forgeos 0.1.0-alpha.56 → 0.1.0-alpha.57

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.56 input=a013874c7856b533aae64f467111c45bd707703fd9db6f0b8115898afc97af53 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.57 input=7128597ce3f6cd158bf4361cebb1eef8678c19ff9b2cb60c454a0876356d37c6 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # forgeos
 
+## 0.1.0-alpha.57
+
+### Patch Changes
+
+- Fix the WorkOS AuthKit local and tunneled development flow.
+
+  - Add `response_type=code` to Forge-owned WorkOS authorization URLs and avoid sending a default `organization_id` during login so AuthKit can present normal sign-in and organization selection.
+  - Resolve WorkOS organization and membership claims during callback when AuthKit returns only the user/token, then expose Forge-normalized session claims through `/session`.
+  - Add `forge dev --public-api-url` for browser-facing API URLs behind tunnels and update the WorkOS React bridge to use backend-owned `/login`, `/session`, and `/logout` routes through same-origin/proxy-aware URL resolution.
+  - Sync public WorkOS browser env into `web/.env.local` during `forge add auth workos` and `forge workos setup --real`, and update WorkOS doctor/UI audit checks for the backend-owned AuthKit session flow.
+
 ## 0.1.0-alpha.56
 
 ### Patch Changes
@@ -22,7 +33,7 @@
     `/ready`, `/live/status`, `/outbox/status`, and `/webhooks/workos`.
   - Production docs now present the canonical flow:
     `deploy init -> env doctor -> auth/auth.md/WorkOS proof -> field-test ->
-    readiness -> check -> package -> verify`, while keeping WorkOS FGA
+readiness -> check -> package -> verify`, while keeping WorkOS FGA
     explicitly optional unless the app opts into FGA artifacts.
 
 ## 0.1.0-alpha.55
@@ -115,7 +126,7 @@
 - Tighten the no-dashboard WorkOS real setup/proof handoff.
 
   - WorkOS hosted setup now records explicit `WORKOS_MODE=agent npx --yes
-    workos@latest auth login --json` shell guidance when CLI login is required.
+workos@latest auth login --json` shell guidance when CLI login is required.
   - Failed `forge workos setup --real` login attempts now tell the operator to
     rerun the same setup command after completing OAuth/device-code login,
     instead of pointing generically at `prove --real`.
@@ -276,7 +287,7 @@
     `forge dev --seed --all-tenants`, and seed readiness evidence in dev and
     field-test summaries.
   - Update templates, docs, and tests around the new `create app -> add auth ->
-    field-test -> deploy` path.
+field-test -> deploy` path.
 
 ## 0.1.0-alpha.41
 

package/docs/changelog.md

@@ -6,6 +6,22 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.57
+
+- Fixed the WorkOS/AuthKit login path used by local and tunneled development:
+  Forge-owned authorization URLs now include `response_type=code` and no longer
+  send a default `organization_id` unless explicitly requested.
+- The WorkOS callback now resolves organization and membership claims when
+  AuthKit returns only the user/token, then exposes Forge-normalized session
+  claims through `/session`.
+- Added `forge dev --public-api-url` so browser-facing API URLs can be injected
+  cleanly for SSH tunnels, Docker Desktop, and remote dev hosts.
+- The generated WorkOS React bridge now uses backend-owned `/login`, `/session`,
+  and `/logout` routes through same-origin/proxy-aware URL resolution.
+- `forge add auth workos`, `forge workos setup --real`, `workos doctor`, and
+  `inspect ui --ergonomics` now understand the backend-owned AuthKit session
+  flow and sync public browser env into `web/.env.local`.
+
 ## 0.1.0-alpha.56
 
 - Added `forge deploy init --target docker` as the canonical production Docker

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.56",
+  "version": "0.1.0-alpha.57",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.56","releaseId":"forgeos@0.1.0-alpha.56+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.57","releaseId":"forgeos@0.1.0-alpha.57+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.56 input=a013874c7856b533aae64f467111c45bd707703fd9db6f0b8115898afc97af53 content=a9688092f903ceb0263f9581e3ab71ecc968284ffd530d9112a5467ea10baf63
+// @forge-generated generator=0.1.0-alpha.57 input=7128597ce3f6cd158bf4361cebb1eef8678c19ff9b2cb60c454a0876356d37c6 content=40c7132e14bfeffd8018f04de93db9ad294cfca4e190b21106d86bb80bc3bc03
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.56",
-  "releaseId": "forgeos@0.1.0-alpha.56+unknown",
+  "packageVersion": "0.1.0-alpha.57",
+  "releaseId": "forgeos@0.1.0-alpha.57+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/auth.ts

@@ -180,11 +180,16 @@ function permissionSubsetForRestrictedTenant(permissions: string[]): string[] {
 function buildMultiTenantProof(workspaceRoot: string, workos: ReturnType<typeof detectWorkOS>, requiresTenant: boolean) {
   const rootSeedPresent = existsSync(join(workspaceRoot, "workos-seed.yml"));
   const generatedSeedPresent = existsSync(join(workspaceRoot, "src/forge/_generated/integrations/workos/workos-seed.yml"));
+  const fgaArtifactsPresent =
+    existsSync(join(workspaceRoot, "src/forge/_generated/integrations/workos/fga.ts")) ||
+    existsSync(join(workspaceRoot, "src/forge/_generated/integrations/workos/resource-map.ts")) ||
+    existsSync(join(workspaceRoot, ".workos-fga-state.json"));
   const authMdPresent = existsSync(join(workspaceRoot, "public/auth.md"));
   const metadataPresent = existsSync(join(workspaceRoot, "public/.well-known/oauth-protected-resource"));
   const activePermissions = collectPolicyPermissions(workspaceRoot);
   const expectedResourceTypes = collectExpectedResourceTypes(workspaceRoot);
   const seed = parseSeedFile(workspaceRoot);
+  const fgaEnabled = fgaArtifactsPresent || seed.resourceTypes.length > 0;
   const missingSeedPermissions = missingValues(activePermissions, seed.permissions);
   const missingSeedResources = missingValues(expectedResourceTypes, seed.resourceTypes);
   const acmePermissions = activePermissions;
@@ -223,8 +228,10 @@ function buildMultiTenantProof(workspaceRoot: string, workos: ReturnType<typeof
     },
     {
       id: "seed-resource-coverage",
-      ok: missingSeedResources.length === 0,
-      evidence: missingSeedResources.length === 0
+      ok: !fgaEnabled || missingSeedResources.length === 0,
+      evidence: !fgaEnabled
+        ? "FGA is not enabled; seed resource type coverage is not required for AuthKit/RBAC tenant isolation."
+        : missingSeedResources.length === 0
         ? `seed covers expected app resource type(s): ${expectedResourceTypes.join(", ") || "none required"}`
         : `seed missing expected app resource type(s): ${missingSeedResources.join(", ")}`,
     },
@@ -244,6 +251,7 @@ function buildMultiTenantProof(workspaceRoot: string, workos: ReturnType<typeof
     appContract: {
       activePermissions,
       expectedResourceTypes,
+      fgaEnabled,
       seedPath: seed.path,
       seedPermissions: seed.permissions,
       seedResourceTypes: seed.resourceTypes,

package/src/forge/cli/commands.ts

@@ -2709,6 +2709,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         webOnly: command.webOnly,
         open: command.open,
         webPort: command.webPort,
+        publicApiUrl: command.publicApiUrl,
         telemetry: command.telemetry,
         envFile: command.envFile,
         skipStartupConsole: command.skipStartupConsole,

package/src/forge/cli/dev.ts

@@ -53,6 +53,7 @@ export interface DevCommandOptions {
   webOnly?: boolean;
   open?: boolean;
   webPort?: number;
+  publicApiUrl?: string;
   telemetry: string[];
   envFile?: string;
   mode?: "dev" | "serve";
@@ -305,6 +306,7 @@ function buildDetachedDevArgs(options: DevCommandOptions): string[] {
   if (options.webOnly) args.push("--web-only");
   if (options.open) args.push("--open");
   if (options.webPort !== undefined) args.push("--web-port", String(options.webPort));
+  if (options.publicApiUrl) args.push("--public-api-url", options.publicApiUrl);
   if (options.telemetry.length > 0) args.push("--telemetry", options.telemetry.join(","));
   if (options.envFile) args.push("--env-file", options.envFile);
   if (options.seed) args.push("--seed");
@@ -1343,13 +1345,14 @@ export async function runDevCommand(
 
   if (options.webOnly) {
     const apiUrl = `http://${host}:${port}`;
+    const publicApiUrl = options.publicApiUrl ?? apiUrl;
     const webHandle = startWebDevServer({
       workspaceRoot,
       host,
       port: webPort,
       requestedPort: webPortSelection.requestedPort,
       autoPortSelected: webPortSelection.autoPortSelected,
-      apiUrl,
+      apiUrl: publicApiUrl,
       json: options.json,
     });
     if (!webHandle) {
@@ -1451,7 +1454,7 @@ export async function runDevCommand(
         port: webPort,
         requestedPort: webPortSelection.requestedPort,
         autoPortSelected: webPortSelection.autoPortSelected,
-        apiUrl: handle.url,
+        apiUrl: options.publicApiUrl ?? handle.url,
         json: options.json,
       });
 

package/src/forge/cli/main.ts

@@ -110,6 +110,7 @@ function formatDevHelp(): string {
     "  --db memory|pglite|postgres|none  Choose the development database adapter",
     "  --port <port>                     API runtime port; use 0 for an ephemeral port",
     "  --web-port <port>                 Web dev server port; use 0 for an ephemeral port",
+    "  --public-api-url <url>            Browser-facing API URL injected into web env, useful for tunnels",
     "  --host <host>                     Bind host, default 127.0.0.1",
     "  --no-web                          Start API/runtime only",
     "  --api-only                        Start API/runtime only",
@@ -124,6 +125,7 @@ function formatDevHelp(): string {
     "",
     "Examples:",
     "  forge dev --db memory --port 3777 --web-port 5174",
+    "  forge dev --public-api-url http://localhost:3765",
     "  forge dev --db memory --port 0 --web-port 0",
     "  forge dev --seed --db pglite",
     "  forge dev --seed --all-tenants --db pglite",

package/src/forge/cli/parse.ts

@@ -336,6 +336,7 @@ export type ForgeCommand =
       webOnly: boolean;
       open: boolean;
       webPort?: number;
+      publicApiUrl?: string;
       telemetry: string[];
       envFile?: string;
       skipStartupConsole: boolean;
@@ -2733,6 +2734,7 @@ export function parseCli(argv: string[]): ParsedCli {
           webOnly: parseFlag(argv, "--web-only"),
           open: parseFlag(argv, "--open"),
           webPort,
+          publicApiUrl: parseOptionValue(argv, "--public-api-url"),
           telemetry: (parseOptionValue(argv, "--telemetry") ?? "local")
             .split(",")
             .map((value) => value.trim())
@@ -3250,6 +3252,7 @@ export function hasUnknownOption(argv: string[]): string | null {
     "--postgres-version",
     "--runtime-port",
     "--web-port",
+    "--public-api-url",
     "--preview-port",
     "--preview-url",
     "--studio-url",
@@ -3377,6 +3380,7 @@ export function hasUnknownOption(argv: string[]): string | null {
         arg === "--postgres-version" ||
         arg === "--runtime-port" ||
         arg === "--web-port" ||
+        arg === "--public-api-url" ||
         arg === "--preview-port" ||
         arg === "--preview-url" ||
         arg === "--studio-url" ||

package/src/forge/cli/workos.ts

@@ -573,6 +573,62 @@ function collectWorkOSRealEnvChecks(workspaceRoot: string, cliAuth?: WorkOSCliAu
   ];
 }
 
+function renderMergedDotEnv(current: string | null, values: Record<string, string>): string {
+  const lines = (current ?? "").split(/\r?\n/);
+  const seen = new Set<string>();
+  const next = lines.map((line) => {
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=/);
+    if (!match || !(match[1]! in values)) {
+      return line;
+    }
+    seen.add(match[1]!);
+    return `${match[1]}=${values[match[1]!]}`;
+  });
+  for (const [key, value] of Object.entries(values)) {
+    if (!seen.has(key)) {
+      next.push(`${key}=${value}`);
+    }
+  }
+  return `${next.filter((line, index, all) => line.length > 0 || index < all.length - 1).join("\n").trimEnd()}\n`;
+}
+
+function syncWorkOSPublicWebEnv(workspaceRoot: string, write: boolean): { ok: boolean; changed: string[]; path?: string; skipped?: string } {
+  const frontendWorkspace = findWorkOSFrontendWorkspace(workspaceRoot);
+  if (!frontendWorkspace) {
+    return { ok: true, changed: [], skipped: "no web workspace detected" };
+  }
+  const env = readRealEnv(workspaceRoot);
+  const clientId = env.VITE_WORKOS_CLIENT_ID || env.WORKOS_CLIENT_ID || "";
+  const redirectUri = env.VITE_WORKOS_REDIRECT_URI || env.WORKOS_REDIRECT_URI || "http://localhost:5173/callback";
+  const values: Record<string, string> = {
+    VITE_FORGE_URL: env.VITE_FORGE_URL || "http://localhost:3765",
+    VITE_WORKOS_CLIENT_ID: clientId,
+    VITE_WORKOS_REDIRECT_URI: redirectUri,
+  };
+  const relPath = join(frontendWorkspace, ".env.local");
+  const path = join(workspaceRoot, relPath);
+  const current = readRawText(workspaceRoot, relPath);
+  const next = renderMergedDotEnv(current, values);
+  if (current === next) {
+    return { ok: true, changed: [], path: relPath };
+  }
+  if (write) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, next, "utf8");
+  }
+  return { ok: true, changed: [relPath], path: relPath };
+}
+
+function findWorkOSFrontendWorkspace(workspaceRoot: string): string | undefined {
+  for (const candidate of ["web", "frontend", "client", "apps/web", "packages/web"]) {
+    if (existsSync(join(workspaceRoot, candidate, "package.json"))) {
+      return candidate;
+    }
+  }
+  return undefined;
+}
+
+
 export function collectPolicyPermissions(workspaceRoot: string): string[] {
   const registry = readJson(workspaceRoot, `${GENERATED_DIR}/policyRegistry.json`) as {
     policies?: Array<{ permissions?: string[] }>;
@@ -1757,12 +1813,10 @@ function collectWorkOSChecks(workspaceRoot: string, preferredSeedPath = DEFAULT_
     readText(workspaceRoot, "web/src/main.tsx"),
     readText(workspaceRoot, "web/src/App.tsx"),
   ].join("\n");
-  const appShellUsesWorkOSProvider =
-    frontendAppShell.includes("ForgeWorkOSAuthProvider") ||
-    frontendAppShell.includes("AuthKitProvider");
-  const authBridgeProvidesToken =
-    generatedFrontendAuthBridge.includes("getToken") ||
-    generatedFrontendAuthBridge.includes("getAccessToken");
+  const appShellUsesWorkOSProvider = frontendAppShell.includes("ForgeWorkOSAuthProvider");
+  const authBridgeUsesBackendRoutes =
+    generatedFrontendAuthBridge.includes("workOSApiUrl") &&
+    ["/login", "/logout", "/session"].every((route) => generatedFrontendAuthBridge.includes(route));
   const authBridgeProvidesSessionClaims =
     includesAll(generatedFrontendAuthBridge, ["useForgeWorkOSSession", "/session", "claims"]);
   const authSessionProxyConfigured = webAuthSessionProxyConfigured(workspaceRoot);
@@ -1809,7 +1863,7 @@ function collectWorkOSChecks(workspaceRoot: string, preferredSeedPath = DEFAULT_
       ok: !hasWeb || (hasValue(realEnv, "VITE_WORKOS_CLIENT_ID") || readRawText(workspaceRoot, ".env.example").includes("VITE_WORKOS_CLIENT_ID=")) &&
         (hasValue(realEnv, "VITE_WORKOS_REDIRECT_URI") || readRawText(workspaceRoot, ".env.example").includes("VITE_WORKOS_REDIRECT_URI=")),
       detail: hasWeb
-        ? "web workspace has VITE_WORKOS_CLIENT_ID and VITE_WORKOS_REDIRECT_URI guidance for AuthKit React"
+        ? "web workspace has browser WorkOS client ID and redirect URI guidance for backend-owned AuthKit routes"
         : "no web workspace detected",
     },
     {
@@ -1821,11 +1875,11 @@ function collectWorkOSChecks(workspaceRoot: string, preferredSeedPath = DEFAULT_
     },
     {
       name: "browser-authkit-bridge",
-      ok: !hasWeb || includesAll(generatedFrontendAuthBridge, ["AuthKitProvider", "ForgeProvider"]) &&
-        authBridgeProvidesToken &&
+      ok: !hasWeb || generatedFrontendAuthBridge.includes("ForgeProvider") &&
+        authBridgeUsesBackendRoutes &&
         authBridgeProvidesSessionClaims,
       detail: hasWeb
-        ? "generated web/src/lib/workos-auth.tsx bridge provides AuthKitProvider, ForgeProvider token wiring, and normalized /session claims"
+        ? "generated web/src/lib/workos-auth.tsx bridge uses backend-owned AuthKit routes, ForgeProvider, and normalized /session claims"
         : "no web workspace detected",
     },
     {
@@ -1841,7 +1895,7 @@ function collectWorkOSChecks(workspaceRoot: string, preferredSeedPath = DEFAULT_
       name: "browser-authkit-provider",
       ok: !hasWeb || appShellUsesWorkOSProvider,
       detail: hasWeb
-        ? "web app shell mounts ForgeWorkOSAuthProvider or AuthKitProvider"
+        ? "web app shell mounts ForgeWorkOSAuthProvider"
         : "no web workspace detected",
     },
     {
@@ -2486,6 +2540,7 @@ export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSComm
   const seed = parseSeedFile(options.workspaceRoot, file);
   const seedState = readWorkOSSeedState(options.workspaceRoot, seed);
   const setupDryRun = options.dryRun || !options.real;
+  const publicEnvSync = syncWorkOSPublicWebEnv(options.workspaceRoot, localOk && !setupDryRun);
   const configActions = runWorkOSConfigActions(seed, options, true);
   const command = ["npx", "--yes", "workos@latest", "seed", "--file", file];
   if (!localOk) {
@@ -2500,6 +2555,7 @@ export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSComm
         real: options.real ?? false,
         seed,
         seedState,
+        publicEnvSync,
         ...(cliAuth ? { cliAuth } : {}),
         configActions,
         nextCommand: cliAuth && !cliAuth.ok
@@ -2521,6 +2577,7 @@ export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSComm
         real: false,
         seed,
         seedState,
+        publicEnvSync,
         ...(cliAuth ? { cliAuth } : {}),
         configActions,
         nextCommand: `forge workos setup --real --file ${file} --json`,
@@ -2546,6 +2603,7 @@ export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSComm
     data: {
       real: true,
       seed,
+      publicEnvSync,
       ...(cliAuth ? { cliAuth } : {}),
       seedState: seedResultData.seedState ?? readWorkOSSeedState(options.workspaceRoot, seed),
       seedResult: seedResult.data,

package/src/forge/compiler/integration/add.ts

@@ -31,6 +31,7 @@ import {
   resolveByPackageName,
   resolveRecipe,
 } from "../recipes/registry.ts";
+import { applyWorkOSRecipeProfile } from "../recipes/profiles.ts";
 import { discover } from "../orchestrator/discover.ts";
 import {
   loadManifest,
@@ -92,24 +93,6 @@ function recipeResultMetadata(recipe: IntegrationRecipe): Pick<
   };
 }
 
-const WORKOS_FGA_INTEGRATION_FILES = new Set([
-  "workos/fga.ts",
-  "workos/resource-map.ts",
-]);
-
-function applyWorkOSRecipeProfile(
-  recipe: NonNullable<ReturnType<typeof resolveRecipe>>,
-  options: Pick<ForgeAddOptions, "withFga">,
-): IntegrationRecipe {
-  if (recipe.alias !== "workos" || options.withFga) {
-    return recipe;
-  }
-  return {
-    ...recipe,
-    integrations: recipe.integrations?.filter((file) => !WORKOS_FGA_INTEGRATION_FILES.has(file)),
-  };
-}
-
 function addExplanation(result: ForgeAddResult): string {
   if (result.mode === "package") {
     const location = result.target && result.target !== "root" ? `${result.target}/package.json` : "package.json";
@@ -528,6 +511,60 @@ function workosFrontendWorkspace(workspaceRoot: string): string | undefined {
   return findFrontendWorkspace(workspaceRoot);
 }
 
+function parseDotEnv(text: string | null): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const line of (text ?? "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match) continue;
+    result[match[1]!] = match[2]!.replace(/^["']|["']$/g, "");
+  }
+  return result;
+}
+
+function renderMergedDotEnv(current: string | null, values: Record<string, string>): string {
+  const lines = (current ?? "").split(/\r?\n/);
+  const seen = new Set<string>();
+  const next = lines.map((line) => {
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=/);
+    if (!match || !(match[1]! in values)) {
+      return line;
+    }
+    seen.add(match[1]!);
+    return `${match[1]}=${values[match[1]!]}`;
+  });
+  for (const [key, value] of Object.entries(values)) {
+    if (!seen.has(key)) {
+      next.push(`${key}=${value}`);
+    }
+  }
+  return `${next.filter((line, index, all) => line.length > 0 || index < all.length - 1).join("\n").trimEnd()}\n`;
+}
+
+function syncWorkOSPublicWebEnv(workspaceRoot: string, frontendWorkspace: string): { changed: string[] } {
+  const rootLocal = parseDotEnv(nodeFileSystem.readText(join(workspaceRoot, ".env.local")));
+  const rootExample = parseDotEnv(nodeFileSystem.readText(join(workspaceRoot, ".env.example")));
+  const source = { ...rootExample, ...rootLocal };
+  const clientId = source.VITE_WORKOS_CLIENT_ID || source.WORKOS_CLIENT_ID || "";
+  const redirectUri = source.VITE_WORKOS_REDIRECT_URI || source.WORKOS_REDIRECT_URI || "http://localhost:5173/callback";
+  const values: Record<string, string> = {
+    VITE_FORGE_URL: source.VITE_FORGE_URL || "http://localhost:3765",
+    VITE_WORKOS_CLIENT_ID: clientId,
+    VITE_WORKOS_REDIRECT_URI: redirectUri,
+  };
+  const envRel = `${frontendWorkspace}/.env.local`;
+  const envPath = join(workspaceRoot, envRel);
+  const current = nodeFileSystem.readText(envPath);
+  const next = renderMergedDotEnv(current, values);
+  if (current === next) {
+    return { changed: [] };
+  }
+  nodeFileSystem.mkdirp(join(workspaceRoot, frontendWorkspace));
+  nodeFileSystem.writeText(envPath, next);
+  return { changed: [envRel] };
+}
+
 function connectWorkOSReactRoot(workspaceRoot: string, frontendWorkspace: string): {
   changed: string[];
   warnings: Diagnostic[];
@@ -610,7 +647,7 @@ function connectWorkOSReactRoot(workspaceRoot: string, frontendWorkspace: string
         "          <p className=\"notice error\">{workosSession.error.message}</p>",
         "          <div className=\"login-form\">",
         "            <button type=\"button\" onClick={() => void workosSession.refresh()}>Retry session</button>",
-        "            <button className=\"secondary\" type=\"button\" onClick={() => auth.signOut({ returnTo: window.location.origin })}>Sign out</button>",
+        "            <button className=\"secondary\" type=\"button\" onClick={() => auth.signOut()}>Sign out</button>",
         "          </div>",
         "        </section>",
         "      </main>",
@@ -631,8 +668,8 @@ function connectWorkOSReactRoot(workspaceRoot: string, frontendWorkspace: string
         "          <p className=\"eyebrow\">WorkOS AuthKit</p>",
         "          <h1>Sign in to review vendor access</h1>",
         "          <div className=\"login-form\">",
-        "            <button type=\"button\" onClick={() => void auth.signIn()}>Sign in with WorkOS</button>",
-        "            <button className=\"secondary\" type=\"button\" onClick={() => void auth.signUp()}>Create account</button>",
+        "            <button type=\"button\" onClick={() => auth.signIn()}>Sign in with WorkOS</button>",
+        "            <button className=\"secondary\" type=\"button\" onClick={() => auth.signUp()}>Create account</button>",
         "          </div>",
         "        </section>",
         "        <aside className=\"login-context\">",
@@ -664,7 +701,7 @@ function connectWorkOSReactRoot(workspaceRoot: string, frontendWorkspace: string
         "      persona={persona}",
         "      personas={[persona]}",
         "      onPersonaChange={() => undefined}",
-        "      onSignOut={() => auth.signOut({ returnTo: window.location.origin })}",
+        "      onSignOut={() => auth.signOut()}",
         "    />",
         "  );",
         "}",
@@ -1103,7 +1140,11 @@ export async function forgeAdd(
     });
 
     const workosWeb = normalized === "workos" && frontendWorkspace
-      ? connectWorkOSReactRoot(options.workspaceRoot, frontendWorkspace)
+      ? (() => {
+          const root = connectWorkOSReactRoot(options.workspaceRoot, frontendWorkspace);
+          const env = syncWorkOSPublicWebEnv(options.workspaceRoot, frontendWorkspace);
+          return { changed: [...root.changed, ...env.changed], warnings: root.warnings };
+        })()
       : { changed: [] as string[], warnings: [] as Diagnostic[] };
 
     const warningsCombined = [...preinstalledWarnings, ...warnings, ...emitResult.warnings, ...workosWeb.warnings];

package/src/forge/compiler/integration/templates/workos.ts

@@ -285,6 +285,7 @@ export function renderWorkosEnvExample(_input: IntegrationTemplateInput): string
     "WORKOS_WEBHOOK_SECRET=",
     "",
     "# Browser AuthKit settings for Vite/React. These are public client identifiers, not secrets.",
+    "VITE_FORGE_URL=http://localhost:3765",
     "VITE_WORKOS_CLIENT_ID=",
     "VITE_WORKOS_REDIRECT_URI=http://localhost:5173/callback",
     "",
@@ -299,12 +300,22 @@ export function renderWorkosReactBridge(_input: IntegrationTemplateInput): strin
     "/** Forge generated WorkOS/AuthKit React bridge.",
     " * Import ForgeWorkOSAuthProvider from web/src/main.tsx, or copy the pattern into your app shell.",
     " */",
-    'import { AuthKitProvider, useAuth as useWorkOSAuth } from "@workos-inc/authkit-react";',
     'import { useEffect, useState, type ReactNode } from "react";',
     'import { ForgeProvider, forgeUrl } from "./forge";',
     "",
     "const clientId = import.meta.env.VITE_WORKOS_CLIENT_ID as string | undefined;",
     "const redirectUri = import.meta.env.VITE_WORKOS_REDIRECT_URI as string | undefined;",
+    "const forgeApiUrl = import.meta.env.VITE_FORGE_URL as string | undefined;",
+    "",
+    "function workOSApiUrl(path: string): URL {",
+    "  if (typeof window !== 'undefined' && forgeApiUrl) {",
+    "    const configured = new URL(forgeApiUrl, window.location.origin);",
+    "    if ((configured.hostname === 'localhost' || configured.hostname === '127.0.0.1') && (window.location.hostname === 'localhost' || window.location.hostname === '127.0.0.1')) {",
+    "      return new URL(path, window.location.origin);",
+    "    }",
+    "  }",
+    "  return new URL(path, forgeApiUrl || forgeUrl || window.location.origin);",
+    "}",
     "",
     "export function hasWorkOSBrowserConfig(): boolean {",
     "  return Boolean(clientId && redirectUri);",
@@ -315,24 +326,7 @@ export function renderWorkosReactBridge(_input: IntegrationTemplateInput): strin
     "    throw new Error(\"WorkOS AuthKit requires VITE_WORKOS_CLIENT_ID and VITE_WORKOS_REDIRECT_URI\");",
     "  }",
     "  return (",
-    "    <AuthKitProvider clientId={clientId} redirectUri={redirectUri}>",
-    "      <ForgeWorkOSBearerProvider>{children}</ForgeWorkOSBearerProvider>",
-    "    </AuthKitProvider>",
-    "  );",
-    "}",
-    "",
-    "function ForgeWorkOSBearerProvider({ children }: { children: ReactNode }) {",
-    "  const auth = useWorkOSAuth();",
-    "  return (",
-    "    <ForgeProvider",
-    "      url={forgeUrl}",
-    "      auth={{",
-    "        getToken: async () => {",
-    "          const token = await auth.getAccessToken();",
-    "          return token ?? null;",
-    "        },",
-    "      }}",
-    "    >",
+    "    <ForgeProvider url={forgeUrl}>",
     "      {children}",
     "    </ForgeProvider>",
     "  );",
@@ -360,7 +354,7 @@ export function renderWorkosReactBridge(_input: IntegrationTemplateInput): strin
     "    setLoading(true);",
     "    setError(null);",
     "    try {",
-    "      const response = await fetch('/session', { credentials: 'include' });",
+    "      const response = await fetch(workOSApiUrl('/session'), { credentials: 'include' });",
     "      if (response.status === 401) {",
     "        setSession(null);",
     "        return;",
@@ -385,6 +379,30 @@ export function renderWorkosReactBridge(_input: IntegrationTemplateInput): strin
     "  return { loading, session, error, refresh };",
     "}",
     "",
+    "export function useWorkOSAuth() {",
+    "  const session = useForgeWorkOSSession();",
+    "  const user = session.session?.user ?? null;",
+    "  return {",
+    "    isLoading: session.loading,",
+    "    user,",
+    "    session: session.session,",
+    "    sessionError: session.error,",
+    "    refresh: session.refresh,",
+    "    signIn: () => {",
+    "      const url = workOSApiUrl('/login');",
+    "      url.searchParams.set('returnTo', window.location.pathname + window.location.search);",
+    "      window.location.assign(url);",
+    "    },",
+    "    signUp: () => {",
+    "      const url = workOSApiUrl('/login');",
+    "      url.searchParams.set('returnTo', window.location.pathname + window.location.search);",
+    "      window.location.assign(url);",
+    "    },",
+    "    signOut: () => { void fetch(workOSApiUrl('/logout'), { method: 'POST', credentials: 'include' }).finally(() => { window.location.assign('/'); }); },",
+    "    getAccessToken: async () => null,",
+    "  };",
+    "}",
+    "",
     "export function WorkOSLoginPanel() {",
     "  const { isLoading, user, signIn, signUp, signOut } = useWorkOSAuth();",
     "  useEffect(() => {",
@@ -405,12 +423,11 @@ export function renderWorkosReactBridge(_input: IntegrationTemplateInput): strin
     "  return (",
     "    <div>",
     "      <span>{user.email}</span>",
-    "      <button type=\"button\" onClick={() => signOut({ returnTo: window.location.origin })}>Sign out</button>",
+    "      <button type=\"button\" onClick={() => signOut()}>Sign out</button>",
     "    </div>",
     "  );",
     "}",
     "",
-    "export { useWorkOSAuth };",
     "",
   ].join("\n");
 }
@@ -829,7 +846,7 @@ export function renderWorkosAuthRoutes(_input: IntegrationTemplateInput): string
     "export interface WorkOSAuthRoutesOptions {",
     "  workos: WorkOS;",
     "  config: ForgeWorkOSAuthKitConfig;",
-    "  resolveOrganization?: (input: { user: Record<string, unknown>; accessToken: string }) => Promise<{ organizationId?: string; organizationMembershipId?: string; role?: string; roles?: string[]; permissions?: string[] }> | { organizationId?: string; organizationMembershipId?: string; role?: string; roles?: string[]; permissions?: string[] };",
+    "  resolveOrganization?: (input: { user: Record<string, unknown>; accessToken: string; organizationId?: string; organizationMembershipId?: string; result: Record<string, unknown> }) => Promise<{ organizationId?: string; organizationMembershipId?: string; role?: string; roles?: string[]; permissions?: string[] }> | { organizationId?: string; organizationMembershipId?: string; role?: string; roles?: string[]; permissions?: string[] };",
     "}",
     "",
     "function jsonResponse(body: unknown, status = 200, headers?: HeadersInit): Response {",
@@ -863,12 +880,15 @@ export function renderWorkosAuthRoutes(_input: IntegrationTemplateInput): string
     "",
     "export function getWorkOSAuthorizationUrl(input: { workos: WorkOS; config: ForgeWorkOSAuthKitConfig; state?: string }): string {",
     "  if (!input.config.redirectUri) throw new Error(\"WORKOS_REDIRECT_URI is required\");",
-    "  return input.workos.userManagement.getAuthorizationUrl({",
+    "  const url = new URL(input.workos.userManagement.getAuthorizationUrl({",
     "    provider: \"authkit\",",
     "    redirectUri: input.config.redirectUri,",
     "    clientId: input.config.clientId,",
     "    ...(input.state ? { state: input.state } : {}),",
-    "  });",
+    "  }));",
+    "  url.searchParams.set(\"response_type\", \"code\");",
+    "  url.searchParams.delete(\"organization_id\");",
+    "  return url.toString();",
     "}",
     "",
     "export async function authenticateWorkOSCallback(input: { workos: WorkOS; config: ForgeWorkOSAuthKitConfig; code: string; resolveOrganization?: WorkOSAuthRoutesOptions[\"resolveOrganization\"] }): Promise<ForgeWorkOSSession> {",
@@ -877,19 +897,34 @@ export function renderWorkosAuthRoutes(_input: IntegrationTemplateInput): string
     "    clientId: input.config.clientId,",
     "  });",
     "  const user = workOSUserRecord(result.user);",
+    "  const rawResult = result as Record<string, unknown>;",
+    "  const resultOrganization = (rawResult.organization ?? {}) as Record<string, unknown>;",
+    "  const resultMembership = (rawResult.organizationMembership ?? {}) as Record<string, unknown>;",
+    "  const resultOrganizationId = typeof result.organizationId === \"string\" ? result.organizationId : typeof resultOrganization.id === \"string\" ? resultOrganization.id : undefined;",
+    "  const resultOrganizationMembershipId = typeof result.organizationMembershipId === \"string\" ? result.organizationMembershipId : typeof resultMembership.id === \"string\" ? resultMembership.id : undefined;",
     "  const resolved = await input.resolveOrganization?.({",
     "    user,",
     "    accessToken: result.accessToken,",
+    "    organizationId: resultOrganizationId,",
+    "    organizationMembershipId: resultOrganizationMembershipId,",
+    "    result: rawResult,",
     "  });",
+    "  const resultRoles = Array.isArray(result.roles) ? result.roles.filter((role): role is string => typeof role === \"string\") : [];",
+    "  const resultPermissions = Array.isArray(result.permissions) ? result.permissions.filter((permission): permission is string => typeof permission === \"string\") : [];",
+    "  const organizationId = resolved?.organizationId ?? resultOrganizationId;",
+    "  const organizationMembershipId = resolved?.organizationMembershipId ?? resultOrganizationMembershipId;",
+    "  const role = resolved?.role ?? (typeof result.role === \"string\" ? result.role : resultRoles[0]);",
+    "  const roles = resolved?.roles ?? resultRoles;",
+    "  const permissions = resolved?.permissions ?? resultPermissions;",
     "  return {",
     "    user: workOSSessionUser(user),",
     "    accessToken: result.accessToken,",
     "    ...(result.refreshToken ? { refreshToken: result.refreshToken } : {}),",
-    "    ...(resolved?.organizationId ? { organizationId: resolved.organizationId } : {}),",
-    "    ...(resolved?.organizationMembershipId ? { organizationMembershipId: resolved.organizationMembershipId } : {}),",
-    "    ...(resolved?.role ? { role: resolved.role } : {}),",
-    "    ...(resolved?.roles ? { roles: resolved.roles } : {}),",
-    "    ...(resolved?.permissions ? { permissions: resolved.permissions } : {}),",
+    "    ...(organizationId ? { organizationId } : {}),",
+    "    ...(organizationMembershipId ? { organizationMembershipId } : {}),",
+    "    ...(role ? { role } : {}),",
+    "    ...(roles.length > 0 ? { roles } : {}),",
+    "    ...(permissions.length > 0 ? { permissions } : {}),",
     "    issuedAt: Math.floor(Date.now() / 1000),",
     "  };",
     "}",

package/src/forge/compiler/orchestrator/run.ts

@@ -16,6 +16,7 @@ import { buildRuntimeMatrix } from "../classifier/runtime-matrix.ts";
 import { emit } from "../emitter/emit.ts";
 import { PackageGraphCompiler } from "../package-graph/compiler.ts";
 import { resolveByPackageName } from "../recipes/registry.ts";
+import { applyWorkspaceRecipeProfile } from "../recipes/profiles.ts";
 import { checkImportGuards } from "./guards.ts";
 import {
   saveManifest,
@@ -45,9 +46,10 @@ import { verifyLockIntegrity } from "./verify.ts";
 
 function classifyPackages(
   packageGraph: Awaited<ReturnType<PackageGraphCompiler["build"]>>["graph"],
+  workspaceRoot: string,
 ): ClassifiedPackage[] {
   return packageGraph.packages.map((api) => {
-    const recipe = resolveByPackageName(api.name) ?? undefined;
+    const recipe = applyWorkspaceRecipeProfile(resolveByPackageName(api.name), workspaceRoot);
     return {
       api,
       classification: classify(api, recipe),
@@ -171,7 +173,7 @@ async function runUnlocked(options: GenerateOptions): Promise<GenerateResult> {
   if (profileEnabled) {
     resetSignalProfile();
   }
-  const classified = classifyPackages(pkgResult.graph);
+  const classified = classifyPackages(pkgResult.graph, options.workspaceRoot);
   const classifierSignals = profileEnabled ? getSignalProfile() : undefined;
   if (profileEnabled) {
     clearSignalProfile();

package/src/forge/compiler/recipes/profiles.ts

@@ -0,0 +1,81 @@
+import { join } from "node:path";
+import { nodeFileSystem } from "../fs/index.ts";
+import { FORGE_LOCK_PATH, GENERATED_DIR } from "../emitter/constants.ts";
+import type { IntegrationRecipe } from "../types/integration.ts";
+import type { ForgeLock } from "../types/lock.ts";
+
+export const WORKOS_FGA_INTEGRATION_FILES = new Set([
+  "workos/fga.ts",
+  "workos/resource-map.ts",
+]);
+
+function filterWorkOSFga(recipe: IntegrationRecipe): IntegrationRecipe {
+  return {
+    ...recipe,
+    integrations: recipe.integrations?.filter((file) => !WORKOS_FGA_INTEGRATION_FILES.has(file)),
+  };
+}
+
+export function applyWorkOSRecipeProfile(
+  recipe: IntegrationRecipe,
+  options: { withFga?: boolean },
+): IntegrationRecipe {
+  if (recipe.alias !== "workos" || options.withFga) {
+    return recipe;
+  }
+  return filterWorkOSFga(recipe);
+}
+
+function readForgeLock(workspaceRoot: string): ForgeLock | null {
+  const absolute = join(workspaceRoot, FORGE_LOCK_PATH);
+  if (!nodeFileSystem.exists(absolute)) {
+    return null;
+  }
+  try {
+    return JSON.parse(nodeFileSystem.readText(absolute) ?? "") as ForgeLock;
+  } catch {
+    return null;
+  }
+}
+
+function lockEnablesWorkOSFga(lock: ForgeLock | null): boolean {
+  const entry = lock?.packages.find((pkg) => pkg.name === "@workos-inc/node" || pkg.name === "workos");
+  return Boolean(entry?.generatedFiles.some((file) =>
+    file === `${GENERATED_DIR}/integrations/workos/fga.ts` ||
+    file === `${GENERATED_DIR}/integrations/workos/resource-map.ts`
+  ));
+}
+
+function seedEnablesWorkOSFga(workspaceRoot: string): boolean {
+  for (const path of [
+    "workos-seed.yml",
+    `${GENERATED_DIR}/integrations/workos/workos-seed.yml`,
+  ]) {
+    const text = nodeFileSystem.readText(join(workspaceRoot, path));
+    if (text !== null && /^\s*resource_types\s*:/m.test(text)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function workspaceEnablesWorkOSFga(workspaceRoot: string): boolean {
+  return nodeFileSystem.exists(join(workspaceRoot, ".workos-fga-state.json")) ||
+    seedEnablesWorkOSFga(workspaceRoot) ||
+    lockEnablesWorkOSFga(readForgeLock(workspaceRoot));
+}
+
+export function applyWorkspaceRecipeProfile(
+  recipe: IntegrationRecipe | null | undefined,
+  workspaceRoot: string,
+): IntegrationRecipe | undefined {
+  if (!recipe) {
+    return undefined;
+  }
+  if (recipe.alias !== "workos") {
+    return recipe;
+  }
+  return applyWorkOSRecipeProfile(recipe, {
+    withFga: workspaceEnablesWorkOSFga(workspaceRoot),
+  });
+}

package/src/forge/dev/server.ts

@@ -24,6 +24,8 @@ import {
 import { authenticateHeaders } from "../runtime/auth/authenticate.ts";
 import { loadAuthConfigFromEnv } from "../runtime/auth/config.ts";
 import { ForgeAuthError } from "../runtime/auth/errors.ts";
+import { resolveAuthFromHeaders } from "../runtime/auth/resolve.ts";
+import type { AuthContext } from "../runtime/auth/types.ts";
 import type { TableMapEntry } from "../compiler/data-graph/sql/serialize.ts";
 import type { SqlPlan } from "../compiler/data-graph/sql/types.ts";
 import { GENERATED_DIR } from "../compiler/emitter/constants.ts";
@@ -506,6 +508,61 @@ function workOSDevSessionClaims(session: WorkOSDevSession): Record<string, unkno
   };
 }
 
+function authFromWorkOSDevSessionCookie(
+  request: Request,
+  envStore: ReturnType<typeof getRuntimeEnvStore>,
+): AuthContext | null {
+  const cookiePassword = envStore.resolve("WORKOS_COOKIE_PASSWORD");
+  if (!cookiePassword) {
+    return null;
+  }
+  const session = decodeWorkOSDevSession(
+    readRequestCookie(request, workOSDevCookieName(envStore)),
+    cookiePassword,
+  );
+  if (!session) {
+    return null;
+  }
+  const claims = workOSDevSessionClaims(session);
+  return resolveAuthFromHeaders({
+    userId: typeof claims.sub === "string" ? claims.sub : undefined,
+    tenantId: typeof claims.organization_id === "string" ? claims.organization_id : undefined,
+    organizationId: typeof claims.organization_id === "string" ? claims.organization_id : undefined,
+    organizationMembershipId:
+      typeof claims.organization_membership_id === "string" ? claims.organization_membership_id : undefined,
+    role: typeof claims.role === "string" ? claims.role : undefined,
+    roles: Array.isArray(claims.roles) ? claims.roles.filter((role): role is string => typeof role === "string") : [],
+    permissions: Array.isArray(claims.permissions)
+      ? claims.permissions.filter((permission): permission is string => typeof permission === "string")
+      : [],
+    claims,
+  });
+}
+
+async function authenticateDevRequest(
+  request: Request,
+  authConfig: ReturnType<typeof loadAuthConfigFromEnv>,
+  envStore: ReturnType<typeof getRuntimeEnvStore>,
+): Promise<AuthContext> {
+  if (authConfig.mode === "dev-headers") {
+    const headerAuth = await authenticateHeaders(request.headers, authConfig);
+    if (headerAuth.kind !== "anonymous") {
+      return headerAuth;
+    }
+    return authFromWorkOSDevSessionCookie(request, envStore) ?? headerAuth;
+  }
+
+  try {
+    return await authenticateHeaders(request.headers, authConfig);
+  } catch (error) {
+    const cookieAuth = authFromWorkOSDevSessionCookie(request, envStore);
+    if (cookieAuth) {
+      return cookieAuth;
+    }
+    throw error;
+  }
+}
+
 function createWorkOSDevSessionCookie(
   envStore: ReturnType<typeof getRuntimeEnvStore>,
   session: WorkOSDevSession,
@@ -539,17 +596,64 @@ function workOSConfigDiagnostics(envStore: ReturnType<typeof getRuntimeEnvStore>
     );
 }
 
-function workOSAuthorizationUrl(envStore: ReturnType<typeof getRuntimeEnvStore>, state: string): string {
+function workOSAuthorizationUrl(
+  envStore: ReturnType<typeof getRuntimeEnvStore>,
+  state: string,
+  organizationId?: string,
+): string {
   const url = new URL("https://api.workos.com/user_management/authorize");
+  url.searchParams.set("response_type", "code");
   url.searchParams.set("provider", "authkit");
   url.searchParams.set("client_id", envStore.resolve("WORKOS_CLIENT_ID") ?? "");
   url.searchParams.set("redirect_uri", envStore.resolve("WORKOS_REDIRECT_URI") ?? "");
+  const effectiveOrganizationId = normalizeOptionalId(organizationId);
+  if (effectiveOrganizationId) {
+    url.searchParams.set("organization_id", effectiveOrganizationId);
+  }
   if (state) {
     url.searchParams.set("state", state);
   }
   return url.toString();
 }
 
+function normalizeOptionalId(value: string | undefined): string | undefined {
+  const trimmed = value?.trim();
+  if (!trimmed || trimmed === "undefined" || trimmed === "null") return undefined;
+  return trimmed;
+}
+
+function uniqueStrings(values: Iterable<unknown>): string[] {
+  return [...new Set([...values].filter((value): value is string => typeof value === "string" && value.length > 0))];
+}
+
+function permissionsFromPolicyRegistry(workspaceRoot: string): string[] {
+  const registryPath = join(workspaceRoot, `${GENERATED_DIR}/policyRegistry.json`);
+  if (!existsSync(registryPath)) return [];
+  try {
+    const registry = readGeneratedJson<{
+      policies?: Array<{ permissions?: unknown[] }>;
+    }>(workspaceRoot, `${GENERATED_DIR}/policyRegistry.json`);
+    return uniqueStrings(((registry?.policies ?? [])).flatMap((policy) => policy.permissions ?? []));
+  } catch {
+    return [];
+  }
+}
+
+function deriveDevPermissionsForRole(workspaceRoot: string, role: string | undefined): string[] {
+  const permissions = permissionsFromPolicyRegistry(workspaceRoot);
+  if (permissions.length === 0) return [];
+  const normalizedRole = role?.toLowerCase();
+  if (normalizedRole && ["owner", "admin", "manager", "security"].includes(normalizedRole)) {
+    return permissions;
+  }
+  if (normalizedRole === "requester") {
+    return permissions.filter((permission) =>
+      /(^|:)read$|read|list|view|audit|request|demo:seed/i.test(permission),
+    );
+  }
+  return permissions.filter((permission) => /(^|:)read$|read|list|view|audit|demo:seed/i.test(permission));
+}
+
 async function authenticateWorkOSCode(workspaceRoot: string, envStore: ReturnType<typeof getRuntimeEnvStore>, code: string) {
   const req = createRequire(join(workspaceRoot, "package.json"));
   const localEntry = join(workspaceRoot, "node_modules/@workos-inc/node/index.js");
@@ -569,14 +673,60 @@ async function authenticateWorkOSCode(workspaceRoot: string, envStore: ReturnTyp
           clientId: envStore.resolve("WORKOS_CLIENT_ID") ?? "",
         })
       : null;
-  const userManagement = (client as { userManagement?: { authenticateWithCode?: (input: { code: string; clientId: string }) => Promise<Record<string, unknown>> } } | null)?.userManagement;
+  const userManagement = (client as {
+    userManagement?: {
+      authenticateWithCode?: (input: { code: string; clientId: string }) => Promise<Record<string, unknown>>;
+      listOrganizationMemberships?: (input: { userId?: string; organizationId?: string }) => Promise<unknown>;
+    };
+  } | null)?.userManagement;
   if (!userManagement?.authenticateWithCode) {
     throw new Error("@workos-inc/node does not expose userManagement.authenticateWithCode");
   }
-  return userManagement.authenticateWithCode({
+  const result = await userManagement.authenticateWithCode({
     code,
     clientId: envStore.resolve("WORKOS_CLIENT_ID") ?? "",
   });
+  const user = (result.user ?? {}) as Record<string, unknown>;
+  const userId = typeof user.id === "string" ? user.id : undefined;
+  const defaultOrganizationId =
+    normalizeOptionalId(envStore.resolve("WORKOS_DEFAULT_ORGANIZATION_ID")) ||
+    normalizeOptionalId(envStore.resolve("WORKOS_ORGANIZATION_ID"));
+  const hasOrganization =
+    typeof result.organizationId === "string" ||
+    (typeof ((result.organization ?? {}) as Record<string, unknown>).id === "string");
+  if (!hasOrganization && userId && defaultOrganizationId && userManagement.listOrganizationMemberships) {
+    const membershipList = await userManagement.listOrganizationMemberships({
+      userId,
+      organizationId: defaultOrganizationId,
+    });
+    const data = (membershipList as { data?: unknown[] }).data;
+    const membership = Array.isArray(data)
+      ? data.find((item) => {
+          const record = item as Record<string, unknown>;
+          return record.status === undefined || record.status === "active";
+        }) as Record<string, unknown> | undefined
+      : undefined;
+    if (membership) {
+      const roleRecord = membership.role as Record<string, unknown> | undefined;
+      const roles = Array.isArray(membership.roles)
+        ? membership.roles
+            .map((role) => (typeof role === "string" ? role : (role as Record<string, unknown>).slug))
+            .filter((role): role is string => typeof role === "string")
+        : [];
+      const role = typeof roleRecord?.slug === "string" ? roleRecord.slug : roles[0];
+      return {
+        ...result,
+        organizationId: defaultOrganizationId,
+        organization: { id: defaultOrganizationId },
+        organizationMembershipId: typeof membership.id === "string" ? membership.id : undefined,
+        organizationMembership: membership,
+        ...(role ? { role } : {}),
+        ...(roles.length > 0 ? { roles } : role ? { roles: [role] } : {}),
+        permissions: deriveDevPermissionsForRole(workspaceRoot, role),
+      };
+    }
+  }
+  return result;
 }
 
 function acceptsHtml(request: Request): boolean {
@@ -1409,8 +1559,10 @@ export async function startDevServer(
             if (diagnostics.length > 0) {
               return jsonResponse({ ok: false, diagnostics }, 503);
             }
-            const returnTo = normalizeLocalRedirect(new URL(request.url).searchParams.get("returnTo"));
-            return redirectResponse(workOSAuthorizationUrl(envStore, returnTo));
+            const url = new URL(request.url);
+            const returnTo = normalizeLocalRedirect(url.searchParams.get("returnTo"));
+            const organizationId = url.searchParams.get("organizationId") ?? url.searchParams.get("organization_id") ?? undefined;
+            return redirectResponse(workOSAuthorizationUrl(envStore, returnTo, organizationId));
           }
 
           if (pathname === "/callback") {
@@ -1733,7 +1885,7 @@ export async function startDevServer(
             }
           }
 
-          const auth = await authenticateHeaders(request.headers, authConfig);
+          const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
           const lastRevision = Number(
             request.headers.get("last-event-id") ??
               url.searchParams.get("lastRevision") ??
@@ -1857,7 +2009,7 @@ export async function startDevServer(
               400,
             );
           }
-          const auth = await authenticateHeaders(request.headers, authConfig);
+          const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
           const envStore = getRuntimeEnvStore(workspaceRoot);
           const secretRegistry = loadSecretRegistry(workspaceRoot);
           const bundle = createRuntimeSecretsBundle({
@@ -1977,7 +2129,7 @@ export async function startDevServer(
           }
 
           const purpose = body.purpose ?? "dev_agent_chat";
-          const auth = await authenticateHeaders(request.headers, authConfig);
+          const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
           const envStore = getRuntimeEnvStore(workspaceRoot);
           const secretRegistry = loadSecretRegistry(workspaceRoot);
           const bundle = createRuntimeSecretsBundle({
@@ -2392,7 +2544,7 @@ export async function startDevServer(
           const externalInvoke = parseExternalInvoke(pathname);
           if (externalInvoke) {
             const args = await parseRequestArgs(request);
-            const auth = await authenticateHeaders(request.headers, authConfig);
+            const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
             const result = await runExternalEntry(
               workspaceRoot,
               {
@@ -2460,7 +2612,7 @@ export async function startDevServer(
             }
 
             const args = await parseRequestArgs(request);
-            const auth = await authenticateHeaders(request.headers, authConfig);
+            const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
 
             const result = await runQuery(
               workspaceRoot,
@@ -2533,7 +2685,7 @@ export async function startDevServer(
             }
 
             const args = await parseRequestArgs(request);
-            const auth = await authenticateHeaders(request.headers, authConfig);
+            const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
 
             await prepareRuntimeEnvironment(workspaceRoot, {
               mock: options.mock,

package/src/forge/ui/index.ts

@@ -233,20 +233,6 @@ function hasWorkOSIntegration(workspaceRoot: string): boolean {
     nodeFileSystem.exists(join(workspaceRoot, `${GENERATED}/integrations/workos/auth-routes.ts`));
 }
 
-function webPackageHasAuthKit(workspaceRoot: string): boolean {
-  const path = join(workspaceRoot, "web/package.json");
-  if (!nodeFileSystem.exists(path)) return false;
-  try {
-    const packageJson = JSON.parse(nodeFileSystem.readText(path) ?? "{}") as {
-      dependencies?: Record<string, string>;
-      devDependencies?: Record<string, string>;
-    };
-    return Boolean(packageJson.dependencies?.["@workos-inc/authkit-react"] ?? packageJson.devDependencies?.["@workos-inc/authkit-react"]);
-  } catch {
-    return false;
-  }
-}
-
 type UiPackageManager = "bun" | "npm" | "pnpm" | "yarn";
 
 interface UiPackageContext {
@@ -1440,23 +1426,19 @@ function runUiAudit(options: UiCommandOptions): UiCommandResult {
     hasWorkOSIntegration(options.workspaceRoot) &&
     manifest.webRoot &&
     webSources.length > 0 &&
-    (!webPackageHasAuthKit(options.workspaceRoot) ||
-      (!/AuthKitProvider/.test(appShellText) && !/ForgeWorkOSAuthProvider/.test(appShellText)) ||
-      (!/getToken/.test(webImplementationText) && !/getAccessToken/.test(webImplementationText)))
+    !/ForgeWorkOSAuthProvider/.test(appShellText)
   ) {
     diagnostics.push(diagnostic(
       "warning",
       "FORGE_UI_WORKOS_AUTHKIT_MISSING",
-      "WorkOS integration is present, but the web app does not appear to mount AuthKitProvider or pass a WorkOS token provider into ForgeProvider.",
+      "WorkOS integration is present, but the web app does not appear to mount ForgeWorkOSAuthProvider.",
     ));
   }
   if (
     hasWorkOSIntegration(options.workspaceRoot) &&
     manifest.webRoot &&
     webSources.length > 0 &&
-    webPackageHasAuthKit(options.workspaceRoot) &&
-    (/AuthKitProvider/.test(appShellText) || /ForgeWorkOSAuthProvider/.test(appShellText)) &&
-    (/getToken/.test(webImplementationText) || /getAccessToken/.test(webImplementationText)) &&
+    /ForgeWorkOSAuthProvider/.test(appShellText) &&
     (!webUsesWorkOSSessionClaims(webImplementationText) || !webConfigProxiesWorkOSSession(options.workspaceRoot, manifest.webRoot))
   ) {
     diagnostics.push(diagnostic(

package/src/forge/version.ts

@@ -1,3 +1,3 @@
-export const FORGEOS_VERSION = "0.1.0-alpha.56";
+export const FORGEOS_VERSION = "0.1.0-alpha.57";
 export const GENERATOR_VERSION = FORGEOS_VERSION;
 export const CLI_VERSION = FORGEOS_VERSION;