forgeos 0.1.0-alpha.41 → 0.1.0-alpha.43

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.41","releaseId":"forgeos@0.1.0-alpha.41+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.43","releaseId":"forgeos@0.1.0-alpha.43+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.41 input=472a35507fac4f297d64b66cb443aa712ceb113986ac03317278c6464c17cdd4 content=ba31c1269d2cbbe1fdb5c6dc20de16dabe1afbe97d1af2a72346806ad2d17e16
+// @forge-generated generator=0.1.0-alpha.43 input=f15e1d5ecb88338643677cb7fb622a7ccdcf347f2b5c020ea5ce16b33f7d1f56 content=26804428ac690374e29343ac563ce217391f23b1039aad88e6ae0a1b05aa2036
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.41",
-  "releaseId": "forgeos@0.1.0-alpha.41+unknown",
+  "packageVersion": "0.1.0-alpha.43",
+  "releaseId": "forgeos@0.1.0-alpha.43+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/auth.ts

@@ -258,6 +258,7 @@ function buildMultiTenantProof(workspaceRoot: string, workos: ReturnType<typeof
     nextActions: [
       "forge workos doctor --json",
       "forge workos seed --file workos-seed.yml --dry-run --json",
+      "forge workos prove --file workos-seed.yml --json",
       "run an HTTP E2E with Acme and Globex tokens before production",
     ],
   });

package/src/forge/cli/commands.ts

@@ -224,6 +224,11 @@ import {
   formatFieldTestJson,
   runFieldTestCommand,
 } from "./field-test.ts";
+import {
+  formatSeedHuman,
+  formatSeedJson,
+  runSeedCommand,
+} from "./seed.ts";
 import {
   formatLastHuman,
   formatLastJson,
@@ -1966,6 +1971,11 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       process.stdout.write(command.json ? formatFieldTestJson(result) : formatFieldTestHuman(result));
       return result.exitCode;
     }
+    case "seed": {
+      const result = await runSeedCommand(command);
+      process.stdout.write(command.json ? formatSeedJson(result) : formatSeedHuman(result));
+      return result.exitCode;
+    }
     case "rls": {
       const result = await runRlsCommand(command);
       if (command.json) {
@@ -2525,6 +2535,9 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         envFile: command.envFile,
         skipStartupConsole: command.skipStartupConsole,
         detach: command.detach,
+        seed: command.seed,
+        seedCommand: command.seedCommand,
+        seedAllTenants: command.seedAllTenants,
         lifecycle: command.lifecycle,
       });
       return result.exitCode;

package/src/forge/cli/deploy.ts

@@ -13,7 +13,7 @@ import { runAuthCommand } from "./auth.ts";
 import { runAuthMdCommand } from "./authmd.ts";
 import { runWorkOSCommand } from "./workos.ts";
 
-export type DeploySubcommand = "plan" | "check" | "render" | "verify";
+export type DeploySubcommand = "plan" | "check" | "render" | "package" | "verify";
 export type DeployTarget = "docker" | "forge-cloud";
 
 export interface DeployCommandOptions {
@@ -119,25 +119,104 @@ function fieldTestReportCandidates(workspaceRoot: string): Array<{ path: string;
   });
 }
 
+const FIELD_TEST_PRODUCTION_COMMAND = "forge field-test run --realistic --json";
+
 function summarizeFieldTestReport(data: Record<string, unknown>) {
   const results = Array.isArray(data.results) ? data.results as Array<Record<string, unknown>> : [];
   const failed = results.filter((result) => result.ok === false && result.skipped !== true);
   const skipped = results.filter((result) => result.skipped === true);
+  const executed = results.filter((result) => result.skipped !== true);
+  const topLevelSteps = results.flatMap((result) =>
+    Array.isArray(result.steps) ? result.steps as Array<Record<string, unknown>> : [],
+  );
   const runtimeSteps = results.flatMap((result) => {
     const runtime = result.runtime && typeof result.runtime === "object"
       ? result.runtime as Record<string, unknown>
       : {};
     return Array.isArray(runtime.steps) ? runtime.steps as Array<Record<string, unknown>> : [];
   });
+  const commandOf = (step: unknown): string =>
+    step && typeof step === "object" && typeof (step as { command?: unknown }).command === "string"
+      ? (step as { command: string }).command
+      : "";
+  const okStep = (step: unknown): boolean =>
+    Boolean(step && typeof step === "object" && (step as { ok?: unknown }).ok === true);
+  const hasOkRuntimeCommand = (pattern: RegExp): boolean =>
+    runtimeSteps.some((step) => okStep(step) && pattern.test(commandOf(step)));
+  const hasOkTopLevelCommand = (pattern: RegExp): boolean =>
+    topLevelSteps.some((step) => okStep(step) && pattern.test(commandOf(step)));
+  const authSetupProbeSteps = topLevelSteps.filter((step) =>
+    /forge\s+(?:--\s+)?(add\s+auth\s+workos|authmd\s+generate|authmd\s+check|workos\s+doctor|workos\s+seed|workos\s+prove|auth\s+prove)/.test(commandOf(step)),
+  );
+  const authMetadataProbeSteps = runtimeSteps.filter((step) =>
+    /^(HEAD|GET)\s+https?:\/\/[^/]+\/(auth\.md|\.well-known\/oauth-protected-resource)\b/i.test(commandOf(step)),
+  );
+  const uiErgonomicsResults = results
+    .map((result) => result.uiErgonomics)
+    .filter((value): value is Record<string, unknown> => Boolean(value && typeof value === "object"));
+  const uiErgonomicsWarnings = uiErgonomicsResults.reduce((total, result) =>
+    total + (typeof result.warnings === "number" ? result.warnings : 0), 0);
+  const uiErgonomicsErrors = uiErgonomicsResults.reduce((total, result) =>
+    total + (typeof result.errors === "number" ? result.errors : 0), 0);
+  const runtimeProbes = data.runtimeProbes === true;
+  const authProbes = data.authProbes === true;
+  const uiProbes = data.uiProbes === true;
+  const uiProbeSteps = runtimeSteps.filter((step) =>
+    /^GET\s+https?:\/\/[^/]+\/$/i.test(commandOf(step)),
+  );
+  const uiErgonomics = uiProbes !== true || (executed.length > 0 && uiErgonomicsResults.length === executed.length);
+  const runtimeHealthEvidence = !runtimeProbes || hasOkRuntimeCommand(/\bGET\s+.*\/health\b/i);
+  const runtimeEntriesEvidence = !runtimeProbes || hasOkRuntimeCommand(/\bGET\s+.*\/entries\b/i);
+  const authSetupEvidence = !authProbes || [
+    /forge\s+(?:--\s+)?add\s+auth\s+workos\b/,
+    /forge\s+(?:--\s+)?authmd\s+generate\b/,
+    /forge\s+(?:--\s+)?authmd\s+check\b/,
+    /forge\s+(?:--\s+)?workos\s+doctor\b/,
+    /forge\s+(?:--\s+)?workos\s+seed\b/,
+    /forge\s+(?:--\s+)?workos\s+prove\b/,
+    /forge\s+(?:--\s+)?auth\s+prove\b/,
+  ].every((pattern) => hasOkTopLevelCommand(pattern));
+  const authMetadataEvidence = !authProbes || [
+    /^HEAD\s+.*\/auth\.md\b/i,
+    /^GET\s+.*\/auth\.md\b/i,
+    /^HEAD\s+.*\/\.well-known\/oauth-protected-resource\b/i,
+    /^GET\s+.*\/\.well-known\/oauth-protected-resource\b/i,
+  ].every((pattern) => hasOkRuntimeCommand(pattern));
+  const uiProbeEvidence = !uiProbes || uiProbeSteps.some((step) => okStep(step));
+  const productionEvidenceMissing = [
+    ...(data.ok !== true ? ["passing field-test report"] : []),
+    ...(!runtimeProbes ? ["runtime probes"] : []),
+    ...(!authProbes ? ["auth probes"] : []),
+    ...(!uiProbes ? ["ui probes"] : []),
+    ...(!runtimeHealthEvidence ? ["runtime health probe"] : []),
+    ...(!runtimeEntriesEvidence ? ["runtime entries probe"] : []),
+    ...(!authSetupEvidence ? ["auth setup probes"] : []),
+    ...(!authMetadataEvidence ? ["auth metadata endpoint probes"] : []),
+    ...(!uiProbeEvidence ? ["web UI probe"] : []),
+    ...(!uiErgonomics ? ["UI ergonomics audit"] : []),
+    ...(uiErgonomicsErrors > 0 ? ["zero UI ergonomics errors"] : []),
+    ...(failed.length > 0 ? ["zero failed cases"] : []),
+  ];
   return {
     ok: data.ok === true,
     cases: results.length,
     passed: results.filter((result) => result.ok === true && result.skipped !== true).length,
     failed: failed.length,
     skipped: skipped.length,
-    runtimeProbes: data.runtimeProbes === true,
-    authProbes: data.authProbes === true,
+    runtimeProbes,
+    authProbes,
+    uiProbes,
+    uiErgonomics,
+    uiErgonomicsWarnings,
+    uiErgonomicsErrors,
     runtimeProbeSteps: runtimeSteps.length,
+    authSetupProbeSteps: authSetupProbeSteps.length,
+    authMetadataProbeSteps: authMetadataProbeSteps.length,
+    uiProbeSteps: uiProbeSteps.length,
+    productionEvidence: {
+      readyForDeployCheck: productionEvidenceMissing.length === 0,
+      missing: productionEvidenceMissing,
+    },
   };
 }
 
@@ -431,13 +510,13 @@ function databaseReadyCommand(options: DeployCommandOptions): string {
   if (hasRenderedProductionEnvExample(options.workspaceRoot)) {
     return "cp deploy/.env.production.example deploy/.env.production";
   }
-  return "forge deploy render docker";
+  return "forge deploy package --target docker";
 }
 
 function renderProductionReadme(): string {
   return `# ForgeOS Production Deploy
 
-This directory is generated by \`forge deploy render docker\`.
+This directory is generated by \`forge deploy package --target docker\`.
 
 ## 1. Prepare production env
 
@@ -463,7 +542,7 @@ forge generate --check --json
 forge check --json
 forge authmd generate --json
 forge auth prove --scenario multi-tenant --json
-forge field-test run --runtime-probes --auth-probes --json
+forge field-test run --realistic --json
 forge deploy check --production --json
 \`\`\`
 
@@ -492,15 +571,15 @@ function buildPlan(options: DeployCommandOptions): DeployCommandResult {
         "forge deploy check --production --json",
         "forge auth check --production --json",
         "forge authmd check --json",
-        "forge field-test run --runtime-probes --auth-probes --json",
+        FIELD_TEST_PRODUCTION_COMMAND,
         "forge field-test report --json",
         "forge deploy verify --production --url https://<your-forge-cloud-app> --json",
       ]
     : [
-        "forge deploy render docker",
+        "forge deploy package --target docker",
         "cp deploy/.env.production.example deploy/.env.production",
         "forge deploy check --production --json",
-        "forge field-test run --runtime-probes --auth-probes --json",
+        FIELD_TEST_PRODUCTION_COMMAND,
         "docker compose -f deploy/docker-compose.yml up --build",
         "forge deploy verify --production --url https://app.example.com --json",
       ];
@@ -524,7 +603,7 @@ function buildPlan(options: DeployCommandOptions): DeployCommandResult {
         "production database env evidence is present",
         "required secret names are present",
         "auth.md and protected-resource metadata are published",
-        "field-test report exists with runtime/auth probes",
+        "field-test report exists with runtime/auth/UI probes",
         "runtime /health responds",
         "tenant and policy proof is run before public traffic",
       ],
@@ -693,20 +772,32 @@ async function buildChecks(options: DeployCommandOptions): Promise<DeployCommand
   const fieldReports = fieldTestReportCandidates(options.workspaceRoot);
   const latestFieldReport = fieldReports[0];
   const fieldSummary = latestFieldReport ? summarizeFieldTestReport(latestFieldReport.data) : null;
+  const fieldReportComplete = Boolean(fieldSummary?.productionEvidence.readyForDeployCheck);
+  const fieldReportMissing = fieldSummary?.productionEvidence.missing ?? [];
   checks.push({
     name: "field-test-report",
-    ok: Boolean(fieldSummary?.ok && fieldSummary.runtimeProbes && fieldSummary.authProbes),
+    ok: fieldReportComplete,
     severity: options.production ? "error" : "warning",
     message: fieldSummary?.ok
-      ? fieldSummary.runtimeProbes && fieldSummary.authProbes
-        ? `field-test report ${latestFieldReport?.path} passed with runtime and auth probes`
-        : `field-test report ${latestFieldReport?.path} passed but is missing runtime/auth probes`
+      ? fieldReportComplete
+        ? `field-test report ${latestFieldReport?.path} passed with concrete runtime, auth, metadata, UI, and ergonomics evidence`
+        : `field-test report ${latestFieldReport?.path} passed but is missing deploy evidence: ${fieldReportMissing.join(", ")}`
       : latestFieldReport
         ? `field-test report ${latestFieldReport.path} did not pass`
-        : "no field-test report found; run forge field-test run --runtime-probes --auth-probes --json",
-    command: "forge field-test run --runtime-probes --auth-probes --json",
+      : `no field-test report found; run ${FIELD_TEST_PRODUCTION_COMMAND}`,
+    command: FIELD_TEST_PRODUCTION_COMMAND,
     details: latestFieldReport ? { path: latestFieldReport.path, summary: fieldSummary } : undefined,
   });
+  if (fieldSummary?.uiErgonomicsWarnings) {
+    checks.push({
+      name: "field-test-ui-ergonomics",
+      ok: false,
+      severity: "warning",
+      message: `field-test UI ergonomics audit reported ${fieldSummary.uiErgonomicsWarnings} warning(s); fix the product surface before treating the app as polished`,
+      command: "forge inspect ui --ergonomics --json",
+      details: { path: latestFieldReport?.path, summary: fieldSummary },
+    });
+  }
   checks.push({
     name: "frontend-build-script",
     ok: !readGeneratedJson<FrontendGraph>(options.workspaceRoot, `${GENERATED_DIR}/frontendGraph.json`)?.present || hasScript(options.workspaceRoot, "build") || hasScript(join(options.workspaceRoot, "web"), "build"),
@@ -759,7 +850,7 @@ function renderDocker(options: DeployCommandOptions): DeployCommandResult {
     schemaVersion: "0.1.0",
     ok: true,
     kind: "deploy",
-    action: "render",
+    action: options.subcommand,
     target: options.target,
     production: options.production,
     checks: [],
@@ -866,7 +957,7 @@ async function verifyUrl(options: DeployCommandOptions): Promise<DeployCommandRe
 export async function runDeployCommand(options: DeployCommandOptions): Promise<DeployCommandResult> {
   if (options.subcommand === "plan") return buildPlan(options);
   if (options.subcommand === "check") return buildChecks(options);
-  if (options.subcommand === "render") return renderDocker(options);
+  if (options.subcommand === "render" || options.subcommand === "package") return renderDocker(options);
   return verifyUrl(options);
 }
 

package/src/forge/cli/dev.ts

@@ -34,6 +34,7 @@ import { FORGE_PGLITE_STORE_ABORTED } from "../compiler/diagnostics/codes.ts";
 import { isPgliteAbortMessage } from "../runtime/db/pglite-adapter.ts";
 import { forgeCliCommandForWorkspace, forgeCliCommandsForWorkspace } from "../workspace/forge-cli.ts";
 import { writeLastRunRecord } from "./last-run.ts";
+import { runSeedCommand, type SeedCommandResult } from "./seed.ts";
 
 export interface DevCommandOptions {
   workspaceRoot: string;
@@ -58,6 +59,9 @@ export interface DevCommandOptions {
   allowDevAuth?: boolean;
   skipStartupConsole?: boolean;
   detach?: boolean;
+  seed?: boolean;
+  seedCommand?: string;
+  seedAllTenants?: boolean;
   lifecycle?: "status" | "stop";
 }
 
@@ -75,7 +79,7 @@ export interface DevGenerateResult {
   exitCode: 0 | 1;
 }
 
-interface DevStartupGeneratedEvidence {
+export interface DevStartupGeneratedEvidence {
   ok: boolean;
   state: "fresh" | "regenerated" | "stale-risk";
   changedFiles: number;
@@ -86,7 +90,7 @@ interface DevStartupGeneratedEvidence {
   checkCommand: string;
 }
 
-interface WebDevServerHandle {
+export interface WebDevServerHandle {
   url: string;
   port: number;
   requestedPort?: number;
@@ -95,7 +99,7 @@ interface WebDevServerHandle {
   stop: () => void;
 }
 
-interface DevStartupSummary {
+export interface DevStartupSummary {
   schemaVersion: "0.1.0";
   ok: true;
   mode: "dev";
@@ -155,11 +159,31 @@ interface DevStartupSummary {
     checkCommand: string;
     message: string;
   };
+  seed: {
+    requested: boolean;
+    available: boolean;
+    commands: string[];
+    selectedCommand?: string;
+    readiness?: SeedCommandResult["readiness"];
+    ran: boolean;
+    ok?: boolean;
+    responseStatus?: number;
+    tenantRuns?: Array<{
+      tenantId: string;
+      label?: string;
+      organizationName?: string;
+      ok: boolean;
+      responseStatus?: number;
+    }>;
+    error?: string;
+    nextActions: string[];
+  };
   next: {
     browserUrl: string;
     apiIndex: string;
     inspect: string;
     verify: string;
+    changed: string;
   };
   pid: number;
 }
@@ -283,6 +307,9 @@ function buildDetachedDevArgs(options: DevCommandOptions): string[] {
   if (options.webPort !== undefined) args.push("--web-port", String(options.webPort));
   if (options.telemetry.length > 0) args.push("--telemetry", options.telemetry.join(","));
   if (options.envFile) args.push("--env-file", options.envFile);
+  if (options.seed) args.push("--seed");
+  if (options.seedCommand) args.push("--seed-command", options.seedCommand);
+  if (options.seedAllTenants) args.push("--all-tenants");
   return args;
 }
 
@@ -486,6 +513,27 @@ async function isPortAvailable(host: string, port: number): Promise<boolean> {
   });
 }
 
+async function reserveEphemeralPort(host: string): Promise<number> {
+  const server = createNetServer();
+  return new Promise<number>((resolve, reject) => {
+    const cleanup = () => {
+      server.removeAllListeners();
+    };
+    server.once("error", (error) => {
+      cleanup();
+      reject(error);
+    });
+    server.listen(0, host, () => {
+      const address = server.address();
+      const port = typeof address === "object" && address !== null ? address.port : 0;
+      server.close(() => {
+        cleanup();
+        resolve(port);
+      });
+    });
+  });
+}
+
 function classifyDevStartFailure(input: {
   rawMessage: string;
   host: string;
@@ -602,7 +650,11 @@ export async function resolveAvailableWebPort(input: {
   const attempts = input.maxAttempts ?? 20;
   const start = Math.max(0, Math.floor(input.preferredPort));
   if (start === 0) {
-    return { port: 0, autoPortSelected: false };
+    return {
+      port: await reserveEphemeralPort(input.host),
+      requestedPort: 0,
+      autoPortSelected: true,
+    };
   }
 
   for (let offset = 0; offset < attempts; offset += 1) {
@@ -787,12 +839,27 @@ function startWebDevServer(input: {
   };
 }
 
-function buildStartupSummary(input: {
+function seedReadinessForWorkspace(
+  workspaceRoot: string,
+  readiness: SeedCommandResult["readiness"],
+): SeedCommandResult["readiness"] {
+  return {
+    ...readiness,
+    emptyWorkspaceRecovery: forgeCliCommandsForWorkspace(
+      workspaceRoot,
+      readiness.emptyWorkspaceRecovery,
+    ),
+  };
+}
+
+export function buildStartupSummary(input: {
   workspaceRoot: string;
   handle: DevServerHandle;
   web?: WebDevServerHandle | null;
   watch: boolean;
   generated?: DevStartupGeneratedEvidence;
+  seed?: SeedCommandResult;
+  seedRequested?: boolean;
 }): DevStartupSummary {
   const frontend = readGeneratedJson<FrontendGraph>(
     input.workspaceRoot,
@@ -819,6 +886,22 @@ function buildStartupSummary(input: {
         },
       ]
     : [];
+  if (input.seed && input.seed.subcommand !== "status" && input.seed.ok === false) {
+    warnings.push({
+      code: input.seed.diagnostics[0]?.code ?? "FORGE_SEED_FAILED",
+      message: input.seed.diagnostics[0]?.message ?? "Seed command failed.",
+      nextAction: forgeCliCommandForWorkspace(input.workspaceRoot, "forge seed status --json"),
+    });
+  }
+  for (const diagnostic of input.seed?.diagnostics.filter((item) => item.severity === "warning") ?? []) {
+    warnings.push({
+      code: diagnostic.code,
+      message: diagnostic.message,
+      nextAction: diagnostic.suggestedCommands?.[0]
+        ? forgeCliCommandForWorkspace(input.workspaceRoot, diagnostic.suggestedCommands[0])
+        : forgeCliCommandForWorkspace(input.workspaceRoot, "forge seed status --json"),
+    });
+  }
   const preview = previewSummaryFor({
     workspaceRoot: input.workspaceRoot,
     host: input.handle.host,
@@ -884,11 +967,34 @@ function buildStartupSummary(input: {
       checkCommand: input.generated?.checkCommand ?? forgeCliCommandForWorkspace(input.workspaceRoot, "forge generate --check --json"),
       message: input.generated?.message ?? (buildInfoRaw ? "generated artifacts are loaded" : "generated build info is missing"),
     },
+    seed: {
+      requested: input.seedRequested === true,
+      available: (input.seed?.commands.length ?? 0) > 0,
+      commands: input.seed?.commands.map((command) => command.name) ?? [],
+      ...(input.seed?.selectedCommand ? { selectedCommand: input.seed.selectedCommand } : {}),
+      ...(input.seed?.readiness ? { readiness: seedReadinessForWorkspace(input.workspaceRoot, input.seed.readiness) } : {}),
+      ran: input.seedRequested === true && input.seed?.subcommand !== "status",
+      ...(input.seed && input.seed.subcommand !== "status" ? { ok: input.seed.ok } : {}),
+      ...(input.seed?.response ? { responseStatus: input.seed.response.status } : {}),
+      ...(input.seed?.tenantRuns ? {
+        tenantRuns: input.seed.tenantRuns.map((run) => ({
+          tenantId: run.tenantId,
+          ...(run.label ? { label: run.label } : {}),
+          ...(run.organizationName ? { organizationName: run.organizationName } : {}),
+          ok: run.ok,
+          ...(run.response ? { responseStatus: run.response.status } : {}),
+        })),
+      } : {}),
+      ...(!input.seed?.ok && input.seed?.diagnostics[0]?.message ? { error: input.seed.diagnostics[0].message } : {}),
+      nextActions: input.seed?.nextActions.map((action) => forgeCliCommandForWorkspace(input.workspaceRoot, action)) ??
+        [forgeCliCommandForWorkspace(input.workspaceRoot, "forge seed status --json")],
+    },
     next: {
       browserUrl,
       apiIndex: input.handle.url,
       inspect: forgeCliCommandForWorkspace(input.workspaceRoot, "forge inspect summary --json"),
       verify: forgeCliCommandForWorkspace(input.workspaceRoot, "forge dev --once --json"),
+      changed: forgeCliCommandForWorkspace(input.workspaceRoot, "forge changed --json"),
     },
     pid: process.pid,
   };
@@ -898,7 +1004,7 @@ function printStartupJson(summary: DevStartupSummary): void {
   process.stdout.write(`${JSON.stringify(summary)}\n`);
 }
 
-function printStartupHuman(summary: DevStartupSummary): void {
+export function formatStartupHuman(summary: DevStartupSummary): string {
   const lines = ["Forge Dev", ""];
   lines.push("API runtime");
   lines.push(`  URL: ${summary.api.url}`);
@@ -909,6 +1015,39 @@ function printStartupHuman(summary: DevStartupSummary): void {
   lines.push(`  Generated: ${summary.generated.state}${summary.generated.changedFiles > 0 ? ` (${summary.generated.changedFiles} changed)` : ""}${summary.generated.runtimeStaleRisk ? " (stale risk)" : ""}`);
   lines.push(`  Generated note: ${summary.generated.message}`);
   lines.push(`  Generated check: ${summary.generated.checkCommand}`);
+  if (summary.seed.available || summary.seed.requested) {
+    lines.push(`  Seed: ${summary.seed.available ? summary.seed.commands.join(", ") : "none detected"}`);
+    if (summary.seed.readiness) {
+      const autoSeedNote = summary.seed.readiness.autoSeedMode !== "none"
+        ? summary.seed.readiness.autoSeedMode === "all-tenants"
+          ? " (npm run dev auto-seeds all local tenants)"
+          : " (npm run dev auto-seeds)"
+        : "";
+      lines.push(`  Seed readiness: ${summary.seed.readiness.ready ? "ready" : summary.seed.readiness.reason}${autoSeedNote}`);
+      if (summary.seed.readiness.emptyWorkspaceRecovery.length > 0) {
+        lines.push("  Seed recovery:");
+        for (const action of summary.seed.readiness.emptyWorkspaceRecovery) {
+          lines.push(`    - ${action}`);
+        }
+      }
+    }
+    if (summary.seed.requested) {
+      lines.push(`  Seed run: ${summary.seed.ok ? "ok" : "failed"}${summary.seed.selectedCommand ? ` (${summary.seed.selectedCommand})` : ""}${summary.seed.responseStatus ? ` HTTP ${summary.seed.responseStatus}` : ""}`);
+      if (summary.seed.tenantRuns && summary.seed.tenantRuns.length > 0) {
+        const okCount = summary.seed.tenantRuns.filter((run) => run.ok).length;
+        lines.push(`  Seed tenants: ${okCount}/${summary.seed.tenantRuns.length} ok`);
+        for (const run of summary.seed.tenantRuns) {
+          const label = run.organizationName ?? run.label ?? run.tenantId;
+          lines.push(`    - ${run.ok ? "ok" : "failed"} ${label} (${run.tenantId})${run.responseStatus ? ` HTTP ${run.responseStatus}` : ""}`);
+        }
+      }
+      if (summary.seed.error) {
+        lines.push(`  Seed error: ${summary.seed.error}`);
+      }
+    } else if (summary.seed.available) {
+      lines.push(`  Seed next: ${summary.seed.nextActions[0] ?? "forge seed dev --json"}`);
+    }
+  }
   for (const warning of summary.warnings) {
     lines.push(`  Warning ${warning.code}: ${warning.message}`);
     if (warning.nextAction) {
@@ -920,8 +1059,9 @@ function printStartupHuman(summary: DevStartupSummary): void {
   lines.push("Web app");
   if (summary.web) {
     lines.push(`  URL: ${summary.web.url}`);
-    if (summary.web.autoPortSelected && summary.web.requestedPort) {
-      lines.push(`  Requested port: ${summary.web.requestedPort} (busy; selected ${summary.web.port})`);
+    if (summary.web.autoPortSelected && summary.web.requestedPort !== undefined) {
+      const reason = summary.web.requestedPort === 0 ? "ephemeral" : "busy";
+      lines.push(`  Requested port: ${summary.web.requestedPort} (${reason}; selected ${summary.web.port})`);
     }
     lines.push(`  Framework: ${summary.web.framework}`);
     lines.push(`  API env: ${summary.web.apiUrlEnv ?? "unknown"}=${summary.api.url}`);
@@ -948,7 +1088,7 @@ function printStartupHuman(summary: DevStartupSummary): void {
   lines.push("Agent checks");
   lines.push(`  ${summary.next.verify}`);
   lines.push(`  ${summary.next.inspect}`);
-  lines.push("  forge changed --json");
+  lines.push(`  ${summary.next.changed}`);
   lines.push("");
 
   lines.push("Preview");
@@ -959,7 +1099,11 @@ function printStartupHuman(summary: DevStartupSummary): void {
   lines.push(`  Note: ${summary.preview.note}`);
   lines.push("");
 
-  process.stdout.write(`${lines.join("\n")}\n`);
+  return `${lines.join("\n")}\n`;
+}
+
+function printStartupHuman(summary: DevStartupSummary): void {
+  process.stdout.write(formatStartupHuman(summary));
 }
 
 function openBrowser(url: string): void {
@@ -1311,12 +1455,34 @@ export async function runDevCommand(
         json: options.json,
       });
 
+  const seedStatus = await runSeedCommand({
+    subcommand: "status",
+    command: options.seedCommand,
+    args: {},
+    url: handle.url,
+    json: true,
+    workspaceRoot,
+  });
+  const seedResult = options.seed
+    ? await runSeedCommand({
+        subcommand: "dev",
+        command: options.seedCommand ?? seedStatus.selectedCommand,
+        args: {},
+        url: handle.url,
+        allTenants: options.seedAllTenants,
+        json: true,
+        workspaceRoot,
+      })
+    : seedStatus;
+
   const startupSummary = buildStartupSummary({
     workspaceRoot,
     handle,
     web: webHandle,
     watch: options.watch,
     generated: startupGenerated,
+    seed: seedResult,
+    seedRequested: options.seed,
   });
   if (options.json) {
     printStartupJson(startupSummary);