forgeos 0.1.0-alpha.61 → 0.1.0-alpha.63

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.61 input=6dd290dbb57f6f75a802f741028ac6dbd672aa09d598ba2639ffcec7fa7feb7d content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.63 input=6671cc4ce9f1aeab62768f037489379d8303a79d2681b1fae4cb42a84e818b30 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # forgeos
 
+## 0.1.0-alpha.63
+
+### Patch Changes
+
+- Make generated freshness and Java/Spring brownfield analysis trustworthy.
+
+  - `forge status` now executes deterministic generation verification, so a
+    clean Git worktree can no longer hide committed generated drift that
+    `forge handoff` would reject.
+  - Report compact generation evidence in status output, including freshness,
+    changed artifact counts, samples, and diagnostic codes.
+  - Extend `forge import analyze` to inventory Maven dependencies, recognize
+    Spring Boot, scan Java source, discover Spring MVC controller mappings, and
+    detect `System.getenv(...)` usage.
+  - Keep Spring-derived command/query candidates static, review-required, and
+    hidden from agents under the existing brownfield safety model.
+  - Pin a modern Maven compiler plugin for the Java adapter and Spring starter,
+    so their declared Java 17 release compiles on the supported JDK 21 toolchain.
+  - Make example fixture seeding replace package directories cleanly, avoiding
+    cross-identity timestamp/ownership failures in shared development workspaces.
+
+## 0.1.0-alpha.62
+
+### Patch Changes
+
+- Keep commit-ready change views from exposing local secrets or WorkOS state.
+
+  - Classify real `.env*` files as operational while keeping `.env.example`
+    and `.env.*.example` files commit-ready.
+  - Exclude `.workos-seed-state.json` and `.workos-fga-state.json` from
+    commit-ready summaries.
+  - Add regression coverage so deploy examples stay visible while
+    `deploy/.env.production` remains excluded.
+
 ## 0.1.0-alpha.61
 
 ### Patch Changes

package/README.md

@@ -309,7 +309,7 @@ Common command groups:
 | `forge release` | Release/source-map bridge and symbolication |
 | `forge agent`, `forge agent-contract` | Agent-facing contract, adapter exports, context, install, ingest, and memory commands |
 | `forge mcp serve` | MCP server for external agents to read Forge context, memory, timeline, and inspect surfaces |
-| `forge import analyze`, `forge import inspect` | Brownfield TypeScript/JavaScript app inventory and reviewed migration planning |
+| `forge import analyze`, `forge import inspect` | Brownfield TypeScript/JavaScript and Java/Spring app inventory with reviewed migration planning |
 | `forge inspect imported --json` | Inspect `.forge/import` analysis artifacts |
 | `forge self-host` | Self-host packaging and checks |
 

package/adapters/java/pom.xml

@@ -31,4 +31,17 @@
       <version>${jackson.version}</version>
     </dependency>
   </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <version>3.13.0</version>
+        <configuration>
+          <release>${maven.compiler.release}</release>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
 </project>

package/adapters/java-spring-boot-starter/pom.xml

@@ -33,4 +33,17 @@
       <version>6.1.14</version>
     </dependency>
   </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <version>3.13.0</version>
+        <configuration>
+          <release>${maven.compiler.release}</release>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
 </project>

package/docs/changelog.md

@@ -4,6 +4,20 @@ Release history for the `forgeos` npm package.
 
 The canonical source file in the repository is `CHANGELOG.md`.
 
+## 0.1.0-alpha.63
+
+- `forge status` now verifies generated output deterministically instead of
+  inferring freshness from Git state, preventing committed stale artifacts from
+  appearing ready while `forge handoff` rejects them.
+- Brownfield import now understands Java/Spring Boot projects: Maven dependency
+  inventory, Spring MVC mappings, Java handler scoping, path variables, and
+  `System.getenv(...)` usage.
+- Imported Spring operations retain the same conservative review and agent
+  visibility defaults as TypeScript/JavaScript candidates.
+- Java adapter builds now pin a release-aware Maven compiler plugin, and example
+  fixture setup safely replaces generated package directories in shared
+  workspaces.
+
 ## 0.1.0-alpha.61
 
 - Added `forge golden-path plan/status` as the canonical

package/examples/java-billing/pom.xml

@@ -24,6 +24,14 @@
 
   <build>
     <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <version>3.13.0</version>
+        <configuration>
+          <release>${maven.compiler.release}</release>
+        </configuration>
+      </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-shade-plugin</artifactId>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.61",
+  "version": "0.1.0-alpha.63",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.61","releaseId":"forgeos@0.1.0-alpha.61+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.63","releaseId":"forgeos@0.1.0-alpha.63+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.61 input=6dd290dbb57f6f75a802f741028ac6dbd672aa09d598ba2639ffcec7fa7feb7d content=82fdee65e1219bbb3fa9572a4c904c7e1e4061b00430769528426ece3b3a4067
+// @forge-generated generator=0.1.0-alpha.63 input=6671cc4ce9f1aeab62768f037489379d8303a79d2681b1fae4cb42a84e818b30 content=407b2f82bfffde0fd6fec96fc9130364878d1f2a6d0945e40da2b05d49aea75a
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.61",
-  "releaseId": "forgeos@0.1.0-alpha.61+unknown",
+  "packageVersion": "0.1.0-alpha.63",
+  "releaseId": "forgeos@0.1.0-alpha.63+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/brownfield-import/index.ts

@@ -16,7 +16,7 @@ import type {
 } from "./types.ts";
 
 const IMPORT_DIR = ".forge/import";
-const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
+const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".java"]);
 const IGNORED_DIRS = new Set([
   ".git",
   ".forge",
@@ -130,8 +130,10 @@ function buildDependencyInventory(workspaceRoot: string): {
   dependencies: ImportedDependencyInventory;
 } {
   const pkg = readPackageJson(workspaceRoot);
-  const dependencies = objectKeys(pkg.dependencies);
+  const npmDependencies = objectKeys(pkg.dependencies);
   const devDependencies = objectKeys(pkg.devDependencies);
+  const pom = readMavenInventory(workspaceRoot);
+  const dependencies = [...new Set([...npmDependencies, ...pom.dependencies])].sort();
   const all = [...dependencies, ...devDependencies];
   const scripts = objectKeys(pkg.scripts);
   const frameworks = [
@@ -143,9 +145,11 @@ function buildDependencyInventory(workspaceRoot: string): {
     hasAny(all, ["@nestjs/core"]) ? "nest" : null,
     hasAny(all, ["fastify"]) ? "fastify" : null,
     hasAny(all, ["hono"]) ? "hono" : null,
+    pom.frameworks.includes("spring-boot") ? "spring-boot" : null,
   ].filter((value): value is string => value !== null);
   const dataPackages = all.filter((name) =>
-    ["@prisma/client", "prisma", "drizzle-orm", "typeorm", "mongoose", "sequelize", "knex"].includes(name),
+    ["@prisma/client", "prisma", "drizzle-orm", "typeorm", "mongoose", "sequelize", "knex"].includes(name) ||
+    /(?:spring-boot-starter-data-|hibernate-core|mybatis)/u.test(name),
   );
   const externalPackages = all.filter((name) =>
     [
@@ -163,7 +167,7 @@ function buildDependencyInventory(workspaceRoot: string): {
     ].includes(name),
   );
   return {
-    packageName: typeof pkg.name === "string" ? pkg.name : undefined,
+    packageName: typeof pkg.name === "string" ? pkg.name : pom.packageName,
     dependencies: {
       dependencies,
       devDependencies,
@@ -175,6 +179,34 @@ function buildDependencyInventory(workspaceRoot: string): {
   };
 }
 
+function readMavenInventory(workspaceRoot: string): {
+  packageName?: string;
+  dependencies: string[];
+  frameworks: string[];
+} {
+  const pomPath = join(workspaceRoot, "pom.xml");
+  if (!existsSync(pomPath)) {
+    return { dependencies: [], frameworks: [] };
+  }
+  const text = readFileSync(pomPath, "utf8");
+  const dependencies: string[] = [];
+  for (const match of text.matchAll(/<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gu)) {
+    const block = match[1] ?? "";
+    const groupId = block.match(/<groupId>\s*([^<]+?)\s*<\/groupId>/u)?.[1]?.trim();
+    const artifactId = block.match(/<artifactId>\s*([^<]+?)\s*<\/artifactId>/u)?.[1]?.trim();
+    if (artifactId) {
+      dependencies.push(groupId ? `${groupId}:${artifactId}` : artifactId);
+    }
+  }
+  const projectWithoutParent = text.replace(/<parent\b[^>]*>[\s\S]*?<\/parent>/u, "");
+  const packageName = projectWithoutParent.match(/<artifactId>\s*([^<]+?)\s*<\/artifactId>/u)?.[1]?.trim();
+  return {
+    ...(packageName ? { packageName } : {}),
+    dependencies: [...new Set(dependencies)].sort(),
+    frameworks: /\b(?:org\.springframework\.boot|spring-boot)[\w.:-]*/u.test(text) ? ["spring-boot"] : [],
+  };
+}
+
 function stableId(prefix: string, parts: string[]): string {
   let hash = 2166136261;
   for (const char of parts.join("|")) {
@@ -185,7 +217,7 @@ function stableId(prefix: string, parts: string[]): string {
 }
 
 function stripExtension(segment: string): string {
-  return segment.replace(/\.(ts|tsx|js|jsx|mjs|cjs)$/u, "");
+  return segment.replace(/\.(ts|tsx|js|jsx|mjs|cjs|java)$/u, "");
 }
 
 function normalizeRouteSegment(segment: string): string | null {
@@ -219,7 +251,56 @@ function routePathFromFile(relativePath: string, marker: string): string {
 }
 
 function joinRoutePath(base: string, child: string): string {
-  return `/${[base, child].map((part) => part.replace(/^\/|\/$/gu, "")).filter(Boolean).join("/")}`.replace(/\/+/gu, "/");
+  return `/${[base, child].map((part) => part.replace(/^\/|\/$/gu, "")).filter(Boolean).join("/")}`
+    .replace(/\/+/gu, "/")
+    .replace(/\{([^}/]+)\}/gu, ":$1");
+}
+
+function springMappingPath(argumentsText: string): string {
+  return argumentsText.match(/(?:path|value)\s*=\s*["']([^"']*)["']/u)?.[1] ??
+    argumentsText.match(/["']([^"']*)["']/u)?.[1] ??
+    "";
+}
+
+function springHandlerName(text: string): string | undefined {
+  return text.match(/(?:public|protected|private)?\s*(?:static\s+)?(?:[\w.$<>?,\[\]]+\s+)+(\w+)\s*\(/u)?.[1];
+}
+
+function detectSpringRoutes(file: SourceFile, routes: ImportedRoute[]): void {
+  if (extname(file.relativePath) !== ".java" || !/@(?:RestController|Controller)\b/u.test(file.text)) {
+    return;
+  }
+  const classIndex = file.text.search(/\bclass\s+\w+/u);
+  if (classIndex < 0) {
+    return;
+  }
+  const classAnnotations = file.text.slice(0, classIndex);
+  const classMapping = [...classAnnotations.matchAll(/@RequestMapping\s*(?:\(([^)]*)\))?/gu)].at(-1);
+  const basePath = springMappingPath(classMapping?.[1] ?? "");
+  const methodMappings = /@(GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping|RequestMapping)\s*(?:\(([^)]*)\))?/gu;
+  methodMappings.lastIndex = classIndex;
+  for (const match of file.text.matchAll(methodMappings)) {
+    const annotation = match[1] ?? "RequestMapping";
+    const argumentsText = match[2] ?? "";
+    const handler = springHandlerName(file.text.slice((match.index ?? 0) + match[0].length, (match.index ?? 0) + match[0].length + 500));
+    if (!handler) {
+      continue;
+    }
+    const methods = annotation === "RequestMapping"
+      ? [...argumentsText.matchAll(/RequestMethod\.(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)/gu)].map((item) => item[1] ?? "ANY")
+      : [annotation.replace(/Mapping$/u, "").toUpperCase()];
+    for (const method of methods.length > 0 ? methods : ["ANY"]) {
+      addRoute(
+        routes,
+        method,
+        joinRoutePath(basePath, springMappingPath(argumentsText)),
+        file.relativePath,
+        "spring",
+        0.86,
+        handler,
+      );
+    }
+  }
 }
 
 function pathIncludesRouteMarker(relativePath: string, marker: string): boolean {
@@ -251,6 +332,7 @@ function detectRoutes(files: SourceFile[]): ImportedRoute[] {
   const routes: ImportedRoute[] = [];
   const methods = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
   for (const file of files) {
+    const isJava = extname(file.relativePath) === ".java";
     if (pathIncludesRouteMarker(file.relativePath, "/app/api/") && basename(file.relativePath).startsWith("route.")) {
       const path = routePathFromFile(file.relativePath, "/app/");
       for (const method of methods) {
@@ -265,12 +347,14 @@ function detectRoutes(files: SourceFile[]): ImportedRoute[] {
       addRoute(routes, "ANY", path, file.relativePath, "next-pages-api", 0.78, "default");
     }
 
-    const expressRoute = /\b(?:app|router)\s*\.\s*(get|post|put|patch|delete|all)\s*\(\s*["'`]([^"'`]+)["'`]/giu;
-    for (const match of file.text.matchAll(expressRoute)) {
-      addRoute(routes, match[1] ?? "all", match[2] ?? "/", file.relativePath, "express", 0.84);
+    if (!isJava) {
+      const expressRoute = /\b(?:app|router)\s*\.\s*(get|post|put|patch|delete|all)\s*\(\s*["'`]([^"'`]+)["'`]/giu;
+      for (const match of file.text.matchAll(expressRoute)) {
+        addRoute(routes, match[1] ?? "all", match[2] ?? "/", file.relativePath, "express", 0.84);
+      }
     }
 
-    const controller = file.text.match(/@Controller\s*\(\s*["'`]([^"'`]*)["'`]\s*\)/u);
+    const controller = !isJava ? file.text.match(/@Controller\s*\(\s*["'`]([^"'`]*)["'`]\s*\)/u) : null;
     if (controller) {
       const nestRoute = /@(Get|Post|Put|Patch|Delete|All)\s*\(\s*(?:["'`]([^"'`]*)["'`])?\s*\)/giu;
       for (const match of file.text.matchAll(nestRoute)) {
@@ -284,6 +368,7 @@ function detectRoutes(files: SourceFile[]): ImportedRoute[] {
         );
       }
     }
+    detectSpringRoutes(file, routes);
   }
   const seen = new Set<string>();
   return routes
@@ -346,6 +431,9 @@ function collectEnv(workspaceRoot: string, files: SourceFile[]): ImportedInvento
     for (const match of file.text.matchAll(/\bprocess\.env\.([A-Z0-9_]+)/gu)) {
       names.add(match[1] ?? "");
     }
+    for (const match of file.text.matchAll(/\bSystem\.getenv\(\s*["']([A-Z0-9_]+)["']\s*\)/gu)) {
+      names.add(match[1] ?? "");
+    }
   }
   const envFiles = [".env", ".env.local", ".env.example", ".env.sample"]
     .filter((name) => existsSync(join(workspaceRoot, name)))
@@ -398,6 +486,13 @@ function scopedSourceTextForRoute(route: ImportedRoute, text: string): string |
       /@(Get|Post|Put|Patch|Delete|All)\s*\(/gu,
     );
   }
+  if (route.source === "spring" && route.handler) {
+    return sliceUntilNextMatch(
+      text,
+      new RegExp(`@(?:GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping|RequestMapping)[\\s\\S]{0,500}?\\b${escapeRegExp(route.handler)}\\s*\\(`, "u"),
+      /@(GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping|RequestMapping)\b/gu,
+    );
+  }
   return null;
 }
 
@@ -451,7 +546,7 @@ function classifyCandidate(route: ImportedRoute, text: string): Pick<ImportedCan
   if (tenant) {
     risks.add("tenant-sensitive");
   }
-  if (/\bprocess\.env\./u.test(text)) {
+  if (/\bprocess\.env\.|\bSystem\.getenv\s*\(/u.test(text)) {
     risks.add("secret-sensitive");
   }
   if (methodUnknown) {

package/src/forge/brownfield-import/types.ts

@@ -12,7 +12,7 @@ export interface BrownfieldImportCommandOptions {
 export type ImportedAssurance = "static-scan";
 export type ImportedReviewStatus = "needs-review" | "approved" | "rejected";
 export type ImportedEntryKind = "command" | "command-candidate" | "query" | "unknown";
-export type ImportedRouteSource = "next-app-router" | "next-pages-api" | "express" | "nest" | "unknown";
+export type ImportedRouteSource = "next-app-router" | "next-pages-api" | "express" | "nest" | "spring" | "unknown";
 
 export interface ImportedDependencyInventory {
   dependencies: string[];

package/src/forge/cli/commands.ts

@@ -732,11 +732,18 @@ export interface StatusCommandResult {
   exitCode: 0 | 1;
 }
 
-export function runStatusCommand(workspaceRoot: string): StatusCommandResult {
+export async function runStatusCommand(workspaceRoot: string): Promise<StatusCommandResult> {
   const summary = buildInspectSummary(workspaceRoot);
   const drift = buildDriftInspect(workspaceRoot);
   const handoff = buildHandoffInspect(workspaceRoot);
   const gitSummary = buildWorkspaceGitSummary(workspaceRoot);
+  const generatedVerification = await runGenerateCommand({
+    workspaceRoot,
+    check: true,
+    dryRun: false,
+    json: true,
+    concurrency: 4,
+  });
   const git = {
     available: gitSummary.available,
     ...(gitSummary.error ? { error: gitSummary.error } : {}),
@@ -751,7 +758,8 @@ export function runStatusCommand(workspaceRoot: string): StatusCommandResult {
   const missingArtifacts = Number(summaryBlock.missingArtifacts ?? 0);
   const tableDrift = Number(driftSummary.tableDrift ?? 0);
   const generatedReady = missingArtifacts === 0;
-  const driftClean = driftSummary.ok === true;
+  const generatedFresh = generatedVerification.exitCode === 0;
+  const driftClean = driftSummary.ok === true && generatedFresh;
   const ok = driftClean && generatedReady;
   const handoffDefaultReady = handoffSummary.defaultReady === true;
   const changed = gitSummary.changeSummary.changed;
@@ -761,24 +769,19 @@ export function runStatusCommand(workspaceRoot: string): StatusCommandResult {
     changed.byType.source.count +
     changed.byType.config.count +
     changed.byType.operational.count;
-  const generatedNeedsCheck = generatedReady && driftClean && generatedGitFiles === 0 && authoredGeneratedInputs > 0;
   const generatedState = !generatedReady
     ? "missing-artifacts"
-    : generatedNeedsCheck
-      ? "check-needed"
     : driftClean
       ? "ready"
       : "drift";
   const generatedNextActionsRaw = generatedState === "ready"
     ? ["forge dev", "forge dev --once --json", "forge generate --check --json"]
-    : generatedState === "check-needed"
-      ? ["forge generate --check --json", "forge handoff --json", "forge dev --once --json"]
     : ["forge generate", "forge check --json", "forge inspect drift --json"];
   const generatedNextActions = forgeCliCommandsForWorkspace(workspaceRoot, generatedNextActionsRaw);
-  const generatedGitExplanation = generatedGitFiles === 0
-    ? generatedNeedsCheck
-      ? "git status has no generated artifact changes, but authored source/config changes mean freshness is unverified until forge generate --check runs"
-      : "git status has no generated artifact changes"
+  const generatedGitExplanation = !generatedFresh
+    ? "deterministic generation verification found stale artifacts; git cleanliness does not prove generated freshness"
+    : generatedGitFiles === 0
+    ? "git status has no generated artifact changes and deterministic generation verification passed"
     : authoredGitFiles === 0
       ? "forge generate --check can be clean while git shows generated artifacts changed: generated files match current workspace inputs but differ from HEAD"
       : "git status includes generated artifacts alongside authored changes; review authored inputs first";
@@ -832,10 +835,18 @@ export function runStatusCommand(workspaceRoot: string): StatusCommandResult {
         state: generatedState,
         ready: generatedReady,
         driftClean,
-        freshness: generatedNeedsCheck ? "unverified" : generatedState === "ready" ? "verified-or-unchanged" : "attention",
+        freshness: generatedState === "ready" ? "verified" : generatedFresh ? "attention" : "stale",
         authoredGeneratedInputs,
         missingArtifacts,
         tableDrift,
+        verification: {
+          checked: true,
+          fresh: generatedFresh,
+          changedFiles: generatedVerification.changed.length,
+          sampleChanged: generatedVerification.changed.slice(0, 8),
+          hiddenChanged: Math.max(0, generatedVerification.changed.length - 8),
+          diagnosticCodes: [...new Set(generatedVerification.errors.map((diagnostic) => diagnostic.code))],
+        },
         safeDevCommand,
         checkCommand: generatedCheckCommand,
         repairCommand: generatedRepairCommand,
@@ -883,7 +894,6 @@ export function runStatusCommand(workspaceRoot: string): StatusCommandResult {
         workspaceRoot,
         ok
           ? [
-            ...(generatedState === "check-needed" ? ["forge generate --check --json"] : []),
             "forge handoff --json",
             "forge changed --json",
             "forge dev",
@@ -2469,7 +2479,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       return result.exitCode;
     }
     case "status": {
-      const result = runStatusCommand(command.workspaceRoot);
+      const result = await runStatusCommand(command.workspaceRoot);
       if (command.json) {
         process.stdout.write(formatJsonResult(result.data));
       } else {

package/src/forge/version.ts

@@ -1,3 +1,3 @@
-export const FORGEOS_VERSION = "0.1.0-alpha.61";
+export const FORGEOS_VERSION = "0.1.0-alpha.63";
 export const GENERATOR_VERSION = FORGEOS_VERSION;
 export const CLI_VERSION = FORGEOS_VERSION;

package/src/forge/workspace/change-summary.ts

@@ -78,6 +78,11 @@ export function classifyChangeType(file: string): ChangeType {
   const normalized = file.replace(/\\/g, "/");
   const lower = normalized.toLowerCase();
   const basename = lower.split("/").pop() ?? lower;
+  const isEnvExample =
+    basename === ".env.example" ||
+    (basename.startsWith(".env.") && basename.endsWith(".example"));
+  const isLocalEnvFile =
+    (basename === ".env" || basename.startsWith(".env.")) && !isEnvExample;
 
   if (
     lower.startsWith("src/forge/_generated/") ||
@@ -90,6 +95,13 @@ export function classifyChangeType(file: string): ChangeType {
   if (lower === ".codex/hooks.json") {
     return "config";
   }
+  if (
+    isLocalEnvFile ||
+    lower === ".workos-seed-state.json" ||
+    lower === ".workos-fga-state.json"
+  ) {
+    return "operational";
+  }
   if (lower.startsWith(".playwright-cli/")) {
     return "operational";
   }
@@ -134,7 +146,7 @@ export function classifyChangeType(file: string): ChangeType {
   }
   if (
     basename === "package.json" ||
-    basename === ".env.example" ||
+    isEnvExample ||
     basename === "bun.lock" ||
     basename === "package-lock.json" ||
     basename === "pnpm-lock.yaml" ||

package/templates/b2b-support-web/web/package.json

@@ -8,7 +8,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "next": "^16.2.9",
+    "next": "16.3.0-preview.8",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },