forgedock 1.0.21 → 1.0.22

package/examples/forgedock-demo/src/routes/notes.js

@@ -0,0 +1,64 @@
+// Route handlers for the demo Notes API.
+//
+// Each handler takes (req, res, params) and returns a plain object that the
+// server serializes to JSON. Handlers throw errors with a `statusCode` to
+// signal HTTP error responses.
+
+const db = require('../db');
+const { requireToken } = require('../auth');
+
+// GET /notes
+// Lists notes. Supports an optional ?where= filter that is passed straight
+// into db.query().
+//
+// >>> DEMO NOTE: forwarding the raw ?where= string into db.query() is the
+// >>> injection surface (see db.js). Issue #2 asks to make this safe.
+function listNotes(req, res, params) {
+  const where = params.query.where;
+  if (where) {
+    return { notes: db.query(where) };
+  }
+  return { notes: db.all() };
+}
+
+// GET /notes/:id
+function getNote(req, res, params) {
+  const note = db.findById(params.id);
+  if (!note) {
+    const err = new Error('Note not found');
+    err.statusCode = 404;
+    throw err;
+  }
+  return { note };
+}
+
+// POST /notes  (protected)
+function createNote(req, res, params) {
+  requireToken(req);
+  const { title, body, owner } = params.body || {};
+  if (!title) {
+    const err = new Error('title is required');
+    err.statusCode = 400;
+    throw err;
+  }
+  const note = db.insert({ title, body: body || '', owner: owner || 'anonymous' });
+  res.statusCode = 201;
+  return { note };
+}
+
+// DELETE /notes/:id
+//
+// >>> DEMO NOTE: this mutating route is MISSING a requireToken(req) call, so
+// >>> anyone can delete any note. That missing authorization check is the
+// >>> INTENTIONAL flaw that Issue #1 (bug fix) asks you to close.
+function deleteNote(req, res, params) {
+  const ok = db.remove(params.id);
+  if (!ok) {
+    const err = new Error('Note not found');
+    err.statusCode = 404;
+    throw err;
+  }
+  return { deleted: Number(params.id) };
+}
+
+module.exports = { listNotes, getNote, createNote, deleteNote };

package/examples/forgedock-demo/src/server.js

@@ -0,0 +1,79 @@
+// Entry point for the demo Notes API.
+//
+// Uses only Node's built-in `http` module — no Express, no npm install. Run it
+// with `node src/server.js` (or `npm start`). The router below is intentionally
+// small and hand-rolled so the whole codebase stays readable in a few minutes.
+
+const http = require('http');
+const { URL } = require('url');
+const routes = require('./routes/notes');
+
+const PORT = process.env.PORT || 3000;
+
+// Route table: [method, pathRegex, handler]. A `:id` segment is captured.
+const TABLE = [
+  ['GET', /^\/notes$/, routes.listNotes],
+  ['POST', /^\/notes$/, routes.createNote],
+  ['GET', /^\/notes\/(?<id>\d+)$/, routes.getNote],
+  ['DELETE', /^\/notes\/(?<id>\d+)$/, routes.deleteNote],
+];
+
+function readBody(req) {
+  return new Promise((resolve) => {
+    let raw = '';
+    req.on('data', (chunk) => {
+      raw += chunk;
+    });
+    req.on('end', () => {
+      if (!raw) return resolve({});
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        resolve({});
+      }
+    });
+  });
+}
+
+const server = http.createServer(async (req, res) => {
+  res.setHeader('Content-Type', 'application/json');
+
+  // Health check.
+  if (req.method === 'GET' && req.url === '/health') {
+    res.statusCode = 200;
+    return res.end(JSON.stringify({ status: 'ok' }));
+  }
+
+  const url = new URL(req.url, `http://localhost:${PORT}`);
+  const query = Object.fromEntries(url.searchParams.entries());
+
+  const match = TABLE.find(
+    ([method, pattern]) => method === req.method && pattern.test(url.pathname)
+  );
+
+  if (!match) {
+    res.statusCode = 404;
+    return res.end(JSON.stringify({ error: 'Not found' }));
+  }
+
+  const [, pattern, handler] = match;
+  const groups = url.pathname.match(pattern).groups || {};
+  const body = req.method === 'POST' ? await readBody(req) : {};
+
+  try {
+    const result = handler(req, res, { ...groups, query, body });
+    return res.end(JSON.stringify(result));
+  } catch (err) {
+    res.statusCode = err.statusCode || 500;
+    return res.end(JSON.stringify({ error: err.message }));
+  }
+});
+
+if (require.main === module) {
+  server.listen(PORT, () => {
+    // eslint-disable-next-line no-console
+    console.log(`Notes API listening on http://localhost:${PORT}`);
+  });
+}
+
+module.exports = { server };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.0.21",
+  "version": "1.0.22",
   "description": "Autonomous dev pipeline for Claude Code. GitHub as institutional memory — every issue, PR, and annotation survives context resets and makes the next agent smarter.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"
@@ -36,6 +36,7 @@
     "!bin/tests/",
     "commands/",
     "docs/",
+    "examples/",
     "scripts/",
     "templates/",
     "LICENSE",
@@ -47,6 +48,9 @@
   "engines": {
     "node": ">=18"
   },
+  "optionalDependencies": {
+    "@anthropic-ai/sdk": ">=0.30.0"
+  },
   "peerDependencies": {
     "@anthropic-ai/claude-code": ">=2.0.0"
   },

package/templates/forge.yaml.minimal

@@ -0,0 +1,44 @@
+# forge.yaml — ForgeDock Configuration (minimal)
+#
+# The smallest config that runs the full pipeline. Copy it to your project root:
+#
+#   cp forge.yaml.minimal forge.yaml
+#
+# ...or generate one with detected values automatically:
+#
+#   npx forgedock init --minimal
+#
+# Only project, paths, and branches are required — everything else is optional
+# and falls back to sensible defaults. Start here and add sections as you need
+# them. See forge.yaml.example and docs/CONFIG.md for the full reference.
+#
+# This mirrors ForgeDock's own real-world config: a handful of lines is enough.
+
+# =============================================================================
+# PROJECT (REQUIRED)
+# =============================================================================
+
+project:
+  name: "My Project"
+  owner: "my-github-org"
+  repo: "my-repo"
+
+# =============================================================================
+# PATHS (REQUIRED)
+# Local paths used for git worktrees. worktree_base defaults to
+# {root}/.claude/worktrees.
+# =============================================================================
+
+paths:
+  root: "/path/to/my-repo"
+  worktree_base: "/path/to/my-repo/.claude/worktrees"
+
+# =============================================================================
+# BRANCHES (REQUIRED)
+# Set staging to your default branch if you have no separate staging branch.
+# =============================================================================
+
+branches:
+  default: "main"
+  staging: "staging"
+  feature_pattern: "milestone/{slug}"