forgeos 0.1.0-alpha.31 → 0.1.0-alpha.33

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.31 input=ffdf0fea34e4880fa5215aaef174878f8b3e824def735dec6040c8a7502c4ae4 content=0d493cf0e41b71cb652d5e0e1b0c1f83d2a1281b748321f0b00f0773ba93074e
+// @forge-generated generator=0.1.0-alpha.33 input=618472d83d84f1f735eeaaec13559692c94a492c7f592b20882b5ebac7a1c378 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->
@@ -205,8 +205,8 @@ node bin/forge.mjs do verify --json
 Use:
 
 ```bash
-node bin/forge.mjs make resource <name> --fields title:text,status:enum(open,closed) --dry-run --json
-node bin/forge.mjs make resource <name> --fields title:text,status:enum(open,closed) --with-ui --yes
+node bin/forge.mjs make resource <name> --fields title:text,status:enum=open+closed --dry-run --json
+node bin/forge.mjs make resource <name> --fields title:text,status:enum=open+closed --with-ui --yes
 node bin/forge.mjs make ui --framework vite --dry-run --json
 node bin/forge.mjs make ui --framework nuxt --dry-run --json
 node bin/forge.mjs make ai-chat support --dry-run --json

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # forgeos
 
+## 0.1.0-alpha.33
+
+### Patch Changes
+
+- Fix the Nuxt template smoke by adding the explicit `vue-tsc` dev dependency
+  required by `nuxt typecheck`, so newly scaffolded `nuxt-web` apps can run
+  `npm run typecheck` after install without manual package repair.
+
+## 0.1.0-alpha.32
+
+### Patch Changes
+
+- Harden the alpha field-test loop after real Codex, WorkOS, PGlite, and app-server exercises.
+
+  - Accept `create-forgeos-app --git` as a supported/no-op compatibility flag when git initialization is already handled by the scaffold path, and keep `npm create forgeos-app@alpha .` working from empty current directories.
+  - Reject schema definitions that try to model `id` as a normal text field so generated SQL cannot silently create the wrong primary-key shape.
+  - Fix tenant-scoped updates in the in-memory database adapter and bring memory timestamp behavior closer to PGlite by rejecting empty timestamp strings and returning `Date` objects for timestamp columns.
+  - Improve smoke/generate drift diagnostics and keep `forge handoff` read-only with respect to generated artifacts.
+  - Copy generated WorkOS seed data to a root-level `workos-seed.yml` for app DX, serve `HEAD /auth.md` and `HEAD /.well-known/oauth-protected-resource`, and make local-vs-production auth posture more explicit.
+  - Normalize suggested Forge commands in framework checkouts so `agent`, `delta`, `studio`, `status`, `changed`, `handoff`, doctors, and WorkOS/auth helpers recommend `node bin/forge.mjs ...` instead of a possibly stale global `forge`.
+  - Return structured JSON diagnostics for Delta/PGlite export/open failures instead of leaking raw PGlite stack output, and improve Windows/PGlite repair guidance.
+  - Expand `forge ui audit` with static UX/auth-readiness warnings for missing semantic landmarks, unlabeled form controls, unnamed buttons, missing loading/error/empty states, and tenant/prod-auth apps that still only show local dev auth posture.
+
 ## 0.1.0-alpha.31
 
 ### Patch Changes
@@ -10,6 +33,10 @@
   - Add `forge auth status` and production-focused `forge auth prove --prod` output so `dev-headers` is clearly labeled as local-only while JWT/OIDC proofs show production auth posture.
   - Expand `forge doctor windows` with local PGlite store posture and cleanup guidance, including safer PGlite abort inspection that does not poison the surrounding process exit code.
   - Add `forge ui audit` and run it during `forge verify --smoke` when a web app is present, catching missing UI scenarios, missing stable Forge test IDs, and missing policy-denied coverage for sensitive routes.
+  - Expand `forge ui audit` with static UX/auth-readiness warnings for missing semantic landmarks, unlabeled form controls, unnamed buttons, missing loading/error/empty states, and tenant/prod-auth apps that still only show local dev auth posture.
+  - Bring the in-memory DB adapter closer to PGlite for timestamp fields by rejecting empty timestamp values and returning `Date` objects for `timestamp`/`timestamptz` columns.
+  - Make `forge handoff` use a read-only generated-artifact check so preparing a handoff no longer rewrites `src/forge/_generated/**`, `forge.lock`, or generated `AGENTS.md` noise; `forge dev --once` still self-heals stale artifacts.
+  - Allow `forge new .` / `npm create forgeos-app@alpha .` from an empty current directory, while refusing non-empty directories to avoid overwriting existing apps.
 
 ## 0.1.0-alpha.30
 

package/docs/changelog.md

@@ -6,6 +6,38 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.33
+
+- Fixed the Nuxt template smoke by adding the explicit `vue-tsc` dev
+  dependency required by `nuxt typecheck`, so newly scaffolded `nuxt-web` apps
+  can run `npm run typecheck` after install without manual package repair.
+
+## 0.1.0-alpha.32
+
+- Accepted `create-forgeos-app --git` as a supported/no-op compatibility flag
+  when git initialization is already handled by the scaffold path, and kept
+  `npm create forgeos-app@alpha .` working from empty current directories.
+- Added stronger schema validation for `id` so apps cannot accidentally model
+  the primary key as a normal text field and generate incorrect SQL.
+- Fixed tenant-scoped updates in the in-memory database adapter and made memory
+  timestamp handling closer to PGlite by rejecting empty timestamp strings and
+  returning `Date` objects for timestamp columns.
+- Improved smoke/generate drift diagnostics and kept `forge handoff` read-only
+  with respect to generated artifacts.
+- Improved WorkOS/auth app DX: root-level `workos-seed.yml`, `HEAD /auth.md`,
+  `HEAD /.well-known/oauth-protected-resource`, and clearer local-vs-production
+  auth posture.
+- Normalized suggested Forge commands in framework checkouts so `agent`,
+  `delta`, `studio`, `status`, `changed`, `handoff`, doctors, and WorkOS/auth
+  helpers recommend `node bin/forge.mjs ...` instead of a possibly stale global
+  `forge`.
+- Returned structured JSON diagnostics for Delta/PGlite export/open failures
+  instead of raw PGlite stack output, and expanded Windows/PGlite repair hints.
+- Expanded `forge ui audit` with static UX/auth-readiness warnings for missing
+  semantic landmarks, unlabeled form controls, unnamed buttons, missing
+  loading/error/empty states, and tenant/prod-auth apps that still only expose
+  local dev auth posture.
+
 ## 0.1.0-alpha.31
 
 - Added Forge workspace baselines for non-git app directories:
@@ -20,7 +52,20 @@ The canonical source file in the repository is `CHANGELOG.md`.
   exit code.
 - Added `forge ui audit` and wired it into `forge verify --smoke` for web apps
   to catch missing route scenarios, missing stable Forge test IDs, and missing
-  policy-denied coverage for sensitive flows.
+  policy-denied coverage for sensitive flows. It now also reports static
+  UX/auth-readiness warnings for missing semantic landmarks, unlabeled form
+  controls, unnamed buttons, missing loading/error/empty states, and
+  tenant/prod-auth apps that still only expose local dev auth posture.
+- Brought the in-memory DB adapter closer to PGlite for timestamp fields by
+  rejecting empty timestamp values and returning `Date` objects for
+  `timestamp`/`timestamptz` columns.
+- Made `forge handoff` use a read-only generated-artifact check so preparing a
+  handoff no longer rewrites `src/forge/_generated/**`, `forge.lock`, or
+  generated `AGENTS.md` noise; `forge dev --once` still self-heals stale
+  artifacts.
+- Allowed `forge new .` / `npm create forgeos-app@alpha .` from an empty
+  current directory, while refusing non-empty directories to avoid overwriting
+  existing apps.
 
 ## 0.1.0-alpha.30
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.31",
+  "version": "0.1.0-alpha.33",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.31","releaseId":"forgeos@0.1.0-alpha.31+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.33","releaseId":"forgeos@0.1.0-alpha.33+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.31 input=ffdf0fea34e4880fa5215aaef174878f8b3e824def735dec6040c8a7502c4ae4 content=806e4e7f20264628107bf964331f13335175f065d6a8826b5defc2027d8047cd
+// @forge-generated generator=0.1.0-alpha.33 input=618472d83d84f1f735eeaaec13559692c94a492c7f592b20882b5ebac7a1c378 content=2cfb24f552edc1fade82dc4abca3f6085ae94a0ac9ae70f5b0cffab11c1c3e7c
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.31",
-  "releaseId": "forgeos@0.1.0-alpha.31+unknown",
+  "packageVersion": "0.1.0-alpha.33",
+  "releaseId": "forgeos@0.1.0-alpha.33+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/agent-adapters/index.ts

@@ -56,6 +56,7 @@ import {
 } from "../agent-memory/hook-runner.ts";
 import { releaseManifest } from "../_generated/releaseManifest.ts";
 import { runDevConsoleCycle } from "../dev-console/cycle.ts";
+import { normalizeForgeCliCommandsInValue } from "../workspace/forge-cli.ts";
 
 export const AGENT_ADAPTER_VERSION = "agent-adapter-0.1.0";
 export const AGENT_FORMAT_VERSION = "2026-06";
@@ -77,6 +78,25 @@ function diagnostic(
   return createDiagnostic({ severity, code, message, ...(file ? { file } : {}) });
 }
 
+function normalizeAgentCliCommandHints<T>(workspaceRoot: string, result: T): T {
+  if (!result || typeof result !== "object") {
+    return result;
+  }
+  const value = result as Record<string, unknown>;
+  const normalized: Record<string, unknown> = { ...value };
+  for (const key of ["nextActions", "diagnostics", "commands", "checks", "steps"]) {
+    if (key in normalized) {
+      normalized[key] = normalizeForgeCliCommandsInValue(workspaceRoot, normalized[key], key);
+    }
+  }
+  for (const key of ["installResult", "ingestResult"]) {
+    if (key in normalized) {
+      normalized[key] = normalizeAgentCliCommandHints(workspaceRoot, normalized[key]);
+    }
+  }
+  return normalized as T;
+}
+
 function readText(workspaceRoot: string, relative: string): string | null {
   const path = join(workspaceRoot, relative);
   if (!nodeFileSystem.exists(path)) {
@@ -2222,9 +2242,11 @@ export async function runAgentHooksSmoke(options: AgentCommandOptions): Promise<
   };
 }
 
-export async function runAgentCommand(options: AgentCommandOptions): Promise<
+type AgentCommandResult =
   AgentExportResult | AgentCheckResult | AgentTargetsResult | AgentPrintContextResult | AgentDoctorResult | AgentPrepareResult | AgentOnboardResult | AgentHooksSmokeResult | AgentHooksStatusResult | AgentTimelineResult | AgentMemoryCommandResult
-> {
+;
+
+async function runAgentCommandRaw(options: AgentCommandOptions): Promise<AgentCommandResult> {
   if (options.subcommand === "list-targets") {
     return runAgentListTargets(options.workspaceRoot);
   }
@@ -2295,6 +2317,10 @@ export async function runAgentCommand(options: AgentCommandOptions): Promise<
   };
 }
 
+export async function runAgentCommand(options: AgentCommandOptions): Promise<AgentCommandResult> {
+  return normalizeAgentCliCommandHints(options.workspaceRoot, await runAgentCommandRaw(options));
+}
+
 export function formatAgentJson(result: Awaited<ReturnType<typeof runAgentCommand>>): string {
   if ("timeline" in result && result.timeline === "agent") {
     return `${JSON.stringify(result, null, 2)}\n`;

package/src/forge/cli/auth.ts

@@ -9,6 +9,9 @@ import { mapClaimsToAuthContext } from "../runtime/auth/claims.ts";
 import { ForgeAuthError } from "../runtime/auth/errors.ts";
 import { verifyJwtToken } from "../runtime/auth/verifier.ts";
 import { loadSecretRegistry } from "../runtime/secrets/check.ts";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { normalizeForgeCliCommandsInValue } from "../workspace/forge-cli.ts";
 
 export type AuthSubcommand = "check" | "config" | "decode" | "test-token" | "jwks" | "prove" | "status";
 
@@ -18,6 +21,7 @@ export interface AuthCommandOptions {
   json: boolean;
   token?: string;
   prod?: boolean;
+  scenario?: string;
 }
 
 export interface AuthCommandResult {
@@ -88,7 +92,7 @@ function buildAuthPosture(workspaceRoot: string) {
   const productionMode = config.mode === "jwt" || config.mode === "oidc";
   const errors = configErrors(config);
   const configReady = errors.length === 0;
-  return {
+  return normalizeForgeCliCommandsInValue(workspaceRoot, {
     schemaVersion: "0.1.0",
     mode: config.mode,
     localOnly: config.mode === "dev-headers",
@@ -96,6 +100,15 @@ function buildAuthPosture(workspaceRoot: string) {
     requiresTenant: config.requiresTenant,
     bearerHeader: productionMode ? "Authorization: Bearer <token>" : null,
     tenantClaim: config.claims.tenantId ?? "tenant_id",
+    productionChecklist: [
+      { item: "auth mode is jwt or oidc", ok: productionMode },
+      { item: "FORGE_AUTH_ISSUER configured", ok: Boolean(config.issuer) },
+      { item: "FORGE_AUTH_AUDIENCE configured", ok: Boolean(config.audience) },
+      { item: "FORGE_AUTH_JWKS_URI or OIDC discovery configured", ok: config.mode === "oidc" || Boolean(config.jwksUri) },
+      { item: "tenant claim mapped", ok: Boolean(config.claims.tenantId) },
+      { item: "permission claim mapped", ok: Boolean(config.claims.permissions) },
+      { item: "dev-headers disabled for public runtime", ok: config.mode !== "dev-headers" },
+    ],
     reason: productionMode
       ? configReady
         ? "jwt/oidc production auth configuration is present"
@@ -106,7 +119,58 @@ function buildAuthPosture(workspaceRoot: string) {
         ? ["forge auth prove --prod --token <jwt> --json", "forge serve --json"]
         : ["forge auth check --json", "configure FORGE_AUTH_ISSUER, FORGE_AUTH_AUDIENCE, and FORGE_AUTH_JWKS_URI or OIDC issuer"]
       : ["set FORGE_AUTH_MODE=jwt or oidc for production", "forge auth prove --prod --token <jwt> --json"],
-  };
+  });
+}
+
+function buildMultiTenantProof(workspaceRoot: string, workos: ReturnType<typeof detectWorkOS>, requiresTenant: boolean) {
+  const rootSeedPresent = existsSync(join(workspaceRoot, "workos-seed.yml"));
+  const generatedSeedPresent = existsSync(join(workspaceRoot, "src/forge/_generated/integrations/workos/workos-seed.yml"));
+  const authMdPresent = existsSync(join(workspaceRoot, "public/auth.md"));
+  const metadataPresent = existsSync(join(workspaceRoot, "public/.well-known/oauth-protected-resource"));
+  const permissions = ["onboarding:read", "invitations:create", "tasks:update"];
+  const permissionVocabularyPresent = workos.detected && workos.claimStatus.some((claim) => claim.name === "permissions" && claim.ok);
+  const checks = [
+    {
+      id: "tenant-claim",
+      ok: requiresTenant && workos.claimStatus.some((claim) => claim.name === "tenantId" && claim.ok),
+      evidence: "Forge tenant claim maps to WorkOS organization_id and tenant auth is required.",
+    },
+    {
+      id: "permission-claim",
+      ok: permissionVocabularyPresent,
+      evidence: "Forge permissions claim maps to WorkOS permissions.",
+    },
+    {
+      id: "seed-organizations",
+      ok: rootSeedPresent || generatedSeedPresent,
+      evidence: rootSeedPresent ? "workos-seed.yml exists at app root." : "generated WorkOS seed exists.",
+    },
+    {
+      id: "agent-auth-metadata",
+      ok: authMdPresent && metadataPresent,
+      evidence: "public/auth.md and protected resource metadata are present.",
+    },
+  ];
+  return normalizeForgeCliCommandsInValue(workspaceRoot, {
+    scenario: "multi-tenant",
+    ok: checks.every((check) => check.ok),
+    claims: {
+      acme: { organization_id: "org_acme", role: "owner", permissions },
+      globex: { organization_id: "org_globex", role: "member", permissions: ["onboarding:read", "tasks:update"] },
+    },
+    invariants: [
+      "Acme and Globex must use different organization_id claim values.",
+      "Tenant-scoped reads must include the active organization_id.",
+      "Tenant-scoped writes must verify the resource tenant before mutation.",
+      "Role-only UI affordances are not sufficient; policies must use permissions/claims.",
+    ],
+    checks,
+    nextActions: [
+      "forge workos doctor --json",
+      "forge workos seed --file workos-seed.yml --dry-run --json",
+      "run an HTTP E2E with Acme and Globex tokens before production",
+    ],
+  });
 }
 
 function validateConfig(workspaceRoot: string): AuthCommandResult {
@@ -258,8 +322,12 @@ export async function runAuthCommand(
           ? tokenProof.error
           : undefined;
     const proofOk = checked.ok && (!options.prod || (productionMode && tokenProof?.ok === true));
+    const multiTenantProof = options.scenario === "multi-tenant"
+      ? buildMultiTenantProof(options.workspaceRoot, workos, config.requiresTenant)
+      : null;
+    const scenarioOk = !multiTenantProof || multiTenantProof.ok;
     return {
-      ok: proofOk,
+      ok: proofOk && scenarioOk,
       mode: config.mode,
       data: {
         schemaVersion: "0.1.0",
@@ -268,8 +336,10 @@ export async function runAuthCommand(
         mode: config.mode,
         productionReady: productionMode && checked.ok,
         prod: options.prod === true,
+        scenario: options.scenario ?? null,
         authPosture: posture,
         ...(tokenProof ? { tokenProof: tokenProof.ok ? tokenProof.data : tokenProof.error } : {}),
+        ...(multiTenantProof ? { multiTenantProof } : {}),
         invariants: [
           {
             id: "INV-001",
@@ -305,7 +375,7 @@ export async function runAuthCommand(
         checkedAt: "deterministic",
       },
       error: prodError ?? checked.error,
-      exitCode: proofOk ? 0 : 1,
+      exitCode: proofOk && scenarioOk ? 0 : 1,
     };
   }
   if (options.subcommand === "config") {

package/src/forge/cli/changed.ts

@@ -4,6 +4,7 @@ import {
   filterCategorizedSummary,
   summarizeChangeTypes,
 } from "../workspace/change-summary.ts";
+import { forgeCliCommandsForWorkspace } from "../workspace/forge-cli.ts";
 import { buildWorkspaceGitSummary, type WorkspaceGitSummary } from "../workspace/git-summary.ts";
 
 export interface ChangedCommandResult {
@@ -44,6 +45,7 @@ interface GeneratedChangeExplanation {
 }
 
 const AUTHORED_CHANGE_TYPES = ["source", "tests", "docs", "config", "assets", "other"] as const;
+const REVIEW_CHANGE_TYPES = ["source", "tests", "docs", "config", "assets"] as const;
 
 function emptyCategory(summary: CategorizedFileSummary, category: keyof CategorizedFileSummary["byType"]): boolean {
   return summary.byType[category].count === 0;
@@ -102,10 +104,16 @@ function buildRisks(git: WorkspaceGitSummary): string[] {
   if (!emptyCategory(changed, "generated") && humanChanges.total === 0) {
     risks.push("only generated artifacts changed; verify the source edit, generator input, or intentional regeneration that produced them");
   }
+  return risks;
+}
+
+function buildAdvisories(git: WorkspaceGitSummary): string[] {
+  const advisories: string[] = [];
+  const changed = git.changeSummary.changed;
   if (changed.total.count > 50) {
-    risks.push(`${changed.total.count} changed file(s) detected; use the grouped summaries before reviewing raw diffs`);
+    advisories.push(`${changed.total.count} changed file(s) detected; use grouped summaries before reviewing raw diffs`);
   }
-  return risks;
+  return advisories;
 }
 
 function buildRecommendedCommands(git: WorkspaceGitSummary): string[] {
@@ -127,7 +135,12 @@ function buildRecommendedCommands(git: WorkspaceGitSummary): string[] {
       "forge generate --check --json",
     ];
   }
+  const authoredGeneratedInputs =
+    changed.byType.source.count +
+    changed.byType.config.count +
+    changed.byType.operational.count;
   return [
+    ...(authoredGeneratedInputs > 0 ? ["forge generate --check --json"] : []),
     "forge handoff --json",
     "forge test plan --changed --json",
     "forge verify --changed",
@@ -189,7 +202,7 @@ function buildGeneratedChangeExplanation(
   };
 }
 
-export function runChangedCommand(workspaceRoot: string, options: { authoredOnly?: boolean } = {}): ChangedCommandResult {
+export function runChangedCommand(workspaceRoot: string, options: { authoredOnly?: boolean; reviewOnly?: boolean } = {}): ChangedCommandResult {
   const git = buildWorkspaceGitSummary(workspaceRoot);
   const changed = git.changeSummary.changed;
   const humanChanges = selectHumanChangeSummary(changed);
@@ -198,16 +211,25 @@ export function runChangedCommand(workspaceRoot: string, options: { authoredOnly
   const authoredStaged = filterCategorizedSummary(git.changeSummary.staged, [...AUTHORED_CHANGE_TYPES]);
   const authoredUnstaged = filterCategorizedSummary(git.changeSummary.unstaged, [...AUTHORED_CHANGE_TYPES]);
   const authoredUntracked = filterCategorizedSummary(git.changeSummary.untracked, [...AUTHORED_CHANGE_TYPES]);
-  const viewHumanChanges = options.authoredOnly ? selectHumanChangeSummary(authoredChanged) : humanChanges;
-  const viewChanged = options.authoredOnly ? authoredChanged : changed;
-  const viewStaged = options.authoredOnly ? authoredStaged : git.changeSummary.staged;
-  const viewUnstaged = options.authoredOnly ? authoredUnstaged : git.changeSummary.unstaged;
-  const viewUntracked = options.authoredOnly ? authoredUntracked : git.changeSummary.untracked;
-  const viewDerivedChanges: DerivedChangeSummary = options.authoredOnly
+  const reviewChanged = filterCategorizedSummary(changed, [...REVIEW_CHANGE_TYPES]);
+  const reviewStaged = filterCategorizedSummary(git.changeSummary.staged, [...REVIEW_CHANGE_TYPES]);
+  const reviewUnstaged = filterCategorizedSummary(git.changeSummary.unstaged, [...REVIEW_CHANGE_TYPES]);
+  const reviewUntracked = filterCategorizedSummary(git.changeSummary.untracked, [...REVIEW_CHANGE_TYPES]);
+  const viewHumanChanges = options.reviewOnly
+    ? selectHumanChangeSummary(reviewChanged)
+    : options.authoredOnly
+      ? selectHumanChangeSummary(authoredChanged)
+      : humanChanges;
+  const viewChanged = options.reviewOnly ? reviewChanged : options.authoredOnly ? authoredChanged : changed;
+  const viewStaged = options.reviewOnly ? reviewStaged : options.authoredOnly ? authoredStaged : git.changeSummary.staged;
+  const viewUnstaged = options.reviewOnly ? reviewUnstaged : options.authoredOnly ? authoredUnstaged : git.changeSummary.unstaged;
+  const viewUntracked = options.reviewOnly ? reviewUntracked : options.authoredOnly ? authoredUntracked : git.changeSummary.untracked;
+  const viewDerivedChanges: DerivedChangeSummary = options.authoredOnly || options.reviewOnly
     ? { total: 0, generated: { count: 0, sample: [], hidden: 0 } }
     : derivedChanges;
   const risks = buildRisks(git);
-  const recommendedCommands = buildRecommendedCommands(git);
+  const advisories = buildAdvisories(git);
+  const recommendedCommands = forgeCliCommandsForWorkspace(workspaceRoot, buildRecommendedCommands(git));
   const reviewFocus = buildReviewFocus(viewHumanChanges, viewDerivedChanges);
   const generatedExplanation = buildGeneratedChangeExplanation(viewHumanChanges, viewDerivedChanges);
   const diffPlan: DiffPlan = buildDiffPlanFromChangeSummary(viewChanged);
@@ -223,7 +245,7 @@ export function runChangedCommand(workspaceRoot: string, options: { authoredOnly
         commit: git.commit,
         workspaceMode: git.workspaceMode ?? (git.available ? "git" : "nonGit"),
         tracking: git.tracking ?? git.source,
-        view: options.authoredOnly ? "authored" : "all",
+        view: options.reviewOnly ? "review" : options.authoredOnly ? "authored" : "all",
         changedFiles: viewChanged.total.count,
         humanFiles: viewHumanChanges.total,
         generatedFiles: viewDerivedChanges.total,
@@ -253,6 +275,7 @@ export function runChangedCommand(workspaceRoot: string, options: { authoredOnly
       generatedExplanation,
       diffPlan,
       risks,
+      advisories,
       recommendedCommands,
       nextActions: recommendedCommands,
     },
@@ -268,6 +291,7 @@ export function formatChangedHuman(result: ChangedCommandResult): string {
   const generatedExplanation = result.data.generatedExplanation as { summary?: string } | undefined;
   const diffPlan = result.data.diffPlan as { summary?: string; authoredDiffCommand?: string; generatedDiffCommand?: string; generatedCollapsedByDefault?: boolean } | undefined;
   const risks = (result.data.risks as string[] | undefined) ?? [];
+  const advisories = (result.data.advisories as string[] | undefined) ?? [];
   const nextActions = (result.data.nextActions as string[] | undefined) ?? [];
   const lines = [
     `Forge changed: ${result.ok ? "ready" : "git unavailable"}`,
@@ -310,6 +334,9 @@ export function formatChangedHuman(result: ChangedCommandResult): string {
   if (risks.length > 0) {
     lines.push("", "Risks:", ...risks.map((risk) => `  ${risk}`));
   }
+  if (advisories.length > 0) {
+    lines.push("", "Notes:", ...advisories.map((advisory) => `  ${advisory}`));
+  }
 
   lines.push("", "Next:", ...nextActions.map((command) => `  ${command}`));
   return `${lines.join("\n")}\n`;