forgeos 0.1.0-alpha.0

package/src/forge/agent-adapters/types.ts

@@ -0,0 +1,135 @@
+import type { Diagnostic } from "../compiler/types/diagnostic.ts";
+
+export type AgentAdapterTarget = "generic" | "codex" | "cursor" | "claude" | "all" | string;
+
+export type BuiltInAgentAdapterTarget = "generic" | "codex" | "cursor" | "claude";
+
+export type AgentSubcommand =
+  | "list-targets"
+  | "export"
+  | "check"
+  | "doctor"
+  | "print-context"
+  | "clean";
+
+export interface AgentCommandOptions {
+  subcommand: AgentSubcommand;
+  workspaceRoot: string;
+  json: boolean;
+  target: AgentAdapterTarget;
+  dryRun: boolean;
+  force: boolean;
+  preserveUserSections: boolean;
+  skills: boolean;
+  rules: boolean;
+}
+
+export interface AgentExportFile {
+  path: string;
+  content: string;
+}
+
+export interface AgentAdapterTargetManifest {
+  name: BuiltInAgentAdapterTarget | string;
+  files: string[];
+  default?: boolean;
+  optional?: boolean;
+  adapterVersion: string;
+  formatVersion: string;
+}
+
+export interface AgentAdapterManifest {
+  schemaVersion: "0.1.0";
+  generatorVersion: string;
+  targets: AgentAdapterTargetManifest[];
+  sourceHash: string;
+}
+
+export interface AgentContext {
+  schemaVersion: "0.1.0";
+  project: {
+    name: string;
+    framework: "forgeos";
+    template?: string;
+  };
+  runtimeModel: Record<string, string>;
+  commands: string[];
+  queries: string[];
+  liveQueries: string[];
+  actions: string[];
+  workflows: string[];
+  tables: string[];
+  policies: string[];
+  secrets: string[];
+  criticalCommands: {
+    afterSourceChange: string[];
+    beforeCommit: string[];
+    targetedLoop: string[];
+    repair: string[];
+  };
+  knownPitfalls: string[];
+}
+
+export interface AgentCommandsMap {
+  setup: string[];
+  dev: string[];
+  generate: string[];
+  check: string[];
+  verify: string[];
+  impact: string[];
+  testPlan: string[];
+  testRun: string[];
+  repair: string[];
+}
+
+export interface AgentDoneCriteria {
+  default: string[];
+  frontendChange: string[];
+  schemaChange: string[];
+  packageChange: string[];
+}
+
+export interface AgentExportResult {
+  ok: boolean;
+  target: AgentAdapterTarget;
+  filesWritten: string[];
+  filesPlanned: string[];
+  warnings: Diagnostic[];
+  diagnostics: Diagnostic[];
+  exitCode: 0 | 1;
+}
+
+export interface AgentCheckResult {
+  ok: boolean;
+  stale: string[];
+  missing: string[];
+  warnings: Diagnostic[];
+  diagnostics: Diagnostic[];
+  exitCode: 0 | 1;
+}
+
+export interface AgentTargetsResult {
+  targets: Array<{ name: string; default?: boolean; optional?: boolean; custom?: boolean }>;
+  exitCode: 0 | 1;
+}
+
+export interface AgentPrintContextResult {
+  context: AgentContext | null;
+  diagnostics: Diagnostic[];
+  exitCode: 0 | 1;
+}
+
+export interface AgentDoctorResult {
+  ok: boolean;
+  checks: Array<{ name: string; ok: boolean; message?: string }>;
+  diagnostics: Diagnostic[];
+  exitCode: 0 | 1;
+}
+
+export interface CustomAdapterConfig {
+  name: string;
+  outputs: Array<{
+    template: string;
+    path: string;
+  }>;
+}

package/src/forge/cli/agent-contract.ts

@@ -0,0 +1,50 @@
+import { nodeFileSystem } from "../compiler/fs/index.ts";
+import { join } from "node:path";
+import { stripDeterministicHeader } from "../compiler/primitives/header.ts";
+import { GENERATED_DIR } from "../compiler/emitter/constants.ts";
+import type { GenerateResult } from "../compiler/types/cli.ts";
+
+export type AgentContractSubcommand = "generate" | "check" | "print";
+
+export interface AgentContractCommandOptions {
+  subcommand: AgentContractSubcommand;
+  workspaceRoot: string;
+  json: boolean;
+}
+
+export interface AgentContractPrintResult {
+  data: unknown;
+  exitCode: 0 | 1;
+}
+
+export function runAgentContractPrint(
+  workspaceRoot: string,
+): AgentContractPrintResult {
+  const path = join(workspaceRoot, GENERATED_DIR, "agentContract.json");
+  if (!nodeFileSystem.exists(path)) {
+    return { data: null, exitCode: 1 };
+  }
+  const raw = stripDeterministicHeader((nodeFileSystem.readText(path) ?? ""));
+  return {
+    data: JSON.parse(raw) as unknown,
+    exitCode: 0,
+  };
+}
+
+export function formatAgentContractHuman(
+  subcommand: AgentContractSubcommand,
+  result: GenerateResult | AgentContractPrintResult,
+): string {
+  if (subcommand === "print") {
+    return `${JSON.stringify((result as AgentContractPrintResult).data, null, 2)}\n`;
+  }
+  const generated = result as GenerateResult;
+  if (generated.exitCode === 0) {
+    return subcommand === "check"
+      ? "agent contract is up to date\n"
+      : "agent contract generated\n";
+  }
+  return subcommand === "check"
+    ? "agent contract is stale\n"
+    : "agent contract generation failed\n";
+}

package/src/forge/cli/ai.ts

@@ -0,0 +1,148 @@
+import { createDiagnostic } from "../compiler/diagnostics/create.ts";
+import { createAiContext } from "../runtime/ai/context.ts";
+import {
+  checkAiProviders,
+  loadAiModels,
+  loadAiProviders,
+  loadAiRegistry,
+} from "../runtime/ai/check.ts";
+import { enqueueMockAiResponse } from "../runtime/ai/mock.ts";
+import { getRuntimeEnvStore, initializeRuntimeEnv } from "../runtime/context/create-context.ts";
+import { createNoopTelemetryContext } from "../runtime/telemetry/context.ts";
+import { generateTraceId } from "../runtime/telemetry/correlation.ts";
+import { loadSecretRegistry } from "../runtime/secrets/check.ts";
+import { createRuntimeSecretsBundle } from "../runtime/secrets/runtime-bundle.ts";
+import type { ForgeAiProvider } from "../runtime/ai/types.ts";
+
+export type AiSubcommand = "providers" | "check" | "test" | "models";
+
+export interface AiCommandOptions {
+  subcommand: AiSubcommand;
+  workspaceRoot: string;
+  json: boolean;
+  provider?: ForgeAiProvider;
+  model?: string;
+  prompt?: string;
+  mock?: boolean;
+}
+
+export interface AiCommandResult {
+  exitCode: 0 | 1;
+  data?: unknown;
+  diagnostics?: ReturnType<typeof createDiagnostic>[];
+}
+
+export async function runAiCommand(options: AiCommandOptions): Promise<AiCommandResult> {
+  initializeRuntimeEnv(options.workspaceRoot);
+  const registry = loadAiRegistry(options.workspaceRoot);
+  const secretRegistry = loadSecretRegistry(options.workspaceRoot);
+  const store = getRuntimeEnvStore(options.workspaceRoot);
+
+  switch (options.subcommand) {
+    case "providers": {
+      const providers = registry?.providers ?? loadAiProviders(options.workspaceRoot);
+      return { exitCode: 0, data: { providers } };
+    }
+    case "models": {
+      const models = loadAiModels(options.workspaceRoot);
+      return { exitCode: 0, data: { models } };
+    }
+    case "check": {
+      const result = checkAiProviders(store, registry, secretRegistry);
+      return { exitCode: result.ok ? 0 : 1, data: result };
+    }
+    case "test": {
+      if (!options.provider || !options.model || !options.prompt) {
+        return {
+          exitCode: 1,
+          diagnostics: [
+            createDiagnostic({
+              severity: "error",
+              code: "FORGE_CLI_USAGE",
+              message:
+                "forge ai test requires --provider, --model, and --prompt",
+            }),
+          ],
+        };
+      }
+
+      if (options.mock) {
+        enqueueMockAiResponse({
+          text: `mock:${options.prompt}`,
+          usage: { promptTokens: 5, completionTokens: 10, totalTokens: 15 },
+        });
+      }
+
+      const bundle = createRuntimeSecretsBundle({
+        store,
+        registry: secretRegistry,
+        envSchema: null,
+        runtimeKind: "server",
+      });
+      const telemetry = createNoopTelemetryContext(generateTraceId());
+      const ai = createAiContext({
+        secrets: bundle.secrets,
+        telemetry,
+        runtimeKind: "server",
+        mockAi: options.mock,
+      });
+
+      try {
+        const result = await ai.generateText({
+          provider: options.provider,
+          model: options.model,
+          prompt: options.prompt,
+          purpose: "cli_test",
+        });
+        return { exitCode: 0, data: result };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+          exitCode: 1,
+          diagnostics: [
+            createDiagnostic({
+              severity: "error",
+              code: "FORGE_AI_GENERATION_FAILED",
+              message,
+            }),
+          ],
+        };
+      }
+    }
+    default:
+      return { exitCode: 1 };
+  }
+}
+
+export function formatAiJson(result: AiCommandResult): string {
+  return `${JSON.stringify(result, null, 2)}\n`;
+}
+
+export function formatAiHuman(subcommand: AiSubcommand, result: AiCommandResult): string {
+  if (result.diagnostics?.length) {
+    return `${result.diagnostics.map((d) => d.message).join("\n")}\n`;
+  }
+
+  if (subcommand === "providers") {
+    const providers = (result.data as { providers: unknown[] })?.providers ?? [];
+    return `${providers.map((p) => JSON.stringify(p)).join("\n")}\n`;
+  }
+
+  if (subcommand === "models") {
+    const models = (result.data as { models: unknown[] })?.models ?? [];
+    return `${models.map((m) => JSON.stringify(m)).join("\n")}\n`;
+  }
+
+  if (subcommand === "check") {
+    const data = result.data as { ok: boolean; missing: string[] };
+    return data.ok
+      ? "AI providers configured\n"
+      : `missing secrets: ${data.missing.join(", ")}\n`;
+  }
+
+  if (subcommand === "test") {
+    return `${JSON.stringify(result.data, null, 2)}\n`;
+  }
+
+  return "\n";
+}

package/src/forge/cli/auth.ts

@@ -0,0 +1,198 @@
+import { decodeJwt } from "jose";
+import {
+  FORGE_AUTH_INVALID_ISSUER,
+  FORGE_AUTH_INVALID_AUDIENCE,
+  FORGE_AUTH_JWKS_FAILED,
+} from "../compiler/diagnostics/codes.ts";
+import { loadAuthConfigFromEnv } from "../runtime/auth/config.ts";
+import { mapClaimsToAuthContext } from "../runtime/auth/claims.ts";
+import { ForgeAuthError } from "../runtime/auth/errors.ts";
+import { verifyJwtToken } from "../runtime/auth/verifier.ts";
+
+export type AuthSubcommand = "check" | "config" | "decode" | "test-token" | "jwks";
+
+export interface AuthCommandOptions {
+  subcommand: AuthSubcommand;
+  workspaceRoot: string;
+  json: boolean;
+  token?: string;
+}
+
+export interface AuthCommandResult {
+  ok: boolean;
+  mode: string;
+  data?: unknown;
+  error?: { code: string; message: string };
+  exitCode: 0 | 1;
+}
+
+function validateConfig(workspaceRoot: string): AuthCommandResult {
+  const config = loadAuthConfigFromEnv(workspaceRoot);
+  const errors: { code: string; message: string }[] = [];
+
+  if ((config.mode === "jwt" || config.mode === "oidc") && !config.issuer) {
+    errors.push({
+      code: FORGE_AUTH_INVALID_ISSUER,
+      message: "FORGE_AUTH_ISSUER is required for jwt/oidc auth",
+    });
+  }
+  if ((config.mode === "jwt" || config.mode === "oidc") && !config.audience) {
+    errors.push({
+      code: FORGE_AUTH_INVALID_AUDIENCE,
+      message: "FORGE_AUTH_AUDIENCE is required for jwt/oidc auth",
+    });
+  }
+  if (config.mode === "jwt" && !config.jwksUri) {
+    errors.push({
+      code: FORGE_AUTH_JWKS_FAILED,
+      message: "FORGE_AUTH_JWKS_URI is required for jwt auth",
+    });
+  }
+
+  return {
+    ok: errors.length === 0,
+    mode: config.mode,
+    data: {
+      mode: config.mode,
+      issuerConfigured: Boolean(config.issuer),
+      audienceConfigured: Boolean(config.audience),
+      jwksConfigured: Boolean(config.jwksUri),
+      algorithms: config.algorithms,
+      claims: config.claims,
+      requiresTenant: config.requiresTenant,
+      errors,
+    },
+    error: errors[0],
+    exitCode: errors.length === 0 ? 0 : 1,
+  };
+}
+
+function publicConfig(workspaceRoot: string): AuthCommandResult {
+  const config = loadAuthConfigFromEnv(workspaceRoot);
+  return {
+    ok: true,
+    mode: config.mode,
+    data: {
+      mode: config.mode,
+      issuer: config.issuer,
+      audience: config.audience,
+      jwksConfigured: Boolean(config.jwksUri),
+      algorithms: config.algorithms,
+      claims: config.claims,
+      requiresTenant: config.requiresTenant,
+    },
+    exitCode: 0,
+  };
+}
+
+function decodeToken(workspaceRoot: string, token: string | undefined): AuthCommandResult {
+  const config = loadAuthConfigFromEnv(workspaceRoot);
+  if (!token) {
+    return {
+      ok: false,
+      mode: config.mode,
+      error: { code: "FORGE_AUTH_MISSING_TOKEN", message: "--token is required" },
+      exitCode: 1,
+    };
+  }
+
+  try {
+    return {
+      ok: true,
+      mode: config.mode,
+      data: {
+        warning: "decoded without signature verification",
+        claims: decodeJwt(token),
+      },
+      exitCode: 0,
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "failed to decode JWT";
+    return {
+      ok: false,
+      mode: config.mode,
+      error: { code: "FORGE_AUTH_INVALID_TOKEN", message },
+      exitCode: 1,
+    };
+  }
+}
+
+async function testToken(
+  workspaceRoot: string,
+  token: string | undefined,
+): Promise<AuthCommandResult> {
+  const config = loadAuthConfigFromEnv(workspaceRoot);
+  if (!token) {
+    return {
+      ok: false,
+      mode: config.mode,
+      error: { code: "FORGE_AUTH_MISSING_TOKEN", message: "--token is required" },
+      exitCode: 1,
+    };
+  }
+
+  try {
+    const verified = await verifyJwtToken(token, config);
+    const auth = mapClaimsToAuthContext(verified.payload, config, verified.token);
+    return {
+      ok: true,
+      mode: config.mode,
+      data: { auth },
+      exitCode: 0,
+    };
+  } catch (error) {
+    const authError =
+      error instanceof ForgeAuthError
+        ? error
+        : new ForgeAuthError(
+            "FORGE_AUTH_INVALID_TOKEN",
+            error instanceof Error ? error.message : "token failed verification",
+          );
+    return {
+      ok: false,
+      mode: config.mode,
+      error: { code: authError.code, message: authError.message },
+      exitCode: 1,
+    };
+  }
+}
+
+export async function runAuthCommand(
+  options: AuthCommandOptions,
+): Promise<AuthCommandResult> {
+  if (options.subcommand === "check") {
+    return validateConfig(options.workspaceRoot);
+  }
+  if (options.subcommand === "config") {
+    return publicConfig(options.workspaceRoot);
+  }
+  if (options.subcommand === "decode") {
+    return decodeToken(options.workspaceRoot, options.token);
+  }
+  if (options.subcommand === "test-token") {
+    return testToken(options.workspaceRoot, options.token);
+  }
+
+  const config = loadAuthConfigFromEnv(options.workspaceRoot);
+  return {
+    ok: true,
+    mode: config.mode,
+    data: {
+      mode: config.mode,
+      jwksUri: config.jwksUri,
+      oidcDiscovery: config.mode === "oidc",
+    },
+    exitCode: 0,
+  };
+}
+
+export function formatAuthJson(result: AuthCommandResult): string {
+  return `${JSON.stringify(result, null, 2)}\n`;
+}
+
+export function formatAuthHuman(result: AuthCommandResult): string {
+  if (!result.ok) {
+    return `Auth ${result.mode}: failed\n${result.error?.code}: ${result.error?.message}\n`;
+  }
+  return `Auth ${result.mode}: ok\n${JSON.stringify(result.data, null, 2)}\n`;
+}

package/src/forge/cli/build.ts

@@ -0,0 +1,105 @@
+import { spawn } from "node:child_process";
+import { nodeFileSystem } from "../compiler/fs/index.ts";
+import { join } from "node:path";
+import { runGenerateCommand } from "./commands.ts";
+import { runVerifyCommand } from "./verify.ts";
+import { detectPackageManager } from "../compiler/package-manager/detect.ts";
+import { resolvePackageManagerArgv } from "../compiler/package-manager/executor.ts";
+
+export interface BuildCommandOptions {
+  workspaceRoot: string;
+  json: boolean;
+}
+
+export interface BuildCommandResult {
+  ok: boolean;
+  exitCode: 0 | 1;
+  steps: Array<{ name: string; ok: boolean; exitCode?: number }>;
+  manifestPath?: string;
+}
+
+async function runOptionalScript(
+  workspaceRoot: string,
+  scriptName: string,
+): Promise<{ skipped: boolean; exitCode: number }> {
+  const packageJsonPath = join(workspaceRoot, "package.json");
+  if (!nodeFileSystem.exists(packageJsonPath)) {
+    return { skipped: true, exitCode: 0 };
+  }
+  const pkg = JSON.parse(nodeFileSystem.readText(packageJsonPath) ?? "{}") as {
+    scripts?: Record<string, string>;
+  };
+  if (!pkg.scripts?.[scriptName]) {
+    return { skipped: true, exitCode: 0 };
+  }
+  const packageManager = detectPackageManager(workspaceRoot);
+  const argv = resolvePackageManagerArgv([packageManager, "run", scriptName]);
+  const exitCode = await new Promise<number>((resolveExitCode, reject) => {
+    const child = spawn(argv[0]!, argv.slice(1), {
+      cwd: workspaceRoot,
+      stdio: ["ignore", "inherit", "inherit"],
+      windowsHide: true,
+    });
+    child.on("error", reject);
+    child.on("close", (code) => resolveExitCode(code ?? 1));
+  });
+  return { skipped: false, exitCode };
+}
+
+export async function runBuildCommand(options: BuildCommandOptions): Promise<BuildCommandResult> {
+  const steps: BuildCommandResult["steps"] = [];
+  const generate = await runGenerateCommand({
+    workspaceRoot: options.workspaceRoot,
+    check: false,
+    dryRun: false,
+    json: false,
+    concurrency: 4,
+  });
+  steps.push({ name: "generate", ok: generate.exitCode === 0, exitCode: generate.exitCode });
+  if (generate.exitCode !== 0) {
+    return { ok: false, exitCode: 1, steps };
+  }
+
+  const verify = await runVerifyCommand({
+    workspaceRoot: options.workspaceRoot,
+    json: false,
+    skipTests: false,
+    skipTypecheck: false,
+    skipEslint: false,
+    strict: true,
+  });
+  steps.push({ name: "verify", ok: verify.exitCode === 0, exitCode: verify.exitCode });
+  if (verify.exitCode !== 0) {
+    return { ok: false, exitCode: 1, steps };
+  }
+
+  const webBuild = nodeFileSystem.exists(join(options.workspaceRoot, "web", "package.json"))
+    ? await runOptionalScript(join(options.workspaceRoot, "web"), "build")
+    : { skipped: true, exitCode: 0 };
+  steps.push({
+    name: "web-build",
+    ok: webBuild.exitCode === 0,
+    exitCode: webBuild.skipped ? undefined : webBuild.exitCode,
+  });
+  if (webBuild.exitCode !== 0) {
+    return { ok: false, exitCode: 1, steps };
+  }
+
+  const distDir = join(options.workspaceRoot, "dist", "forge");
+  nodeFileSystem.mkdirp(distDir);
+  const manifestPath = join(distDir, "build-info.json");
+  nodeFileSystem.writeText(manifestPath, `${JSON.stringify({
+    schemaVersion: "0.1.0",
+    builtAt: new Date(0).toISOString(),
+    steps,
+  }, null, 2)}\n`);
+
+  return { ok: true, exitCode: 0, steps, manifestPath };
+}
+
+export function formatBuildHuman(result: BuildCommandResult): string {
+  if (!result.ok) {
+    return `forge build failed at ${result.steps.find((step) => !step.ok)?.name ?? "unknown"}\n`;
+  }
+  return `forge build complete: ${result.manifestPath}\n`;
+}

package/src/forge/cli/bun-exec.ts

@@ -0,0 +1,4 @@
+export {
+  resolveBunExecutable,
+  type BunExecutableResolutionOptions,
+} from "../compiler/package-manager/bun-executable.ts";