forgeos 0.1.0-alpha.2 → 0.1.0-alpha.3

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.2 input=2ce189e4d3555acfca07eb3bb3d103b22a8da52f3c26f9ac2197254f0563234f content=e0bf36433d915daf5ad06ac6265b3ac6f2cd1706269c69618bbbc1cb1f44e465
+// @forge-generated generator=0.1.0-alpha.3 input=c6d07cc92a729a46f2ff02a05c005e7fe0d71a3a5800be6f670a3fca2db04d6f content=1611635edf59c122b013ba76c85bd333ab3b30b289aaea04a9074f9438782a50
 # AGENTS.md
 
 <!-- forge-generated:start -->
@@ -69,6 +69,7 @@ forge inspect app --json
 forge inspect all --json
 forge inspect frontend --json
 forge inspect capabilities --json
+forge inspect agent-tools --json
 forge deps inspect <package> --json
 forge deps api <package> <symbol> --json
 forge deps trace <package> --json
@@ -82,6 +83,9 @@ forge doctor
 forge doctor windows --json
 forge setup windows --json
 forge agent print-context --json
+forge ai tools --json
+forge ai agents --json
+forge ai trace <traceId> --json
 forge verify --smoke
 forge verify --standard
 forge verify --strict
@@ -103,6 +107,21 @@ Tenant-scoped tables:
 - ANTHROPIC_API_KEY (required)
 - OPENAI_API_KEY (required)
 
+## AI Tools And Agents
+
+- AI SDK engine: Vercel AI SDK v6.
+- Forge layer: generated registry, runtime rules, telemetry, secrets, tenant/auth context, and agent contract.
+- Use `ctx.agent.run` or `ctx.ai.runAgent` only in actions, workflows, endpoints, and server code.
+- Do not create custom tool loops; use Forge tools and AI SDK `ToolLoopAgent` through the Forge runtime.
+
+Tools:
+
+- none
+
+Agents:
+
+- none
+
 ## Auth
 
 - Modes: dev-headers, jwt, oidc, disabled
@@ -158,6 +177,7 @@ Use:
 forge make resource <name> --fields title:text,status:enum(open,closed) --dry-run --json
 forge make resource <name> --fields title:text,status:enum(open,closed) --with-ui --yes
 forge make ui --framework vite --dry-run --json
+forge make ai-chat support --dry-run --json
 ```
 
 Review the plan before applying when the resource touches schema or policies.
@@ -194,11 +214,13 @@ Use:
 ```bash
 forge refactor rename field tickets.priority tickets.urgency --dry-run --json
 forge refactor rename field tickets.priority tickets.urgency --yes
+forge refactor rename command createTicket openTicket --dry-run --json
+forge refactor rename command createTicket openTicket --yes
 ```
 
-These codemods are AST-aware for `extract-action`, `rename field`, and `rename table`. Field renames are scoped to the target table, so `tickets.priority` only rewrites references linked to `tickets`.
+These codemods are AST-aware for `extract-action`, `rename command`, `rename field`, and `rename table`. Command renames update runtime registries, generated client references, frontend hooks, tests, and string references where safe. Field renames are scoped to the target table, so `tickets.priority` only rewrites references linked to `tickets`.
 
-Never edit `src/forge/_generated/**` directly. Review migration hints before applying field or table renames.
+Never edit `src/forge/_generated/**` directly. Review migration hints before applying command, field, or table renames.
 
 ### Plan impact-based tests
 
@@ -224,6 +246,19 @@ forge repair plan --from-last-test-run --write
 
 Apply only high-confidence deterministic repairs automatically. Review medium or low confidence repairs before changing code.
 
+### Add AI tools or agents
+
+Use:
+
+```bash
+forge generate
+forge inspect all --json
+forge ai check --json
+forge ai trace <traceId> --json
+```
+
+Define tools with `aiTool({ inputSchema, outputSchema, risk, needsApproval, handler })` and agents with `agent({ provider, model, instructions, tools, stopWhen })`. Execute agents with `ctx.agent.run` or `ctx.ai.runAgent` only from actions, workflows, endpoints, or server code. In dev, POST `/ai/agents/run` returns JSON for automation and POST `/ai/agents/chat` returns an AI SDK UIMessage stream for React `useChat`; both accept `agent: "<exportedAgentName>"` and use generated auto-tools from `agentTools.json`.
+
 ### Export agent adapters
 
 Use:

package/README.md

@@ -2,7 +2,7 @@
 
 Agent-native application framework and compiler for building Forge apps without a mandatory dashboard. ForgeOS turns application source into deterministic runtime contracts, generated clients, safety checks, and machine-readable context that humans and AI coding agents can use safely.
 
-**Status:** private/public alpha MVP, implemented through H42. The core compiler, local runtime, frontend SDK, production auth, RLS compiler, repair/review loops, UI test bridge, guided intent router, full-stack capability map, clean templates, faster generated checks, showcase app, Windows-safe Bun resolution, native Windows diagnostics/setup, Node-compatible CLI/runtime paths, observable verify timeouts, multi-OS Node CI smoke, release packaging smoke, npm alpha publishing, Trusted Publisher/OIDC release wiring, ReadTheDocs-ready public docs, package/version-aligned generator metadata, AST-aware codemods for `extract-action`, `rename field`, and `rename table`, broader field-test automation, and quieter template workspaces are present. Public release hardening is still focused on deeper semantic codemods and more real-project field reports.
+**Status:** private/public alpha MVP, implemented through H42. The core compiler, local runtime, frontend SDK, production auth, RLS compiler, repair/review loops, UI test bridge, guided intent router, full-stack capability map, clean templates, faster generated checks, showcase app, Windows-safe Bun resolution, native Windows diagnostics/setup, Node-compatible CLI/runtime paths, observable verify timeouts, multi-OS Node CI smoke, release packaging smoke, npm alpha publishing, Trusted Publisher/OIDC release wiring, ReadTheDocs-ready public docs, package/version-aligned generator metadata, AST-aware codemods for `extract-action`, `rename command`, `rename field`, and `rename table`, broader field-test automation, and quieter template workspaces are present. Public release hardening is still focused on deeper semantic codemods and more real-project field reports.
 
 Public docs are configured for ReadTheDocs with `.readthedocs.yaml` and `mkdocs.yml`. The local docs entrypoint is `docs/index.md`.
 
@@ -138,7 +138,7 @@ forge.lock
 | Auth | dev headers, JWT, OIDC discovery/JWKS verification via `jose`, production-mode guardrails |
 | RLS | Postgres RLS SQL compiler/checks for DB-enforced tenant isolation |
 | Secrets/env | secret registry, env schema, redaction, strict `process.env` checks |
-| AI | provider registry, `ctx.ai`, mock mode, telemetry without prompt/output retention by default |
+| AI | Vercel AI SDK v6 engine, provider registry, `ctx.ai`, `ctx.agent.run`, `aiTool`, `agent`, `/ai/agents/run` JSON automation, `/ai/agents/chat` UIMessage streaming, `forge ai trace`, mock mode, telemetry without prompt/output retention by default |
 | Frontend | generated client SDK, React/Next hooks, template app, liveQuery client support |
 | LiveQuery | durable invalidation log, reconnect/resume semantics, production hardening checks |
 | Self-host | compose/deploy artifacts and self-host checks |
@@ -214,6 +214,7 @@ Common command groups:
 Refactor codemods are AST-aware where safety matters most:
 
 - `forge refactor extract-action` is binding-aware and preserves unrelated imports, type-only imports, and shadowed locals.
+- `forge refactor rename command <oldName> <newName>` rewrites command declarations, generated client references, React hook usage, tests, and safe string references while preserving unrelated symbols.
 - `forge refactor rename field <table.field> <table.field>` rewrites structured TS/JS/JSX/TSX and JSON references, preserves locals, and scopes the field change to files/objects linked to the target table. For example, `tickets.priority -> tickets.urgency` does not rewrite a generic `priority` prop in a component with no `tickets` binding.
 - `forge refactor rename table <from> <to>` rewrites table definitions, `ctx.db.<table>` access, policy strings, JSON/blueprints, and import/export specifiers while preserving unrelated locals with the same name.
 
@@ -323,7 +324,7 @@ For the first prerelease publish, use the alpha dist-tag explicitly:
 
 ```bash
 npm run release:publish-local-alpha -- --dry-run
-npm run release:publish-local-alpha -- --yes
+npm run release:publish-alpha
 ```
 
 The normal path is:
@@ -346,7 +347,7 @@ Configure npm Trusted Publisher for package `forgeos`:
 | Environment | blank |
 | Allowed action | `npm publish` |
 
-Do not add `NPM_TOKEN` for normal releases. Alpha releases publish with the `alpha` dist-tag so prerelease builds do not become `latest` accidentally. The first manual package creation uses `release:publish-local-alpha`, which publishes from a temporary hardlink-free staging copy and disables provenance because local shells do not have a GitHub OIDC provider. The workflow uses `id-token: write`, Node 24/npm 11+, and provenance for subsequent releases. `npm run release:smoke` runs `npm pack`, creates a fresh app with the packed tarball, installs dependencies, runs `forge dev --once --json`, and verifies the app smoke path.
+Do not add `NPM_TOKEN` for normal releases. Alpha releases publish with the `alpha` dist-tag so prerelease builds do not become `latest` accidentally. Use `release:publish-local-alpha -- --dry-run` only to validate the staged tarball locally; real npm publishing should go through `release:publish-alpha`, which dispatches `publish.yml` and uses npm OIDC Trusted Publisher. The workflow checks whether the package version already exists before installing dependencies or running tests, then uses `id-token: write`, Node 24/npm 11+, and provenance for the actual publish. `npm run release:smoke` runs `npm pack`, creates a fresh app with the packed tarball, installs dependencies, runs `forge dev --once --json`, and verifies the app smoke path.
 
 ## Milestone History
 
@@ -397,7 +398,7 @@ H42  Verify observability and quieter app workspaces
 
 ## Remaining Hardening Before Public Release
 
-- Keep expanding semantic codemods beyond the current AST-aware `extract-action`, `rename field`, and `rename table` paths.
+- Keep expanding semantic codemods beyond the current AST-aware `extract-action`, `rename command`, `rename field`, and `rename table` paths.
 - Reduce command-selection risk with more task routers and richer inline diagnostics.
 - Keep hardening native Windows setup beyond diagnostics and safe automatic environment fixes.
 - Keep broadening package manager CI from template smoke toward install/build smoke for pnpm and yarn apps.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "files": [
@@ -36,6 +36,7 @@
     "release": "changeset publish --tag alpha",
     "release:pack": "npm pack --dry-run",
     "release:smoke": "node scripts/smoke-packed-package.mjs",
+    "release:publish-alpha": "node scripts/publish-trusted-alpha.mjs",
     "release:publish-local-alpha": "node scripts/publish-local-alpha.mjs",
     "field:test": "node scripts/field-test-forgeos.mjs",
     "forge": "node ./bin/forge.mjs",
@@ -72,10 +73,10 @@
     "cli"
   ],
   "dependencies": {
-    "@ai-sdk/anthropic": "^2.0.0",
-    "@ai-sdk/openai": "^2.0.0",
+    "@ai-sdk/anthropic": "^3.0.84",
+    "@ai-sdk/openai": "^3.0.71",
     "@electric-sql/pglite": "^0.2.17",
-    "ai": "^5.0.0",
+    "ai": "^6.0.205",
     "jose": "^6.2.3",
     "postgres": "^3.4.5",
     "react": "^19.2.7",

package/src/forge/_generated/actionSubscriptions.json

@@ -1,2 +1,2 @@
-// @forge-generated generator=0.1.0-alpha.2 input=2ce189e4d3555acfca07eb3bb3d103b22a8da52f3c26f9ac2197254f0563234f content=acdc5e7ef3bf126aac642e289ca64729c6e124dbe669aa972deacba382a889a4
-{"analyzerVersion":"0.1.0","byEvent":{},"diagnostics":[],"generatorVersion":"0.1.0-alpha.2","inputHash":"ad62fe5e04c91b7039f9390867b215a7b923d8091080ed6d32b917134f35ca3f","schemaVersion":"0.1.0","subscriptions":[]}
+// @forge-generated generator=0.1.0-alpha.3 input=c6d07cc92a729a46f2ff02a05c005e7fe0d71a3a5800be6f670a3fca2db04d6f content=2d023951fabe281a316ab0cfb3de2a66b02f8a8f79941d1131bdd5e473bbf07d
+{"analyzerVersion":"0.1.0","byEvent":{},"diagnostics":[],"generatorVersion":"0.1.0-alpha.3","inputHash":"c9475eac5a16004809cb3ec4a8a67a0d6c9a310cb414b8be0200c1f787d021df","schemaVersion":"0.1.0","subscriptions":[]}

package/src/forge/_generated/actionSubscriptions.ts

@@ -1,10 +1,10 @@
-// @forge-generated generator=0.1.0-alpha.2 input=2ce189e4d3555acfca07eb3bb3d103b22a8da52f3c26f9ac2197254f0563234f content=2a4a97bde87d9f63dee60194d5edca3e5e236473bd285fa0b53339f90af03595
+// @forge-generated generator=0.1.0-alpha.3 input=c6d07cc92a729a46f2ff02a05c005e7fe0d71a3a5800be6f670a3fca2db04d6f content=37a3e90789abd2ccddf4a70b82a8d7f377c97475268be530292c8ba1e830e616
 export const actionSubscriptions = {
   "analyzerVersion": "0.1.0",
   "byEvent": {},
   "diagnostics": [],
-  "generatorVersion": "0.1.0-alpha.2",
-  "inputHash": "ad62fe5e04c91b7039f9390867b215a7b923d8091080ed6d32b917134f35ca3f",
+  "generatorVersion": "0.1.0-alpha.3",
+  "inputHash": "c9475eac5a16004809cb3ec4a8a67a0d6c9a310cb414b8be0200c1f787d021df",
   "schemaVersion": "0.1.0",
   "subscriptions": []
 } as const;

package/src/forge/_generated/agentAdapterManifest.json

@@ -1,2 +1,2 @@
-// @forge-generated generator=0.1.0-alpha.2 input=2ce189e4d3555acfca07eb3bb3d103b22a8da52f3c26f9ac2197254f0563234f content=4717cb695b9ac2e3dfe996adfa7b695a273ca4b6f599b19cee51171cce6117c8
-{"generatorVersion":"0.1.0-alpha.2","schemaVersion":"0.1.0","sourceHash":"sha256:0390e7b804b16105ba584cd6c1fdd272f04b118ab9853e0201eca0209ad9e85a","targets":[{"adapterVersion":"agent-adapter-0.1.0","default":true,"files":["AGENTS.md",".forge/agent/context.json",".forge/agent/commands.json",".forge/agent/done-criteria.json",".forge/agent/playbooks/add-command.md",".forge/agent/playbooks/add-query.md",".forge/agent/playbooks/add-livequery.md",".forge/agent/playbooks/add-resource.md",".forge/agent/playbooks/refactor-field.md",".forge/agent/playbooks/fix-policy-denied.md",".forge/agent/playbooks/fix-guard-violation.md",".forge/agent/playbooks/upgrade-package.md",".forge/agent/playbooks/debug-trace.md",".forge/agent/playbooks/frontend-change.md",".forge/agent/playbooks/self-host-check.md"],"formatVersion":"2026-06","name":"generic"},{"adapterVersion":"agent-adapter-0.1.0","files":[".codex/skills/forge-add-command/SKILL.md",".codex/skills/forge-add-resource/SKILL.md",".codex/skills/forge-fix-guard-violation/SKILL.md",".codex/skills/forge-fix-policy-denied/SKILL.md",".codex/skills/forge-upgrade-package/SKILL.md",".codex/skills/forge-debug-trace/SKILL.md",".codex/agents/forge-explorer.toml",".codex/agents/forge-worker.toml",".codex/agents/forge-reviewer.toml",".codex/agents/forge-security.toml"],"formatVersion":"2026-06","name":"codex","optional":true},{"adapterVersion":"agent-adapter-0.1.0","files":[".cursor/rules/forge-runtime.mdc",".cursor/rules/forge-frontend.mdc",".cursor/rules/forge-security.mdc",".cursor/rules/forge-workflow.mdc"],"formatVersion":"2026-06","name":"cursor","optional":true},{"adapterVersion":"agent-adapter-0.1.0","files":["CLAUDE.md",".claude/forge-runtime.md",".claude/forge-playbooks.md",".claude/forge-security.md"],"formatVersion":"2026-06","name":"claude","optional":true}]}
+// @forge-generated generator=0.1.0-alpha.3 input=c6d07cc92a729a46f2ff02a05c005e7fe0d71a3a5800be6f670a3fca2db04d6f content=29b0486d2fbd8fec9b07e00a910ef11bca3ce47cd33374878f81e34a9ddd8a4d
+{"generatorVersion":"0.1.0-alpha.3","schemaVersion":"0.1.0","sourceHash":"sha256:96d8a8d8dbf71b5a8b36a062aa69312aa540fe47ac1a3fc7e03c49befc428a30","targets":[{"adapterVersion":"agent-adapter-0.1.0","default":true,"files":["AGENTS.md",".forge/agent/context.json",".forge/agent/commands.json",".forge/agent/done-criteria.json",".forge/agent/playbooks/add-command.md",".forge/agent/playbooks/add-query.md",".forge/agent/playbooks/add-livequery.md",".forge/agent/playbooks/add-resource.md",".forge/agent/playbooks/refactor-field.md",".forge/agent/playbooks/fix-policy-denied.md",".forge/agent/playbooks/fix-guard-violation.md",".forge/agent/playbooks/upgrade-package.md",".forge/agent/playbooks/debug-trace.md",".forge/agent/playbooks/frontend-change.md",".forge/agent/playbooks/self-host-check.md"],"formatVersion":"2026-06","name":"generic"},{"adapterVersion":"agent-adapter-0.1.0","files":[".codex/skills/forge-add-command/SKILL.md",".codex/skills/forge-add-resource/SKILL.md",".codex/skills/forge-fix-guard-violation/SKILL.md",".codex/skills/forge-fix-policy-denied/SKILL.md",".codex/skills/forge-upgrade-package/SKILL.md",".codex/skills/forge-debug-trace/SKILL.md",".codex/agents/forge-explorer.toml",".codex/agents/forge-worker.toml",".codex/agents/forge-reviewer.toml",".codex/agents/forge-security.toml"],"formatVersion":"2026-06","name":"codex","optional":true},{"adapterVersion":"agent-adapter-0.1.0","files":[".cursor/rules/forge-runtime.mdc",".cursor/rules/forge-frontend.mdc",".cursor/rules/forge-security.mdc",".cursor/rules/forge-workflow.mdc"],"formatVersion":"2026-06","name":"cursor","optional":true},{"adapterVersion":"agent-adapter-0.1.0","files":["CLAUDE.md",".claude/forge-runtime.md",".claude/forge-playbooks.md",".claude/forge-security.md"],"formatVersion":"2026-06","name":"claude","optional":true}]}

package/src/forge/_generated/agentAdapterManifest.ts

@@ -1,8 +1,8 @@
-// @forge-generated generator=0.1.0-alpha.2 input=2ce189e4d3555acfca07eb3bb3d103b22a8da52f3c26f9ac2197254f0563234f content=d18d0ebcec10f4f027c0a871b84c88cbeb80e20b4115999a7fb9abe947015b0b
+// @forge-generated generator=0.1.0-alpha.3 input=c6d07cc92a729a46f2ff02a05c005e7fe0d71a3a5800be6f670a3fca2db04d6f content=5fa75085c83aafc4d227978e3aeb555c16cfea75584c57fc75de474b2f230d5a
 export const agentAdapterManifest = {
-  "generatorVersion": "0.1.0-alpha.2",
+  "generatorVersion": "0.1.0-alpha.3",
   "schemaVersion": "0.1.0",
-  "sourceHash": "sha256:0390e7b804b16105ba584cd6c1fdd272f04b118ab9853e0201eca0209ad9e85a",
+  "sourceHash": "sha256:96d8a8d8dbf71b5a8b36a062aa69312aa540fe47ac1a3fc7e03c49befc428a30",
   "targets": [
     {
       "adapterVersion": "agent-adapter-0.1.0",