forgeos 0.1.0-alpha.4 → 0.1.0-alpha.41

package/src/forge/review/index.ts

@@ -6,6 +6,8 @@ import { serializeCanonical } from "../compiler/primitives/serialize.ts";
 import { stripDeterministicHeader } from "../compiler/primitives/header.ts";
 import { analyzeImpact, buildImpactTestPlan, detectChangedFiles } from "../impact/index.ts";
 import type { ImpactCommandOptions, ImpactSource } from "../impact/types.ts";
+import { buildDiffPlanFromChangeSummary, categorizeFiles } from "../workspace/change-summary.ts";
+import type { CategorizedFileSummary, ChangeType } from "../workspace/change-summary.ts";
 import type {
   ReviewChanged,
   ReviewCommandOptions,
@@ -14,6 +16,8 @@ import type {
   ReviewFinding,
   ReviewFindingCategory,
   ReviewFindingSeverity,
+  ReviewFocus,
+  ReviewDiffPlan,
   ReviewReport,
   ReviewResult,
   ReviewRisk,
@@ -41,6 +45,21 @@ const ALL_CATEGORIES: ReviewFindingCategory[] = [
   "agent",
 ];
 
+const SYSTEM_ENV_NAMES = new Set([
+  "CI",
+  "HOME",
+  "PATH",
+  "PWD",
+  "SHELL",
+  "TEMP",
+  "TMP",
+  "USER",
+  "USERNAME",
+  "USERPROFILE",
+]);
+
+const SECRET_ENV_PATTERN = /(^|_)(API_KEY|AUTH_TOKEN|CLIENT_SECRET|CREDENTIALS|JWT_SECRET|PASSWORD|PRIVATE_KEY|SECRET|SECRET_KEY|TOKEN|WEBHOOK_SECRET)$/;
+
 const RULE_DOCS: ReviewRuleDoc[] = [
   {
     id: "runtime-command-forbidden-import",
@@ -124,6 +143,32 @@ function changedFromFiles(files: string[]): ReviewChanged {
   };
 }
 
+function buildReviewFocus(changeSummary: CategorizedFileSummary): ReviewFocus {
+  const authoredOrder = ([
+    "source",
+    "tests",
+    "docs",
+    "config",
+    "operational",
+    "assets",
+    "other",
+  ] satisfies ChangeType[])
+    .filter((type) => changeSummary.byType[type].count > 0);
+  const suggestedOrder: ChangeType[] = [...authoredOrder];
+  if (changeSummary.byType.generated.count > 0) {
+    suggestedOrder.push("generated");
+  }
+  return {
+    first: "authoredChanges",
+    then: "derivedArtifacts",
+    generatedIsDerived: true,
+    suggestedOrder,
+    summary: changeSummary.byType.generated.count > 0
+      ? "Review authored changes first; inspect generated artifacts after the source cause is understood."
+      : "Review authored changes directly; no generated artifacts changed.",
+  };
+}
+
 function loadContext(options: ReviewCommandOptions): ReviewContext {
   const source = sourceFromOptions(options);
   const impactSource = impactSourceFromReview(source);
@@ -190,9 +235,22 @@ function isTestFile(file: string): boolean {
   return /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file) || normalize(file).startsWith("tests/");
 }
 
+function isDocumentationFile(file: string): boolean {
+  const normalized = normalize(file);
+  return normalized.startsWith("docs/") ||
+    normalized.startsWith("marketing/") ||
+    normalized.endsWith(".md") ||
+    normalized.endsWith(".mdx");
+}
+
 function isForgeToolingFile(file: string): boolean {
   const normalized = normalize(file);
-  return normalized.startsWith("src/forge/cli/") || normalized.startsWith("src/forge/review/");
+  return normalized.startsWith("src/forge/cli/") ||
+    normalized.startsWith("src/forge/review/") ||
+    normalized.startsWith("src/forge/dev/") ||
+    normalized.startsWith("src/forge/dev-console/") ||
+    normalized.startsWith("src/forge/compiler/package-manager/") ||
+    normalized.startsWith("src/forge/compiler/integration/");
 }
 
 function includesCategory(options: ReviewCommandOptions, category: ReviewFindingCategory): boolean {
@@ -200,20 +258,47 @@ function includesCategory(options: ReviewCommandOptions, category: ReviewFinding
   return options.include.length === 0 || options.include.includes(category);
 }
 
-function secretNamesFromText(text: string): string[] {
+function processEnvNamesFromText(text: string): string[] {
   const names = new Set<string>();
-  for (const regex of [/process\.env\.([A-Z0-9_]+)/g, /process\.env\[['"]([A-Z0-9_]+)['"]\]/g, /ctx\.secrets\.get\(['"]([A-Z0-9_]+)['"]\)/g]) {
+  for (const regex of [/process\.env\.([A-Z0-9_]+)/g, /process\.env\[['"]([A-Z0-9_]+)['"]\]/g]) {
     let match: RegExpExecArray | null;
     while ((match = regex.exec(text))) names.add(match[1]);
   }
   return [...names].sort();
 }
 
-function processEnvNamesFromText(text: string): string[] {
+function ctxSecretNamesFromText(text: string): string[] {
+  const names = new Set<string>();
+  const regex = /ctx\.secrets\.get\(['"]([A-Z0-9_]+)['"]\)/g;
+  let match: RegExpExecArray | null;
+  while ((match = regex.exec(text))) names.add(match[1]);
+  return [...names].sort();
+}
+
+function isSecretEnvName(name: string): boolean {
+  if (SYSTEM_ENV_NAMES.has(name)) return false;
+  return SECRET_ENV_PATTERN.test(name);
+}
+
+function secretNamesFromText(text: string): string[] {
+  const names = new Set<string>();
+  for (const name of processEnvNamesFromText(text)) {
+    if (isSecretEnvName(name)) names.add(name);
+  }
+  for (const name of ctxSecretNamesFromText(text)) names.add(name);
+  return [...names].sort();
+}
+
+function publicSecretNamesFromText(text: string): string[] {
   const names = new Set<string>();
   for (const regex of [/process\.env\.([A-Z0-9_]+)/g, /process\.env\[['"]([A-Z0-9_]+)['"]\]/g]) {
     let match: RegExpExecArray | null;
-    while ((match = regex.exec(text))) names.add(match[1]);
+    while ((match = regex.exec(text))) {
+      const name = match[1];
+      if ((name.startsWith("PUBLIC_") || name.startsWith("NEXT_PUBLIC_")) && isSecretEnvName(name)) {
+        names.add(name);
+      }
+    }
   }
   return [...names].sort();
 }
@@ -352,15 +437,16 @@ function secretRules(ctx: ReviewContext): ReviewFinding[] {
   const findings: ReviewFinding[] = [];
   const documented = ctx.envExample;
   for (const [file, text] of ctx.fileTexts) {
-    if (isTestFile(file) || isForgeToolingFile(file)) continue;
+    if (isTestFile(file) || isDocumentationFile(file)) continue;
     const names = secretNamesFromText(text);
-    if (processEnvNamesFromText(text).length > 0) {
+    const directSecretEnvNames = processEnvNamesFromText(text).filter(isSecretEnvName);
+    if (directSecretEnvNames.length > 0 && !isForgeToolingFile(file)) {
       findings.push(finding({
         severity: "error",
         category: "secrets",
         code: "secret-direct-process-env",
         title: "Direct process.env usage introduced",
-        message: "ForgeOS code should access secrets through ctx.secrets or generated config context.",
+        message: `${directSecretEnvNames.join(", ")} should be accessed through ctx.secrets or generated config context.`,
         file,
         suggestedCommands: ["forge secrets check", "forge refactor replace-process-env <ENV_VAR>"],
         autoRepair: { available: true, command: "forge refactor replace-process-env <ENV_VAR>", confidence: "medium" },
@@ -378,7 +464,7 @@ function secretRules(ctx: ReviewContext): ReviewFinding[] {
           suggestedCommands: ["forge secrets check"],
         }));
       }
-      if (/(_SECRET|SECRET_|TOKEN|KEY)/.test(name) && (name.startsWith("PUBLIC_") || name.startsWith("NEXT_PUBLIC_"))) {
+      if (publicSecretNamesFromText(text).includes(name)) {
         findings.push(finding({
           severity: "blocking",
           category: "secrets",
@@ -693,6 +779,9 @@ function buildReport(options: ReviewCommandOptions): ReviewReport {
     findings: findings.map((item) => [item.code, item.file, item.severity]),
   })).slice(0, 12)}`;
   const generatedPaths = ctx.changed.generated;
+  const changeSummary = categorizeFiles(ctx.changed.files);
+  const reviewFocus = buildReviewFocus(changeSummary);
+  const diffPlan: ReviewDiffPlan = buildDiffPlanFromChangeSummary(changeSummary);
   return {
     schemaVersion: "0.1.0",
     reviewVersion: REVIEW_VERSION,
@@ -709,6 +798,9 @@ function buildReport(options: ReviewCommandOptions): ReviewReport {
     risk,
     findings,
     changed: ctx.changed,
+    changeSummary,
+    reviewFocus,
+    diffPlan,
     impacted: ctx.impacted,
     checks: [
       { name: "impact-analysis", ok: true, message: `risk ${risk.level}` },
@@ -755,7 +847,13 @@ ${report.summary.bullets.map((bullet) => `- ${bullet}`).join("\n")}
 
 ## Changed Files
 
-${report.changed.files.map((file) => `- ${file}`).join("\n") || "- none"}
+${report.changed.files.filter((file) => !file.startsWith(`${GENERATED}/`) && file !== "forge.lock").map((file) => `- ${file}`).join("\n") || "- none"}
+
+Generated artifacts are derived and collapsed by default.
+
+- Generated files: ${report.diffPlan.generatedFiles}
+- Authored diff: \`${report.diffPlan.authoredDiffCommand}\`
+- Generated diff: \`${report.diffPlan.generatedDiffCommand}\`
 
 ## Findings
 
@@ -958,8 +1056,54 @@ export function runReviewCommand(options: ReviewCommandOptions): ReviewResult {
   }
 }
 
-export function formatReviewJson(result: ReviewResult): string {
-  return `${JSON.stringify(result.report ?? result.reports ?? result.explanation ?? result, null, 2)}\n`;
+function compactReviewReport(result: ReviewResult): unknown {
+  const report = result.report;
+  if (!report) return result.reports ?? result.explanation ?? result;
+  const impacted = {
+    ...report.impacted,
+    generatedArtifacts: report.impacted.generatedArtifacts.length,
+  };
+  return {
+    schemaVersion: report.schemaVersion,
+    reviewVersion: report.reviewVersion,
+    ok: result.ok,
+    id: report.id,
+    source: report.source,
+    summary: report.summary,
+    risk: report.risk,
+    findings: report.findings,
+    changed: {
+      files: report.changed.files.length,
+      tests: report.changed.tests.length,
+      sourceFiles: report.changed.sourceFiles.length,
+      generated: report.changed.generated.length,
+      packageFiles: report.changed.packageFiles.length,
+      deployFiles: report.changed.deployFiles.length,
+    },
+    changeSummary: report.changeSummary,
+    reviewFocus: report.reviewFocus,
+    diffPlan: report.diffPlan,
+    impacted,
+    checks: report.checks,
+    recommendedCommands: report.recommendedCommands,
+    humanChecklist: report.humanChecklist,
+    agentInstructions: report.agentInstructions,
+    generatedArtifacts: {
+      paths: report.generatedArtifacts.paths.length,
+      stale: report.generatedArtifacts.stale,
+    },
+    writeResult: result.writeResult,
+    diagnostics: result.diagnostics,
+    exitCode: result.exitCode,
+    fullCommand: "forge review run --changed --full --json",
+  };
+}
+
+export function formatReviewJson(result: ReviewResult, options: { full?: boolean } = {}): string {
+  const payload = options.full
+    ? result.report ?? result.reports ?? result.explanation ?? result
+    : compactReviewReport(result);
+  return `${JSON.stringify(payload, null, 2)}\n`;
 }
 
 export function formatReviewHuman(result: ReviewResult): string {
@@ -978,6 +1122,8 @@ ${result.reports.map((report) => `- ${report.id}: ${report.dir}`).join("\n") ||
 
 Risk: ${report.risk.level} (${report.risk.score})
 Findings: ${report.findings.length}
+Review focus: ${report.reviewFocus.summary}
+Review order: ${report.reviewFocus.suggestedOrder.join(" -> ") || "none"}
 
 Blocking issues:
 ${report.findings.filter((finding) => finding.severity === "blocking").map((finding) => `  - ${finding.code}: ${finding.message}`).join("\n") || "  - none"}

package/src/forge/review/types.ts

@@ -1,5 +1,6 @@
 import type { Diagnostic } from "../compiler/types/diagnostic.ts";
 import type { ImpactedSystems, ImpactSource } from "../impact/types.ts";
+import type { CategorizedFileSummary, ChangeType, DiffPlan } from "../workspace/change-summary.ts";
 
 export type ReviewSubcommand = "run" | "inspect" | "list" | "explain";
 export type ReviewMode = "quick" | "standard" | "strict";
@@ -26,6 +27,7 @@ export interface ReviewCommandOptions {
   json: boolean;
   md: boolean;
   sarif: boolean;
+  full?: boolean;
   write: boolean;
   changed: boolean;
   staged: boolean;
@@ -60,6 +62,16 @@ export interface ReviewChanged {
   deployFiles: string[];
 }
 
+export interface ReviewFocus {
+  first: "authoredChanges";
+  then: "derivedArtifacts";
+  generatedIsDerived: boolean;
+  suggestedOrder: ChangeType[];
+  summary: string;
+}
+
+export type ReviewDiffPlan = DiffPlan;
+
 export interface ReviewSummary {
   title: string;
   bullets: string[];
@@ -130,6 +142,9 @@ export interface ReviewReport {
   risk: ReviewRisk;
   findings: ReviewFinding[];
   changed: ReviewChanged;
+  changeSummary: CategorizedFileSummary;
+  reviewFocus: ReviewFocus;
+  diffPlan: ReviewDiffPlan;
   impacted: ImpactedSystems;
   checks: ReviewCheckResult[];
   recommendedCommands: string[];

package/src/forge/runtime/auth/config.ts

@@ -146,3 +146,20 @@ export function buildDefaultAuthRegistry(
     requiresTenant,
   };
 }
+
+export function buildWorkOSAuthRegistry(
+  requiresTenant: boolean,
+): AuthRegistryArtifact {
+  return {
+    ...buildDefaultAuthRegistry(requiresTenant),
+    claims: {
+      userId: "sub",
+      tenantId: "organization_id",
+      role: "role",
+      roles: "roles",
+      permissions: "permissions",
+      email: "email",
+      name: "name",
+    },
+  };
+}

package/src/forge/runtime/auth/evaluate.ts

@@ -22,6 +22,18 @@ function roleAllowed(
   return roles.some((role) => entry.roles.includes(role));
 }
 
+function permissionAllowed(
+  matrix: PermissionMatrix,
+  policy: string,
+  permissions: string[],
+): boolean {
+  const entry = matrix.entries.find((candidate) => candidate.policy === policy);
+  if (!entry) {
+    return false;
+  }
+  return permissions.some((permission) => (entry.permissions ?? []).includes(permission));
+}
+
 function authRoles(auth: Extract<AuthContext, { kind: "user" }>): string[] {
   return [...new Set([...(auth.role ? [auth.role] : []), ...(auth.roles ?? [])])];
 }
@@ -93,7 +105,8 @@ function evaluateAuthRequirement(
   }
 
   const roles = authRoles(auth);
-  const allowed = roleAllowed(matrix, resolved.policy, roles);
+  const allowed = roleAllowed(matrix, resolved.policy, roles) ||
+    permissionAllowed(matrix, resolved.policy, auth.permissions ?? []);
   const role = primaryRole(roles);
   if (allowed) {
     return { allowed: true, policy: resolved.policy, role };
@@ -102,7 +115,7 @@ function evaluateAuthRequirement(
   return {
     allowed: false,
     code: FORGE_POLICY_DENIED,
-    message: `role '${role}' denied for policy '${resolved.policy}'`,
+    message: `role '${role}' and permissions denied for policy '${resolved.policy}'`,
     policy: resolved.policy,
     role,
   };

package/src/forge/runtime/auth/resolve.ts

@@ -3,37 +3,87 @@ import type { AuthContext } from "./types.ts";
 export interface AuthHeaderInput {
   userId?: string;
   tenantId?: string;
+  organizationId?: string;
+  organizationMembershipId?: string;
   role?: string;
+  roles?: string[];
+  permissions?: string[];
+  claims?: Record<string, unknown>;
 }
 
 export interface CliAuthInput {
   userId?: string;
   tenantId?: string;
   role?: string;
+  roles?: string[];
+  permissions?: string[];
 }
 
 export function resolveAuthFromHeaders(input: AuthHeaderInput): AuthContext {
-  const { userId, tenantId, role } = input;
-  if (userId && role) {
+  const { userId, role } = input;
+  const tenantId = input.tenantId ?? input.organizationId;
+  const roles = [...new Set([...(role ? [role] : []), ...(input.roles ?? [])])];
+  const claims = {
+    ...(input.claims ?? {}),
+    ...(input.organizationId ? { organization_id: input.organizationId } : {}),
+    ...(input.organizationMembershipId
+      ? { organization_membership_id: input.organizationMembershipId }
+      : {}),
+  };
+  const hasClaims = Object.keys(claims).length > 0;
+  if (userId && (role || roles.length > 0 || (input.permissions ?? []).length > 0 || hasClaims)) {
     return {
       kind: "user",
       userId,
       ...(tenantId ? { tenantId } : {}),
-      role,
-      roles: [role],
-      permissions: [],
+      ...(role ? { role } : roles[0] ? { role: roles[0] } : {}),
+      roles,
+      permissions: [...new Set(input.permissions ?? [])].sort(),
       token: {
         issuer: "dev-headers",
         audience: "dev",
         subject: userId,
         authProvider: "dev-headers",
       },
-      claims: {},
+      ...(hasClaims ? { claims } : {}),
     };
   }
   return { kind: "anonymous" };
 }
 
+function parseHeaderList(value: string | null): string[] {
+  if (!value) {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    if (Array.isArray(parsed)) {
+      return parsed.filter((entry): entry is string => typeof entry === "string" && entry.length > 0);
+    }
+  } catch {
+    // Fall through to comma-separated dev header parsing.
+  }
+  return value
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+function parseClaims(value: string | null): Record<string, unknown> | undefined {
+  if (!value) {
+    return undefined;
+  }
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed as Record<string, unknown>;
+    }
+  } catch {
+    // Invalid dev claims should not break the whole request; policies can still use explicit headers.
+  }
+  return undefined;
+}
+
 export function resolveAuthFromCli(input: CliAuthInput): AuthContext {
   return resolveAuthFromHeaders(input);
 }
@@ -42,7 +92,12 @@ export function parseAuthHeaders(headers: Headers): AuthContext {
   return resolveAuthFromHeaders({
     userId: headers.get("x-forge-user-id") ?? undefined,
     tenantId: headers.get("x-forge-tenant-id") ?? undefined,
+    organizationId: headers.get("x-forge-organization-id") ?? undefined,
+    organizationMembershipId: headers.get("x-forge-organization-membership-id") ?? undefined,
     role: headers.get("x-forge-role") ?? undefined,
+    roles: parseHeaderList(headers.get("x-forge-roles")),
+    permissions: parseHeaderList(headers.get("x-forge-permissions")),
+    claims: parseClaims(headers.get("x-forge-claims")),
   });
 }
 

package/src/forge/runtime/auth/types.ts

@@ -72,6 +72,7 @@ export function snapshotAuth(auth: AuthContext): AuthSnapshot {
       ...(auth.email ? { email: auth.email } : {}),
       ...(auth.name ? { name: auth.name } : {}),
       ...(auth.token ? { token: auth.token } : {}),
+      ...(auth.claims ? { claims: auth.claims } : {}),
     };
   }
 

package/src/forge/runtime/db/factory.ts

@@ -4,7 +4,7 @@ import { FORGE_DB_CONNECT_FAILED } from "../../compiler/diagnostics/codes.ts";
 import type { Diagnostic } from "../../compiler/types/diagnostic.ts";
 import type { DbAdapter, DbAdapterKind } from "./adapter.ts";
 import { createMemoryAdapter } from "./memory-adapter.ts";
-import { createPgliteAdapter } from "./pglite-adapter.ts";
+import { createPgliteAdapter, DEFAULT_PGLITE_DIR } from "./pglite-adapter.ts";
 import { createPostgresAdapter } from "./postgres-adapter.ts";
 
 export interface CreateDbAdapterOptions {
@@ -19,8 +19,6 @@ export interface CreateDbAdapterResult {
   diagnostics: Diagnostic[];
 }
 
-const DEFAULT_PGLITE_DIR = ".forge/pglite";
-
 export async function createDbAdapter(
   options: CreateDbAdapterOptions,
 ): Promise<CreateDbAdapterResult> {

package/src/forge/runtime/db/generated-client.ts

@@ -37,6 +37,10 @@ export interface GeneratedDbClientOptions {
   writeTracker?: WriteTracker;
 }
 
+function camelCase(value: string): string {
+  return value.replace(/[_-]([a-zA-Z0-9])/g, (_match, char: string) => char.toUpperCase());
+}
+
 function quoteIdent(ident: string): string {
   return `"${ident.replace(/"/g, '""')}"`;
 }
@@ -286,8 +290,15 @@ export function createGeneratedDbClient(
 ): DbClient {
   const client: DbClient = {};
 
-  for (const [tableName, entry] of Object.entries(tableMap).sort()) {
-    client[tableName] = createTableClient(tx, tableName, entry, options);
+  for (const [accessName, entry] of Object.entries(tableMap).sort()) {
+    const tableClient = createTableClient(tx, entry.tableName, entry, options);
+    client[accessName] = tableClient;
+
+    for (const alias of new Set([camelCase(accessName), camelCase(entry.tableName)])) {
+      if (alias && client[alias] === undefined) {
+        client[alias] = tableClient;
+      }
+    }
   }
 
   return client;