forgeos 0.1.0-alpha.55 → 0.1.0-alpha.57

package/src/forge/cli/parse.ts

@@ -336,6 +336,7 @@ export type ForgeCommand =
       webOnly: boolean;
       open: boolean;
       webPort?: number;
+      publicApiUrl?: string;
       telemetry: string[];
       envFile?: string;
       skipStartupConsole: boolean;
@@ -418,6 +419,7 @@ export type ForgeCommand =
       subcommand: EnvSubcommand;
       json: boolean;
       redacted: boolean;
+      target?: "local" | "staging" | "production";
       workspaceRoot: string;
     }
   | {
@@ -602,7 +604,7 @@ const BASELINE_SUBCOMMANDS: BaselineSubcommand[] = ["create", "status"];
 const AUTHMD_SUBCOMMANDS: AuthMdSubcommand[] = ["generate", "check"];
 const WORKOS_SUBCOMMANDS: WorkOSSubcommand[] = ["install", "doctor", "seed", "setup", "prove", "fga"];
 const WORKOS_FGA_ACTIONS: WorkOSFgaAction[] = ["plan", "sync", "prove", "doctor"];
-const DEPLOY_SUBCOMMANDS: DeploySubcommand[] = ["plan", "check", "render", "package", "verify"];
+const DEPLOY_SUBCOMMANDS: DeploySubcommand[] = ["plan", "init", "check", "readiness", "render", "package", "verify"];
 const FIELD_TEST_SUBCOMMANDS: FieldTestSubcommand[] = ["create", "run", "report"];
 const SECURITY_SUBCOMMANDS: SecuritySubcommand[] = ["prove"];
 const RLS_SUBCOMMANDS: RlsSubcommand[] = ["generate", "check", "apply", "test", "mutate-test"];
@@ -1484,10 +1486,10 @@ export function parseCli(argv: string[]): ParsedCli {
     case "deploy": {
       const subcommand = rest[0] as DeploySubcommand | undefined;
       if (!subcommand || !DEPLOY_SUBCOMMANDS.includes(subcommand)) {
-        errors.push("forge deploy requires subcommand: plan, check, render, package, or verify");
+        errors.push("forge deploy requires subcommand: plan, init, check, readiness, render, package, or verify");
         return { command: null, workspaceRoot, errors };
       }
-      const targetRaw = parseOptionValue(argv, "--target") ?? (subcommand === "render" || subcommand === "package" ? rest[1] : undefined) ?? "docker";
+      const targetRaw = parseOptionValue(argv, "--target") ?? (subcommand === "init" || subcommand === "render" || subcommand === "package" ? rest[1] : undefined) ?? "docker";
       if (targetRaw !== "docker" && targetRaw !== "forge-cloud") {
         errors.push("forge deploy --target must be docker or forge-cloud");
       }
@@ -2732,6 +2734,7 @@ export function parseCli(argv: string[]): ParsedCli {
           webOnly: parseFlag(argv, "--web-only"),
           open: parseFlag(argv, "--open"),
           webPort,
+          publicApiUrl: parseOptionValue(argv, "--public-api-url"),
           telemetry: (parseOptionValue(argv, "--telemetry") ?? "local")
             .split(",")
             .map((value) => value.trim())
@@ -2974,10 +2977,14 @@ export function parseCli(argv: string[]): ParsedCli {
     }
     case "env": {
       const subcommand = rest[0] as EnvSubcommand | undefined;
-      if (!subcommand || !["list", "check", "print"].includes(subcommand)) {
-        errors.push("forge env requires subcommand: list, check, or print");
+      if (!subcommand || !["list", "check", "print", "doctor"].includes(subcommand)) {
+        errors.push("forge env requires subcommand: list, check, print, or doctor");
         return { command: null, workspaceRoot, errors };
       }
+      const targetRaw = parseOptionValue(argv, "--target") ?? "local";
+      if (!["local", "staging", "production"].includes(targetRaw)) {
+        errors.push("forge env --target must be local, staging, or production");
+      }
 
       return {
         command: {
@@ -2985,6 +2992,7 @@ export function parseCli(argv: string[]): ParsedCli {
           subcommand,
           json: parseFlag(argv, "--json"),
           redacted: parseFlag(argv, "--redacted"),
+          target: targetRaw as "local" | "staging" | "production",
           workspaceRoot,
         },
         workspaceRoot,
@@ -3244,6 +3252,7 @@ export function hasUnknownOption(argv: string[]): string | null {
     "--postgres-version",
     "--runtime-port",
     "--web-port",
+    "--public-api-url",
     "--preview-port",
     "--preview-url",
     "--studio-url",
@@ -3371,6 +3380,7 @@ export function hasUnknownOption(argv: string[]): string | null {
         arg === "--postgres-version" ||
         arg === "--runtime-port" ||
         arg === "--web-port" ||
+        arg === "--public-api-url" ||
         arg === "--preview-port" ||
         arg === "--preview-url" ||
         arg === "--studio-url" ||

package/src/forge/cli/secrets.ts

@@ -219,13 +219,141 @@ export function formatSecretsJson(result: SecretsCommandResult): string {
   return `${JSON.stringify(result, null, 2)}\n`;
 }
 
-export type EnvSubcommand = "list" | "check" | "print";
+export type EnvSubcommand = "list" | "check" | "print" | "doctor";
+export type EnvDoctorTarget = "local" | "staging" | "production";
 
 export interface EnvCommandOptions {
   subcommand: EnvSubcommand;
   workspaceRoot: string;
   json: boolean;
   redacted?: boolean;
+  target?: EnvDoctorTarget;
+}
+
+const ENV_DOCTOR_KEYS = [
+  "DATABASE_URL",
+  "FORGE_AUTH_MODE",
+  "FORGE_AUTH_ISSUER",
+  "FORGE_AUTH_AUDIENCE",
+  "FORGE_AUTH_JWKS_URI",
+  "FORGE_AUTH_DISCOVERY_URL",
+  "WORKOS_API_KEY",
+  "WORKOS_CLIENT_ID",
+  "WORKOS_COOKIE_PASSWORD",
+  "WORKOS_REDIRECT_URI",
+  "WORKOS_POST_LOGIN_REDIRECT_URI",
+  "WORKOS_POST_LOGOUT_REDIRECT_URI",
+  "WORKOS_WEBHOOK_SECRET",
+] as const;
+
+function parseEnvFile(workspaceRoot: string, relative: string): Record<string, string> {
+  const path = join(workspaceRoot, relative);
+  if (!nodeFileSystem.exists(path)) return {};
+  const values: Record<string, string> = {};
+  for (const rawLine of (nodeFileSystem.readText(path) ?? "").split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const rawValue = line.slice(eq + 1).trim();
+    values[line.slice(0, eq).trim()] = rawValue.replace(/^["']|["']$/g, "");
+  }
+  return values;
+}
+
+function envDoctorFiles(target: EnvDoctorTarget): string[] {
+  if (target === "production") return ["deploy/.env.production"];
+  if (target === "staging") return ["deploy/.env.staging", ".env.staging"];
+  return [".env", ".env.local"];
+}
+
+function hasWorkOSAppArtifacts(workspaceRoot: string): boolean {
+  return nodeFileSystem.exists(join(workspaceRoot, "workos-seed.yml")) ||
+    nodeFileSystem.exists(join(workspaceRoot, "src/policies.workos.ts")) ||
+    nodeFileSystem.exists(join(workspaceRoot, "src/forge/_generated/integrations/workos/auth-routes.ts"));
+}
+
+function envDoctor(options: EnvCommandOptions): SecretsCommandResult {
+  const target = options.target ?? "local";
+  const files = envDoctorFiles(target).map((path) => {
+    const values = parseEnvFile(options.workspaceRoot, path);
+    return {
+      path,
+      present: nodeFileSystem.exists(join(options.workspaceRoot, path)),
+      keys: Object.keys(values).filter((key) => ENV_DOCTOR_KEYS.includes(key as (typeof ENV_DOCTOR_KEYS)[number])).sort(),
+      values,
+    };
+  });
+  const processValues = Object.fromEntries(
+    ENV_DOCTOR_KEYS.filter((key) => Boolean(process.env[key])).map((key) => [key, process.env[key]!]),
+  );
+  const effective = {
+    ...Object.assign({}, ...files.map((file) => file.values)),
+    ...processValues,
+  } as Record<string, string>;
+  const required = target === "production"
+    ? ["DATABASE_URL", "FORGE_AUTH_MODE", "FORGE_AUTH_ISSUER", "FORGE_AUTH_AUDIENCE"]
+    : ["FORGE_AUTH_MODE"];
+  const missing = required.filter((key) => !effective[key]);
+  const authMode = effective.FORGE_AUTH_MODE ?? "dev-headers";
+  const productionAuth = authMode === "jwt" || authMode === "oidc";
+  const database = effective.DATABASE_URL
+    ? "postgres"
+    : target === "production"
+      ? "missing"
+      : "local-dev";
+  const workosDetected = hasWorkOSAppArtifacts(options.workspaceRoot) ||
+    Boolean(effective.WORKOS_CLIENT_ID || effective.WORKOS_API_KEY);
+  const provider = workosDetected ? "workos" : "none";
+  const hasJwtSource = Boolean(effective.FORGE_AUTH_JWKS_URI || effective.FORGE_AUTH_DISCOVERY_URL);
+  const blockers = [
+    ...missing.filter((key) => key !== "DATABASE_URL").map((key) => `${key} missing`),
+    ...(target === "production" && !productionAuth ? [`FORGE_AUTH_MODE=${authMode} is not production auth`] : []),
+    ...(target === "production" && database === "missing" ? ["DATABASE_URL missing"] : []),
+    ...(target === "production" && productionAuth && !hasJwtSource
+      ? ["FORGE_AUTH_JWKS_URI or FORGE_AUTH_DISCOVERY_URL missing"]
+      : []),
+    ...(target === "production" && workosDetected && !effective.WORKOS_CLIENT_ID ? ["WORKOS_CLIENT_ID missing"] : []),
+    ...(target === "production" && workosDetected && !effective.WORKOS_API_KEY ? ["WORKOS_API_KEY missing"] : []),
+  ];
+  const warnings = [
+    ...(target === "production" && files.every((file) => !file.present)
+      ? ["deploy/.env.production not found; process.env alone may be fine in CI but is easy for agents to miss"]
+      : []),
+    ...(workosDetected && !effective.WORKOS_COOKIE_PASSWORD ? ["WORKOS_COOKIE_PASSWORD missing"] : []),
+    ...(workosDetected && !effective.WORKOS_REDIRECT_URI ? ["WORKOS_REDIRECT_URI missing"] : []),
+  ];
+  return {
+    exitCode: blockers.length === 0 ? 0 : 1,
+    data: {
+      schemaVersion: "0.1.0",
+      kind: "env-doctor",
+      ok: blockers.length === 0,
+      target,
+      authMode,
+      productionAuth,
+      database,
+      provider,
+      sources: [
+        {
+          path: "process.env",
+          present: Object.keys(processValues).length > 0,
+          keys: Object.keys(processValues).sort(),
+          values: undefined,
+        },
+        ...files.map(({ path, present, keys }) => ({ path, present, keys })),
+      ],
+      present: ENV_DOCTOR_KEYS.filter((key) => Boolean(effective[key])).sort(),
+      missing,
+      blockers,
+      warnings,
+      nextActions: blockers.length === 0
+        ? ["forge deploy readiness --production --json"]
+        : target === "production"
+          ? ["cp deploy/.env.production.example deploy/.env.production", "forge env doctor --target production --json"]
+          : ["forge env doctor --target local --json"],
+    },
+  };
 }
 
 export async function runEnvCommand(options: EnvCommandOptions): Promise<SecretsCommandResult> {
@@ -233,6 +361,8 @@ export async function runEnvCommand(options: EnvCommandOptions): Promise<Secrets
   const schema = loadEnvSchema(options.workspaceRoot);
 
   switch (options.subcommand) {
+    case "doctor":
+      return envDoctor(options);
     case "list":
       if (!schema) {
         return {

package/src/forge/cli/workos.ts

@@ -573,6 +573,62 @@ function collectWorkOSRealEnvChecks(workspaceRoot: string, cliAuth?: WorkOSCliAu
   ];
 }
 
+function renderMergedDotEnv(current: string | null, values: Record<string, string>): string {
+  const lines = (current ?? "").split(/\r?\n/);
+  const seen = new Set<string>();
+  const next = lines.map((line) => {
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=/);
+    if (!match || !(match[1]! in values)) {
+      return line;
+    }
+    seen.add(match[1]!);
+    return `${match[1]}=${values[match[1]!]}`;
+  });
+  for (const [key, value] of Object.entries(values)) {
+    if (!seen.has(key)) {
+      next.push(`${key}=${value}`);
+    }
+  }
+  return `${next.filter((line, index, all) => line.length > 0 || index < all.length - 1).join("\n").trimEnd()}\n`;
+}
+
+function syncWorkOSPublicWebEnv(workspaceRoot: string, write: boolean): { ok: boolean; changed: string[]; path?: string; skipped?: string } {
+  const frontendWorkspace = findWorkOSFrontendWorkspace(workspaceRoot);
+  if (!frontendWorkspace) {
+    return { ok: true, changed: [], skipped: "no web workspace detected" };
+  }
+  const env = readRealEnv(workspaceRoot);
+  const clientId = env.VITE_WORKOS_CLIENT_ID || env.WORKOS_CLIENT_ID || "";
+  const redirectUri = env.VITE_WORKOS_REDIRECT_URI || env.WORKOS_REDIRECT_URI || "http://localhost:5173/callback";
+  const values: Record<string, string> = {
+    VITE_FORGE_URL: env.VITE_FORGE_URL || "http://localhost:3765",
+    VITE_WORKOS_CLIENT_ID: clientId,
+    VITE_WORKOS_REDIRECT_URI: redirectUri,
+  };
+  const relPath = join(frontendWorkspace, ".env.local");
+  const path = join(workspaceRoot, relPath);
+  const current = readRawText(workspaceRoot, relPath);
+  const next = renderMergedDotEnv(current, values);
+  if (current === next) {
+    return { ok: true, changed: [], path: relPath };
+  }
+  if (write) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, next, "utf8");
+  }
+  return { ok: true, changed: [relPath], path: relPath };
+}
+
+function findWorkOSFrontendWorkspace(workspaceRoot: string): string | undefined {
+  for (const candidate of ["web", "frontend", "client", "apps/web", "packages/web"]) {
+    if (existsSync(join(workspaceRoot, candidate, "package.json"))) {
+      return candidate;
+    }
+  }
+  return undefined;
+}
+
+
 export function collectPolicyPermissions(workspaceRoot: string): string[] {
   const registry = readJson(workspaceRoot, `${GENERATED_DIR}/policyRegistry.json`) as {
     policies?: Array<{ permissions?: string[] }>;
@@ -1757,12 +1813,10 @@ function collectWorkOSChecks(workspaceRoot: string, preferredSeedPath = DEFAULT_
     readText(workspaceRoot, "web/src/main.tsx"),
     readText(workspaceRoot, "web/src/App.tsx"),
   ].join("\n");
-  const appShellUsesWorkOSProvider =
-    frontendAppShell.includes("ForgeWorkOSAuthProvider") ||
-    frontendAppShell.includes("AuthKitProvider");
-  const authBridgeProvidesToken =
-    generatedFrontendAuthBridge.includes("getToken") ||
-    generatedFrontendAuthBridge.includes("getAccessToken");
+  const appShellUsesWorkOSProvider = frontendAppShell.includes("ForgeWorkOSAuthProvider");
+  const authBridgeUsesBackendRoutes =
+    generatedFrontendAuthBridge.includes("workOSApiUrl") &&
+    ["/login", "/logout", "/session"].every((route) => generatedFrontendAuthBridge.includes(route));
   const authBridgeProvidesSessionClaims =
     includesAll(generatedFrontendAuthBridge, ["useForgeWorkOSSession", "/session", "claims"]);
   const authSessionProxyConfigured = webAuthSessionProxyConfigured(workspaceRoot);
@@ -1809,7 +1863,7 @@ function collectWorkOSChecks(workspaceRoot: string, preferredSeedPath = DEFAULT_
       ok: !hasWeb || (hasValue(realEnv, "VITE_WORKOS_CLIENT_ID") || readRawText(workspaceRoot, ".env.example").includes("VITE_WORKOS_CLIENT_ID=")) &&
         (hasValue(realEnv, "VITE_WORKOS_REDIRECT_URI") || readRawText(workspaceRoot, ".env.example").includes("VITE_WORKOS_REDIRECT_URI=")),
       detail: hasWeb
-        ? "web workspace has VITE_WORKOS_CLIENT_ID and VITE_WORKOS_REDIRECT_URI guidance for AuthKit React"
+        ? "web workspace has browser WorkOS client ID and redirect URI guidance for backend-owned AuthKit routes"
         : "no web workspace detected",
     },
     {
@@ -1821,11 +1875,11 @@ function collectWorkOSChecks(workspaceRoot: string, preferredSeedPath = DEFAULT_
     },
     {
       name: "browser-authkit-bridge",
-      ok: !hasWeb || includesAll(generatedFrontendAuthBridge, ["AuthKitProvider", "ForgeProvider"]) &&
-        authBridgeProvidesToken &&
+      ok: !hasWeb || generatedFrontendAuthBridge.includes("ForgeProvider") &&
+        authBridgeUsesBackendRoutes &&
         authBridgeProvidesSessionClaims,
       detail: hasWeb
-        ? "generated web/src/lib/workos-auth.tsx bridge provides AuthKitProvider, ForgeProvider token wiring, and normalized /session claims"
+        ? "generated web/src/lib/workos-auth.tsx bridge uses backend-owned AuthKit routes, ForgeProvider, and normalized /session claims"
         : "no web workspace detected",
     },
     {
@@ -1841,7 +1895,7 @@ function collectWorkOSChecks(workspaceRoot: string, preferredSeedPath = DEFAULT_
       name: "browser-authkit-provider",
       ok: !hasWeb || appShellUsesWorkOSProvider,
       detail: hasWeb
-        ? "web app shell mounts ForgeWorkOSAuthProvider or AuthKitProvider"
+        ? "web app shell mounts ForgeWorkOSAuthProvider"
         : "no web workspace detected",
     },
     {
@@ -2486,6 +2540,7 @@ export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSComm
   const seed = parseSeedFile(options.workspaceRoot, file);
   const seedState = readWorkOSSeedState(options.workspaceRoot, seed);
   const setupDryRun = options.dryRun || !options.real;
+  const publicEnvSync = syncWorkOSPublicWebEnv(options.workspaceRoot, localOk && !setupDryRun);
   const configActions = runWorkOSConfigActions(seed, options, true);
   const command = ["npx", "--yes", "workos@latest", "seed", "--file", file];
   if (!localOk) {
@@ -2500,6 +2555,7 @@ export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSComm
         real: options.real ?? false,
         seed,
         seedState,
+        publicEnvSync,
         ...(cliAuth ? { cliAuth } : {}),
         configActions,
         nextCommand: cliAuth && !cliAuth.ok
@@ -2521,6 +2577,7 @@ export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSComm
         real: false,
         seed,
         seedState,
+        publicEnvSync,
         ...(cliAuth ? { cliAuth } : {}),
         configActions,
         nextCommand: `forge workos setup --real --file ${file} --json`,
@@ -2546,6 +2603,7 @@ export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSComm
     data: {
       real: true,
       seed,
+      publicEnvSync,
       ...(cliAuth ? { cliAuth } : {}),
       seedState: seedResultData.seedState ?? readWorkOSSeedState(options.workspaceRoot, seed),
       seedResult: seedResult.data,

package/src/forge/compiler/integration/add.ts

@@ -31,6 +31,7 @@ import {
   resolveByPackageName,
   resolveRecipe,
 } from "../recipes/registry.ts";
+import { applyWorkOSRecipeProfile } from "../recipes/profiles.ts";
 import { discover } from "../orchestrator/discover.ts";
 import {
   loadManifest,
@@ -92,24 +93,6 @@ function recipeResultMetadata(recipe: IntegrationRecipe): Pick<
   };
 }
 
-const WORKOS_FGA_INTEGRATION_FILES = new Set([
-  "workos/fga.ts",
-  "workos/resource-map.ts",
-]);
-
-function applyWorkOSRecipeProfile(
-  recipe: NonNullable<ReturnType<typeof resolveRecipe>>,
-  options: Pick<ForgeAddOptions, "withFga">,
-): IntegrationRecipe {
-  if (recipe.alias !== "workos" || options.withFga) {
-    return recipe;
-  }
-  return {
-    ...recipe,
-    integrations: recipe.integrations?.filter((file) => !WORKOS_FGA_INTEGRATION_FILES.has(file)),
-  };
-}
-
 function addExplanation(result: ForgeAddResult): string {
   if (result.mode === "package") {
     const location = result.target && result.target !== "root" ? `${result.target}/package.json` : "package.json";
@@ -528,6 +511,60 @@ function workosFrontendWorkspace(workspaceRoot: string): string | undefined {
   return findFrontendWorkspace(workspaceRoot);
 }
 
+function parseDotEnv(text: string | null): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const line of (text ?? "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match) continue;
+    result[match[1]!] = match[2]!.replace(/^["']|["']$/g, "");
+  }
+  return result;
+}
+
+function renderMergedDotEnv(current: string | null, values: Record<string, string>): string {
+  const lines = (current ?? "").split(/\r?\n/);
+  const seen = new Set<string>();
+  const next = lines.map((line) => {
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=/);
+    if (!match || !(match[1]! in values)) {
+      return line;
+    }
+    seen.add(match[1]!);
+    return `${match[1]}=${values[match[1]!]}`;
+  });
+  for (const [key, value] of Object.entries(values)) {
+    if (!seen.has(key)) {
+      next.push(`${key}=${value}`);
+    }
+  }
+  return `${next.filter((line, index, all) => line.length > 0 || index < all.length - 1).join("\n").trimEnd()}\n`;
+}
+
+function syncWorkOSPublicWebEnv(workspaceRoot: string, frontendWorkspace: string): { changed: string[] } {
+  const rootLocal = parseDotEnv(nodeFileSystem.readText(join(workspaceRoot, ".env.local")));
+  const rootExample = parseDotEnv(nodeFileSystem.readText(join(workspaceRoot, ".env.example")));
+  const source = { ...rootExample, ...rootLocal };
+  const clientId = source.VITE_WORKOS_CLIENT_ID || source.WORKOS_CLIENT_ID || "";
+  const redirectUri = source.VITE_WORKOS_REDIRECT_URI || source.WORKOS_REDIRECT_URI || "http://localhost:5173/callback";
+  const values: Record<string, string> = {
+    VITE_FORGE_URL: source.VITE_FORGE_URL || "http://localhost:3765",
+    VITE_WORKOS_CLIENT_ID: clientId,
+    VITE_WORKOS_REDIRECT_URI: redirectUri,
+  };
+  const envRel = `${frontendWorkspace}/.env.local`;
+  const envPath = join(workspaceRoot, envRel);
+  const current = nodeFileSystem.readText(envPath);
+  const next = renderMergedDotEnv(current, values);
+  if (current === next) {
+    return { changed: [] };
+  }
+  nodeFileSystem.mkdirp(join(workspaceRoot, frontendWorkspace));
+  nodeFileSystem.writeText(envPath, next);
+  return { changed: [envRel] };
+}
+
 function connectWorkOSReactRoot(workspaceRoot: string, frontendWorkspace: string): {
   changed: string[];
   warnings: Diagnostic[];
@@ -610,7 +647,7 @@ function connectWorkOSReactRoot(workspaceRoot: string, frontendWorkspace: string
         "          <p className=\"notice error\">{workosSession.error.message}</p>",
         "          <div className=\"login-form\">",
         "            <button type=\"button\" onClick={() => void workosSession.refresh()}>Retry session</button>",
-        "            <button className=\"secondary\" type=\"button\" onClick={() => auth.signOut({ returnTo: window.location.origin })}>Sign out</button>",
+        "            <button className=\"secondary\" type=\"button\" onClick={() => auth.signOut()}>Sign out</button>",
         "          </div>",
         "        </section>",
         "      </main>",
@@ -631,8 +668,8 @@ function connectWorkOSReactRoot(workspaceRoot: string, frontendWorkspace: string
         "          <p className=\"eyebrow\">WorkOS AuthKit</p>",
         "          <h1>Sign in to review vendor access</h1>",
         "          <div className=\"login-form\">",
-        "            <button type=\"button\" onClick={() => void auth.signIn()}>Sign in with WorkOS</button>",
-        "            <button className=\"secondary\" type=\"button\" onClick={() => void auth.signUp()}>Create account</button>",
+        "            <button type=\"button\" onClick={() => auth.signIn()}>Sign in with WorkOS</button>",
+        "            <button className=\"secondary\" type=\"button\" onClick={() => auth.signUp()}>Create account</button>",
         "          </div>",
         "        </section>",
         "        <aside className=\"login-context\">",
@@ -664,7 +701,7 @@ function connectWorkOSReactRoot(workspaceRoot: string, frontendWorkspace: string
         "      persona={persona}",
         "      personas={[persona]}",
         "      onPersonaChange={() => undefined}",
-        "      onSignOut={() => auth.signOut({ returnTo: window.location.origin })}",
+        "      onSignOut={() => auth.signOut()}",
         "    />",
         "  );",
         "}",
@@ -1103,7 +1140,11 @@ export async function forgeAdd(
     });
 
     const workosWeb = normalized === "workos" && frontendWorkspace
-      ? connectWorkOSReactRoot(options.workspaceRoot, frontendWorkspace)
+      ? (() => {
+          const root = connectWorkOSReactRoot(options.workspaceRoot, frontendWorkspace);
+          const env = syncWorkOSPublicWebEnv(options.workspaceRoot, frontendWorkspace);
+          return { changed: [...root.changed, ...env.changed], warnings: root.warnings };
+        })()
       : { changed: [] as string[], warnings: [] as Diagnostic[] };
 
     const warningsCombined = [...preinstalledWarnings, ...warnings, ...emitResult.warnings, ...workosWeb.warnings];