forgeos 0.1.0-alpha.41 → 0.1.0-alpha.43

package/src/forge/cli/field-test.ts

@@ -1,6 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, isAbsolute, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { runNewCommand, type NewPackageManager, type NewTemplateName } from "./new.ts";
 import { normalizeForgeCliCommandsInValue } from "../workspace/forge-cli.ts";
 
@@ -21,6 +22,8 @@ export interface FieldTestCommandOptions {
   keep: boolean;
   runtimeProbes: boolean;
   authProbes: boolean;
+  uiProbes: boolean;
+  realistic: boolean;
   timeoutMs: number;
   writeReport?: string;
 }
@@ -40,8 +43,14 @@ export interface FieldTestCommandResult {
   exitCode: 0 | 1;
 }
 
-function scriptPath(workspaceRoot: string): string {
-  return join(workspaceRoot, "scripts", "field-test-forgeos.mjs");
+function scriptCandidates(workspaceRoot: string): string[] {
+  const localScript = join(workspaceRoot, "scripts", "field-test-forgeos.mjs");
+  const packageScript = join(dirname(fileURLToPath(import.meta.url)), "../../../scripts/field-test-forgeos.mjs");
+  return Array.from(new Set([localScript, packageScript]));
+}
+
+function scriptPath(workspaceRoot: string): string | null {
+  return scriptCandidates(workspaceRoot).find((candidate) => existsSync(candidate)) ?? null;
 }
 
 function compact(text: string, limit = 12000): string {
@@ -54,6 +63,10 @@ function defaultReportPath(): string {
   return ".forge/field-test-report.json";
 }
 
+function resolveReportPath(workspaceRoot: string, reportPath: string): string {
+  return isAbsolute(reportPath) ? reportPath : join(workspaceRoot, reportPath);
+}
+
 function parseJsonOutput(text: string): unknown | null {
   const trimmed = text.trim();
   if (!trimmed) return null;
@@ -77,19 +90,156 @@ function summarizeReport(data: unknown) {
   const plannedCases = Array.isArray(root.cases) ? root.cases as Array<Record<string, unknown>> : [];
   const failed = results.filter((result) => result.ok === false && result.skipped !== true);
   const skipped = results.filter((result) => result.skipped === true);
+  const topLevelSteps = results.flatMap((result) =>
+    Array.isArray(result.steps) ? result.steps as unknown[] : [],
+  );
   const runtimeProbeSteps = results.flatMap((result) => {
     const runtime = result.runtime && typeof result.runtime === "object"
       ? result.runtime as Record<string, unknown>
       : {};
     return Array.isArray(runtime.steps) ? runtime.steps as unknown[] : [];
   });
+  const hasVendorAccessCase = results.some((result) => result.template === "vendor-access");
+  const commandOf = (step: unknown): string =>
+    step && typeof step === "object" && typeof (step as { command?: unknown }).command === "string"
+      ? (step as { command: string }).command
+      : "";
+  const stdoutOf = (step: unknown): string =>
+    step && typeof step === "object" && typeof (step as { stdout?: unknown }).stdout === "string"
+      ? (step as { stdout: string }).stdout
+      : "";
+  const okStep = (step: unknown): boolean =>
+    Boolean(step && typeof step === "object" && (step as { ok?: unknown }).ok === true);
+  const jsonOfStep = (step: unknown): Record<string, unknown> | null => {
+    const stdout = stdoutOf(step).trim();
+    if (!stdout) return null;
+    const parsed = parseJsonOutput(stdout);
+    return parsed && typeof parsed === "object" ? parsed as Record<string, unknown> : null;
+  };
+  const hasOkRuntimeCommand = (pattern: RegExp): boolean =>
+    runtimeProbeSteps.some((step) => okStep(step) && pattern.test(commandOf(step)));
+  const hasOkTopLevelCommand = (pattern: RegExp): boolean =>
+    topLevelSteps.some((step) => okStep(step) && pattern.test(commandOf(step)));
+  const seedProbeSteps = runtimeProbeSteps.filter((step) => commandOf(step).includes("seed-"));
+  const seedReadinessSteps = runtimeProbeSteps.filter((step) => commandOf(step).includes("seed-status"));
+  const seedReadinessResults = seedReadinessSteps
+    .filter((step) => okStep(step))
+    .map((step) => {
+      const payload = jsonOfStep(step);
+      const readiness = payload?.readiness && typeof payload.readiness === "object"
+        ? payload.readiness as Record<string, unknown>
+        : {};
+      const recovery = Array.isArray(readiness.emptyWorkspaceRecovery)
+        ? readiness.emptyWorkspaceRecovery.filter((item) => typeof item === "string")
+        : [];
+      return {
+        ready: readiness.ready === true,
+        autoSeedOnDev: readiness.autoSeedOnDev === true,
+        autoSeedAllTenantsOnDev: readiness.autoSeedAllTenantsOnDev === true,
+        autoSeedMode: typeof readiness.autoSeedMode === "string" ? readiness.autoSeedMode : undefined,
+        selectedCommand: typeof readiness.selectedCommand === "string" ? readiness.selectedCommand : undefined,
+        recoveryCommands: recovery.length,
+      };
+    });
+  const seedReadinessEvidence = !hasVendorAccessCase || seedReadinessResults.some((result) =>
+    result.ready &&
+    result.selectedCommand === "seedVendorAccessDemo" &&
+    result.recoveryCommands >= 2,
+  );
+  const seedAllTenantsAutoSeedEvidence = !hasVendorAccessCase || seedReadinessResults.some((result) =>
+    result.ready &&
+    result.selectedCommand === "seedVendorAccessDemo" &&
+    (result.autoSeedMode === "all-tenants" || result.autoSeedAllTenantsOnDev),
+  );
+  const vendorAccessProbeSteps = runtimeProbeSteps.filter((step) => commandOf(step).includes("vendor-access-"));
+  const uiProbeSteps = runtimeProbeSteps.filter((step) => /^GET\s+https?:\/\/[^/]+\/$/i.test(commandOf(step)));
+  const authMetadataProbeSteps = runtimeProbeSteps.filter((step) =>
+    /^(HEAD|GET)\s+https?:\/\/[^/]+\/(auth\.md|\.well-known\/oauth-protected-resource)\b/i.test(commandOf(step)),
+  );
+  const authSetupProbeSteps = topLevelSteps.filter((step) =>
+    /forge\s+(?:--\s+)?(add\s+auth\s+workos|authmd\s+generate|authmd\s+check|workos\s+doctor|workos\s+seed|workos\s+prove|auth\s+prove)/.test(commandOf(step)),
+  );
+  const uiErgonomicsResults = results
+    .map((result) => result.uiErgonomics)
+    .filter((value): value is Record<string, unknown> => Boolean(value && typeof value === "object"));
+  const uiErgonomicsWarnings = uiErgonomicsResults.reduce((total, result) =>
+    total + (typeof result.warnings === "number" ? result.warnings : 0), 0);
+  const uiErgonomicsErrors = uiErgonomicsResults.reduce((total, result) =>
+    total + (typeof result.errors === "number" ? result.errors : 0), 0);
+  const uiErgonomicsWarningCodes = Array.from(new Set(uiErgonomicsResults.flatMap((result) =>
+    Array.isArray(result.diagnosticCodes)
+      ? result.diagnosticCodes.filter((code): code is string => typeof code === "string")
+      : [],
+  ))).sort();
+  const uiScenarioNames = Array.from(new Set(uiErgonomicsResults.flatMap((result) =>
+    Array.isArray(result.scenarioNames)
+      ? result.scenarioNames.filter((name): name is string => typeof name === "string")
+      : [],
+  ))).sort();
+  const vendorAccessRequiredUiScenarios = [
+    "vendor-access-autoseed-data-visible",
+    "vendor-access-local-login",
+    "vendor-access-requester-denied-visible",
+    "vendor-access-seed-control-visible",
+  ];
   const ok = root.ok === true;
   const runtimeProbes = root.runtimeProbes === true;
   const authProbes = root.authProbes === true;
+  const uiProbes = root.uiProbes === true;
+  const uiErgonomics = !uiProbes || (results.length > 0 && uiErgonomicsResults.length === results.filter((result) => result.skipped !== true).length);
+  const runtimeHealthEvidence = !runtimeProbes || hasOkRuntimeCommand(/\bGET\s+.*\/health\b/i);
+  const runtimeEntriesEvidence = !runtimeProbes || hasOkRuntimeCommand(/\bGET\s+.*\/entries\b/i);
+  const authSetupEvidence = !authProbes || [
+    /forge\s+(?:--\s+)?add\s+auth\s+workos\b/,
+    /forge\s+(?:--\s+)?authmd\s+generate\b/,
+    /forge\s+(?:--\s+)?authmd\s+check\b/,
+    /forge\s+(?:--\s+)?workos\s+doctor\b/,
+    /forge\s+(?:--\s+)?workos\s+seed\b/,
+    /forge\s+(?:--\s+)?workos\s+prove\b/,
+    /forge\s+(?:--\s+)?auth\s+prove\b/,
+  ].every((pattern) => hasOkTopLevelCommand(pattern));
+  const authMetadataEvidence = !authProbes || [
+    /^HEAD\s+.*\/auth\.md\b/i,
+    /^GET\s+.*\/auth\.md\b/i,
+    /^HEAD\s+.*\/\.well-known\/oauth-protected-resource\b/i,
+    /^GET\s+.*\/\.well-known\/oauth-protected-resource\b/i,
+  ].every((pattern) => hasOkRuntimeCommand(pattern));
+  const uiProbeEvidence = !uiProbes || uiProbeSteps.some((step) => okStep(step));
+  const vendorAccessSeedEvidence = !hasVendorAccessCase ||
+    hasOkRuntimeCommand(/vendor-access-seed-all-tenants:/) ||
+    [
+      /vendor-access-seed-acme:/,
+      /vendor-access-seed-globex:/,
+    ].every((pattern) => hasOkRuntimeCommand(pattern));
+  const vendorAccessEvidence = !hasVendorAccessCase || (
+    vendorAccessSeedEvidence &&
+    [
+      /vendor-access-query-acme:/,
+      /vendor-access-query-globex:/,
+      /vendor-access-owner-approve:/,
+      /vendor-access-requester-approve-denied:/,
+      /vendor-access-cross-tenant-approve-denied:/,
+    ].every((pattern) => hasOkRuntimeCommand(pattern))
+  );
+  const vendorAccessUiScenarioEvidence = !hasVendorAccessCase || !uiProbes ||
+    vendorAccessRequiredUiScenarios.every((scenario) => uiScenarioNames.includes(scenario));
   const productionEvidenceMissing = [
     ...(!ok ? ["passing field-test report"] : []),
     ...(!runtimeProbes ? ["runtime probes"] : []),
     ...(!authProbes ? ["auth probes"] : []),
+    ...(!uiProbes ? ["ui probes"] : []),
+    ...(!runtimeHealthEvidence ? ["runtime health probe"] : []),
+    ...(!runtimeEntriesEvidence ? ["runtime entries probe"] : []),
+    ...(!authSetupEvidence ? ["auth setup probes"] : []),
+    ...(!authMetadataEvidence ? ["auth metadata endpoint probes"] : []),
+    ...(!uiProbeEvidence ? ["web UI probe"] : []),
+    ...(!seedReadinessEvidence ? ["seed readiness evidence"] : []),
+    ...(!seedAllTenantsAutoSeedEvidence ? ["seed readiness all-tenants auto-seed evidence"] : []),
+    ...(!vendorAccessEvidence ? ["vendor-access multi-tenant domain probes"] : []),
+    ...(!vendorAccessUiScenarioEvidence ? ["vendor-access UI scenarios"] : []),
+    ...(!uiErgonomics ? ["UI ergonomics audit"] : []),
+    ...(uiErgonomicsWarnings > 0 ? ["zero UI ergonomics warnings"] : []),
+    ...(uiErgonomicsErrors > 0 ? ["zero UI ergonomics errors"] : []),
     ...(failed.length > 0 ? ["zero failed cases"] : []),
   ];
   return {
@@ -102,7 +252,35 @@ function summarizeReport(data: unknown) {
     skipped: skipped.length,
     runtimeProbes,
     authProbes,
+    uiProbes,
+    uiErgonomics,
+    uiErgonomicsWarnings,
+    uiErgonomicsErrors,
+    uiErgonomicsWarningCodes,
+    uiScenarios: {
+      names: uiScenarioNames,
+      vendorAccessReady: vendorAccessUiScenarioEvidence,
+      requiredVendorAccess: hasVendorAccessCase ? vendorAccessRequiredUiScenarios : [],
+    },
     runtimeProbeSteps: runtimeProbeSteps.length,
+    seedProbeSteps: seedProbeSteps.length,
+    seedReadiness: {
+      ready: seedReadinessEvidence,
+      steps: seedReadinessSteps.length,
+      autoSeedOnDev: seedReadinessResults.some((result) => result.autoSeedOnDev),
+      autoSeedAllTenantsOnDev: seedReadinessResults.some((result) => result.autoSeedAllTenantsOnDev),
+      allTenantsAutoSeedReady: seedAllTenantsAutoSeedEvidence,
+      autoSeedModes: Array.from(new Set(seedReadinessResults
+        .map((result) => result.autoSeedMode)
+        .filter((value): value is string => Boolean(value)))),
+      selectedCommands: Array.from(new Set(seedReadinessResults
+        .map((result) => result.selectedCommand)
+        .filter((value): value is string => Boolean(value)))),
+    },
+    authSetupProbeSteps: authSetupProbeSteps.length,
+    authMetadataProbeSteps: authMetadataProbeSteps.length,
+    uiProbeSteps: uiProbeSteps.length,
+    vendorAccessProbeSteps: vendorAccessProbeSteps.length,
     productionEvidence: {
       readyForDeployCheck: productionEvidenceMissing.length === 0,
       missing: productionEvidenceMissing,
@@ -119,11 +297,9 @@ function summarizeReport(data: unknown) {
 
 function runCommandForOptions(templates: NewTemplateName[], packageManagers: NewPackageManager[]): string {
   return [
-    "forge field-test run",
+    "forge field-test run --realistic",
     `--templates ${templates.join(",")}`,
     `--package-managers ${packageManagers.join(",")}`,
-    "--runtime-probes",
-    "--auth-probes",
     "--json",
   ].join(" ");
 }
@@ -136,7 +312,7 @@ async function createFieldTestApp(options: FieldTestCommandOptions): Promise<Fie
       kind: "field-test",
       action: "create",
       data: { error: "forge field-test create requires an app name" },
-      nextActions: ["forge field-test create vendor-access --auth workos --template minimal-web --json"],
+      nextActions: ["forge field-test create vendor-access --auth workos --json"],
       exitCode: 1,
     };
   }
@@ -152,9 +328,21 @@ async function createFieldTestApp(options: FieldTestCommandOptions): Promise<Fie
         template: options.template,
         packageManager: options.packageManager,
         auth: options.auth,
+        install: true,
+        git: true,
         command: `forge new ${options.name} --template ${options.template} --package-manager ${options.packageManager} --field-test --install`,
+        goldenPath: [
+          `forge field-test create ${options.name} --auth ${options.auth ?? "none"} --template ${options.template} --package-manager ${options.packageManager} --install --git --json`,
+          `cd ${options.name}`,
+          "forge field-test run --realistic --json",
+          "forge field-test report --json",
+          "forge deploy plan --target docker --json",
+          "forge deploy check --production --json",
+        ],
       },
-      nextActions: [`forge new ${options.name} --template ${options.template} --package-manager ${options.packageManager} --field-test --install`],
+      nextActions: [
+        `forge field-test create ${options.name} --auth ${options.auth ?? "none"} --template ${options.template} --package-manager ${options.packageManager} --install --git --json`,
+      ],
       exitCode: 0,
     });
   }
@@ -198,9 +386,12 @@ async function createFieldTestApp(options: FieldTestCommandOptions): Promise<Fie
             `${options.packageManager} run forge -- authmd check --json`,
             `${options.packageManager} run forge -- workos doctor --json`,
             `${options.packageManager} run forge -- workos seed --file workos-seed.yml --dry-run --json`,
+            `${options.packageManager} run forge -- workos prove --file workos-seed.yml --json`,
             `${options.packageManager} run forge -- workos setup --file workos-seed.yml --json`,
           ]
         : []),
+      `${options.packageManager} run forge -- field-test run --realistic --json`,
+      `${options.packageManager} run forge -- field-test report --json`,
       `${options.packageManager} run forge -- dev --once --json`,
       `${options.packageManager} run forge -- verify --smoke --json`,
       `${options.packageManager} run forge -- handoff --json`,
@@ -211,14 +402,14 @@ async function createFieldTestApp(options: FieldTestCommandOptions): Promise<Fie
 
 function runHarness(options: FieldTestCommandOptions): FieldTestCommandResult {
   const script = scriptPath(options.workspaceRoot);
-  if (!existsSync(script)) {
+  if (!script) {
     return {
       schemaVersion: "0.1.0",
       ok: false,
       kind: "field-test",
       action: "run",
-      data: { error: "field-test harness script not found", script },
-      nextActions: ["run from the ForgeOS framework checkout or use npm run field:test"],
+      data: { error: "field-test harness script not found", searched: scriptCandidates(options.workspaceRoot) },
+      nextActions: ["upgrade forgeos to a version that includes scripts/field-test-forgeos.mjs", "run from the ForgeOS framework checkout with npm run field:test"],
       exitCode: 1,
     };
   }
@@ -236,8 +427,9 @@ function runHarness(options: FieldTestCommandOptions): FieldTestCommandResult {
   ];
   if (options.dryRun) args.push("--dry-run");
   if (options.keep) args.push("--keep");
-  if (options.runtimeProbes) args.push("--runtime-probes");
-  if (options.authProbes) args.push("--auth-probes");
+  if (options.runtimeProbes || options.realistic) args.push("--runtime-probes");
+  if (options.authProbes || options.realistic) args.push("--auth-probes");
+  if (options.uiProbes || options.realistic) args.push("--ui-probes");
   if (options.forgeSpec) args.push("--forge-spec", options.forgeSpec);
   if (reportPath) args.push("--write-report", reportPath);
   if (options.json) args.push("--json");
@@ -246,7 +438,7 @@ function runHarness(options: FieldTestCommandOptions): FieldTestCommandResult {
     encoding: "utf8",
     windowsHide: true,
   });
-  const reportAbsolute = reportPath ? join(options.workspaceRoot, reportPath) : null;
+  const reportAbsolute = reportPath ? resolveReportPath(options.workspaceRoot, reportPath) : null;
   const reportData = reportAbsolute && existsSync(reportAbsolute)
     ? JSON.parse(readFileSync(reportAbsolute, "utf8")) as unknown
     : parseJsonOutput(result.stdout ?? "");
@@ -276,7 +468,7 @@ function readReport(options: FieldTestCommandOptions): FieldTestCommandResult {
     ".forge/field-test-report.json",
     "field-reports/full-alpha.json",
   ].filter(Boolean) as string[];
-  const report = candidates.find((candidate) => existsSync(join(options.workspaceRoot, candidate)));
+  const report = candidates.find((candidate) => existsSync(resolveReportPath(options.workspaceRoot, candidate)));
   if (!report) {
     return {
       schemaVersion: "0.1.0",
@@ -284,11 +476,11 @@ function readReport(options: FieldTestCommandOptions): FieldTestCommandResult {
       kind: "field-test",
       action: "report",
       data: { searched: candidates },
-      nextActions: ["forge field-test run --runtime-probes --auth-probes --write-report .forge/field-test-report.json --json"],
+      nextActions: ["forge field-test run --realistic --write-report .forge/field-test-report.json --json"],
       exitCode: 1,
     };
   }
-  const data = JSON.parse(readFileSync(join(options.workspaceRoot, report), "utf8")) as unknown;
+  const data = JSON.parse(readFileSync(resolveReportPath(options.workspaceRoot, report), "utf8")) as unknown;
   const summary = summarizeReport(data);
   const productionEvidence = (summary as { productionEvidence?: { readyForDeployCheck?: boolean } }).productionEvidence;
   return {
@@ -301,7 +493,7 @@ function readReport(options: FieldTestCommandOptions): FieldTestCommandResult {
     data,
     nextActions: productionEvidence?.readyForDeployCheck
       ? ["forge deploy check --production --json"]
-      : ["forge field-test run --runtime-probes --auth-probes --write-report .forge/field-test-report.json --json"],
+      : ["forge field-test run --realistic --write-report .forge/field-test-report.json --json"],
     exitCode: (data && typeof data === "object" && "ok" in data && (data as { ok?: unknown }).ok !== true) ? 1 : 0,
   };
 }

package/src/forge/cli/main.ts

@@ -16,10 +16,14 @@ function formatHelp(): string {
     "  forge changed --authored --json  Show only authored changed files, excluding generated artifacts",
     "  forge changed --review --json  Show review-focused app/config/docs changes, excluding local agent/browser artifacts",
     "  forge changed --commit-ready --json  Show files suitable for git add, excluding generated and operational artifacts",
-    "  forge new my-app --template minimal-web --field-test  Create an installed WorkOS/auth.md field-test app",
-    "  forge field-test create vendor-access --auth workos --template minimal-web --json  Create a real field-test app",
-    "  forge field-test run --templates minimal-web,nuxt-web --package-managers npm,pnpm --runtime-probes --auth-probes --json",
+    "  forge new my-app --template vendor-access --field-test  Create an installed WorkOS/auth.md field-test app",
+    "  forge field-test create vendor-access --auth workos --install --git --json  Create a real field-test app",
+    "  forge field-test run --realistic --templates vendor-access --package-managers npm --json",
     "  forge field-test report --json  Summarize the machine-readable field-test report",
+    "  forge seed status --json  Discover app seed commands from the generated runtime graph",
+    "  forge seed dev --json     Run the app seed command against the local Forge dev runtime",
+    "  forge seed dev --all-tenants --json  Seed every discovered local tenant/persona profile",
+    "  forge seed reset --json   Run the seed command with args.reset=true against the local dev runtime",
     "  forge diff authored       Run the authored-only git diff pathspec",
     "  forge handoff --json      Compact work handoff for the next external code agent",
     "  forge agent onboard --target codex --json  Prepare adapter, hooks, memory, and dev snapshot",
@@ -37,10 +41,11 @@ function formatHelp(): string {
     "  forge workos doctor --json  Check WorkOS AuthKit/FGA files, claims, seed, webhook, and tenant guards",
     "  forge workos doctor --yes --json  Run local checks, then delegate to npx --yes workos@latest doctor",
     "  forge workos seed --file workos-seed.yml --dry-run --json  Validate WorkOS seed without hosted changes",
+    "  forge workos prove --file workos-seed.yml --json  Prove local WorkOS/AuthKit/FGA/seed readiness without dashboard changes",
     "  forge workos setup --real --file workos-seed.yml --json  Apply redirect/CORS/homepage config and seed WorkOS without dashboard",
     "  forge deploy plan --target docker --json  Explain production deploy gates and commands",
     "  forge deploy check --production --json  Gate auth, DB, metadata, generated artifacts, and liveQuery readiness",
-    "  forge deploy render docker  Write Docker production deploy files under deploy/",
+    "  forge deploy package --target docker  Write Docker production deploy files under deploy/",
     "  forge deploy verify --production --url https://app.example.com --json  Probe /health and validate public auth metadata",
     "  forge release check --allow-missing-local-release --json  Gate release readiness without failing on unprepared local artifacts",
     "  forge self-host check --prepared-only --json  Report compose readiness without creating deploy files",
@@ -96,18 +101,24 @@ function formatDevHelp(): string {
     "Options:",
     "  --db memory|pglite|postgres|none  Choose the development database adapter",
     "  --port <port>                     API runtime port; use 0 for an ephemeral port",
-    "  --web-port <port>                 Web dev server port",
+    "  --web-port <port>                 Web dev server port; use 0 for an ephemeral port",
     "  --host <host>                     Bind host, default 127.0.0.1",
     "  --no-web                          Start API/runtime only",
     "  --api-only                        Start API/runtime only",
     "  --web-only                        Start web server only, expecting an API runtime",
     "  --no-worker                       Disable local worker",
     "  --no-watch                        Disable file watching",
+    "  --seed                            Run the discovered seed command after the API runtime starts",
+    "  --seed-command <name>              Select a specific seed command for --seed",
+    "  --all-tenants                     With --seed, seed every discovered local tenant/persona",
     "  --once --json                     Run one-shot diagnostics without starting servers",
     "  --detach --json                   Start dev in the background with .forge/dev/dev.pid and .forge/dev/dev.log",
     "",
     "Examples:",
     "  forge dev --db memory --port 3777 --web-port 5174",
+    "  forge dev --db memory --port 0 --web-port 0",
+    "  forge dev --seed --db pglite",
+    "  forge dev --seed --all-tenants --db pglite",
     "  forge dev --db pglite --once --json",
     "  forge dev --detach --db memory --port 0 --json",
     "  forge dev status --json",

package/src/forge/cli/new.ts

@@ -8,7 +8,7 @@ import { run as runGenerate } from "../compiler/orchestrator/run.ts";
 import { resolvePackageManagerArgv } from "../compiler/package-manager/executor.ts";
 import { moduleDir } from "../platform/module.ts";
 
-export type NewTemplateName = "agent-workroom" | "b2b-support-web" | "minimal-web" | "nuxt-web";
+export type NewTemplateName = "agent-workroom" | "b2b-support-web" | "minimal-web" | "nuxt-web" | "vendor-access";
 export type NewPackageManager = "bun" | "npm" | "pnpm" | "yarn";
 
 export interface NewCommandOptions {
@@ -79,6 +79,7 @@ const TEXT_EXTENSIONS = new Set([
   ".css",
   ".env",
   ".example",
+  ".html",
   ".json",
   ".md",
   ".ts",

package/src/forge/cli/output.ts

@@ -118,6 +118,8 @@ export function buildGenerateJson(
       ? {
           kind: "generated-drift",
           message: `${result.changed.length} generated artifact(s) would change; run forge generate before handoff or verification.`,
+          concurrencyNote:
+            "Do not run forge generate, forge generate --check, forge dev --once, or forge verify concurrently in the same workspace. If a generate command was active or just started, wait for it to finish and rerun the check once.",
           changedGroups: summarizeGeneratedArtifacts(result.changed),
           sampleChanged: changed.sample,
           hiddenChanged: changed.hidden,
@@ -127,6 +129,12 @@ export function buildGenerateJson(
           checkCommand: options.workspaceRoot
             ? forgeCliCommandsForWorkspace(options.workspaceRoot, ["forge generate --check --json"])[0]
             : "forge generate --check --json",
+          sequentialCommands: options.workspaceRoot
+            ? forgeCliCommandsForWorkspace(options.workspaceRoot, [
+                "forge generate --json",
+                "forge generate --check --json",
+              ])
+            : ["forge generate --json", "forge generate --check --json"],
         }
       : null;
   return {
@@ -234,6 +242,7 @@ export function buildAddJson(
                 "forge workos doctor --yes --json",
                 "forge workos seed --file workos-seed.yml --dry-run --json",
                 "forge workos seed --file workos-seed.yml --json",
+                "forge workos prove --file workos-seed.yml --json",
                 "forge auth check --json",
                 "forge auth prove --json",
               ]