forgeos 0.1.0-alpha.4 → 0.1.0-alpha.6

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.4 input=4af795b70ec62dc5967f6e9b78865cfbc8afb09275e575845cf80a360b3b85e2 content=1611635edf59c122b013ba76c85bd333ab3b30b289aaea04a9074f9438782a50
+// @forge-generated generator=0.1.0-alpha.6 input=83fec05765e1108f1188333308a145d7655ba77bbcb979c2299f4c325df466c7 content=1611635edf59c122b013ba76c85bd333ab3b30b289aaea04a9074f9438782a50
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # forgeos
 
+## 0.1.0-alpha.6
+
+### Patch Changes
+
+- [`c30f906`](https://github.com/Stahldavid/forge/commit/c30f9069c99ac747ce143ab5fbcbf13912ed8760) Thanks [@Stahldavid](https://github.com/Stahldavid)! - Add CLI version output, align create-app help with package metadata, and add release dependency audit evidence.
+
+## Unreleased
+
+Release and packaging hardening:
+
+- Added `forge --version` / `forge --version --json`.
+- Updated `create-forgeos-app` help to read the wrapper package version instead of a hardcoded string and bumped the wrapper to `0.1.0-alpha.2`.
+- Added dependency vulnerability evidence with an explicit waiver file and CI release gate.
+- Updated generated web template dependencies to current Vite/plugin-react and Next majors.
+
+## 0.1.0-alpha.5
+
+Release alignment for the public alpha channel:
+
+- Added `forge ai redteam --model-level --json` with deterministic prompt-injection, secret-exfiltration, approval-bypass, cross-tenant, and indirect tool-injection probes.
+- Added `forge security prove --full --json` support for source checkouts, with graceful structural-proof fallback when packaged apps do not include ForgeOS test fixtures.
+- Strengthened npm publish workflows to run `security prove --db postgres --full --json`.
+- Added public registry smoke coverage for `forgeos@alpha` and `create-forgeos-app@alpha`.
+- Bumped the create-app wrapper package line to `create-forgeos-app@0.1.0-alpha.1`.
+
 ## 0.1.0-alpha.4
 
 Security assurance and release evidence hardening:

package/README.md

@@ -49,7 +49,7 @@ These files describe the app surface, runtime rules, generated files, policies,
 Public one-command app creation:
 
 ```bash
-npm create forge-app@alpha notes-app -- --template minimal-web
+npm create forgeos-app@alpha notes-app -- --template minimal-web
 cd notes-app
 npm run dev
 ```
@@ -140,7 +140,7 @@ forge.lock
 | Auth | dev headers, JWT, OIDC discovery/JWKS verification via `jose`, production-mode guardrails |
 | RLS | Postgres RLS SQL compiler/checks for DB-enforced tenant isolation |
 | Secrets/env | secret registry, env schema, redaction, strict `process.env` checks |
-| AI | Vercel AI SDK v6 engine, provider registry, `ctx.ai`, `ctx.agent.run`, `aiTool`, `agent`, `/ai/agents/run` JSON automation, `/ai/agents/chat` UIMessage streaming, `forge ai trace`, mock mode, telemetry without prompt/output retention by default |
+| AI | Vercel AI SDK v6 engine, provider registry, `ctx.ai`, `ctx.agent.run`, `aiTool`, `agent`, `/ai/agents/run` JSON automation, `/ai/agents/chat` UIMessage streaming, `forge ai trace`, structural and model-level redteam probes, mock mode, telemetry without prompt/output retention by default |
 | Frontend | generated client SDK, React/Next hooks, template app, liveQuery client support |
 | LiveQuery | durable invalidation log, reconnect/resume semantics, production hardening checks |
 | Self-host | compose/deploy artifacts and self-host checks |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.4",
+  "version": "0.1.0-alpha.6",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "files": [
@@ -32,12 +32,14 @@
     "build": "tsc --noEmit",
     "typecheck": "tsc --noEmit",
     "changeset": "changeset",
-    "version-packages": "changeset version",
-    "release": "changeset publish --tag alpha",
+    "version-packages": "node scripts/version-packages.mjs",
+    "release": "changeset publish",
     "release:pack": "npm pack --dry-run",
     "release:smoke": "node scripts/smoke-packed-package.mjs",
     "release:evidence": "node scripts/write-release-evidence.mjs",
+    "release:verify-public-alpha": "node scripts/verify-public-alpha.mjs",
     "security:evidence": "node scripts/write-security-evidence.mjs",
+    "security:deps": "node scripts/write-dependency-audit-evidence.mjs",
     "release:publish-alpha": "node scripts/publish-trusted-alpha.mjs",
     "release:publish-local-alpha": "node scripts/publish-local-alpha.mjs",
     "field:test": "node scripts/field-test-forgeos.mjs",

package/src/forge/_generated/actionSubscriptions.json

@@ -1,2 +1,2 @@
-// @forge-generated generator=0.1.0-alpha.4 input=4af795b70ec62dc5967f6e9b78865cfbc8afb09275e575845cf80a360b3b85e2 content=e38472b113dc79a2390dcbc2f51741b8a86e33c858849367109b170f347b056e
-{"analyzerVersion":"0.1.0","byEvent":{},"diagnostics":[],"generatorVersion":"0.1.0-alpha.4","inputHash":"c52261a0b76af0f64feadff97d3852e815fa814de2566d0d1fce9e4805d1bfab","schemaVersion":"0.1.0","subscriptions":[]}
+// @forge-generated generator=0.1.0-alpha.6 input=83fec05765e1108f1188333308a145d7655ba77bbcb979c2299f4c325df466c7 content=cb60a6eb2608eee0193d6a6d99c7c00ee0d1e2c536196f8a1dcfd970c6ff4451
+{"analyzerVersion":"0.1.0","byEvent":{},"diagnostics":[],"generatorVersion":"0.1.0-alpha.6","inputHash":"b372718ace2a84e8bcc38ab238add25faa6cf49bd65a00242101d07f5fdc5843","schemaVersion":"0.1.0","subscriptions":[]}

package/src/forge/_generated/actionSubscriptions.ts

@@ -1,10 +1,10 @@
-// @forge-generated generator=0.1.0-alpha.4 input=4af795b70ec62dc5967f6e9b78865cfbc8afb09275e575845cf80a360b3b85e2 content=a5b050935bb13ffac31c4e8f6b4a0a5e08cd84e7df079cce295b225302323b3a
+// @forge-generated generator=0.1.0-alpha.6 input=83fec05765e1108f1188333308a145d7655ba77bbcb979c2299f4c325df466c7 content=f8102bdc43faab49b19db396e6444a974f1daca77d232f9db831b74b354ba7c3
 export const actionSubscriptions = {
   "analyzerVersion": "0.1.0",
   "byEvent": {},
   "diagnostics": [],
-  "generatorVersion": "0.1.0-alpha.4",
-  "inputHash": "c52261a0b76af0f64feadff97d3852e815fa814de2566d0d1fce9e4805d1bfab",
+  "generatorVersion": "0.1.0-alpha.6",
+  "inputHash": "b372718ace2a84e8bcc38ab238add25faa6cf49bd65a00242101d07f5fdc5843",
   "schemaVersion": "0.1.0",
   "subscriptions": []
 } as const;

package/src/forge/_generated/agentAdapterManifest.json

@@ -1,2 +1,2 @@
-// @forge-generated generator=0.1.0-alpha.4 input=4af795b70ec62dc5967f6e9b78865cfbc8afb09275e575845cf80a360b3b85e2 content=488bf387fd048437f772a253b7b64f6a51c25d1f2e6d7d07f7a8c971e0c8c90d
-{"generatorVersion":"0.1.0-alpha.4","schemaVersion":"0.1.0","sourceHash":"sha256:69500f8aefc9e77c7049e70279cadc0242fbeb0be0390ef26b051889956ad680","targets":[{"adapterVersion":"agent-adapter-0.1.0","default":true,"files":["AGENTS.md",".forge/agent/context.json",".forge/agent/commands.json",".forge/agent/done-criteria.json",".forge/agent/playbooks/add-command.md",".forge/agent/playbooks/add-query.md",".forge/agent/playbooks/add-livequery.md",".forge/agent/playbooks/add-resource.md",".forge/agent/playbooks/refactor-field.md",".forge/agent/playbooks/fix-policy-denied.md",".forge/agent/playbooks/fix-guard-violation.md",".forge/agent/playbooks/upgrade-package.md",".forge/agent/playbooks/debug-trace.md",".forge/agent/playbooks/frontend-change.md",".forge/agent/playbooks/self-host-check.md"],"formatVersion":"2026-06","name":"generic"},{"adapterVersion":"agent-adapter-0.1.0","files":[".codex/skills/forge-add-command/SKILL.md",".codex/skills/forge-add-resource/SKILL.md",".codex/skills/forge-fix-guard-violation/SKILL.md",".codex/skills/forge-fix-policy-denied/SKILL.md",".codex/skills/forge-upgrade-package/SKILL.md",".codex/skills/forge-debug-trace/SKILL.md",".codex/agents/forge-explorer.toml",".codex/agents/forge-worker.toml",".codex/agents/forge-reviewer.toml",".codex/agents/forge-security.toml"],"formatVersion":"2026-06","name":"codex","optional":true},{"adapterVersion":"agent-adapter-0.1.0","files":[".cursor/rules/forge-runtime.mdc",".cursor/rules/forge-frontend.mdc",".cursor/rules/forge-security.mdc",".cursor/rules/forge-workflow.mdc"],"formatVersion":"2026-06","name":"cursor","optional":true},{"adapterVersion":"agent-adapter-0.1.0","files":["CLAUDE.md",".claude/forge-runtime.md",".claude/forge-playbooks.md",".claude/forge-security.md"],"formatVersion":"2026-06","name":"claude","optional":true}]}
+// @forge-generated generator=0.1.0-alpha.6 input=83fec05765e1108f1188333308a145d7655ba77bbcb979c2299f4c325df466c7 content=3a0f0150c33fca97d9c0d2c8d769647b751e4bebf6e3cf1911fe7ce369f3b544
+{"generatorVersion":"0.1.0-alpha.6","schemaVersion":"0.1.0","sourceHash":"sha256:46cf2a7f40b21f129a965674e9529b879cca89f4f7e3ac0f2dcd3f4a65bbb12c","targets":[{"adapterVersion":"agent-adapter-0.1.0","default":true,"files":["AGENTS.md",".forge/agent/context.json",".forge/agent/commands.json",".forge/agent/done-criteria.json",".forge/agent/playbooks/add-command.md",".forge/agent/playbooks/add-query.md",".forge/agent/playbooks/add-livequery.md",".forge/agent/playbooks/add-resource.md",".forge/agent/playbooks/refactor-field.md",".forge/agent/playbooks/fix-policy-denied.md",".forge/agent/playbooks/fix-guard-violation.md",".forge/agent/playbooks/upgrade-package.md",".forge/agent/playbooks/debug-trace.md",".forge/agent/playbooks/frontend-change.md",".forge/agent/playbooks/self-host-check.md"],"formatVersion":"2026-06","name":"generic"},{"adapterVersion":"agent-adapter-0.1.0","files":[".codex/skills/forge-add-command/SKILL.md",".codex/skills/forge-add-resource/SKILL.md",".codex/skills/forge-fix-guard-violation/SKILL.md",".codex/skills/forge-fix-policy-denied/SKILL.md",".codex/skills/forge-upgrade-package/SKILL.md",".codex/skills/forge-debug-trace/SKILL.md",".codex/agents/forge-explorer.toml",".codex/agents/forge-worker.toml",".codex/agents/forge-reviewer.toml",".codex/agents/forge-security.toml"],"formatVersion":"2026-06","name":"codex","optional":true},{"adapterVersion":"agent-adapter-0.1.0","files":[".cursor/rules/forge-runtime.mdc",".cursor/rules/forge-frontend.mdc",".cursor/rules/forge-security.mdc",".cursor/rules/forge-workflow.mdc"],"formatVersion":"2026-06","name":"cursor","optional":true},{"adapterVersion":"agent-adapter-0.1.0","files":["CLAUDE.md",".claude/forge-runtime.md",".claude/forge-playbooks.md",".claude/forge-security.md"],"formatVersion":"2026-06","name":"claude","optional":true}]}

package/src/forge/_generated/agentAdapterManifest.ts

@@ -1,8 +1,8 @@
-// @forge-generated generator=0.1.0-alpha.4 input=4af795b70ec62dc5967f6e9b78865cfbc8afb09275e575845cf80a360b3b85e2 content=a111bf4de7c15892a6465afaf86be51e792266d18f2f526fd03a78f9f08f89c6
+// @forge-generated generator=0.1.0-alpha.6 input=83fec05765e1108f1188333308a145d7655ba77bbcb979c2299f4c325df466c7 content=8b27906c552e1c4d3c4f1e6caaa47e03455da4ec6c215cfe1b31b91938f8c094
 export const agentAdapterManifest = {
-  "generatorVersion": "0.1.0-alpha.4",
+  "generatorVersion": "0.1.0-alpha.6",
   "schemaVersion": "0.1.0",
-  "sourceHash": "sha256:69500f8aefc9e77c7049e70279cadc0242fbeb0be0390ef26b051889956ad680",
+  "sourceHash": "sha256:46cf2a7f40b21f129a965674e9529b879cca89f4f7e3ac0f2dcd3f4a65bbb12c",
   "targets": [
     {
       "adapterVersion": "agent-adapter-0.1.0",