natural Language Ledger) entries
+```
+
+All operations are local and file-based — no server required.
+
 ## Roadmap
 
 - [ ] Go + Gin/Chi backend

package/bin/chainproof.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+
+/**
+ * ChainProof CLI - local trust chain operations.
+ * All commands are file-based, no server required.
+ */
+
+import path from 'node:path';
+import { verifyChain, getChainStatus } from '../src/chainproof-bridge.js';
+import fs from 'node:fs';
+
+const args = process.argv.slice(2);
+const command = args[0];
+const projectDir = process.cwd();
+
+function printUsage() {
+  console.log(`
+  ChainProof - Verified AI software delivery
+
+  Usage:
+    chainproof status    Show trust chain status
+    chainproof verify    Verify hash chain integrity
+    chainproof log       Show NLL entries
+
+  Options:
+    -h, --help           Show this help message
+`);
+}
+
+if (!command || command === '--help' || command === '-h') {
+  printUsage();
+  process.exit(0);
+}
+
+if (command === 'status') {
+  try {
+    const status = getChainStatus(projectDir);
+    if (!status.initialized) {
+      console.log('  ChainProof is not initialized in this directory.');
+      console.log('  Run "devforge init" to set up trust chain tracking.');
+      process.exit(1);
+    }
+    console.log('');
+    console.log('  ChainProof Status');
+    console.log('  -----------------');
+    console.log(`  Project:          ${status.projectName}`);
+    console.log(`  NLL Entries:      ${status.entryCount}`);
+    console.log(`  Code Artifacts:   ${status.artifactCount}`);
+    const hash = status.currentHash || '';
+    console.log(`  Current Hash:     ${hash.slice(0, 16)}...`);
+    console.log(`  Unsigned Entries: ${status.unsignedEntries}`);
+    if (status.createdAt) console.log(`  Created:          ${status.createdAt}`);
+    if (status.lastEntry) console.log(`  Last Entry:       ${status.lastEntry}`);
+    console.log('');
+  } catch (err) {
+    console.error(`  Failed to read chain status: ${err.message}`);
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
+if (command === 'verify') {
+  const cpDir = path.join(projectDir, '.chainproof');
+  if (!fs.existsSync(cpDir)) {
+    console.log('  ChainProof is not initialized. Nothing to verify.');
+    process.exit(1);
+  }
+
+  try {
+    const result = verifyChain(projectDir);
+    if (result.valid) {
+      console.log('  ✓ Trust chain integrity verified.');
+      const status = getChainStatus(projectDir);
+      console.log(`    ${status.entryCount} entries, all hashes valid.`);
+      process.exit(0);
+    } else {
+      console.error('  ✗ Trust chain integrity is broken:');
+      for (const err of result.errors) {
+        console.error(`    - ${err}`);
+      }
+      process.exit(1);
+    }
+  } catch (err) {
+    console.error(`  Failed to verify chain: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+if (command === 'log') {
+  const chainPath = path.join(projectDir, '.chainproof', 'chain.json');
+  if (!fs.existsSync(chainPath)) {
+    console.log('  ChainProof is not initialized. No entries to show.');
+    process.exit(1);
+  }
+
+  let chain;
+  try {
+    chain = JSON.parse(fs.readFileSync(chainPath, 'utf-8'));
+  } catch (err) {
+    console.error(`  Could not read chain.json: ${err.message}`);
+    process.exit(1);
+  }
+
+  if (chain.entries.length === 0) {
+    console.log('  No entries in the trust chain yet.');
+    process.exit(0);
+  }
+
+  console.log('');
+  console.log(`  ChainProof Log (${chain.entries.length} entries)`);
+  console.log('  -------------------------------------');
+  for (const entry of chain.entries) {
+    const signed = entry.signature ? '✓' : '○';
+    console.log(`  ${signed} [${entry.entryType}] ${entry.timestamp}`);
+    console.log(`    ${entry.content.slice(0, 100)}${entry.content.length > 100 ? '...' : ''}`);
+    console.log(`    hash: ${entry.chainHash.slice(0, 16)}...`);
+    console.log('');
+  }
+  process.exit(0);
+}
+
+// Sanitize user input before printing
+const sanitized = String(command).replace(/[\x00-\x1f\x7f-\x9f]/g, '');
+console.error(`  Unknown command: "${sanitized}"`);
+printUsage();
+process.exit(1);

package/bin/devforge.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 import { parseCommand } from '../src/cli.js';
 
 try {

package/package.json

@@ -1,15 +1,27 @@
 {
   "name": "forgedev",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "Universal, AI-first project scaffolding CLI with Claude Code infrastructure",
   "type": "module",
   "bin": {
     "forgedev": "bin/devforge.js",
-    "devforge": "bin/devforge.js"
+    "devforge": "bin/devforge.js",
+    "chainproof": "bin/chainproof.js"
   },
   "scripts": {
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "e2e": "vitest run tests/e2e-scaffold.test.js tests/uat-verification.test.js tests/user-flows.test.js",
+    "test:imports": "vitest run tests/imports-runtime.test.js",
+    "test:uat": "vitest run tests/uat-verification.test.js",
+    "test:quality": "vitest run tests/quality-gate.test.js",
+    "test:boot": "vitest run tests/boot-test.test.js --config vitest.boot.config.js",
+    "verify": "vitest run",
+    "verify:all": "vitest run && node bin/devforge.js --version",
+    "lint": "eslint \"eslint.config.js\" \"bin/**/*.js\" \"src/**/*.js\" \"tests/**/*.js\"",
+    "lint:fix": "eslint \"eslint.config.js\" \"bin/**/*.js\" \"src/**/*.js\" \"tests/**/*.js\" --fix",
+    "format": "prettier --write \"src/**/*.js\" \"bin/**/*.js\"",
+    "format:check": "prettier --check \"src/**/*.js\" \"bin/**/*.js\""
   },
   "keywords": [
     "scaffolding",
@@ -18,13 +30,20 @@
     "claude-code",
     "ai-first"
   ],
-  "author": "",
+  "author": "DevForge Contributors",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/abbasasad057/devforge.git"
+  },
   "dependencies": {
-    "chalk": "^5.4.1",
-    "@inquirer/prompts": "^7.10.0"
+    "@inquirer/prompts": "^7.10.0",
+    "chalk": "^5.4.1"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.1.0",
+    "prettier": "^3.8.1",
     "vitest": "^3.1.1"
   },
   "engines": {
@@ -34,7 +53,6 @@
     "bin/",
     "src/",
     "templates/",
-    "docs/",
     "LICENSE",
     "README.md"
   ]