forgeos 0.1.0-alpha.4 → 0.1.0-alpha.41

package/src/forge/runtime/telemetry/scrubber.ts

@@ -4,6 +4,7 @@ import {
   FORGE_TELEMETRY_SECRET_REDACTED,
 } from "../../compiler/diagnostics/codes.ts";
 import type { Diagnostic } from "../../compiler/types/diagnostic.ts";
+import { hashStable } from "../../compiler/primitives/hash.ts";
 
 const SECRET_KEY_PATTERN =
   /password|secret|token|apikey|authorization|cookie/i;
@@ -101,6 +102,28 @@ function scrubObject(
   return result;
 }
 
+function summarizeValue(value: unknown): Record<string, unknown> {
+  if (Array.isArray(value)) {
+    return { type: "array", length: value.length };
+  }
+  if (value && typeof value === "object") {
+    return {
+      type: "object",
+      keys: Object.keys(value as Record<string, unknown>).sort().slice(0, 20),
+    };
+  }
+  if (typeof value === "string") {
+    return { type: "string", length: value.length };
+  }
+  return { type: value === null ? "null" : typeof value };
+}
+
+function summarizePayload(payload: Record<string, unknown>): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(payload).map(([key, value]) => [key, summarizeValue(value)]),
+  );
+}
+
 function truncateString(
   value: string,
   maxBytes: number,
@@ -148,7 +171,8 @@ export function scrubEnvelopePayload<T extends Record<string, unknown>>(
   }
 
   const serialized = JSON.stringify(scrubbed);
-  if (Buffer.byteLength(serialized, "utf8") > MAX_PAYLOAD_BYTES) {
+  const originalBytes = Buffer.byteLength(serialized, "utf8");
+  if (originalBytes > MAX_PAYLOAD_BYTES) {
     diagnostics.push(
       createDiagnostic({
         severity: "warning",
@@ -156,10 +180,16 @@ export function scrubEnvelopePayload<T extends Record<string, unknown>>(
         message: `truncated telemetry payload to ${MAX_PAYLOAD_BYTES} bytes`,
       }),
     );
-    const parsed = JSON.parse(
-      truncateString(serialized, MAX_PAYLOAD_BYTES, diagnostics, "payload"),
-    ) as T;
-    return { value: parsed, diagnostics };
+    return {
+      value: {
+        truncated: true,
+        originalBytes,
+        maxBytes: MAX_PAYLOAD_BYTES,
+        hash: hashStable(serialized),
+        summary: summarizePayload(scrubbed),
+      } as unknown as T,
+      diagnostics,
+    };
   }
 
   return { value: scrubbed, diagnostics };

package/src/forge/runtime/webhooks/security.ts

@@ -6,7 +6,7 @@ import {
   FORGE_WEBHOOK_TIMESTAMP_INVALID,
 } from "../../compiler/diagnostics/codes.ts";
 
-export type WebhookProvider = "generic" | "github" | "stripe";
+export type WebhookProvider = "generic" | "github" | "stripe" | "workos";
 
 export interface WebhookReplayStore {
   has(eventId: string): boolean | Promise<boolean>;
@@ -69,12 +69,14 @@ function fail(
   return { ok: false, provider, code, reason };
 }
 
-function parseStripeHeader(header: string): { timestamp?: number; signatures: string[] } {
+function parseTimestampedSignatureHeader(header: string): { timestampRaw?: string; timestamp?: number; signatures: string[] } {
   const signatures: string[] = [];
+  let timestampRaw: string | undefined;
   let timestamp: number | undefined;
   for (const part of header.split(",")) {
     const [key, value] = part.split("=", 2).map((item) => item.trim());
     if (key === "t") {
+      timestampRaw = value;
       const parsed = Number(value);
       if (Number.isFinite(parsed)) {
         timestamp = parsed;
@@ -84,7 +86,7 @@ function parseStripeHeader(header: string): { timestamp?: number; signatures: st
       signatures.push(value);
     }
   }
-  return { timestamp, signatures };
+  return { timestampRaw, timestamp, signatures };
 }
 
 function validateTimestamp(input: {
@@ -131,9 +133,11 @@ export async function verifyWebhookSignature(
   let valid = false;
   let timestamp: number | undefined;
 
-  if (input.provider === "stripe") {
-    const parsed = parseStripeHeader(signatureHeader);
-    timestamp = parsed.timestamp;
+  if (input.provider === "stripe" || input.provider === "workos") {
+    const parsed = parseTimestampedSignatureHeader(signatureHeader);
+    timestamp = input.provider === "workos" && parsed.timestamp !== undefined
+      ? parsed.timestamp / 1000
+      : parsed.timestamp;
     const timestampFailure = validateTimestamp({
       provider: input.provider,
       timestamp,
@@ -143,7 +147,8 @@ export async function verifyWebhookSignature(
     if (timestampFailure) {
       return timestampFailure;
     }
-    const signedPayload = `${timestamp}.${Buffer.from(bytes(input.payload)).toString("utf8")}`;
+    const timestampForSignature = parsed.timestampRaw ?? String(parsed.timestamp);
+    const signedPayload = `${timestampForSignature}.${Buffer.from(bytes(input.payload)).toString("utf8")}`;
     const expected = hmacHex(input.secret, signedPayload);
     valid = parsed.signatures.some((signature) => safeEqualHex(signature, expected));
   } else if (input.provider === "github") {

package/src/forge/server.ts

@@ -1,6 +1,7 @@
 export type ForgeAuthRule =
   | { kind: "policy"; policy: string }
   | { kind: "roles"; roles: string[] }
+  | { kind: "permissions"; permissions: string[] }
   | { kind: "public" };
 
 export type ForgeDefinition<T extends Record<string, unknown>> = T;
@@ -134,11 +135,19 @@ export function canRole(...roles: string[]): ForgeAuthRule {
   return { kind: "roles", roles };
 }
 
+export function canPermission(...permissions: string[]): ForgeAuthRule {
+  return { kind: "permissions", permissions };
+}
+
 export function public_(): ForgeAuthRule {
   return { kind: "public" };
 }
 
-export function command<T extends ForgeCommandDefinition>(definition: T): ForgeDefinition<T> {
+export function command<
+  TArgs = unknown,
+  TResult = unknown,
+  T extends ForgeCommandDefinition<TArgs, TResult> = ForgeCommandDefinition<TArgs, TResult>,
+>(definition: T): ForgeDefinition<T> {
   return definition;
 }
 
@@ -173,8 +182,13 @@ export function step<T extends (...args: any[]) => unknown>(
   return { kind: "step", name, handler };
 }
 
-export function workflow<T extends Record<string, unknown>>(definition: T): ForgeDefinition<T> {
-  return definition;
+export function workflow<T extends Record<string, unknown>>(
+  definition: T,
+): ForgeDefinition<T & { __forge: { kind: "workflow" } }> {
+  return {
+    ...definition,
+    __forge: { kind: "workflow" },
+  };
 }
 
 export {

package/src/forge/ui/index.ts

@@ -57,6 +57,120 @@ function uniqueSorted(values: Array<string | undefined>): string[] {
   return [...new Set(values.filter((value): value is string => Boolean(value)))].sort();
 }
 
+function walkFiles(root: string, relative = ""): string[] {
+  const absolute = relative ? join(root, relative) : root;
+  return nodeFileSystem.readDir(absolute).flatMap((entry) => {
+    const child = relative ? `${relative}/${entry.name}` : entry.name;
+    const normalized = normalize(child);
+    if (entry.isDirectory) {
+      if (["node_modules", ".next", ".nuxt", "dist", "build", ".vite"].includes(entry.name)) {
+        return [];
+      }
+      return walkFiles(root, normalized);
+    }
+    return entry.isFile ? [normalized] : [];
+  });
+}
+
+function listWebSourceFiles(workspaceRoot: string, webRoot: string): Array<{ path: string; text: string }> {
+  if (!webRoot) return [];
+  const absoluteWebRoot = join(workspaceRoot, normalize(webRoot));
+  if (!nodeFileSystem.exists(absoluteWebRoot)) return [];
+  return walkFiles(absoluteWebRoot)
+    .filter((file) => /\.(tsx|jsx|vue|svelte|html)$/.test(file))
+    .map((file) => {
+      const path = `${normalize(webRoot)}/${file}`;
+      return { path, text: readText(workspaceRoot, path) };
+    })
+    .filter((source) => source.text.trim().length > 0);
+}
+
+function readOptionalGeneratedJson(workspaceRoot: string, name: string): unknown {
+  try {
+    return readJson<unknown>(workspaceRoot, `${GENERATED}/${name}`, null);
+  } catch {
+    return null;
+  }
+}
+
+function hasTenantScopedData(workspaceRoot: string): boolean {
+  const dataGraph = readOptionalGeneratedJson(workspaceRoot, "dataGraph.json") as { tables?: Array<Record<string, unknown>> } | null;
+  return (dataGraph?.tables ?? []).some((table) =>
+    table?.tenantScoped === true ||
+    table?.tenantScope === true ||
+    typeof table?.tenantField === "string" ||
+    (Array.isArray(table?.fields) && table.fields.some((field) =>
+      typeof field === "object" &&
+      field !== null &&
+      ("tenantId" === (field as { name?: string }).name || "tenant_id" === (field as { name?: string }).name)
+    ))
+  );
+}
+
+function hasProductionAuthMode(workspaceRoot: string): boolean {
+  const agentContract = readOptionalGeneratedJson(workspaceRoot, "agentContract.json") as { auth?: { modes?: string[]; production?: unknown } } | null;
+  const modes = agentContract?.auth?.modes ?? [];
+  return modes.includes("jwt") || modes.includes("oidc") || Boolean(agentContract?.auth?.production);
+}
+
+function looksLikeAuthFlow(text: string): boolean {
+  return /sign\s*in|signin|login|logout|authkit|organization|tenant|session|workos|clerk|auth0/i.test(text);
+}
+
+function hasWorkOSIntegration(workspaceRoot: string): boolean {
+  return nodeFileSystem.exists(join(workspaceRoot, `${GENERATED}/integrations/workos/authkit.ts`)) ||
+    nodeFileSystem.exists(join(workspaceRoot, `${GENERATED}/integrations/workos/auth-routes.ts`));
+}
+
+function webPackageHasAuthKit(workspaceRoot: string): boolean {
+  const path = join(workspaceRoot, "web/package.json");
+  if (!nodeFileSystem.exists(path)) return false;
+  try {
+    const packageJson = JSON.parse(nodeFileSystem.readText(path) ?? "{}") as {
+      dependencies?: Record<string, string>;
+      devDependencies?: Record<string, string>;
+    };
+    return Boolean(packageJson.dependencies?.["@workos-inc/authkit-react"] ?? packageJson.devDependencies?.["@workos-inc/authkit-react"]);
+  } catch {
+    return false;
+  }
+}
+
+function hasMainLandmark(text: string): boolean {
+  return /<main[\s>]|role=["']main["']|<header[\s>]|<nav[\s>]/i.test(text);
+}
+
+function hasRuntimeDataHook(text: string): boolean {
+  return /\b(useLiveQuery|useQuery|useForgeLiveQuery|useForgeQuery)\b/.test(text);
+}
+
+function hasStateText(text: string, pattern: RegExp): boolean {
+  return pattern.test(text);
+}
+
+function findFormWithoutLabel(text: string): boolean {
+  if (!/<(form|input|select|textarea)\b/i.test(text)) return false;
+  const controls = text.match(/<(input|select|textarea)\b[^>]*>/gi) ?? [];
+  return controls.some((control) => {
+    if (/\b(type=["']?(hidden|submit|button|checkbox|radio)["']?)/i.test(control)) return false;
+    if (/\b(aria-label|aria-labelledby|title)=/i.test(control)) return false;
+    const id = /\bid=["']([^"']+)["']/i.exec(control)?.[1];
+    if (id && new RegExp(`<label\\b[^>]*\\bfor=["']${id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}["']`, "i").test(text)) {
+      return false;
+    }
+    return !/<label\b/i.test(text);
+  });
+}
+
+function findUnnamedButton(text: string): boolean {
+  const buttons = text.match(/<button\b[\s\S]*?<\/button>/gi) ?? [];
+  return buttons.some((button) => {
+    if (/\b(aria-label|aria-labelledby|title)=/i.test(button)) return false;
+    const inner = button.replace(/<button\b[^>]*>/i, "").replace(/<\/button>/i, "").replace(/<[^>]+>/g, "").trim();
+    return inner.length === 0;
+  });
+}
+
 function routeName(path: string): string {
   if (path === "/") return "home";
   return path.replace(/^\//, "").replace(/[^a-zA-Z0-9]+/g, "-") || "route";
@@ -641,6 +755,9 @@ function selectScenarios(options: UiCommandOptions, scenarios: UiScenario[]): Ui
 }
 
 export async function runUiCommand(options: UiCommandOptions): Promise<UiCommandResult> {
+  if (options.subcommand === "audit") {
+    return runUiAudit(options);
+  }
   if (options.subcommand === "doctor") {
     return runUiDoctor(options);
   }
@@ -671,6 +788,98 @@ export async function runUiCommand(options: UiCommandOptions): Promise<UiCommand
   };
 }
 
+function runUiAudit(options: UiCommandOptions): UiCommandResult {
+  const manifest = loadUiManifest(options.workspaceRoot);
+  const scenarios = loadUiScenarios(options.workspaceRoot);
+  const diagnostics: Diagnostic[] = [];
+  const webSources = listWebSourceFiles(options.workspaceRoot, manifest.webRoot);
+  const webText = webSources.map((source) => source.text).join("\n");
+  const appShellText = webSources
+    .filter((source) => !source.path.endsWith("/lib/workos-auth.tsx"))
+    .map((source) => source.text)
+    .join("\n");
+  const scenarioRoutes = new Set(scenarios.map((scenario) => scenario.route));
+  const scenarioNames = scenarios.map((scenario) => scenario.name);
+  const selectorSet = new Set(manifest.selectors);
+
+  if (manifest.routes.length === 0) {
+    diagnostics.push(diagnostic("warning", "FORGE_UI_ROUTE_FAILED", "No frontend routes are present in uiTestManifest."));
+  }
+  if (manifest.routes.length > 0 && scenarios.length === 0) {
+    diagnostics.push(diagnostic("error", "FORGE_UI_TESTID_MISSING", "Frontend routes exist but no UI scenarios were generated."));
+  }
+  for (const route of manifest.routes) {
+    if (!scenarioRoutes.has(route.path)) {
+      diagnostics.push(diagnostic("warning", "FORGE_UI_ROUTE_FAILED", `No UI scenario covers route '${route.path}'.`));
+    }
+    const usesRuntime = route.uses.commands.length > 0 || route.uses.queries.length > 0 || route.uses.liveQueries.length > 0;
+    if (usesRuntime && selectorSet.size === 0) {
+      diagnostics.push(diagnostic("warning", "FORGE_UI_TESTID_MISSING", `Route '${route.path}' uses Forge runtime bindings but no stable data-forge-testid selectors were detected.`));
+    }
+  }
+  const hasPolicySensitiveRuntime = scenarios.some((scenario) =>
+    scenario.requires.policies.length > 0 || scenario.requires.commands.length > 0
+  );
+  if (hasPolicySensitiveRuntime && !scenarioNames.some((name) => name.includes("policy-denied"))) {
+    diagnostics.push(diagnostic("warning", "FORGE_UI_POLICY_ERROR_MISSING", "Policy-sensitive UI flows should include a visible policy-denied scenario."));
+  }
+  if (manifest.routes.length > 0 && !manifest.selectors.some((selector) => selector.includes("data-forge-testid"))) {
+    diagnostics.push(diagnostic("warning", "FORGE_UI_TESTID_MISSING", "No data-forge-testid selectors were captured for UI smoke/audit stability."));
+  }
+  if (manifest.webRoot && manifest.routes.length > 0 && webSources.length === 0) {
+    diagnostics.push(diagnostic("warning", "FORGE_UI_SOURCE_MISSING", `No frontend source files were found under '${manifest.webRoot}' for static UX audit.`));
+  }
+  if (webSources.length > 0 && !webSources.some((source) => hasMainLandmark(source.text))) {
+    diagnostics.push(diagnostic("warning", "FORGE_UI_LANDMARK_MISSING", "Frontend source does not appear to include a main/header/nav landmark; add semantic landmarks for scanning and accessibility."));
+  }
+  for (const source of webSources) {
+    if (findFormWithoutLabel(source.text)) {
+      diagnostics.push(diagnostic("warning", "FORGE_UI_FORM_LABEL_MISSING", "Form controls should have labels or aria-label/aria-labelledby for accessible testing and real users.", source.path));
+    }
+    if (findUnnamedButton(source.text)) {
+      diagnostics.push(diagnostic("warning", "FORGE_UI_BUTTON_NAME_MISSING", "Icon-only or empty buttons should include aria-label/title text.", source.path));
+    }
+  }
+  if (webSources.some((source) => hasRuntimeDataHook(source.text))) {
+    if (!hasStateText(webText, /\b(isLoading|loading|pending|skeleton|spinner|carregando|loading\.\.\.)\b/i)) {
+      diagnostics.push(diagnostic("warning", "FORGE_UI_LOADING_STATE_MISSING", "Forge data-bound UI should expose a loading or pending state."));
+    }
+    if (!hasStateText(webText, /\b(error|erro|failed|failure|FORGE_|traceId|trace)\b/i)) {
+      diagnostics.push(diagnostic("warning", "FORGE_UI_ERROR_STATE_MISSING", "Forge data-bound UI should surface runtime/policy errors with enough context to debug."));
+    }
+    if (!hasStateText(webText, /\b(empty|no\s+\w+|none|vazio|sem\s+\w+|length\s*===\s*0)\b/i)) {
+      diagnostics.push(diagnostic("warning", "FORGE_UI_EMPTY_STATE_MISSING", "Forge data-bound UI should include an empty state so first-run apps do not look broken."));
+    }
+  }
+  if ((hasTenantScopedData(options.workspaceRoot) || hasProductionAuthMode(options.workspaceRoot)) && webSources.length > 0 && !looksLikeAuthFlow(webText)) {
+    diagnostics.push(diagnostic(
+      "warning",
+      "FORGE_UI_AUTH_FLOW_MISSING",
+      "Tenant-scoped or production-auth app has no obvious sign-in/session/organization UI; local devAuth is not a production auth flow.",
+    ));
+  }
+  if (
+    hasWorkOSIntegration(options.workspaceRoot) &&
+    manifest.webRoot &&
+    webSources.length > 0 &&
+    (!webPackageHasAuthKit(options.workspaceRoot) || !/AuthKitProvider/.test(appShellText) || !/getAccessToken/.test(appShellText))
+  ) {
+    diagnostics.push(diagnostic(
+      "warning",
+      "FORGE_UI_WORKOS_AUTHKIT_MISSING",
+      "WorkOS integration is present, but the web app does not appear to mount AuthKitProvider and pass getAccessToken into ForgeProvider.",
+    ));
+  }
+
+  return {
+    ok: diagnostics.every((item) => item.severity !== "error"),
+    manifest,
+    scenarios,
+    diagnostics,
+    exitCode: diagnostics.some((item) => item.severity === "error") ? 1 : 0,
+  };
+}
+
 function runUiDoctor(options: UiCommandOptions): UiCommandResult {
   const manifest = loadUiManifest(options.workspaceRoot);
   const diagnostics: Diagnostic[] = [];

package/src/forge/ui/types.ts

@@ -2,6 +2,7 @@ import type { Diagnostic } from "../compiler/types/diagnostic.ts";
 import type { TestCost } from "../compiler/types/test-graph.ts";
 
 export type UiSubcommand =
+  | "audit"
   | "smoke"
   | "test"
   | "scenario"

package/src/forge/version.ts

@@ -1,3 +1,3 @@
-export const FORGEOS_VERSION = "0.1.0-alpha.4";
+export const FORGEOS_VERSION = "0.1.0-alpha.41";
 export const GENERATOR_VERSION = FORGEOS_VERSION;
 export const CLI_VERSION = FORGEOS_VERSION;