forgeos 0.1.0-alpha.2 → 0.1.0-alpha.21

package/src/forge/cli/commands.ts

@@ -1,8 +1,10 @@
 import { nodeFileSystem } from "../compiler/fs/index.ts";
-import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { join, resolve } from "node:path";
 import { stripDeterministicHeader } from "../compiler/primitives/header.ts";
 import { classify } from "../compiler/classifier/classify.ts";
 import { buildRuntimeMatrix } from "../compiler/classifier/runtime-matrix.ts";
+import { FORGE_RELEASE_PACKAGE_PACK_FAILED } from "../compiler/diagnostics/codes.ts";
 import { createDiagnostic } from "../compiler/diagnostics/create.ts";
 import { forgeAdd } from "../compiler/integration/add.ts";
 import { checkImportGuards } from "../compiler/guards/check-import-guards.ts";
@@ -29,10 +31,14 @@ import type {
 } from "../compiler/types/cli.ts";
 import type { RuntimeMatrix } from "../compiler/types/runtime-matrix.ts";
 import type { FrontendGraph } from "../compiler/types/frontend-graph.ts";
+import type { DataGraph } from "../compiler/types/data-graph.ts";
+import type { SqlPlan } from "../compiler/data-graph/sql/types.ts";
+import type { TableMapEntry } from "../compiler/data-graph/sql/serialize.ts";
 import { GENERATED_DIR } from "../compiler/emitter/constants.ts";
 import {
   attachFailureKind,
   buildAddJson,
+  buildCheckJson,
   buildGenerateJson,
   buildInspectJson,
   formatJsonResult,
@@ -44,6 +50,26 @@ import {
 } from "./output.ts";
 import { INSPECT_TARGETS, TOP_LEVEL_COMMANDS, type ForgeCommand } from "./parse.ts";
 import { runVerifyCommand } from "./verify.ts";
+import {
+  buildExternalServiceGraph,
+  importExternalManifest,
+  readExternalManifestFile,
+} from "../compiler/external-manifest/registry.ts";
+import {
+  resolveExternalQualifiedName,
+  runExternalEntry,
+} from "../runtime/external/bridge.ts";
+import {
+  formatCompilerBenchHuman,
+  formatCompilerBenchJson,
+  runCompilerBenchCommand,
+} from "../bench.ts";
+import {
+  formatCairHuman,
+  formatCairJson,
+  runCairCommand,
+} from "../cair/index.ts";
+import { uniqueNextActions } from "./next-actions.ts";
 import {
   formatRunJson,
   formatRunListHuman,
@@ -51,6 +77,41 @@ import {
   runRunCommand,
 } from "./run.ts";
 import { runDevCommand } from "./dev.ts";
+import {
+  formatHandoffHuman,
+  formatHandoffJson,
+  runHandoffCommand,
+} from "./handoff.ts";
+import {
+  formatStudioAttachHuman,
+  formatStudioAttachJson,
+  formatStudioBridgeEventJson,
+  formatStudioBridgeHuman,
+  formatStudioBridgeJson,
+  formatStudioCodexServerHuman,
+  formatStudioCodexServerJson,
+  formatStudioDoctorHuman,
+  formatStudioDoctorJson,
+  formatStudioOpenHuman,
+  formatStudioOpenJson,
+  formatStudioSnapshotHuman,
+  formatStudioSnapshotJson,
+  formatStudioWatchHuman,
+  formatStudioWatchJson,
+  runStudioAttachCommand,
+  runStudioBridgeCommand,
+  runStudioBridgeLoop,
+  runStudioCodexServerCommand,
+  runStudioDoctorCommand,
+  runStudioOpenCommand,
+  runStudioSnapshotCommand,
+  runStudioWatchCommand,
+  runStudioWatchLoop,
+} from "./studio.ts";
+import {
+  formatChangedHuman,
+  runChangedCommand,
+} from "./changed.ts";
 import { initializeRuntimeEnv } from "../runtime/context/create-context.ts";
 import { formatDbHuman, formatDbJson, runDbCommand } from "./db.ts";
 import { formatOutboxHuman, formatOutboxJson, runOutboxCommand } from "./outbox.ts";
@@ -64,6 +125,23 @@ import {
   formatTelemetryJson,
   runTelemetryCommand,
 } from "./telemetry.ts";
+import {
+  formatDeltaExplainHuman,
+  formatDeltaExplainJson,
+  formatDeltaRepairHuman,
+  formatDeltaRepairJson,
+  formatDeltaStatusHuman,
+  formatDeltaStatusJson,
+  formatDeltaSessionHuman,
+  formatDeltaSessionJson,
+  formatDeltaTimelineHuman,
+  formatDeltaTimelineJson,
+  runDeltaExplain,
+  runDeltaRepair,
+  runDeltaSessionCommand,
+  runDeltaStatus,
+  runDeltaTimeline,
+} from "../delta/index.ts";
 import {
   formatPolicyHuman,
   formatPolicyJson,
@@ -82,7 +160,8 @@ import { formatNewHuman, runNewCommand } from "./new.ts";
 import { formatBuildHuman, runBuildCommand } from "./build.ts";
 import { runServeCommand } from "./serve.ts";
 import { runWorkerCommand } from "./worker.ts";
-import { formatSelfHostHuman, runSelfHostCommand } from "./self-host.ts";
+import { formatSelfHostHuman, runSelfHostCommand, type SelfHostCommandResult } from "./self-host.ts";
+import { formatDocsCheckHuman, runDocsCheckCommand, type DocsCheckResult } from "./docs.ts";
 import {
   formatAgentContractHuman,
   runAgentContractPrint,
@@ -102,10 +181,16 @@ import {
 } from "./windows.ts";
 import { formatAuthHuman, formatAuthJson, runAuthCommand } from "./auth.ts";
 import { formatRlsHuman, formatRlsJson, runRlsCommand } from "./rls.ts";
+import {
+  formatSecurityHuman,
+  formatSecurityJson,
+  runSecurityCommand,
+} from "./security.ts";
 import { formatDepsHuman, formatDepsJson, runDepsCommand } from "./deps.ts";
 import {
   formatReleaseHuman,
   formatReleaseJson,
+  type ReleaseCommandResult,
   runReleaseCommand,
 } from "./release.ts";
 import { formatMakeHuman, formatMakeJson, runMakeCommand } from "./make.ts";
@@ -127,11 +212,18 @@ import {
   formatForgeDoJson,
   runForgeDoCommand,
 } from "../intent/index.ts";
+import {
+  formatBrownfieldImportHuman,
+  formatBrownfieldImportJson,
+  inspectBrownfieldImport,
+  runBrownfieldImportCommand,
+} from "../brownfield-import/index.ts";
 import {
   formatAgentHuman,
   formatAgentJson,
   runAgentCommand,
 } from "../agent-adapters/index.ts";
+import { runMcpServe } from "../agent-memory/mcp.ts";
 import {
   formatReviewHuman,
   formatReviewJson,
@@ -155,6 +247,9 @@ import { runLiveCommand } from "./live.ts";
 import { runQuery } from "../runtime/query/run-query.ts";
 import { resolveAuthFromCli } from "../runtime/auth/resolve.ts";
 import { getActiveDbAdapter } from "../runtime/executor.ts";
+import { CLI_VERSION, FORGEOS_VERSION } from "../version.ts";
+import type { CategorizedFileSummary } from "../workspace/change-summary.ts";
+import { buildWorkspaceGitSummary } from "../workspace/git-summary.ts";
 
 function readGeneratedJson<T>(workspaceRoot: string, relative: string): T | null {
   const absolute = join(workspaceRoot, relative);
@@ -238,9 +333,14 @@ function buildFrameworkInspect(workspaceRoot: string): Record<string, unknown> {
       topLevelCommands: [...TOP_LEVEL_COMMANDS],
       inspectTargets: [...INSPECT_TARGETS],
       preferredEntryPoints: [
+        "forge status --json",
+        "forge changed --json",
+        "forge agent onboard --target codex --json",
         "forge do <objective> --json",
         "forge dev --once --json",
+        "forge inspect all --brief --json",
         "forge inspect all --json",
+        "forge agent print-context --json",
         "forge inspect framework --json",
         "forge verify --strict",
       ],
@@ -270,13 +370,519 @@ function buildFrameworkInspect(workspaceRoot: string): Record<string, unknown> {
   };
 }
 
+function readGeneratedArtifactStatus(workspaceRoot: string): Array<{ name: string; path: string; present: boolean }> {
+  const artifacts = [
+    ["app", `${GENERATED_DIR}/appGraph.json`],
+    ["data", `${GENERATED_DIR}/dataGraph.json`],
+    ["sql", `${GENERATED_DIR}/sqlPlan.json`],
+    ["db", `${GENERATED_DIR}/db.json`],
+    ["runtime", `${GENERATED_DIR}/runtimeGraph.json`],
+    ["frontend", `${GENERATED_DIR}/frontendGraph.json`],
+    ["client", `${GENERATED_DIR}/clientManifest.json`],
+    ["agent-contract", `${GENERATED_DIR}/agentContract.json`],
+    ["agent-adapters", `${GENERATED_DIR}/agentAdapterManifest.json`],
+    ["capability-map", `${GENERATED_DIR}/capabilityMap.json`],
+    ["test-graph", `${GENERATED_DIR}/testGraph.json`],
+    ["agents-md", "AGENTS.md"],
+    ["forge-lock", "forge.lock"],
+  ] as const;
+
+  return artifacts.map(([name, path]) => ({
+    name,
+    path,
+    present: hasPath(workspaceRoot, path),
+  }));
+}
+
+function buildInspectSummary(workspaceRoot: string): Record<string, unknown> {
+  const framework = buildFrameworkInspect(workspaceRoot);
+  const dataGraph = readGeneratedJson<DataGraph>(workspaceRoot, `${GENERATED_DIR}/dataGraph.json`);
+  const frontend = readGeneratedJson<FrontendGraph>(workspaceRoot, `${GENERATED_DIR}/frontendGraph.json`);
+  const agentAdapters = readGeneratedJson<{ targets?: Array<{ name?: string; files?: string[]; default?: boolean; optional?: boolean }> }>(
+    workspaceRoot,
+    `${GENERATED_DIR}/agentAdapterManifest.json`,
+  );
+  const artifacts = readGeneratedArtifactStatus(workspaceRoot);
+  const missingArtifacts = artifacts.filter((artifact) => !artifact.present);
+
+  return {
+    schemaVersion: "0.1.0",
+    summary: {
+      project: (framework.project as Record<string, unknown> | undefined)?.name ?? "unknown",
+      tables: dataGraph?.tables.length ?? 0,
+      frontendPresent: frontend?.present === true,
+      routes: frontend?.routes.length ?? 0,
+      agentTargets: agentAdapters?.targets?.map((target) => target.name).filter(Boolean) ?? [],
+      missingArtifacts: missingArtifacts.length,
+    },
+    artifacts,
+    nextActions: [
+      "forge inspect schema --json",
+      "forge inspect handoff --json",
+      "forge inspect drift --json",
+      "forge check --json",
+    ],
+  };
+}
+
+function buildInspectBrief(workspaceRoot: string): Record<string, unknown> {
+  const summary = buildInspectSummary(workspaceRoot);
+  const framework = buildFrameworkInspect(workspaceRoot);
+  const cli = framework.cli as { preferredEntryPoints?: string[]; inspectTargets?: string[] } | undefined;
+  const artifacts = readGeneratedArtifactStatus(workspaceRoot);
+  const missingArtifacts = artifacts.filter((artifact) => !artifact.present);
+  return {
+    schemaVersion: "0.1.0",
+    brief: true,
+    payload: {
+      mode: "brief",
+      purpose: "orientation",
+      includes: ["summary", "entrypoints", "refs", "artifact counts"],
+      omitted: ["schema table details", "framework module lists", "generated registries"],
+      fullCommand: "forge inspect all --full --json",
+      compactCommand: "forge inspect all --json",
+    },
+    summary: summary.summary,
+    entrypoints: {
+      preferred: cli?.preferredEntryPoints ?? [],
+      inspect: [
+        "forge inspect summary --json",
+        "forge inspect schema --json",
+        "forge inspect handoff --json",
+        "forge inspect all --json",
+        "forge inspect all --full --json",
+      ],
+    },
+    refs: [
+      "AGENTS.md",
+      `${GENERATED_DIR}/agentContract.json`,
+      `${GENERATED_DIR}/appMap.md`,
+      `${GENERATED_DIR}/runtimeRules.md`,
+      `${GENERATED_DIR}/operationPlaybooks.md`,
+      `${GENERATED_DIR}/frontendGraph.json`,
+    ],
+    artifacts: {
+      total: artifacts.length,
+      present: artifacts.length - missingArtifacts.length,
+      missing: missingArtifacts,
+    },
+    nextActions: [
+      "forge status --json",
+      "forge changed --json",
+      "forge agent onboard --target codex --json",
+      "forge dev --once --json",
+      "forge inspect all --json",
+    ],
+  };
+}
+
+function buildSchemaInspect(workspaceRoot: string): { data: Record<string, unknown>; errors: ReturnType<typeof createDiagnostic>[] } {
+  const dataGraph = readGeneratedJson<DataGraph>(workspaceRoot, `${GENERATED_DIR}/dataGraph.json`);
+  const sqlPlan = readGeneratedJson<SqlPlan>(workspaceRoot, `${GENERATED_DIR}/sqlPlan.json`);
+  const db = readGeneratedJson<{ tableMap?: Record<string, TableMapEntry> }>(workspaceRoot, `${GENERATED_DIR}/db.json`);
+  const errors: ReturnType<typeof createDiagnostic>[] = [];
+
+  if (!dataGraph) {
+    errors.push(createDiagnostic({
+      severity: "error",
+      code: "FORGE_INSPECT_MISSING",
+      message: `missing generated artifact: ${GENERATED_DIR}/dataGraph.json; run forge generate first`,
+      file: `${GENERATED_DIR}/dataGraph.json`,
+    }));
+  }
+  if (!sqlPlan) {
+    errors.push(createDiagnostic({
+      severity: "error",
+      code: "FORGE_INSPECT_MISSING",
+      message: `missing generated artifact: ${GENERATED_DIR}/sqlPlan.json; run forge generate first`,
+      file: `${GENERATED_DIR}/sqlPlan.json`,
+    }));
+  }
+  if (!db?.tableMap) {
+    errors.push(createDiagnostic({
+      severity: "error",
+      code: "FORGE_INSPECT_MISSING",
+      message: `missing generated artifact: ${GENERATED_DIR}/db.json; run forge generate first`,
+      file: `${GENERATED_DIR}/db.json`,
+    }));
+  }
+
+  const sqlByAccessName = new Map(
+    (sqlPlan?.tables ?? [])
+      .filter((table) => table.kind === "create_table")
+      .map((table) => [table.accessName ?? table.table ?? "", table]),
+  );
+  const tableMap = db?.tableMap ?? {};
+  const dataGraphDiagnostics = dataGraph?.diagnostics ?? [];
+  const sqlPlanDiagnostics = sqlPlan?.diagnostics ?? [];
+  const tables = (dataGraph?.tables ?? []).map((table) => {
+    const sql = sqlByAccessName.get(table.name);
+    const runtime = sql?.table ? tableMap[sql.table] ?? tableMap[table.name] : tableMap[table.name];
+    const sourceFields = table.fields.map((field) => field.name).sort();
+    const sqlColumns = (sql?.columns ?? []).map((column) => ({
+      name: column.name,
+      fieldName: column.fieldName,
+      sqlType: column.sqlType,
+      primaryKey: column.primaryKey === true,
+    }));
+    const runtimeFields = (runtime?.columns ?? []).map((column) => column.fieldName ?? column.name).sort();
+    const missingRuntimeFields = sourceFields.filter((field) => !runtimeFields.includes(field));
+
+    return {
+      name: table.name,
+      file: table.file,
+      sourceFields,
+      sqlTable: sql?.table ?? null,
+      sqlColumns,
+      runtimeAccessors: Object.entries(tableMap)
+        .filter(([, entry]) => entry.tableName === (sql?.table ?? table.name))
+        .map(([name]) => name)
+        .sort(),
+      missingRuntimeFields,
+    };
+  });
+
+  return {
+    data: {
+      schemaVersion: "0.1.0",
+      summary: {
+        tables: tables.length,
+        missingRuntimeFields: tables.reduce(
+          (count, table) => count + (table.missingRuntimeFields as string[]).length,
+          0,
+        ),
+        diagnostics: dataGraphDiagnostics.length + sqlPlanDiagnostics.length + errors.length,
+      },
+      tables,
+      diagnostics: [
+        ...dataGraphDiagnostics,
+        ...sqlPlanDiagnostics,
+        ...errors,
+      ],
+    },
+    errors,
+  };
+}
+
+function buildDriftInspect(workspaceRoot: string): Record<string, unknown> {
+  const schema = buildSchemaInspect(workspaceRoot);
+  const artifacts = readGeneratedArtifactStatus(workspaceRoot);
+  const missingArtifacts = artifacts.filter((artifact) => !artifact.present);
+  const tableDrift = ((schema.data.tables as Array<{ name: string; missingRuntimeFields: string[] }> | undefined) ?? [])
+    .filter((table) => table.missingRuntimeFields.length > 0)
+    .map((table) => ({
+      table: table.name,
+      missingRuntimeFields: table.missingRuntimeFields,
+      suggestedCommand: "forge generate && forge check --json",
+    }));
+  const staleAgentContext = hasPath(workspaceRoot, ".forge/agent/context.json")
+    ? "run forge agent check --target codex --json or forge agent export --target codex"
+    : null;
+
+  return {
+    schemaVersion: "0.1.0",
+    summary: {
+      ok: missingArtifacts.length === 0 && tableDrift.length === 0,
+      missingArtifacts: missingArtifacts.length,
+      tableDrift: tableDrift.length,
+      agentContextPresent: hasPath(workspaceRoot, ".forge/agent/context.json"),
+    },
+    missingArtifacts,
+    tableDrift,
+    agentContext: staleAgentContext,
+    nextActions: [
+      ...(missingArtifacts.length > 0 || tableDrift.length > 0 ? ["forge generate", "forge check --json"] : []),
+      "forge agent check --target codex --json",
+    ],
+  };
+}
+
+function buildHandoffInspect(workspaceRoot: string): Record<string, unknown> {
+  const manifest = readGeneratedJson<{
+    targets?: Array<{
+      name?: string;
+      files?: string[];
+      default?: boolean;
+      optional?: boolean;
+      formatVersion?: string;
+      adapterVersion?: string;
+    }>;
+  }>(workspaceRoot, `${GENERATED_DIR}/agentAdapterManifest.json`);
+  const targets = (manifest?.targets ?? []).map((target) => {
+    const files = target.files ?? [];
+    const missingFiles = files.filter((file) => !hasPath(workspaceRoot, file));
+    return {
+      name: target.name,
+      default: target.default === true,
+      optional: target.optional === true,
+      formatVersion: target.formatVersion,
+      adapterVersion: target.adapterVersion,
+      files,
+      filesPresent: files.length - missingFiles.length,
+      missingFiles,
+      exportCommand: target.name ? `forge agent export --target ${target.name}` : null,
+      checkCommand: target.name ? `forge agent check --target ${target.name} --json` : null,
+      prepareCommand: target.name ? `forge agent prepare --target ${target.name} --json` : null,
+    };
+  });
+  const missingRequiredFiles = targets.reduce(
+    (count, target) => count + (target.optional ? 0 : target.missingFiles.length),
+    0,
+  );
+  const missingOptionalFiles = targets.reduce(
+    (count, target) => count + (target.optional ? target.missingFiles.length : 0),
+    0,
+  );
+  const defaultTarget = targets.find((target) => target.default);
+  const defaultTargetMissingFiles = defaultTarget?.missingFiles.length ?? missingRequiredFiles;
+
+  return {
+    schemaVersion: "0.1.0",
+    summary: {
+      targets: targets.length,
+      defaultTarget: defaultTarget?.name ?? "generic",
+      missingFiles: missingRequiredFiles + missingOptionalFiles,
+      missingDefaultFiles: defaultTargetMissingFiles,
+      missingRequiredFiles,
+      missingOptionalFiles,
+      defaultReady: defaultTargetMissingFiles === 0,
+      requiredReady: missingRequiredFiles === 0,
+    },
+    targets,
+    commands: [
+      "forge agent list-targets --json",
+      "forge agent prepare --target codex --json",
+      "forge agent hooks smoke --target codex --json",
+      "forge agent ingest codex --event PostToolUse --json",
+    ],
+  };
+}
+
+export interface StatusCommandResult {
+  ok: boolean;
+  data: Record<string, unknown>;
+  exitCode: 0 | 1;
+}
+
+export function runStatusCommand(workspaceRoot: string): StatusCommandResult {
+  const summary = buildInspectSummary(workspaceRoot);
+  const drift = buildDriftInspect(workspaceRoot);
+  const handoff = buildHandoffInspect(workspaceRoot);
+  const gitSummary = buildWorkspaceGitSummary(workspaceRoot);
+  const git = {
+    available: gitSummary.available,
+    ...(gitSummary.error ? { error: gitSummary.error } : {}),
+    changed: gitSummary.changeSummary.changed,
+    staged: gitSummary.changeSummary.staged,
+    unstaged: gitSummary.changeSummary.unstaged,
+    untracked: gitSummary.changeSummary.untracked,
+  };
+  const summaryBlock = summary.summary as Record<string, unknown>;
+  const driftSummary = drift.summary as Record<string, unknown>;
+  const handoffSummary = handoff.summary as Record<string, unknown>;
+  const missingArtifacts = Number(summaryBlock.missingArtifacts ?? 0);
+  const tableDrift = Number(driftSummary.tableDrift ?? 0);
+  const generatedReady = missingArtifacts === 0;
+  const driftClean = driftSummary.ok === true;
+  const ok = driftClean && generatedReady;
+  const handoffDefaultReady = handoffSummary.defaultReady === true;
+  const generatedState = !generatedReady
+    ? "missing-artifacts"
+    : driftClean
+      ? "ready"
+      : "drift";
+  const generatedNextActions = generatedState === "ready"
+    ? ["forge dev", "forge generate --check --json"]
+    : ["forge generate", "forge check --json", "forge inspect drift --json"];
+  const changed = gitSummary.changeSummary.changed;
+  const generatedGitFiles = changed.byType.generated.count;
+  const authoredGitFiles = changed.total.count - generatedGitFiles;
+  const generatedGitExplanation = generatedGitFiles === 0
+    ? "git status has no generated artifact changes"
+    : authoredGitFiles === 0
+      ? "forge generate --check can be clean while git shows generated artifacts changed: generated files match current workspace inputs but differ from HEAD"
+      : "git status includes generated artifacts alongside authored changes; review authored inputs first";
+  const frontendPresent = summaryBlock.frontendPresent === true;
+  const studio = {
+    openCommand: "forge studio open . --preview-port 5174 --target codex --json",
+    attachCommand: "forge studio attach . --preview-port 5174 --target codex --json",
+    snapshotCommand: "forge studio snapshot . --preview-port 5174 --target codex --json",
+    watchCommand: "forge studio watch . --preview-port 5174 --target codex --json",
+    bridgeCommand: "forge studio bridge . --preview-port 5174 --target codex --studio-url http://127.0.0.1:3765 --json",
+    doctorCommand: "forge studio doctor . --preview-port 5174 --target codex --json",
+    targetPreviewUrl: "http://127.0.0.1:5174",
+    startTargetAppCommand: "forge dev --port 3766 --web-port 5174",
+    probeCommand: "forge dev --once --json",
+    useful: frontendPresent,
+    note: frontendPresent
+      ? "Attach this app to Forge Studio as an external-agent workroom; Studio should preview the target app on 5174."
+      : "No frontend was detected, but Studio can still attach for hooks, posture, and agent context.",
+  };
+
+  return {
+    ok,
+    data: {
+      schemaVersion: "0.1.0",
+      ok,
+      generated: {
+        state: generatedState,
+        ready: generatedReady,
+        driftClean,
+        missingArtifacts,
+        tableDrift,
+        safeDevCommand: "forge dev",
+        checkCommand: "forge generate --check --json",
+        repairCommand: "forge generate",
+        git: {
+          changedFiles: changed.total.count,
+          authoredFiles: authoredGitFiles,
+          generatedFiles: generatedGitFiles,
+          explanation: generatedGitExplanation,
+        },
+        nextActions: generatedNextActions,
+      },
+      studio,
+      summary: {
+        project: summaryBlock.project,
+        generated: generatedState,
+        tables: summaryBlock.tables,
+        frontendPresent,
+        routes: summaryBlock.routes,
+        drift: driftClean ? "clean" : "attention",
+        agentTargets: summaryBlock.agentTargets,
+        missingAgentFiles: handoffSummary.missingRequiredFiles,
+        missingDefaultAgentFiles: handoffSummary.missingDefaultFiles,
+        missingRequiredAgentFiles: handoffSummary.missingRequiredFiles,
+        missingOptionalAgentFiles: handoffSummary.missingOptionalFiles,
+      },
+      checks: {
+        artifacts: {
+          missing: missingArtifacts,
+        },
+        schema: {
+          tableDrift,
+        },
+        handoff: {
+          targets: handoffSummary.targets,
+          missingFiles: handoffSummary.missingFiles,
+          missingDefaultFiles: handoffSummary.missingDefaultFiles,
+          missingRequiredFiles: handoffSummary.missingRequiredFiles,
+          missingOptionalFiles: handoffSummary.missingOptionalFiles,
+          defaultReady: handoffSummary.defaultReady,
+          requiredReady: handoffSummary.requiredReady,
+        },
+      },
+      git,
+      nextActions: ok
+        ? [
+            "forge handoff --json",
+            "forge changed --json",
+            "forge dev",
+            ...(frontendPresent ? [studio.openCommand, studio.bridgeCommand, studio.doctorCommand] : []),
+            ...(!handoffDefaultReady ? ["forge agent prepare --target generic --json"] : []),
+            "forge inspect handoff --json",
+            "forge verify --changed",
+          ]
+        : [
+            "forge generate",
+            "forge handoff --json",
+            "forge changed --json",
+            ...(frontendPresent ? [studio.openCommand, studio.bridgeCommand, studio.doctorCommand] : []),
+            "forge inspect drift --json",
+            "forge agent prepare --target codex --json",
+          ],
+    },
+    exitCode: ok ? 0 : 1,
+  };
+}
+
+export function formatStatusHuman(result: StatusCommandResult): string {
+  const summary = result.data.summary as Record<string, unknown>;
+  const generated = result.data.generated as
+    | {
+      state?: string;
+      missingArtifacts?: number;
+      tableDrift?: number;
+      safeDevCommand?: string;
+      checkCommand?: string;
+      repairCommand?: string;
+    }
+    | undefined;
+  const git = result.data.git as
+    | {
+      available?: boolean;
+      changed?: CategorizedFileSummary;
+    }
+    | undefined;
+  const studio = result.data.studio as
+    | {
+      attachCommand?: string;
+      openCommand?: string;
+      doctorCommand?: string;
+      bridgeCommand?: string;
+      targetPreviewUrl?: string;
+      startTargetAppCommand?: string;
+      useful?: boolean;
+    }
+    | undefined;
+  const lines = [
+    `Forge status: ${result.ok ? "ready" : "needs attention"}`,
+    `Project: ${summary.project ?? "unknown"}`,
+    `Generated: ${summary.generated}`,
+    ...(generated
+      ? [
+          `Generated detail: missing artifacts ${generated.missingArtifacts ?? 0}, table drift ${generated.tableDrift ?? 0}`,
+          `Generated check: ${generated.checkCommand ?? "forge generate --check --json"}`,
+          `Generated repair: ${generated.repairCommand ?? "forge generate"}`,
+          `Generated dev: ${generated.safeDevCommand ?? "forge dev"}`,
+        ]
+      : []),
+    `Drift: ${summary.drift}`,
+    `Frontend: ${summary.frontendPresent ? `${summary.routes ?? 0} routes` : "none"}`,
+    ...(studio
+      ? [
+          `Studio open: ${studio.openCommand ?? "forge studio open . --preview-port 5174 --target codex --json"}`,
+          `Studio attach: ${studio.attachCommand ?? "forge studio attach . --preview-port 5174 --target codex --json"}`,
+          `Studio bridge: ${studio.bridgeCommand ?? "forge studio bridge . --preview-port 5174 --target codex --studio-url http://127.0.0.1:3765 --json"}`,
+          `Studio doctor: ${studio.doctorCommand ?? "forge studio doctor . --preview-port 5174 --target codex --json"}`,
+          `Studio preview: ${studio.targetPreviewUrl ?? "http://127.0.0.1:5174"}`,
+          `Studio start: ${studio.startTargetAppCommand ?? "forge dev --port 3766 --web-port 5174"}`,
+        ]
+      : []),
+    ...(git?.available && git.changed
+      ? [`Changed: ${git.changed.total.count}${git.changed.total.count > 0 ? ` (${git.changed.primaryTypes.slice(0, 5).join(", ")})` : ""}`]
+      : []),
+    `Agent default missing files: ${summary.missingDefaultAgentFiles ?? 0}`,
+    `Agent required missing files: ${summary.missingRequiredAgentFiles ?? summary.missingAgentFiles ?? 0}`,
+    `Agent optional missing files: ${summary.missingOptionalAgentFiles ?? 0}`,
+    "",
+    "Next:",
+    ...((result.data.nextActions as string[] | undefined) ?? []).map((command) => `  ${command}`),
+  ];
+  return `${lines.join("\n")}\n`;
+}
+
 export async function runGenerateCommand(
   options: GenerateOptions,
 ): Promise<GenerateResult> {
-  const result = await run(options);
+  const result = await withWorkspaceCwd(options.workspaceRoot, () => run(options));
   return attachFailureKind(result);
 }
 
+async function withWorkspaceCwd<T>(workspaceRoot: string, fn: () => Promise<T>): Promise<T> {
+  const previous = process.cwd();
+  const target = resolve(workspaceRoot);
+  if (resolve(previous).toLowerCase() === target.toLowerCase()) {
+    return fn();
+  }
+  process.chdir(target);
+  try {
+    return await fn();
+  } finally {
+    process.chdir(previous);
+  }
+}
+
 export async function runAddCommand(
   alias: string,
   options: Extract<ForgeCommand, { kind: "add" }>["options"],
@@ -343,6 +949,7 @@ export async function runCheckCommand(
       workspaceRoot,
       `${GENERATED_DIR}/capabilityMap.json`,
     )?.diagnostics ?? [];
+  const externalDiagnostics = buildExternalServiceGraph(workspaceRoot).diagnostics;
 
   const allDiagnostics = [
     ...guardDiagnostics,
@@ -351,6 +958,7 @@ export async function runCheckCommand(
     ...queryDiagnostics,
     ...frontendDiagnostics,
     ...capabilityDiagnostics,
+    ...externalDiagnostics,
   ];
   const errors = allDiagnostics.filter(
     (diagnostic) => diagnostic.severity === "error",
@@ -369,9 +977,265 @@ export async function runCheckCommand(
   });
 }
 
+interface ReleaseDoctorCheck {
+  name: string;
+  ok: boolean;
+  requiredForPublish: boolean;
+  state?: string;
+  result: ReleaseCommandResult | SelfHostCommandResult | DocsCheckResult | PackagePackCheckResult;
+}
+
+interface PackagePackCheckResult {
+  ok: boolean;
+  data: {
+    command: "npm pack --dry-run --json";
+    dryRun: true;
+    tarball: string | null;
+    fileCount: number;
+  };
+  diagnostics: ReturnType<typeof createDiagnostic>[];
+  nextActions?: string[];
+  failureKind?: string;
+  exitCode: 0 | 1;
+}
+
+interface ReleaseDoctorResult {
+  schemaVersion: "0.1.0";
+  ok: boolean;
+  readyToPublish: boolean;
+  summary: {
+    checks: number;
+    failed: string[];
+    notPrepared: string[];
+  };
+  checks: ReleaseDoctorCheck[];
+  nextActions: string[];
+  exitCode: 0 | 1;
+}
+
+function runPackagePackDryRun(workspaceRoot: string): PackagePackCheckResult {
+  const result = spawnSync("npm", ["pack", "--dry-run", "--json"], {
+    cwd: workspaceRoot,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  const command = "npm pack --dry-run --json" as const;
+  if (result.status !== 0) {
+    const failureDetail = result.error instanceof Error ? result.error.message : null;
+    return {
+      ok: false,
+      data: { command, dryRun: true, tarball: null, fileCount: 0 },
+      diagnostics: [
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_RELEASE_PACKAGE_PACK_FAILED,
+          message: "npm pack dry-run failed; release package contents could not be validated",
+          fixHint: (result.stderr || result.stdout || failureDetail || "Run npm pack --dry-run --json locally for details.").trim(),
+          suggestedCommands: ["npm pack --dry-run --json"],
+        }),
+      ],
+      nextActions: ["npm pack --dry-run --json"],
+      failureKind: "package-pack-failed",
+      exitCode: 1,
+    };
+  }
+  try {
+    const parsed = JSON.parse(result.stdout || "[]") as unknown;
+    const pack = Array.isArray(parsed)
+      ? (parsed[0] as { filename?: unknown; files?: unknown[] } | undefined)
+      : undefined;
+    if (typeof pack?.filename !== "string" || !Array.isArray(pack.files)) {
+      return {
+        ok: false,
+        data: { command, dryRun: true, tarball: null, fileCount: 0 },
+        diagnostics: [
+          createDiagnostic({
+            severity: "error",
+            code: FORGE_RELEASE_PACKAGE_PACK_FAILED,
+            message: "npm pack dry-run did not report package contents",
+            fixHint: "Run npm pack --dry-run --json locally and confirm it returns a tarball with file entries.",
+            suggestedCommands: ["npm pack --dry-run --json"],
+          }),
+        ],
+        nextActions: ["npm pack --dry-run --json"],
+        failureKind: "package-pack-missing-contents",
+        exitCode: 1,
+      };
+    }
+    return {
+      ok: true,
+      data: {
+        command,
+        dryRun: true,
+        tarball: pack.filename,
+        fileCount: pack.files.length,
+      },
+      diagnostics: [],
+      exitCode: 0,
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      data: { command, dryRun: true, tarball: null, fileCount: 0 },
+      diagnostics: [
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_RELEASE_PACKAGE_PACK_FAILED,
+          message: "npm pack dry-run returned invalid JSON",
+          fixHint: error instanceof Error ? error.message : String(error),
+          suggestedCommands: ["npm pack --dry-run --json"],
+        }),
+      ],
+      nextActions: ["npm pack --dry-run --json"],
+      failureKind: "package-pack-invalid-json",
+      exitCode: 1,
+    };
+  }
+}
+
+export async function runReleaseDoctorCommand(command: Extract<ForgeCommand, { kind: "release" }>): Promise<ReleaseDoctorResult> {
+  const release = await runReleaseCommand({
+    ...command,
+    action: "check",
+    allowMissingLocalRelease: true,
+    provider: command.provider as import("../compiler/release/types.ts").ReleaseExportProvider | undefined,
+    target: command.target as import("../compiler/release/types.ts").ReleaseExportProvider | undefined,
+  });
+  const sourcemaps = await runReleaseCommand({
+    ...command,
+    area: "sourcemaps",
+    action: "check",
+    provider: command.provider as import("../compiler/release/types.ts").ReleaseExportProvider | undefined,
+    target: command.target as import("../compiler/release/types.ts").ReleaseExportProvider | undefined,
+  });
+  const selfHost = await runSelfHostCommand({
+    subcommand: "check",
+    workspaceRoot: command.workspaceRoot,
+    json: command.json,
+    withWeb: true,
+    postgresVersion: "16",
+    runtimePort: 3765,
+    webPort: 3000,
+    preparedOnly: true,
+  });
+  const docs = runDocsCheckCommand({
+    workspaceRoot: command.workspaceRoot,
+    json: command.json,
+  });
+  const packagePack = runPackagePackDryRun(command.workspaceRoot);
+  const checks: ReleaseDoctorCheck[] = [
+    {
+      name: "release-prepared",
+      ok: release.ok,
+      requiredForPublish: true,
+      state: (release.data as { state?: string } | undefined)?.state,
+      result: release,
+    },
+    {
+      name: "sourcemaps",
+      ok: sourcemaps.ok,
+      requiredForPublish: true,
+      result: sourcemaps,
+    },
+    {
+      name: "self-host",
+      ok: selfHost.ok,
+      requiredForPublish: false,
+      state: selfHost.state,
+      result: selfHost,
+    },
+    {
+      name: "docs",
+      ok: docs.ok,
+      requiredForPublish: true,
+      result: docs,
+    },
+    {
+      name: "npm-pack-dry-run",
+      ok: packagePack.ok,
+      requiredForPublish: true,
+      result: packagePack,
+    },
+  ];
+  const failed = checks.filter((check) => !check.ok).map((check) => check.name);
+  const notPrepared = checks
+    .filter((check) => check.state === "missing-prepared-release" || check.state === "not-prepared")
+    .map((check) => check.name);
+  const readyToPublish = failed.length === 0 && notPrepared.length === 0;
+  return {
+    schemaVersion: "0.1.0",
+    ok: failed.length === 0,
+    readyToPublish,
+    summary: {
+      checks: checks.length,
+      failed,
+      notPrepared,
+    },
+    checks,
+    nextActions: uniqueNextActions(checks.flatMap((check) => check.result.nextActions ?? [])),
+    exitCode: failed.length === 0 ? 0 : 1,
+  };
+}
+
+function formatManifestHuman(result: {
+  subcommand: "validate" | "import";
+  path: string;
+  imported?: boolean;
+  serviceCount?: number;
+  diagnostics: import("../compiler/types/diagnostic.ts").Diagnostic[];
+  exitCode: number;
+}): string {
+  const errors = result.diagnostics.filter((diagnostic) => diagnostic.severity === "error");
+  const warnings = result.diagnostics.filter((diagnostic) => diagnostic.severity === "warning");
+  const lines = [
+    `manifest: ${result.subcommand}`,
+    `path: ${result.path}`,
+    result.subcommand === "import" ? `imported: ${result.imported ? "yes" : "no"}` : null,
+    result.serviceCount !== undefined ? `external services: ${result.serviceCount}` : null,
+    `errors: ${errors.length}`,
+    `warnings: ${warnings.length}`,
+  ].filter((line): line is string => line !== null);
+  for (const diagnostic of result.diagnostics) {
+    lines.push(`${diagnostic.severity} ${diagnostic.code}: ${diagnostic.message}`);
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+function runManifestCommand(command: Extract<ForgeCommand, { kind: "manifest" }>): {
+  subcommand: "validate" | "import";
+  path: string;
+  imported?: boolean;
+  serviceCount?: number;
+  diagnostics: import("../compiler/types/diagnostic.ts").Diagnostic[];
+  exitCode: number;
+} {
+  if (command.subcommand === "validate") {
+    const result = readExternalManifestFile(command.path);
+    const hasErrors = result.diagnostics.some((diagnostic) => diagnostic.severity === "error");
+    return {
+      subcommand: "validate",
+      path: command.path,
+      diagnostics: result.diagnostics,
+      exitCode: hasErrors ? 1 : 0,
+    };
+  }
+
+  const result = importExternalManifest(command.workspaceRoot, command.path);
+  const hasErrors = result.diagnostics.some((diagnostic) => diagnostic.severity === "error");
+  return {
+    subcommand: "import",
+    path: result.path,
+    imported: result.imported,
+    serviceCount: result.graph.services.length,
+    diagnostics: result.diagnostics,
+    exitCode: hasErrors ? 1 : 0,
+  };
+}
+
 export async function runInspectCommand(
   target: InspectTarget,
   workspaceRoot: string,
+  options: { full?: boolean; brief?: boolean } = {},
 ): Promise<InspectResult> {
   const dataPaths: Partial<Record<InspectTarget, string>> = {
     app: `${GENERATED_DIR}/appGraph.json`,
@@ -390,6 +1254,7 @@ export async function runInspectCommand(
     ai: `${GENERATED_DIR}/aiRegistry.json`,
     queries: `${GENERATED_DIR}/queryRegistry.json`,
     api: `${GENERATED_DIR}/api.json`,
+    external: `${GENERATED_DIR}/externalServices.json`,
     client: `${GENERATED_DIR}/clientManifest.json`,
     frontend: `${GENERATED_DIR}/frontendGraph.json`,
     auth: `${GENERATED_DIR}/authRegistry.json`,
@@ -405,6 +1270,7 @@ export async function runInspectCommand(
     "test-graph": `${GENERATED_DIR}/testGraph.json`,
     "test-plans": `${GENERATED_DIR}/testPlanRegistry.json`,
     "agent-contract": `${GENERATED_DIR}/agentContract.json`,
+    "agent-tools": `${GENERATED_DIR}/agentTools.json`,
     "agent-adapters": `${GENERATED_DIR}/agentAdapterManifest.json`,
     "capability-map": `${GENERATED_DIR}/capabilityMap.json`,
     ui: `${GENERATED_DIR}/uiTestManifest.json`,
@@ -424,7 +1290,114 @@ export async function runInspectCommand(
     };
   }
 
+  if (target === "summary") {
+    return {
+      target,
+      data: buildInspectSummary(workspaceRoot),
+      warnings: [],
+      errors: [],
+      exitCode: 0,
+    };
+  }
+
+  if (target === "schema") {
+    const result = buildSchemaInspect(workspaceRoot);
+    return {
+      target,
+      data: result.data,
+      warnings: [],
+      errors: result.errors,
+      exitCode: result.errors.length > 0 ? 1 : 0,
+      failureKind: result.errors.length > 0 ? "missing_artifact" : undefined,
+    };
+  }
+
+  if (target === "drift") {
+    return {
+      target,
+      data: buildDriftInspect(workspaceRoot),
+      warnings: [],
+      errors: [],
+      exitCode: 0,
+    };
+  }
+
+  if (target === "handoff") {
+    return {
+      target,
+      data: buildHandoffInspect(workspaceRoot),
+      warnings: [],
+      errors: [],
+      exitCode: 0,
+    };
+  }
+
+  if (target === "imported") {
+    const result = inspectBrownfieldImport(workspaceRoot);
+    return {
+      target,
+      data: formatBrownfieldImportJson(result),
+      warnings: [],
+      errors: [],
+      exitCode: result.exitCode,
+      failureKind: result.failureKind,
+    };
+  }
+
   if (target === "all") {
+    if (options.brief) {
+      const brief = buildInspectBrief(workspaceRoot);
+      return {
+        target,
+        data: brief,
+        warnings: [],
+        errors: [],
+        exitCode: 0,
+      };
+    }
+    if (!options.full) {
+      const summary = buildInspectSummary(workspaceRoot);
+      const schema = buildSchemaInspect(workspaceRoot);
+      const drift = buildDriftInspect(workspaceRoot);
+      const handoff = buildHandoffInspect(workspaceRoot);
+      const framework = buildFrameworkInspect(workspaceRoot);
+      const errors = [
+        ...schema.errors,
+      ];
+      return {
+        target,
+        data: {
+          schemaVersion: "0.1.0",
+          compact: true,
+          payload: {
+            mode: "compact",
+            purpose: "agent diagnostic bundle",
+            includes: ["summary", "schema", "drift", "handoff", "framework"],
+            omitted: ["large generated registries", "module graph", "full runtime graph payloads"],
+            fullCommand: "forge inspect all --full --json",
+            briefCommand: "forge inspect all --brief --json",
+          },
+          summary: summary.summary,
+          inspections: {
+            summary,
+            schema: schema.data,
+            drift,
+            handoff,
+            framework,
+          },
+          nextActions: [
+            "forge inspect summary --json",
+            "forge inspect schema --json",
+            "forge inspect handoff --json",
+            "forge inspect all --full --json",
+          ],
+        },
+        warnings: [],
+        errors,
+        exitCode: errors.length > 0 ? 1 : 0,
+        failureKind: errors.length > 0 ? "missing_artifact" : undefined,
+      };
+    }
     const aggregatePaths: Array<[string, string]> = [
       ["app", `${GENERATED_DIR}/appGraph.json`],
       ["data", `${GENERATED_DIR}/dataGraph.json`],
@@ -436,6 +1409,7 @@ export async function runInspectCommand(
       ["workflows", `${GENERATED_DIR}/workflowRegistry.json`],
       ["telemetry", `${GENERATED_DIR}/telemetryRegistry.json`],
       ["ai", `${GENERATED_DIR}/aiRegistry.json`],
+      ["externalServices", `${GENERATED_DIR}/externalServices.json`],
       ["client", `${GENERATED_DIR}/clientManifest.json`],
       ["frontend", `${GENERATED_DIR}/frontendGraph.json`],
       ["auth", `${GENERATED_DIR}/authRegistry.json`],
@@ -451,6 +1425,7 @@ export async function runInspectCommand(
       ["testGraph", `${GENERATED_DIR}/testGraph.json`],
       ["testPlanRegistry", `${GENERATED_DIR}/testPlanRegistry.json`],
       ["agentContract", `${GENERATED_DIR}/agentContract.json`],
+      ["agentTools", `${GENERATED_DIR}/agentTools.json`],
       ["agentAdapters", `${GENERATED_DIR}/agentAdapterManifest.json`],
       ["capabilityMap", `${GENERATED_DIR}/capabilityMap.json`],
       ["ui", `${GENERATED_DIR}/uiTestManifest.json`],
@@ -459,6 +1434,7 @@ export async function runInspectCommand(
     ];
     const data: Record<string, unknown> = {};
     const errors = [];
+    data.summary = buildInspectSummary(workspaceRoot).summary;
     for (const [key, relative] of aggregatePaths) {
       const value = readGeneratedJson<unknown>(workspaceRoot, relative);
       if (value === null) {
@@ -476,6 +1452,17 @@ export async function runInspectCommand(
     }
     data.framework = buildFrameworkInspect(workspaceRoot);
     data.diagnostics = errors;
+    data.compact = false;
+    data.payload = {
+      mode: "full",
+      purpose: "complete generated machine contract",
+      includes: aggregatePaths.map(([key]) => key),
+      compactCommand: "forge inspect all --json",
+      briefCommand: "forge inspect all --brief --json",
+    };
+    data.nextActions = errors.length > 0
+      ? ["forge status --json", "forge generate", "forge check --json"]
+      : ["forge inspect all --json", "forge check --json"];
     return {
       target,
       data,
@@ -537,6 +1524,18 @@ export async function runInspectCommand(
 
 export async function executeCommand(command: ForgeCommand): Promise<number> {
   switch (command.kind) {
+    case "version": {
+      if (command.json) {
+        process.stdout.write(`${JSON.stringify({
+          version: CLI_VERSION,
+          cliVersion: CLI_VERSION,
+          forgeosVersion: FORGEOS_VERSION,
+        }, null, 2)}\n`);
+      } else {
+        process.stdout.write(`${CLI_VERSION}\n`);
+      }
+      return 0;
+    }
     case "new": {
       const result = await runNewCommand({
         name: command.name,
@@ -578,6 +1577,15 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       }
       return result.exitCode;
     }
+    case "docs": {
+      const result = runDocsCheckCommand(command);
+      if (command.json) {
+        process.stdout.write(formatJsonResult(result));
+      } else {
+        process.stdout.write(formatDocsCheckHuman(result));
+      }
+      return result.exitCode;
+    }
     case "agent-contract": {
       if (command.subcommand === "print") {
         const result = runAgentContractPrint(command.workspaceRoot);
@@ -605,6 +1613,25 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       return result.exitCode;
     }
     case "doctor": {
+      if (command.target === "agent") {
+        const result = await runAgentCommand({
+          subcommand: "doctor",
+          workspaceRoot: command.workspaceRoot,
+          json: command.json,
+          target: command.agentTarget ?? "codex",
+          dryRun: false,
+          force: false,
+          preserveUserSections: true,
+          skills: true,
+          rules: true,
+        });
+        if (command.json) {
+          process.stdout.write(formatAgentJson(result));
+        } else {
+          process.stdout.write(formatAgentHuman(result));
+        }
+        return result.exitCode;
+      }
       if (command.target === "windows") {
         const result = await runWindowsDoctorCommand({ workspaceRoot: command.workspaceRoot });
         if (command.json) {
@@ -634,6 +1661,15 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       }
       return result.exitCode;
     }
+    case "security": {
+      const result = await runSecurityCommand(command);
+      if (command.json) {
+        process.stdout.write(formatSecurityJson(result));
+      } else {
+        process.stdout.write(formatSecurityHuman(result));
+      }
+      return result.exitCode;
+    }
     case "auth": {
       const result = await runAuthCommand(command);
       if (command.json) {
@@ -662,6 +1698,22 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       return result.exitCode;
     }
     case "release": {
+      if (command.action === "doctor") {
+        const result = await runReleaseDoctorCommand(command);
+        if (command.json) {
+          process.stdout.write(formatJsonResult(result));
+        } else {
+          process.stdout.write(
+            [
+              `release doctor ${result.ok ? "ok" : "failed"}`,
+              `ready to publish: ${result.readyToPublish ? "yes" : "no"}`,
+              ...result.checks.map((check) => `${check.ok ? "ok" : "fail"} ${check.name}${check.state ? ` (${check.state})` : ""}`),
+              ...(result.nextActions.length > 0 ? ["", "Next:", ...result.nextActions.map((action) => `  ${action}`)] : []),
+            ].join("\n").concat("\n"),
+          );
+        }
+        return result.exitCode;
+      }
       const result = await runReleaseCommand({
         ...command,
         provider: command.provider as import("../compiler/release/types.ts").ReleaseExportProvider | undefined,
@@ -737,6 +1789,71 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       }
       return result.exitCode;
     }
+    case "bench": {
+      const result = await runCompilerBenchCommand(command.options);
+      process.stdout.write(
+        command.options.json
+          ? formatCompilerBenchJson(result)
+          : formatCompilerBenchHuman(result),
+      );
+      return result.exitCode;
+    }
+    case "cair": {
+      const result = runCairCommand(command.options);
+      process.stdout.write(
+        command.options.json || command.options.format === "json"
+          ? formatCairJson(result)
+          : formatCairHuman(result),
+      );
+      return result.exitCode;
+    }
+    case "delta": {
+      if (command.subcommand === "repair") {
+        const result = await runDeltaRepair({
+          workspaceRoot: command.workspaceRoot,
+          dryRun: command.dryRun,
+          yes: command.yes,
+        });
+        process.stdout.write(command.json ? formatDeltaRepairJson(result) : formatDeltaRepairHuman(result));
+        return result.exitCode;
+      }
+      const result = await runDeltaStatus(command.workspaceRoot, { verbose: command.verbose });
+      process.stdout.write(command.json ? formatDeltaStatusJson(result) : formatDeltaStatusHuman(result));
+      return result.exitCode;
+    }
+    case "session": {
+      const result = await runDeltaSessionCommand({
+        workspaceRoot: command.workspaceRoot,
+        subcommand: command.subcommand,
+        sessionId: command.sessionId,
+        sourceSessionId: command.sourceSessionId,
+        operationId: command.operationId,
+        title: command.title,
+        limit: command.limit,
+      });
+      process.stdout.write(command.json ? formatDeltaSessionJson(result) : formatDeltaSessionHuman(result));
+      return result.exitCode;
+    }
+    case "timeline": {
+      const result = await runDeltaTimeline({
+        workspaceRoot: command.workspaceRoot,
+        target: command.target,
+        kind: command.kindFilter,
+        session: command.sessionId,
+        limit: command.limit,
+        rebuild: command.rebuild,
+      });
+      process.stdout.write(command.json ? formatDeltaTimelineJson(result) : formatDeltaTimelineHuman(result));
+      return result.exitCode;
+    }
+    case "explain": {
+      const result = await runDeltaExplain({
+        workspaceRoot: command.workspaceRoot,
+        thing: command.thing,
+      });
+      process.stdout.write(command.json ? formatDeltaExplainJson(result) : formatDeltaExplainHuman(result));
+      return result.exitCode;
+    }
     case "agent": {
       const result = await runAgentCommand(command.options);
       if (command.options.json) {
@@ -746,10 +1863,13 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       }
       return result.exitCode;
     }
+    case "mcp": {
+      return runMcpServe(command.workspaceRoot);
+    }
     case "review": {
       const result = runReviewCommand(command.options);
       if (command.options.json) {
-        process.stdout.write(formatReviewJson(result));
+        process.stdout.write(formatReviewJson(result, { full: command.options.full }));
       } else if (command.options.md && result.report) {
         process.stdout.write(renderReviewMarkdown(result.report));
       } else if (command.options.sarif && result.report && !command.options.write) {
@@ -773,7 +1893,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
     }
     case "generate": {
       const result = await runGenerateCommand({
-        workspaceRoot: process.cwd(),
+        workspaceRoot: command.workspaceRoot,
         check: command.check,
         dryRun: command.dryRun,
         json: command.json,
@@ -797,10 +1917,135 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       }
       return result.exitCode;
     }
+    case "manifest": {
+      const result = runManifestCommand(command);
+      if (command.json) {
+        process.stdout.write(formatJsonResult(result));
+      } else {
+        process.stdout.write(formatManifestHuman(result));
+      }
+      return result.exitCode;
+    }
+    case "import": {
+      const result = runBrownfieldImportCommand(command.options);
+      if (command.options.json) {
+        process.stdout.write(formatJsonResult(formatBrownfieldImportJson(result)));
+      } else {
+        process.stdout.write(formatBrownfieldImportHuman(result));
+      }
+      return result.exitCode;
+    }
+    case "status": {
+      const result = runStatusCommand(command.workspaceRoot);
+      if (command.json) {
+        process.stdout.write(formatJsonResult(result.data));
+      } else {
+        process.stdout.write(formatStatusHuman(result));
+      }
+      return result.exitCode;
+    }
+    case "changed": {
+      const result = runChangedCommand(command.workspaceRoot, {
+        authoredOnly: command.authoredOnly,
+      });
+      if (command.json) {
+        process.stdout.write(formatJsonResult(result.data));
+      } else {
+        process.stdout.write(formatChangedHuman(result));
+      }
+      return result.exitCode;
+    }
+    case "diff": {
+      const changed = runChangedCommand(command.workspaceRoot);
+      const diffPlan = changed.data.diffPlan as { authoredDiffCommand: string; generatedDiffCommand: string; fullDiffCommand: string };
+      const commandText = command.target === "generated"
+        ? diffPlan.generatedDiffCommand
+        : command.target === "full"
+          ? diffPlan.fullDiffCommand
+          : diffPlan.authoredDiffCommand;
+      if (command.json) {
+        process.stdout.write(formatJsonResult({
+          schemaVersion: "0.1.0",
+          ok: changed.ok,
+          target: command.target,
+          command: commandText,
+          exitCode: changed.exitCode,
+        }));
+        return changed.exitCode;
+      }
+      const result = spawnSync(commandText, {
+        cwd: command.workspaceRoot,
+        shell: true,
+        stdio: "inherit",
+        windowsHide: true,
+      });
+      return result.status === 0 ? 0 : 1;
+    }
+    case "handoff": {
+      const result = await runHandoffCommand(command);
+      process.stdout.write(command.json ? formatHandoffJson(result) : formatHandoffHuman(result));
+      return result.exitCode;
+    }
+    case "studio": {
+      if (command.subcommand === "bridge" && !command.once && !command.dryRun) {
+        return runStudioBridgeLoop(command, (result) => {
+          process.stdout.write(command.json ? formatStudioBridgeEventJson(result) : formatStudioBridgeHuman(result));
+        });
+      }
+      if (command.subcommand === "watch" && !command.once && !command.dryRun) {
+        return runStudioWatchLoop(command, (result) => {
+          process.stdout.write(command.json ? formatStudioWatchJson(result) : formatStudioWatchHuman(result));
+        });
+      }
+      const result = command.subcommand === "snapshot"
+        ? await runStudioSnapshotCommand(command)
+        : command.subcommand === "watch"
+          ? await runStudioWatchCommand(command)
+          : command.subcommand === "bridge"
+            ? await runStudioBridgeCommand(command)
+            : command.subcommand === "codex-server"
+              ? await runStudioCodexServerCommand(command)
+              : command.subcommand === "doctor"
+                ? await runStudioDoctorCommand(command)
+                : command.subcommand === "open"
+                  ? await runStudioOpenCommand(command)
+                  : await runStudioAttachCommand(command);
+      process.stdout.write(
+        command.json
+          ? command.subcommand === "snapshot"
+            ? formatStudioSnapshotJson(result as Awaited<ReturnType<typeof runStudioSnapshotCommand>>)
+            : command.subcommand === "watch"
+              ? formatStudioWatchJson(result as Awaited<ReturnType<typeof runStudioWatchCommand>>)
+              : command.subcommand === "bridge"
+                ? formatStudioBridgeJson(result as Awaited<ReturnType<typeof runStudioBridgeCommand>>)
+                : command.subcommand === "codex-server"
+                  ? formatStudioCodexServerJson(result as Awaited<ReturnType<typeof runStudioCodexServerCommand>>)
+                  : command.subcommand === "doctor"
+                    ? formatStudioDoctorJson(result as Awaited<ReturnType<typeof runStudioDoctorCommand>>)
+                    : command.subcommand === "open"
+                      ? formatStudioOpenJson(result as Awaited<ReturnType<typeof runStudioOpenCommand>>)
+                      : formatStudioAttachJson(result as Awaited<ReturnType<typeof runStudioAttachCommand>>)
+          : command.subcommand === "snapshot"
+            ? formatStudioSnapshotHuman(result as Awaited<ReturnType<typeof runStudioSnapshotCommand>>)
+            : command.subcommand === "watch"
+              ? formatStudioWatchHuman(result as Awaited<ReturnType<typeof runStudioWatchCommand>>)
+              : command.subcommand === "bridge"
+                ? formatStudioBridgeHuman(result as Awaited<ReturnType<typeof runStudioBridgeCommand>>)
+                : command.subcommand === "codex-server"
+                  ? formatStudioCodexServerHuman(result as Awaited<ReturnType<typeof runStudioCodexServerCommand>>)
+                  : command.subcommand === "doctor"
+                    ? formatStudioDoctorHuman(result as Awaited<ReturnType<typeof runStudioDoctorCommand>>)
+                    : command.subcommand === "open"
+                      ? formatStudioOpenHuman(result as Awaited<ReturnType<typeof runStudioOpenCommand>>)
+                      : formatStudioAttachHuman(result as Awaited<ReturnType<typeof runStudioAttachCommand>>),
+      );
+      return result.exitCode;
+    }
     case "inspect": {
       const result = await runInspectCommand(
         command.target,
         process.cwd(),
+        { full: command.full, brief: command.brief },
       );
       if (command.json) {
         process.stdout.write(formatJsonResult(buildInspectJson(result)));
@@ -816,7 +2061,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         strictSecrets: command.strictSecrets,
       });
       if (command.json) {
-        process.stdout.write(formatJsonResult(buildGenerateJson(result)));
+        process.stdout.write(formatJsonResult(buildCheckJson(result)));
       } else {
         writeHumanGenerate(result);
       }
@@ -838,6 +2083,32 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       );
 
       if (command.queryMode && command.name) {
+        const external = resolveExternalQualifiedName(command.workspaceRoot, command.name, "query");
+        if (external) {
+          const run = await runExternalEntry(command.workspaceRoot, {
+            kind: "query",
+            serviceName: external.serviceName,
+            entryName: external.entryName,
+            args: command.args,
+            auth: resolveAuthFromCli({
+              userId: command.userId,
+              tenantId: command.tenantId,
+              role: command.role,
+            }),
+          });
+          const payload = { run };
+          if (command.json) {
+            process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+          } else {
+            process.stdout.write(
+              run.ok
+                ? `${JSON.stringify(run.result, null, 2)}\n`
+                : `${run.diagnostics.map((diagnostic) => `error ${diagnostic.code}: ${diagnostic.message}`).join("\n")}\n`,
+            );
+          }
+          return run.exitCode;
+        }
+
         const tableMap = readGeneratedJson<{ tableMap: Record<string, import("../compiler/data-graph/sql/serialize.ts").TableMapEntry> }>(
           command.workspaceRoot,
           `${GENERATED_DIR}/db.json`,
@@ -876,6 +2147,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         userId: command.userId,
         tenantId: command.tenantId,
         role: command.role,
+        args: command.args,
         workspaceRoot: command.workspaceRoot,
       });
 
@@ -913,6 +2185,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         webPort: command.webPort,
         telemetry: command.telemetry,
         envFile: command.envFile,
+        skipStartupConsole: command.skipStartupConsole,
       });
       return result.exitCode;
     }
@@ -1111,6 +2384,11 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         model: command.model,
         prompt: command.prompt,
         mock: command.mock,
+        modelLevel: command.modelLevel,
+        live: command.live,
+        traceId: command.traceId,
+        db: command.db,
+        databaseUrl: command.databaseUrl,
       });
 
       if (command.json) {
@@ -1126,5 +2404,5 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
   }
 }
 
-export { runVerifyCommand };
+export { runChangedCommand, runVerifyCommand };
 export type { VerifyOptions, VerifyResult };