forgeos 0.1.0-alpha.33 → 0.1.0-alpha.34

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.33 input=618472d83d84f1f735eeaaec13559692c94a492c7f592b20882b5ebac7a1c378 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.34 input=ce9cf8b6c553d7de8113eb2a388d269cb8c90d4bb15c013a7ab907ef207619b9 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # forgeos
 
+## 0.1.0-alpha.34
+
+### Patch Changes
+
+- Harden the ForgeOS app-building DX after the Vendor Access field test.
+
+  - Make `forge workos doctor` and `forge workos seed --dry-run` app-aware by deriving active permissions and resource types from generated policies, data graph, agent contract, authored WorkOS policies, and `workos-seed.yml` instead of assuming onboarding-specific slugs.
+  - Add strong diagnostics for unnamed runtime default exports so `export default command(...)` reports `FORGE_RUNTIME_EXPORT_NAME_REQUIRED` with a named-export fix hint before generated API, frontend bindings, or capability maps drift.
+  - Extend local `devAuth` for React, Vue, generated clients, and runtime auth parsing with WorkOS-like `permissions`, `roles`, `claims`, `organizationId`, and `organizationMembershipId`.
+  - Add nullable timestamp schema support through `timestamp?` / `nullable("timestamp")` and teach `forge check` to flag empty timestamp literals in commands, queries, and liveQueries.
+  - Add `forge dev --detach`, `forge dev status`, `forge dev stop`, and command-specific `forge dev --help` with explicit DB/port examples for agent-run app previews.
+  - Add `forge changed --commit-ready` and `forge handoff --commit-ready` so agents can stage exactly authored commit files while excluding generated and operational artifacts.
+  - Add `forge test authz` for a cheap generated-contract proof of tenant scope, policy bindings, and capability-map authz coverage.
+  - Expose static UI/UX readiness through `forge inspect ui --ergonomics`.
+
 ## 0.1.0-alpha.33
 
 ### Patch Changes

package/docs/changelog.md

@@ -6,6 +6,33 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.34
+
+- Hardened the ForgeOS app-building DX after the Vendor Access field test.
+- Made `forge workos doctor` and `forge workos seed --dry-run` app-aware by
+  deriving active permissions and resource types from generated policies, data
+  graph, agent contract, authored WorkOS policies, and `workos-seed.yml`
+  instead of assuming onboarding-specific slugs.
+- Added strong diagnostics for unnamed runtime default exports so
+  `export default command(...)` reports `FORGE_RUNTIME_EXPORT_NAME_REQUIRED`
+  with a named-export fix hint before generated API, frontend bindings, or
+  capability maps drift.
+- Extended local `devAuth` for React, Vue, generated clients, and runtime auth
+  parsing with WorkOS-like `permissions`, `roles`, `claims`, `organizationId`,
+  and `organizationMembershipId`.
+- Added nullable timestamp schema support through `timestamp?` /
+  `nullable("timestamp")` and taught `forge check` to flag empty timestamp
+  literals in commands, queries, and liveQueries.
+- Added `forge dev --detach`, `forge dev status`, `forge dev stop`, and
+  command-specific `forge dev --help` with explicit DB/port examples for
+  agent-run app previews.
+- Added `forge changed --commit-ready` and `forge handoff --commit-ready` so
+  agents can stage exactly authored commit files while excluding generated and
+  operational artifacts.
+- Added `forge test authz` for a cheap generated-contract proof of tenant
+  scope, policy bindings, and capability-map authz coverage.
+- Exposed static UI/UX readiness through `forge inspect ui --ergonomics`.
+
 ## 0.1.0-alpha.33
 
 - Fixed the Nuxt template smoke by adding the explicit `vue-tsc` dev

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.33",
+  "version": "0.1.0-alpha.34",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.33","releaseId":"forgeos@0.1.0-alpha.33+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.34","releaseId":"forgeos@0.1.0-alpha.34+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.33 input=618472d83d84f1f735eeaaec13559692c94a492c7f592b20882b5ebac7a1c378 content=2cfb24f552edc1fade82dc4abca3f6085ae94a0ac9ae70f5b0cffab11c1c3e7c
+// @forge-generated generator=0.1.0-alpha.34 input=ce9cf8b6c553d7de8113eb2a388d269cb8c90d4bb15c013a7ab907ef207619b9 content=1a3f239bc322349796830461349167bb154a27e57fb1f10868c788194b3be97e
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.33",
-  "releaseId": "forgeos@0.1.0-alpha.33+unknown",
+  "packageVersion": "0.1.0-alpha.34",
+  "releaseId": "forgeos@0.1.0-alpha.34+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/changed.ts

@@ -1,11 +1,18 @@
+import { spawnSync } from "node:child_process";
 import type { CategorizedFileSummary, DiffPlan } from "../workspace/change-summary.ts";
 import {
   buildDiffPlanFromChangeSummary,
+  categorizeFiles,
   filterCategorizedSummary,
   summarizeChangeTypes,
 } from "../workspace/change-summary.ts";
 import { forgeCliCommandsForWorkspace } from "../workspace/forge-cli.ts";
-import { buildWorkspaceGitSummary, type WorkspaceGitSummary } from "../workspace/git-summary.ts";
+import {
+  buildWorkspaceGitSummary,
+  listWorkspaceFiles,
+  workspaceChangeClassifier,
+  type WorkspaceGitSummary,
+} from "../workspace/git-summary.ts";
 
 export interface ChangedCommandResult {
   ok: boolean;
@@ -148,6 +155,89 @@ function buildRecommendedCommands(git: WorkspaceGitSummary): string[] {
   ];
 }
 
+function parseStatusPath(line: string): string {
+  const raw = line.slice(2).trimStart();
+  const renamed = raw.split(" -> ");
+  return (renamed[renamed.length - 1] ?? raw).replace(/\\/g, "/");
+}
+
+function gitStatusFiles(workspaceRoot: string): {
+  changed: string[];
+  staged: string[];
+  unstaged: string[];
+  untracked: string[];
+} | null {
+  const result = spawnSync("git", ["status", "--porcelain=v1", "-uall"], {
+    cwd: workspaceRoot,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  if (result.status !== 0) {
+    return null;
+  }
+  const staged = new Set<string>();
+  const unstaged = new Set<string>();
+  const untracked = new Set<string>();
+  for (const line of result.stdout.split(/\r?\n/).filter(Boolean)) {
+    const x = line[0] ?? " ";
+    const y = line[1] ?? " ";
+    const file = parseStatusPath(line);
+    if (x === "?" && y === "?") {
+      untracked.add(file);
+      continue;
+    }
+    if (x !== " ") {
+      staged.add(file);
+    }
+    if (y !== " ") {
+      unstaged.add(file);
+    }
+  }
+  return {
+    changed: [...new Set([...staged, ...unstaged, ...untracked])].sort(),
+    staged: [...staged].sort(),
+    unstaged: [...unstaged].sort(),
+    untracked: [...untracked].sort(),
+  };
+}
+
+function isCommitReadyPath(file: string): boolean {
+  const lower = file.replace(/\\/g, "/").replace(/^\.\//, "").toLowerCase();
+  return !(
+    lower.startsWith(".forge/") ||
+    lower.startsWith(".codex/") ||
+    lower.startsWith("src/forge/_generated/") ||
+    lower === "forge.lock" ||
+    lower.endsWith("/forge.lock")
+  );
+}
+
+function commitReadySummary(workspaceRoot: string): {
+  changed: CategorizedFileSummary;
+  staged: CategorizedFileSummary;
+  unstaged: CategorizedFileSummary;
+  untracked: CategorizedFileSummary;
+  files: string[];
+} {
+  const classifier = workspaceChangeClassifier(workspaceRoot);
+  const status = gitStatusFiles(workspaceRoot) ?? {
+    changed: listWorkspaceFiles(workspaceRoot),
+    staged: [],
+    unstaged: [],
+    untracked: listWorkspaceFiles(workspaceRoot),
+  };
+  const filter = (files: string[]) =>
+    files.filter((file) => isCommitReadyPath(file) && !["generated", "operational"].includes(classifier(file)));
+  const changed = filter(status.changed);
+  return {
+    changed: categorizeFiles(changed, 12, classifier),
+    staged: categorizeFiles(filter(status.staged), 12, classifier),
+    unstaged: categorizeFiles(filter(status.unstaged), 12, classifier),
+    untracked: categorizeFiles(filter(status.untracked), 12, classifier),
+    files: changed,
+  };
+}
+
 function buildReviewFocus(humanChanges: HumanChangeSummary, derivedChanges: DerivedChangeSummary): ReviewFocus {
   const authoredOrder = ([
     "source",
@@ -202,7 +292,7 @@ function buildGeneratedChangeExplanation(
   };
 }
 
-export function runChangedCommand(workspaceRoot: string, options: { authoredOnly?: boolean; reviewOnly?: boolean } = {}): ChangedCommandResult {
+export function runChangedCommand(workspaceRoot: string, options: { authoredOnly?: boolean; reviewOnly?: boolean; commitReady?: boolean } = {}): ChangedCommandResult {
   const git = buildWorkspaceGitSummary(workspaceRoot);
   const changed = git.changeSummary.changed;
   const humanChanges = selectHumanChangeSummary(changed);
@@ -215,16 +305,19 @@ export function runChangedCommand(workspaceRoot: string, options: { authoredOnly
   const reviewStaged = filterCategorizedSummary(git.changeSummary.staged, [...REVIEW_CHANGE_TYPES]);
   const reviewUnstaged = filterCategorizedSummary(git.changeSummary.unstaged, [...REVIEW_CHANGE_TYPES]);
   const reviewUntracked = filterCategorizedSummary(git.changeSummary.untracked, [...REVIEW_CHANGE_TYPES]);
+  const commitReady = options.commitReady ? commitReadySummary(workspaceRoot) : null;
   const viewHumanChanges = options.reviewOnly
     ? selectHumanChangeSummary(reviewChanged)
+    : options.commitReady && commitReady
+      ? selectHumanChangeSummary(commitReady.changed)
     : options.authoredOnly
       ? selectHumanChangeSummary(authoredChanged)
       : humanChanges;
-  const viewChanged = options.reviewOnly ? reviewChanged : options.authoredOnly ? authoredChanged : changed;
-  const viewStaged = options.reviewOnly ? reviewStaged : options.authoredOnly ? authoredStaged : git.changeSummary.staged;
-  const viewUnstaged = options.reviewOnly ? reviewUnstaged : options.authoredOnly ? authoredUnstaged : git.changeSummary.unstaged;
-  const viewUntracked = options.reviewOnly ? reviewUntracked : options.authoredOnly ? authoredUntracked : git.changeSummary.untracked;
-  const viewDerivedChanges: DerivedChangeSummary = options.authoredOnly || options.reviewOnly
+  const viewChanged = options.reviewOnly ? reviewChanged : options.commitReady && commitReady ? commitReady.changed : options.authoredOnly ? authoredChanged : changed;
+  const viewStaged = options.reviewOnly ? reviewStaged : options.commitReady && commitReady ? commitReady.staged : options.authoredOnly ? authoredStaged : git.changeSummary.staged;
+  const viewUnstaged = options.reviewOnly ? reviewUnstaged : options.commitReady && commitReady ? commitReady.unstaged : options.authoredOnly ? authoredUnstaged : git.changeSummary.unstaged;
+  const viewUntracked = options.reviewOnly ? reviewUntracked : options.commitReady && commitReady ? commitReady.untracked : options.authoredOnly ? authoredUntracked : git.changeSummary.untracked;
+  const viewDerivedChanges: DerivedChangeSummary = options.authoredOnly || options.reviewOnly || options.commitReady
     ? { total: 0, generated: { count: 0, sample: [], hidden: 0 } }
     : derivedChanges;
   const risks = buildRisks(git);
@@ -245,7 +338,7 @@ export function runChangedCommand(workspaceRoot: string, options: { authoredOnly
         commit: git.commit,
         workspaceMode: git.workspaceMode ?? (git.available ? "git" : "nonGit"),
         tracking: git.tracking ?? git.source,
-        view: options.reviewOnly ? "review" : options.authoredOnly ? "authored" : "all",
+        view: options.reviewOnly ? "review" : options.commitReady ? "commit-ready" : options.authoredOnly ? "authored" : "all",
         changedFiles: viewChanged.total.count,
         humanFiles: viewHumanChanges.total,
         generatedFiles: viewDerivedChanges.total,
@@ -274,6 +367,7 @@ export function runChangedCommand(workspaceRoot: string, options: { authoredOnly
       reviewFocus,
       generatedExplanation,
       diffPlan,
+      ...(commitReady ? { commitReady: { files: commitReady.files, count: commitReady.files.length } } : {}),
       risks,
       advisories,
       recommendedCommands,

package/src/forge/cli/commands.ts

@@ -4,13 +4,18 @@ import { join, resolve } from "node:path";
 import { stripDeterministicHeader } from "../compiler/primitives/header.ts";
 import { classify } from "../compiler/classifier/classify.ts";
 import { buildRuntimeMatrix } from "../compiler/classifier/runtime-matrix.ts";
-import { FORGE_RELEASE_PACKAGE_PACK_FAILED } from "../compiler/diagnostics/codes.ts";
+import {
+  FORGE_DB_EMPTY_TIMESTAMP_LITERAL,
+  FORGE_RELEASE_PACKAGE_PACK_FAILED,
+} from "../compiler/diagnostics/codes.ts";
 import { createDiagnostic } from "../compiler/diagnostics/create.ts";
 import { forgeAdd } from "../compiler/integration/add.ts";
 import { checkImportGuards } from "../compiler/guards/check-import-guards.ts";
 import { checkDirectProcessEnvUsage } from "../compiler/guards/check-process-env.ts";
 import { checkAiUsageInApp } from "../compiler/guards/check-ai-usage.ts";
 import { checkQueryUsageInApp } from "../compiler/guards/check-query-usage.ts";
+import { buildDataGraph } from "../compiler/data-graph/build.ts";
+import { buildSqlPlan } from "../compiler/data-graph/sql/ddl.ts";
 import { loadSecretRegistry } from "../runtime/secrets/check.ts";
 import { run } from "../compiler/orchestrator/run.ts";
 import {
@@ -1003,12 +1008,70 @@ async function loadRuntimeMatrixForCheck(
   return buildRuntimeMatrix(classified);
 }
 
+function normalizeSchemaType(type: string): string {
+  return type.trim().replace(/\?$/, "").toLowerCase();
+}
+
+function timestampFieldNames(dataGraph: DataGraph): Set<string> {
+  const fields = new Set<string>();
+  for (const table of dataGraph.tables) {
+    for (const field of table.fields) {
+      if (["timestamp", "timestamptz"].includes(normalizeSchemaType(field.type))) {
+        fields.add(field.name);
+      }
+    }
+  }
+  return fields;
+}
+
+function checkEmptyTimestampLiterals(
+  appGraph: Awaited<ReturnType<typeof buildAppGraphForSession>>,
+  dataGraph: DataGraph,
+): ReturnType<typeof createDiagnostic>[] {
+  const fields = timestampFieldNames(dataGraph);
+  if (fields.size === 0) {
+    return [];
+  }
+  const diagnostics: ReturnType<typeof createDiagnostic>[] = [];
+  const runtimeKinds = new Set(["command", "query", "liveQuery", "action", "workflow"]);
+  for (const symbol of appGraph.symbols) {
+    if (!runtimeKinds.has(symbol.kind)) {
+      continue;
+    }
+    const sourceSlice = typeof symbol.meta.sourceSlice === "string" ? symbol.meta.sourceSlice : "";
+    if (!sourceSlice) {
+      continue;
+    }
+    for (const field of fields) {
+      const escaped = field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const pattern = new RegExp(`\\b${escaped}\\s*:\\s*(["']{2})`);
+      const emptyTemplatePattern = new RegExp(`\\b${escaped}\\s*:\\s*\`\``);
+      if (!pattern.test(sourceSlice) && !emptyTemplatePattern.test(sourceSlice)) {
+        continue;
+      }
+      diagnostics.push(
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_DB_EMPTY_TIMESTAMP_LITERAL,
+          message:
+            `Forge timestamp field '${field}' is assigned an empty string in ${symbol.kind} '${symbol.name}'.`,
+          file: symbol.file,
+          span: symbol.span,
+        }),
+      );
+    }
+  }
+  return diagnostics;
+}
+
 export async function runCheckCommand(
   workspaceRoot: string,
   options?: { strictSecrets?: boolean },
 ): Promise<GenerateResult> {
   const session = getCompileSession(workspaceRoot);
   const appGraph = await buildAppGraphForSession(session);
+  const dataGraph = buildDataGraph(appGraph);
+  const sqlPlan = buildSqlPlan(dataGraph);
 
   const matrix = await loadRuntimeMatrixForCheck(workspaceRoot);
   const guardDiagnostics = checkImportGuards(appGraph.moduleGraph, matrix);
@@ -1029,12 +1092,17 @@ export async function runCheckCommand(
       `${GENERATED_DIR}/capabilityMap.json`,
     )?.diagnostics ?? [];
   const externalDiagnostics = buildExternalServiceGraph(workspaceRoot).diagnostics;
+  const timestampLiteralDiagnostics = checkEmptyTimestampLiterals(appGraph, dataGraph);
 
   const allDiagnostics = [
+    ...appGraph.diagnostics,
+    ...dataGraph.diagnostics,
+    ...sqlPlan.diagnostics,
     ...guardDiagnostics,
     ...processEnvDiagnostics,
     ...aiDiagnostics,
     ...queryDiagnostics,
+    ...timestampLiteralDiagnostics,
     ...frontendDiagnostics,
     ...capabilityDiagnostics,
     ...externalDiagnostics,
@@ -1314,7 +1382,7 @@ function runManifestCommand(command: Extract<ForgeCommand, { kind: "manifest" }>
 export async function runInspectCommand(
   target: InspectTarget,
   workspaceRoot: string,
-  options: { full?: boolean; brief?: boolean } = {},
+  options: { full?: boolean; brief?: boolean; ergonomics?: boolean } = {},
 ): Promise<InspectResult> {
   const dataPaths: Partial<Record<InspectTarget, string>> = {
     app: `${GENERATED_DIR}/appGraph.json`,
@@ -1411,6 +1479,47 @@ export async function runInspectCommand(
     };
   }
 
+  if (target === "ui" && options.ergonomics) {
+    const result = await runUiCommand({
+      subcommand: "audit",
+      workspaceRoot,
+      json: true,
+      headed: false,
+      browser: "chromium",
+      trace: "off",
+      screenshot: "off",
+      video: "off",
+      baseUrl: "http://127.0.0.1:3000",
+      runtimeUrl: "http://127.0.0.1:3765",
+      reuseServers: false,
+      startServers: false,
+      all: true,
+      changed: false,
+      ci: false,
+      timeoutMs: 30_000,
+    });
+    return {
+      target,
+      data: {
+        schemaVersion: "0.1.0",
+        mode: "ergonomics",
+        ok: result.ok,
+        manifest: result.manifest,
+        scenarios: result.scenarios ?? [],
+        diagnostics: result.diagnostics,
+        nextActions: [
+          "forge ui audit --json",
+          "forge inspect frontend --json",
+          "forge inspect capabilities --json",
+        ],
+      },
+      warnings: result.diagnostics.filter((diagnostic) => diagnostic.severity === "warning"),
+      errors: result.diagnostics.filter((diagnostic) => diagnostic.severity === "error"),
+      exitCode: result.exitCode,
+      failureKind: result.exitCode === 0 ? undefined : "ui_ergonomics",
+    };
+  }
+
   if (target === "imported") {
     const result = inspectBrownfieldImport(workspaceRoot);
     return {
@@ -2106,6 +2215,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       const result = runChangedCommand(command.workspaceRoot, {
         authoredOnly: command.authoredOnly,
         reviewOnly: command.reviewOnly,
+        commitReady: command.commitReady,
       });
       if (command.json) {
         process.stdout.write(formatJsonResult(result.data));
@@ -2203,8 +2313,8 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
     case "inspect": {
       const result = await runInspectCommand(
         command.target,
-        process.cwd(),
-        { full: command.full, brief: command.brief },
+        command.workspaceRoot,
+        { full: command.full, brief: command.brief, ergonomics: command.ergonomics },
       );
       if (command.json) {
         process.stdout.write(formatJsonResult(buildInspectJson(result)));
@@ -2346,6 +2456,8 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         telemetry: command.telemetry,
         envFile: command.envFile,
         skipStartupConsole: command.skipStartupConsole,
+        detach: command.detach,
+        lifecycle: command.lifecycle,
       });
       return result.exitCode;
     }