forgeos 0.1.0-alpha.7 → 0.1.0-alpha.71

package/src/forge/cli/commands.ts

@@ -1,14 +1,23 @@
 import { nodeFileSystem } from "../compiler/fs/index.ts";
-import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { join, resolve } from "node:path";
 import { stripDeterministicHeader } from "../compiler/primitives/header.ts";
 import { classify } from "../compiler/classifier/classify.ts";
 import { buildRuntimeMatrix } from "../compiler/classifier/runtime-matrix.ts";
+import {
+  FORGE_DB_EMPTY_TIMESTAMP_LITERAL,
+  FORGE_RELEASE_NPM_DIST_TAG_CHECK_FAILED,
+  FORGE_RELEASE_NPM_DIST_TAG_STALE,
+  FORGE_RELEASE_PACKAGE_PACK_FAILED,
+} from "../compiler/diagnostics/codes.ts";
 import { createDiagnostic } from "../compiler/diagnostics/create.ts";
 import { forgeAdd } from "../compiler/integration/add.ts";
 import { checkImportGuards } from "../compiler/guards/check-import-guards.ts";
 import { checkDirectProcessEnvUsage } from "../compiler/guards/check-process-env.ts";
 import { checkAiUsageInApp } from "../compiler/guards/check-ai-usage.ts";
 import { checkQueryUsageInApp } from "../compiler/guards/check-query-usage.ts";
+import { buildDataGraph } from "../compiler/data-graph/build.ts";
+import { buildSqlPlan } from "../compiler/data-graph/sql/ddl.ts";
 import { loadSecretRegistry } from "../runtime/secrets/check.ts";
 import { run } from "../compiler/orchestrator/run.ts";
 import {
@@ -29,10 +38,14 @@ import type {
 } from "../compiler/types/cli.ts";
 import type { RuntimeMatrix } from "../compiler/types/runtime-matrix.ts";
 import type { FrontendGraph } from "../compiler/types/frontend-graph.ts";
+import type { DataGraph } from "../compiler/types/data-graph.ts";
+import type { SqlPlan } from "../compiler/data-graph/sql/types.ts";
+import type { TableMapEntry } from "../compiler/data-graph/sql/serialize.ts";
 import { GENERATED_DIR } from "../compiler/emitter/constants.ts";
 import {
   attachFailureKind,
   buildAddJson,
+  buildCheckJson,
   buildGenerateJson,
   buildInspectJson,
   formatJsonResult,
@@ -44,6 +57,28 @@ import {
 } from "./output.ts";
 import { INSPECT_TARGETS, TOP_LEVEL_COMMANDS, type ForgeCommand } from "./parse.ts";
 import { runVerifyCommand } from "./verify.ts";
+import {
+  buildExternalServiceGraph,
+  importExternalManifest,
+  readExternalManifestFile,
+} from "../compiler/external-manifest/registry.ts";
+import {
+  resolveExternalQualifiedName,
+  runExternalEntry,
+} from "../runtime/external/bridge.ts";
+import {
+  formatCompilerBenchHuman,
+  formatCompilerBenchJson,
+  runCompilerBenchCommand,
+} from "../bench.ts";
+import {
+  formatCairHuman,
+  formatCairJson,
+  runCairCommand,
+} from "../cair/index.ts";
+import { runRepositoryCommand } from "./repository.ts";
+import { readRepositoryManifest, resolveRepositoryRoot } from "../repository-manifest/index.ts";
+import { uniqueNextActions } from "./next-actions.ts";
 import {
   formatRunJson,
   formatRunListHuman,
@@ -51,6 +86,41 @@ import {
   runRunCommand,
 } from "./run.ts";
 import { runDevCommand } from "./dev.ts";
+import {
+  formatHandoffHuman,
+  formatHandoffJson,
+  runHandoffCommand,
+} from "./handoff.ts";
+import {
+  formatStudioAttachHuman,
+  formatStudioAttachJson,
+  formatStudioBridgeEventJson,
+  formatStudioBridgeHuman,
+  formatStudioBridgeJson,
+  formatStudioCodexServerHuman,
+  formatStudioCodexServerJson,
+  formatStudioDoctorHuman,
+  formatStudioDoctorJson,
+  formatStudioOpenHuman,
+  formatStudioOpenJson,
+  formatStudioSnapshotHuman,
+  formatStudioSnapshotJson,
+  formatStudioWatchHuman,
+  formatStudioWatchJson,
+  runStudioAttachCommand,
+  runStudioBridgeCommand,
+  runStudioBridgeLoop,
+  runStudioCodexServerCommand,
+  runStudioDoctorCommand,
+  runStudioOpenCommand,
+  runStudioSnapshotCommand,
+  runStudioWatchCommand,
+  runStudioWatchLoop,
+} from "./studio.ts";
+import {
+  formatChangedHuman,
+  runChangedCommand,
+} from "./changed.ts";
 import { initializeRuntimeEnv } from "../runtime/context/create-context.ts";
 import { formatDbHuman, formatDbJson, runDbCommand } from "./db.ts";
 import { formatOutboxHuman, formatOutboxJson, runOutboxCommand } from "./outbox.ts";
@@ -64,6 +134,35 @@ import {
   formatTelemetryJson,
   runTelemetryCommand,
 } from "./telemetry.ts";
+import {
+  formatDeltaExplainHuman,
+  formatDeltaExplainJson,
+  formatDeltaCompactHuman,
+  formatDeltaCompactJson,
+  formatDeltaDoctorHuman,
+  formatDeltaDoctorJson,
+  formatDeltaExportHuman,
+  formatDeltaExportJson,
+  formatDeltaPruneHuman,
+  formatDeltaPruneJson,
+  formatDeltaRepairHuman,
+  formatDeltaRepairJson,
+  formatDeltaStatusHuman,
+  formatDeltaStatusJson,
+  formatDeltaSessionHuman,
+  formatDeltaSessionJson,
+  formatDeltaTimelineHuman,
+  formatDeltaTimelineJson,
+  runDeltaExplain,
+  runDeltaCompact,
+  runDeltaDoctor,
+  runDeltaExport,
+  runDeltaPrune,
+  runDeltaRepair,
+  runDeltaSessionCommand,
+  runDeltaStatus,
+  runDeltaTimeline,
+} from "../delta/index.ts";
 import {
   formatPolicyHuman,
   formatPolicyJson,
@@ -78,11 +177,12 @@ import {
   runSecretsCommand,
 } from "./secrets.ts";
 import { formatAiHuman, formatAiJson, runAiCommand } from "./ai.ts";
-import { formatNewHuman, runNewCommand } from "./new.ts";
+import { formatNewHuman, formatNewJson, runNewCommand } from "./new.ts";
 import { formatBuildHuman, runBuildCommand } from "./build.ts";
 import { runServeCommand } from "./serve.ts";
 import { runWorkerCommand } from "./worker.ts";
-import { formatSelfHostHuman, runSelfHostCommand } from "./self-host.ts";
+import { formatSelfHostHuman, runSelfHostCommand, type SelfHostCommandResult } from "./self-host.ts";
+import { formatDocsCheckHuman, runDocsCheckCommand, type DocsCheckResult } from "./docs.ts";
 import {
   formatAgentContractHuman,
   runAgentContractPrint,
@@ -90,7 +190,13 @@ import {
 import {
   formatDoctorHuman,
   formatDoctorJson,
+  formatPgliteDoctorHuman,
+  formatPgliteDoctorJson,
+  formatRuntimeDoctorHuman,
+  formatRuntimeDoctorJson,
+  runPgliteDoctorCommand,
   runDoctorCommand,
+  runRuntimeDoctorCommand,
 } from "./doctor.ts";
 import {
   formatWindowsDoctorHuman,
@@ -101,6 +207,47 @@ import {
   runWindowsSetupCommand,
 } from "./windows.ts";
 import { formatAuthHuman, formatAuthJson, runAuthCommand } from "./auth.ts";
+import {
+  formatAuthMdHuman,
+  formatAuthMdJson,
+  runAuthMdCommand,
+} from "./authmd.ts";
+import {
+  formatWorkOSHuman,
+  formatWorkOSJson,
+  runWorkOSCommand,
+} from "./workos.ts";
+import {
+  formatDeployHuman,
+  formatDeployJson,
+  type DeployCommandResult,
+  runDeployCommand,
+} from "./deploy.ts";
+import {
+  formatFieldTestHuman,
+  formatFieldTestJson,
+  runFieldTestCommand,
+} from "./field-test.ts";
+import {
+  formatGoldenPathHuman,
+  formatGoldenPathJson,
+  runGoldenPathCommand,
+} from "./golden-path.ts";
+import {
+  formatSeedHuman,
+  formatSeedJson,
+  runSeedCommand,
+} from "./seed.ts";
+import {
+  formatLastHuman,
+  formatLastJson,
+  runLastCommand,
+} from "./last-run.ts";
+import {
+  formatBaselineHuman,
+  formatBaselineJson,
+  runBaselineCommand,
+} from "./baseline.ts";
 import { formatRlsHuman, formatRlsJson, runRlsCommand } from "./rls.ts";
 import {
   formatSecurityHuman,
@@ -111,6 +258,7 @@ import { formatDepsHuman, formatDepsJson, runDepsCommand } from "./deps.ts";
 import {
   formatReleaseHuman,
   formatReleaseJson,
+  type ReleaseCommandResult,
   runReleaseCommand,
 } from "./release.ts";
 import { formatMakeHuman, formatMakeJson, runMakeCommand } from "./make.ts";
@@ -132,11 +280,20 @@ import {
   formatForgeDoJson,
   runForgeDoCommand,
 } from "../intent/index.ts";
+import {
+  formatBrownfieldImportHuman,
+  formatBrownfieldImportJson,
+  inspectBrownfieldImport,
+  runBrownfieldImportCommand,
+} from "../brownfield-import/index.ts";
 import {
   formatAgentHuman,
   formatAgentJson,
   runAgentCommand,
 } from "../agent-adapters/index.ts";
+import { runMcpServe } from "../agent-memory/mcp.ts";
+import { runFabricCommand } from "./fabric.ts";
+import { runEvolutionCommand } from "./evolution.ts";
 import {
   formatReviewHuman,
   formatReviewJson,
@@ -161,6 +318,10 @@ import { runQuery } from "../runtime/query/run-query.ts";
 import { resolveAuthFromCli } from "../runtime/auth/resolve.ts";
 import { getActiveDbAdapter } from "../runtime/executor.ts";
 import { CLI_VERSION, FORGEOS_VERSION } from "../version.ts";
+import { authoredChangePaths, type CategorizedFileSummary } from "../workspace/change-summary.ts";
+import { forgeCliCommandsForWorkspace } from "../workspace/forge-cli.ts";
+import { buildWorkspaceGitSummary } from "../workspace/git-summary.ts";
+import { startCommandHeartbeat } from "./progress.ts";
 
 function readGeneratedJson<T>(workspaceRoot: string, relative: string): T | null {
   const absolute = join(workspaceRoot, relative);
@@ -244,9 +405,14 @@ function buildFrameworkInspect(workspaceRoot: string): Record<string, unknown> {
       topLevelCommands: [...TOP_LEVEL_COMMANDS],
       inspectTargets: [...INSPECT_TARGETS],
       preferredEntryPoints: [
+        "forge status --json",
+        "forge changed --json",
+        "forge agent onboard --target codex --json",
         "forge do <objective> --json",
         "forge dev --once --json",
+        "forge inspect all --brief --json",
         "forge inspect all --json",
+        "forge agent print-context --json",
         "forge inspect framework --json",
         "forge verify --strict",
       ],
@@ -276,13 +442,571 @@ function buildFrameworkInspect(workspaceRoot: string): Record<string, unknown> {
   };
 }
 
+function readGeneratedArtifactStatus(workspaceRoot: string): Array<{ name: string; path: string; present: boolean }> {
+  const artifacts = [
+    ["app", `${GENERATED_DIR}/appGraph.json`],
+    ["data", `${GENERATED_DIR}/dataGraph.json`],
+    ["sql", `${GENERATED_DIR}/sqlPlan.json`],
+    ["db", `${GENERATED_DIR}/db.json`],
+    ["runtime", `${GENERATED_DIR}/runtimeGraph.json`],
+    ["frontend", `${GENERATED_DIR}/frontendGraph.json`],
+    ["client", `${GENERATED_DIR}/clientManifest.json`],
+    ["agent-contract", `${GENERATED_DIR}/agentContract.json`],
+    ["agent-adapters", `${GENERATED_DIR}/agentAdapterManifest.json`],
+    ["capability-map", `${GENERATED_DIR}/capabilityMap.json`],
+    ["test-graph", `${GENERATED_DIR}/testGraph.json`],
+    ["agents-md", "AGENTS.md"],
+    ["forge-lock", "forge.lock"],
+  ] as const;
+
+  return artifacts.map(([name, path]) => ({
+    name,
+    path,
+    present: hasPath(workspaceRoot, path),
+  }));
+}
+
+function buildInspectSummary(workspaceRoot: string): Record<string, unknown> {
+  const framework = buildFrameworkInspect(workspaceRoot);
+  const dataGraph = readGeneratedJson<DataGraph>(workspaceRoot, `${GENERATED_DIR}/dataGraph.json`);
+  const frontend = readGeneratedJson<FrontendGraph>(workspaceRoot, `${GENERATED_DIR}/frontendGraph.json`);
+  const agentAdapters = readGeneratedJson<{ targets?: Array<{ name?: string; files?: string[]; default?: boolean; optional?: boolean }> }>(
+    workspaceRoot,
+    `${GENERATED_DIR}/agentAdapterManifest.json`,
+  );
+  const artifacts = readGeneratedArtifactStatus(workspaceRoot);
+  const missingArtifacts = artifacts.filter((artifact) => !artifact.present);
+
+  return {
+    schemaVersion: "0.1.0",
+    summary: {
+      project: (framework.project as Record<string, unknown> | undefined)?.name ?? "unknown",
+      tables: dataGraph?.tables.length ?? 0,
+      frontendPresent: frontend?.present === true,
+      routes: frontend?.routes.length ?? 0,
+      agentTargets: agentAdapters?.targets?.map((target) => target.name).filter(Boolean) ?? [],
+      missingArtifacts: missingArtifacts.length,
+    },
+    artifacts,
+    nextActions: [
+      "forge inspect schema --json",
+      "forge inspect handoff --json",
+      "forge inspect drift --json",
+      "forge check --json",
+    ],
+  };
+}
+
+function buildInspectBrief(workspaceRoot: string): Record<string, unknown> {
+  const summary = buildInspectSummary(workspaceRoot);
+  const framework = buildFrameworkInspect(workspaceRoot);
+  const cli = framework.cli as { preferredEntryPoints?: string[]; inspectTargets?: string[] } | undefined;
+  const artifacts = readGeneratedArtifactStatus(workspaceRoot);
+  const missingArtifacts = artifacts.filter((artifact) => !artifact.present);
+  return {
+    schemaVersion: "0.1.0",
+    brief: true,
+    payload: {
+      mode: "brief",
+      purpose: "orientation",
+      includes: ["summary", "entrypoints", "refs", "artifact counts"],
+      omitted: ["schema table details", "framework module lists", "generated registries"],
+      fullCommand: "forge inspect all --full --json",
+      compactCommand: "forge inspect all --json",
+    },
+    summary: summary.summary,
+    entrypoints: {
+      preferred: cli?.preferredEntryPoints ?? [],
+      inspect: [
+        "forge inspect summary --json",
+        "forge inspect schema --json",
+        "forge inspect handoff --json",
+        "forge inspect all --json",
+        "forge inspect all --full --json",
+      ],
+    },
+    refs: [
+      "AGENTS.md",
+      `${GENERATED_DIR}/agentContract.json`,
+      `${GENERATED_DIR}/appMap.md`,
+      `${GENERATED_DIR}/runtimeRules.md`,
+      `${GENERATED_DIR}/operationPlaybooks.md`,
+      `${GENERATED_DIR}/frontendGraph.json`,
+    ],
+    artifacts: {
+      total: artifacts.length,
+      present: artifacts.length - missingArtifacts.length,
+      missing: missingArtifacts,
+    },
+    nextActions: [
+      "forge status --json",
+      "forge changed --json",
+      "forge agent onboard --target codex --json",
+      "forge dev --once --json",
+      "forge inspect all --json",
+    ],
+  };
+}
+
+function buildSchemaInspect(workspaceRoot: string): { data: Record<string, unknown>; errors: ReturnType<typeof createDiagnostic>[] } {
+  const dataGraph = readGeneratedJson<DataGraph>(workspaceRoot, `${GENERATED_DIR}/dataGraph.json`);
+  const sqlPlan = readGeneratedJson<SqlPlan>(workspaceRoot, `${GENERATED_DIR}/sqlPlan.json`);
+  const db = readGeneratedJson<{ tableMap?: Record<string, TableMapEntry> }>(workspaceRoot, `${GENERATED_DIR}/db.json`);
+  const errors: ReturnType<typeof createDiagnostic>[] = [];
+
+  if (!dataGraph) {
+    errors.push(createDiagnostic({
+      severity: "error",
+      code: "FORGE_INSPECT_MISSING",
+      message: `missing generated artifact: ${GENERATED_DIR}/dataGraph.json; run forge generate first`,
+      file: `${GENERATED_DIR}/dataGraph.json`,
+    }));
+  }
+  if (!sqlPlan) {
+    errors.push(createDiagnostic({
+      severity: "error",
+      code: "FORGE_INSPECT_MISSING",
+      message: `missing generated artifact: ${GENERATED_DIR}/sqlPlan.json; run forge generate first`,
+      file: `${GENERATED_DIR}/sqlPlan.json`,
+    }));
+  }
+  if (!db?.tableMap) {
+    errors.push(createDiagnostic({
+      severity: "error",
+      code: "FORGE_INSPECT_MISSING",
+      message: `missing generated artifact: ${GENERATED_DIR}/db.json; run forge generate first`,
+      file: `${GENERATED_DIR}/db.json`,
+    }));
+  }
+
+  const sqlByAccessName = new Map(
+    (sqlPlan?.tables ?? [])
+      .filter((table) => table.kind === "create_table")
+      .map((table) => [table.accessName ?? table.table ?? "", table]),
+  );
+  const tableMap = db?.tableMap ?? {};
+  const dataGraphDiagnostics = dataGraph?.diagnostics ?? [];
+  const sqlPlanDiagnostics = sqlPlan?.diagnostics ?? [];
+  const tables = (dataGraph?.tables ?? []).map((table) => {
+    const sql = sqlByAccessName.get(table.name);
+    const runtime = sql?.table ? tableMap[sql.table] ?? tableMap[table.name] : tableMap[table.name];
+    const sourceFields = table.fields.map((field) => field.name).sort();
+    const sqlColumns = (sql?.columns ?? []).map((column) => ({
+      name: column.name,
+      fieldName: column.fieldName,
+      sqlType: column.sqlType,
+      primaryKey: column.primaryKey === true,
+    }));
+    const runtimeFields = (runtime?.columns ?? []).map((column) => column.fieldName ?? column.name).sort();
+    const missingRuntimeFields = sourceFields.filter((field) => !runtimeFields.includes(field));
+
+    return {
+      name: table.name,
+      file: table.file,
+      sourceFields,
+      sqlTable: sql?.table ?? null,
+      sqlColumns,
+      runtimeAccessors: Object.entries(tableMap)
+        .filter(([, entry]) => entry.tableName === (sql?.table ?? table.name))
+        .map(([name]) => name)
+        .sort(),
+      missingRuntimeFields,
+    };
+  });
+
+  return {
+    data: {
+      schemaVersion: "0.1.0",
+      summary: {
+        tables: tables.length,
+        missingRuntimeFields: tables.reduce(
+          (count, table) => count + (table.missingRuntimeFields as string[]).length,
+          0,
+        ),
+        diagnostics: dataGraphDiagnostics.length + sqlPlanDiagnostics.length + errors.length,
+      },
+      tables,
+      diagnostics: [
+        ...dataGraphDiagnostics,
+        ...sqlPlanDiagnostics,
+        ...errors,
+      ],
+    },
+    errors,
+  };
+}
+
+function buildDriftInspect(workspaceRoot: string): Record<string, unknown> {
+  const schema = buildSchemaInspect(workspaceRoot);
+  const artifacts = readGeneratedArtifactStatus(workspaceRoot);
+  const missingArtifacts = artifacts.filter((artifact) => !artifact.present);
+  const tableDrift = ((schema.data.tables as Array<{ name: string; missingRuntimeFields: string[] }> | undefined) ?? [])
+    .filter((table) => table.missingRuntimeFields.length > 0)
+    .map((table) => ({
+      table: table.name,
+      missingRuntimeFields: table.missingRuntimeFields,
+      suggestedCommand: "forge generate && forge check --json",
+    }));
+  const staleAgentContext = hasPath(workspaceRoot, ".forge/agent/context.json")
+    ? "run forge agent check --target codex --json or forge agent export --target codex"
+    : null;
+
+  return {
+    schemaVersion: "0.1.0",
+    summary: {
+      ok: missingArtifacts.length === 0 && tableDrift.length === 0,
+      missingArtifacts: missingArtifacts.length,
+      tableDrift: tableDrift.length,
+      agentContextPresent: hasPath(workspaceRoot, ".forge/agent/context.json"),
+    },
+    missingArtifacts,
+    tableDrift,
+    agentContext: staleAgentContext,
+    nextActions: [
+      ...(missingArtifacts.length > 0 || tableDrift.length > 0 ? ["forge generate", "forge check --json"] : []),
+      "forge agent check --target codex --json",
+    ],
+  };
+}
+
+function buildHandoffInspect(workspaceRoot: string): Record<string, unknown> {
+  const manifest = readGeneratedJson<{
+    targets?: Array<{
+      name?: string;
+      files?: string[];
+      default?: boolean;
+      optional?: boolean;
+      formatVersion?: string;
+      adapterVersion?: string;
+    }>;
+  }>(workspaceRoot, `${GENERATED_DIR}/agentAdapterManifest.json`);
+  const targets = (manifest?.targets ?? []).map((target) => {
+    const files = target.files ?? [];
+    const missingFiles = files.filter((file) => !hasPath(workspaceRoot, file));
+    return {
+      name: target.name,
+      default: target.default === true,
+      optional: target.optional === true,
+      formatVersion: target.formatVersion,
+      adapterVersion: target.adapterVersion,
+      files,
+      filesPresent: files.length - missingFiles.length,
+      missingFiles,
+      exportCommand: target.name ? `forge agent export --target ${target.name}` : null,
+      checkCommand: target.name ? `forge agent check --target ${target.name} --json` : null,
+      prepareCommand: target.name ? `forge agent prepare --target ${target.name} --json` : null,
+    };
+  });
+  const missingRequiredFiles = targets.reduce(
+    (count, target) => count + (target.optional ? 0 : target.missingFiles.length),
+    0,
+  );
+  const missingOptionalFiles = targets.reduce(
+    (count, target) => count + (target.optional ? target.missingFiles.length : 0),
+    0,
+  );
+  const defaultTarget = targets.find((target) => target.default);
+  const defaultTargetMissingFiles = defaultTarget?.missingFiles.length ?? missingRequiredFiles;
+
+  return {
+    schemaVersion: "0.1.0",
+    summary: {
+      targets: targets.length,
+      defaultTarget: defaultTarget?.name ?? "generic",
+      missingFiles: missingRequiredFiles + missingOptionalFiles,
+      missingDefaultFiles: defaultTargetMissingFiles,
+      missingRequiredFiles,
+      missingOptionalFiles,
+      defaultReady: defaultTargetMissingFiles === 0,
+      requiredReady: missingRequiredFiles === 0,
+    },
+    targets,
+    commands: [
+      "forge agent list-targets --json",
+      "forge agent prepare --target codex --json",
+      "forge agent hooks smoke --target codex --json",
+      "forge agent ingest codex --event PostToolUse --json",
+    ],
+  };
+}
+
+export interface StatusCommandResult {
+  ok: boolean;
+  data: Record<string, unknown>;
+  exitCode: 0 | 1;
+}
+
+export async function runStatusCommand(workspaceRoot: string): Promise<StatusCommandResult> {
+  const summary = buildInspectSummary(workspaceRoot);
+  const drift = buildDriftInspect(workspaceRoot);
+  const handoff = buildHandoffInspect(workspaceRoot);
+  const gitSummary = buildWorkspaceGitSummary(workspaceRoot);
+  const generatedVerification = await runGenerateCommand({
+    workspaceRoot,
+    check: true,
+    dryRun: false,
+    json: true,
+    concurrency: 4,
+  });
+  const git = {
+    available: gitSummary.available,
+    ...(gitSummary.error ? { error: gitSummary.error } : {}),
+    changed: gitSummary.changeSummary.changed,
+    staged: gitSummary.changeSummary.staged,
+    unstaged: gitSummary.changeSummary.unstaged,
+    untracked: gitSummary.changeSummary.untracked,
+  };
+  const summaryBlock = summary.summary as Record<string, unknown>;
+  const driftSummary = drift.summary as Record<string, unknown>;
+  const handoffSummary = handoff.summary as Record<string, unknown>;
+  const missingArtifacts = Number(summaryBlock.missingArtifacts ?? 0);
+  const tableDrift = Number(driftSummary.tableDrift ?? 0);
+  const generatedReady = missingArtifacts === 0;
+  const generatedFresh = generatedVerification.exitCode === 0;
+  const driftClean = driftSummary.ok === true && generatedFresh;
+  const ok = driftClean && generatedReady;
+  const handoffDefaultReady = handoffSummary.defaultReady === true;
+  const changed = gitSummary.changeSummary.changed;
+  const generatedGitFiles = changed.byType.generated.count;
+  const authoredGitFiles = changed.total.count - generatedGitFiles;
+  const authoredGeneratedInputs =
+    changed.byType.source.count +
+    changed.byType.config.count +
+    changed.byType.operational.count;
+  const generatedState = !generatedReady
+    ? "missing-artifacts"
+    : driftClean
+      ? "ready"
+      : "drift";
+  const generatedNextActionsRaw = generatedState === "ready"
+    ? ["forge dev", "forge dev --once --json", "forge generate --check --json"]
+    : ["forge generate", "forge check --json", "forge inspect drift --json"];
+  const generatedNextActions = forgeCliCommandsForWorkspace(workspaceRoot, generatedNextActionsRaw);
+  const generatedGitExplanation = !generatedFresh
+    ? "deterministic generation verification found stale artifacts; git cleanliness does not prove generated freshness"
+    : generatedGitFiles === 0
+    ? "git status has no generated artifact changes and deterministic generation verification passed"
+    : authoredGitFiles === 0
+      ? "forge generate --check can be clean while git shows generated artifacts changed: generated files match current workspace inputs but differ from HEAD"
+      : "git status includes generated artifacts alongside authored changes; review authored inputs first";
+  const [safeDevCommand, generatedCheckCommand, generatedRepairCommand] = forgeCliCommandsForWorkspace(workspaceRoot, [
+    "forge dev",
+    "forge generate --check --json",
+    "forge generate",
+  ]);
+  const frontendPresent = summaryBlock.frontendPresent === true;
+  const [
+    studioOpenCommand,
+    studioAttachCommand,
+    studioSnapshotCommand,
+    studioWatchCommand,
+    studioBridgeCommand,
+    studioDoctorCommand,
+    studioStartTargetAppCommand,
+    studioProbeCommand,
+  ] = forgeCliCommandsForWorkspace(workspaceRoot, [
+    "forge studio open . --preview-port 5174 --target codex --json",
+    "forge studio attach . --preview-port 5174 --target codex --json",
+    "forge studio snapshot . --preview-port 5174 --target codex --json",
+    "forge studio watch . --preview-port 5174 --target codex --json",
+    "forge studio bridge . --preview-port 5174 --target codex --studio-url http://127.0.0.1:3765 --json",
+    "forge studio doctor . --preview-port 5174 --target codex --json",
+    "forge dev --port 3766 --web-port 5174",
+    "forge dev --once --json",
+  ]);
+  const studio = {
+    openCommand: studioOpenCommand,
+    attachCommand: studioAttachCommand,
+    snapshotCommand: studioSnapshotCommand,
+    watchCommand: studioWatchCommand,
+    bridgeCommand: studioBridgeCommand,
+    doctorCommand: studioDoctorCommand,
+    targetPreviewUrl: "http://127.0.0.1:5174",
+    startTargetAppCommand: studioStartTargetAppCommand,
+    probeCommand: studioProbeCommand,
+    useful: frontendPresent,
+    note: frontendPresent
+      ? "Attach this app to Forge Studio as an external-agent workroom; Studio should preview the target app on 5174."
+      : "No frontend was detected, but Studio can still attach for hooks, posture, and agent context.",
+  };
+
+  return {
+    ok,
+    data: {
+      schemaVersion: "0.1.0",
+      ok,
+      generated: {
+        state: generatedState,
+        ready: generatedReady,
+        driftClean,
+        freshness: generatedState === "ready" ? "verified" : generatedFresh ? "attention" : "stale",
+        authoredGeneratedInputs,
+        missingArtifacts,
+        tableDrift,
+        verification: {
+          checked: true,
+          fresh: generatedFresh,
+          changedFiles: generatedVerification.changed.length,
+          sampleChanged: generatedVerification.changed.slice(0, 8),
+          hiddenChanged: Math.max(0, generatedVerification.changed.length - 8),
+          diagnosticCodes: [...new Set(generatedVerification.errors.map((diagnostic) => diagnostic.code))],
+        },
+        safeDevCommand,
+        checkCommand: generatedCheckCommand,
+        repairCommand: generatedRepairCommand,
+        git: {
+          changedFiles: changed.total.count,
+          authoredFiles: authoredGitFiles,
+          generatedFiles: generatedGitFiles,
+          explanation: generatedGitExplanation,
+        },
+        nextActions: generatedNextActions,
+      },
+      studio,
+      summary: {
+        project: summaryBlock.project,
+        generated: generatedState,
+        tables: summaryBlock.tables,
+        frontendPresent,
+        routes: summaryBlock.routes,
+        drift: driftClean ? "clean" : "attention",
+        agentTargets: summaryBlock.agentTargets,
+        missingAgentFiles: handoffSummary.missingRequiredFiles,
+        missingDefaultAgentFiles: handoffSummary.missingDefaultFiles,
+        missingRequiredAgentFiles: handoffSummary.missingRequiredFiles,
+        missingOptionalAgentFiles: handoffSummary.missingOptionalFiles,
+      },
+      checks: {
+        artifacts: {
+          missing: missingArtifacts,
+        },
+        schema: {
+          tableDrift,
+        },
+        handoff: {
+          targets: handoffSummary.targets,
+          missingFiles: handoffSummary.missingFiles,
+          missingDefaultFiles: handoffSummary.missingDefaultFiles,
+          missingRequiredFiles: handoffSummary.missingRequiredFiles,
+          missingOptionalFiles: handoffSummary.missingOptionalFiles,
+          defaultReady: handoffSummary.defaultReady,
+          requiredReady: handoffSummary.requiredReady,
+        },
+      },
+      git,
+      nextActions: forgeCliCommandsForWorkspace(
+        workspaceRoot,
+        ok
+          ? [
+            "forge handoff --json",
+            "forge changed --json",
+            "forge dev",
+            ...(frontendPresent ? [studio.openCommand, studio.bridgeCommand, studio.doctorCommand] : []),
+            ...(!handoffDefaultReady ? ["forge agent prepare --target generic --json"] : []),
+            "forge inspect handoff --json",
+            "forge verify --changed",
+          ]
+          : [
+            "forge generate",
+            "forge handoff --json",
+            "forge changed --json",
+            ...(frontendPresent ? [studio.openCommand, studio.bridgeCommand, studio.doctorCommand] : []),
+            "forge inspect drift --json",
+            "forge agent prepare --target codex --json",
+          ],
+      ),
+    },
+    exitCode: ok ? 0 : 1,
+  };
+}
+
+export function formatStatusHuman(result: StatusCommandResult): string {
+  const summary = result.data.summary as Record<string, unknown>;
+  const generated = result.data.generated as
+    | {
+      state?: string;
+      missingArtifacts?: number;
+      tableDrift?: number;
+      safeDevCommand?: string;
+      checkCommand?: string;
+      repairCommand?: string;
+    }
+    | undefined;
+  const git = result.data.git as
+    | {
+      available?: boolean;
+      changed?: CategorizedFileSummary;
+    }
+    | undefined;
+  const studio = result.data.studio as
+    | {
+      attachCommand?: string;
+      openCommand?: string;
+      doctorCommand?: string;
+      bridgeCommand?: string;
+      targetPreviewUrl?: string;
+      startTargetAppCommand?: string;
+      useful?: boolean;
+    }
+    | undefined;
+  const lines = [
+    `Forge status: ${result.ok ? "ready" : "needs attention"}`,
+    `Project: ${summary.project ?? "unknown"}`,
+    `Generated: ${summary.generated}`,
+    ...(generated
+      ? [
+          `Generated detail: missing artifacts ${generated.missingArtifacts ?? 0}, table drift ${generated.tableDrift ?? 0}`,
+          `Generated check: ${generated.checkCommand ?? "forge generate --check --json"}`,
+          `Generated repair: ${generated.repairCommand ?? "forge generate"}`,
+          `Generated dev: ${generated.safeDevCommand ?? "forge dev"}`,
+        ]
+      : []),
+    `Drift: ${summary.drift}`,
+    `Frontend: ${summary.frontendPresent ? `${summary.routes ?? 0} routes` : "none"}`,
+    ...(studio
+      ? [
+          `Studio open: ${studio.openCommand ?? "forge studio open . --preview-port 5174 --target codex --json"}`,
+          `Studio attach: ${studio.attachCommand ?? "forge studio attach . --preview-port 5174 --target codex --json"}`,
+          `Studio bridge: ${studio.bridgeCommand ?? "forge studio bridge . --preview-port 5174 --target codex --studio-url http://127.0.0.1:3765 --json"}`,
+          `Studio doctor: ${studio.doctorCommand ?? "forge studio doctor . --preview-port 5174 --target codex --json"}`,
+          `Studio preview: ${studio.targetPreviewUrl ?? "http://127.0.0.1:5174"}`,
+          `Studio start: ${studio.startTargetAppCommand ?? "forge dev --port 3766 --web-port 5174"}`,
+        ]
+      : []),
+    ...(git?.available && git.changed
+      ? [`Changed: ${git.changed.total.count}${git.changed.total.count > 0 ? ` (${git.changed.primaryTypes.slice(0, 5).join(", ")})` : ""}`]
+      : []),
+    `Agent default missing files: ${summary.missingDefaultAgentFiles ?? 0}`,
+    `Agent required missing files: ${summary.missingRequiredAgentFiles ?? summary.missingAgentFiles ?? 0}`,
+    `Agent optional missing files: ${summary.missingOptionalAgentFiles ?? 0}`,
+    "",
+    "Next:",
+    ...((result.data.nextActions as string[] | undefined) ?? []).map((command) => `  ${command}`),
+  ];
+  return `${lines.join("\n")}\n`;
+}
+
 export async function runGenerateCommand(
   options: GenerateOptions,
 ): Promise<GenerateResult> {
-  const result = await run(options);
+  const result = await withWorkspaceCwd(options.workspaceRoot, () => run(options));
   return attachFailureKind(result);
 }
 
+async function withWorkspaceCwd<T>(workspaceRoot: string, fn: () => Promise<T>): Promise<T> {
+  const previous = process.cwd();
+  const target = resolve(workspaceRoot);
+  if (resolve(previous).toLowerCase() === target.toLowerCase()) {
+    return fn();
+  }
+  process.chdir(target);
+  try {
+    return await fn();
+  } finally {
+    process.chdir(previous);
+  }
+}
+
 export async function runAddCommand(
   alias: string,
   options: Extract<ForgeCommand, { kind: "add" }>["options"],
@@ -324,12 +1048,70 @@ async function loadRuntimeMatrixForCheck(
   return buildRuntimeMatrix(classified);
 }
 
+function normalizeSchemaType(type: string): string {
+  return type.trim().replace(/\?$/, "").toLowerCase();
+}
+
+function timestampFieldNames(dataGraph: DataGraph): Set<string> {
+  const fields = new Set<string>();
+  for (const table of dataGraph.tables) {
+    for (const field of table.fields) {
+      if (["timestamp", "timestamptz"].includes(normalizeSchemaType(field.type))) {
+        fields.add(field.name);
+      }
+    }
+  }
+  return fields;
+}
+
+function checkEmptyTimestampLiterals(
+  appGraph: Awaited<ReturnType<typeof buildAppGraphForSession>>,
+  dataGraph: DataGraph,
+): ReturnType<typeof createDiagnostic>[] {
+  const fields = timestampFieldNames(dataGraph);
+  if (fields.size === 0) {
+    return [];
+  }
+  const diagnostics: ReturnType<typeof createDiagnostic>[] = [];
+  const runtimeKinds = new Set(["command", "query", "liveQuery", "action", "workflow"]);
+  for (const symbol of appGraph.symbols) {
+    if (!runtimeKinds.has(symbol.kind)) {
+      continue;
+    }
+    const sourceSlice = typeof symbol.meta.sourceSlice === "string" ? symbol.meta.sourceSlice : "";
+    if (!sourceSlice) {
+      continue;
+    }
+    for (const field of fields) {
+      const escaped = field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const pattern = new RegExp(`\\b${escaped}\\s*:\\s*(["']{2})`);
+      const emptyTemplatePattern = new RegExp(`\\b${escaped}\\s*:\\s*\`\``);
+      if (!pattern.test(sourceSlice) && !emptyTemplatePattern.test(sourceSlice)) {
+        continue;
+      }
+      diagnostics.push(
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_DB_EMPTY_TIMESTAMP_LITERAL,
+          message:
+            `Forge timestamp field '${field}' is assigned an empty string in ${symbol.kind} '${symbol.name}'.`,
+          file: symbol.file,
+          span: symbol.span,
+        }),
+      );
+    }
+  }
+  return diagnostics;
+}
+
 export async function runCheckCommand(
   workspaceRoot: string,
   options?: { strictSecrets?: boolean },
 ): Promise<GenerateResult> {
   const session = getCompileSession(workspaceRoot);
   const appGraph = await buildAppGraphForSession(session);
+  const dataGraph = buildDataGraph(appGraph);
+  const sqlPlan = buildSqlPlan(dataGraph);
 
   const matrix = await loadRuntimeMatrixForCheck(workspaceRoot);
   const guardDiagnostics = checkImportGuards(appGraph.moduleGraph, matrix);
@@ -349,14 +1131,21 @@ export async function runCheckCommand(
       workspaceRoot,
       `${GENERATED_DIR}/capabilityMap.json`,
     )?.diagnostics ?? [];
+  const externalDiagnostics = buildExternalServiceGraph(workspaceRoot).diagnostics;
+  const timestampLiteralDiagnostics = checkEmptyTimestampLiterals(appGraph, dataGraph);
 
   const allDiagnostics = [
+    ...appGraph.diagnostics,
+    ...dataGraph.diagnostics,
+    ...sqlPlan.diagnostics,
     ...guardDiagnostics,
     ...processEnvDiagnostics,
     ...aiDiagnostics,
     ...queryDiagnostics,
+    ...timestampLiteralDiagnostics,
     ...frontendDiagnostics,
     ...capabilityDiagnostics,
+    ...externalDiagnostics,
   ];
   const errors = allDiagnostics.filter(
     (diagnostic) => diagnostic.severity === "error",
@@ -375,9 +1164,474 @@ export async function runCheckCommand(
   });
 }
 
+interface ReleaseDoctorCheck {
+  name: string;
+  ok: boolean;
+  requiredForPublish: boolean;
+  requiredForProduction?: boolean;
+  state?: string;
+  result: ReleaseCommandResult | SelfHostCommandResult | DocsCheckResult | DeployCommandResult | PackagePackCheckResult | NpmDistTagCheckResult;
+}
+
+interface PackagePackCheckResult {
+  ok: boolean;
+  data: {
+    command: "npm pack --dry-run --json";
+    dryRun: true;
+    tarball: string | null;
+    fileCount: number;
+  };
+  diagnostics: ReturnType<typeof createDiagnostic>[];
+  nextActions?: string[];
+  failureKind?: string;
+  exitCode: 0 | 1;
+}
+
+interface NpmDistTagCheckResult {
+  ok: boolean;
+  data: {
+    command: string;
+    packageName: string | null;
+    packageVersion: string | null;
+    alphaVersion: string | null;
+    latestVersion: string | null;
+    alphaMatches: boolean;
+    latestMatches: boolean;
+    source: "npm-view" | "env-fixture" | "skipped";
+  };
+  diagnostics: ReturnType<typeof createDiagnostic>[];
+  nextActions?: string[];
+  failureKind?: string;
+  exitCode: 0 | 1;
+}
+
+interface ReleaseDoctorResult {
+  schemaVersion: "0.1.0";
+  ok: boolean;
+  readyToPublish: boolean;
+  readyForProductionDeploy: boolean;
+  summary: {
+    checks: number;
+    failed: string[];
+    notPrepared: string[];
+    publishBlockers: string[];
+    productionBlockers: string[];
+  };
+  checks: ReleaseDoctorCheck[];
+  nextActions: string[];
+  exitCode: 0 | 1;
+}
+
+function runPackagePackDryRun(workspaceRoot: string): PackagePackCheckResult {
+  const result = spawnSync("npm", ["pack", "--dry-run", "--json"], {
+    cwd: workspaceRoot,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  const command = "npm pack --dry-run --json" as const;
+  if (result.status !== 0) {
+    const failureDetail = result.error instanceof Error ? result.error.message : null;
+    return {
+      ok: false,
+      data: { command, dryRun: true, tarball: null, fileCount: 0 },
+      diagnostics: [
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_RELEASE_PACKAGE_PACK_FAILED,
+          message: "npm pack dry-run failed; release package contents could not be validated",
+          fixHint: (result.stderr || result.stdout || failureDetail || "Run npm pack --dry-run --json locally for details.").trim(),
+          suggestedCommands: ["npm pack --dry-run --json"],
+        }),
+      ],
+      nextActions: ["npm pack --dry-run --json"],
+      failureKind: "package-pack-failed",
+      exitCode: 1,
+    };
+  }
+  try {
+    const parsed = JSON.parse(result.stdout || "[]") as unknown;
+    const pack = Array.isArray(parsed)
+      ? (parsed[0] as { filename?: unknown; files?: unknown[] } | undefined)
+      : undefined;
+    if (typeof pack?.filename !== "string" || !Array.isArray(pack.files)) {
+      return {
+        ok: false,
+        data: { command, dryRun: true, tarball: null, fileCount: 0 },
+        diagnostics: [
+          createDiagnostic({
+            severity: "error",
+            code: FORGE_RELEASE_PACKAGE_PACK_FAILED,
+            message: "npm pack dry-run did not report package contents",
+            fixHint: "Run npm pack --dry-run --json locally and confirm it returns a tarball with file entries.",
+            suggestedCommands: ["npm pack --dry-run --json"],
+          }),
+        ],
+        nextActions: ["npm pack --dry-run --json"],
+        failureKind: "package-pack-missing-contents",
+        exitCode: 1,
+      };
+    }
+    return {
+      ok: true,
+      data: {
+        command,
+        dryRun: true,
+        tarball: pack.filename,
+        fileCount: pack.files.length,
+      },
+      diagnostics: [],
+      exitCode: 0,
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      data: { command, dryRun: true, tarball: null, fileCount: 0 },
+      diagnostics: [
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_RELEASE_PACKAGE_PACK_FAILED,
+          message: "npm pack dry-run returned invalid JSON",
+          fixHint: error instanceof Error ? error.message : String(error),
+          suggestedCommands: ["npm pack --dry-run --json"],
+        }),
+      ],
+      nextActions: ["npm pack --dry-run --json"],
+      failureKind: "package-pack-invalid-json",
+      exitCode: 1,
+    };
+  }
+}
+
+function parseNpmDistTagsJson(raw: string): Record<string, string> | null {
+  try {
+    const parsed = JSON.parse(raw) as unknown;
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    const tags: Record<string, string> = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (typeof value === "string") {
+        tags[key] = value;
+      }
+    }
+    return tags;
+  } catch {
+    return null;
+  }
+}
+
+function runNpmDistTagCheck(workspaceRoot: string): NpmDistTagCheckResult {
+  const pkg = readPackageJson(workspaceRoot) as {
+    name?: unknown;
+    version?: unknown;
+    private?: unknown;
+  };
+  const packageName = typeof pkg.name === "string" ? pkg.name : null;
+  const packageVersion = typeof pkg.version === "string" ? pkg.version : null;
+  const command = packageName ? `npm view ${packageName} dist-tags --json` : "npm view <package> dist-tags --json";
+  const baseData = {
+    command,
+    packageName,
+    packageVersion,
+    alphaVersion: null,
+    latestVersion: null,
+    alphaMatches: false,
+    latestMatches: false,
+    source: "skipped" as const,
+  };
+
+  if (pkg.private === true) {
+    return {
+      ok: true,
+      data: baseData,
+      diagnostics: [],
+      exitCode: 0,
+    };
+  }
+  if (!packageName || !packageVersion) {
+    return {
+      ok: false,
+      data: baseData,
+      diagnostics: [
+        createDiagnostic({
+          severity: "warning",
+          code: FORGE_RELEASE_NPM_DIST_TAG_CHECK_FAILED,
+          message: "release doctor could not check npm dist-tags because package.json is missing name or version",
+          fixHint: "Set package.json name and version before publishing, then rerun forge release doctor.",
+          suggestedCommands: ["node bin/forge.mjs release doctor --json"],
+        }),
+      ],
+      nextActions: ["node bin/forge.mjs release doctor --json"],
+      failureKind: "npm-dist-tags-package-metadata-missing",
+      exitCode: 1,
+    };
+  }
+
+  const fixture = process.env.FORGE_RELEASE_NPM_DIST_TAGS_JSON;
+  const source = fixture ? "env-fixture" as const : "npm-view" as const;
+  const stdout = fixture ?? spawnSync("npm", ["view", packageName, "dist-tags", "--json"], {
+    cwd: workspaceRoot,
+    encoding: "utf8",
+    timeout: 10_000,
+    windowsHide: true,
+  }).stdout;
+  const tags = parseNpmDistTagsJson(stdout || "");
+  if (!tags) {
+    return {
+      ok: false,
+      data: { ...baseData, source },
+      diagnostics: [
+        createDiagnostic({
+          severity: "warning",
+          code: FORGE_RELEASE_NPM_DIST_TAG_CHECK_FAILED,
+          message: `release doctor could not read npm dist-tags for ${packageName}`,
+          fixHint: `Run ${command}. If the package has not been published yet, publish it with the alpha tag first.`,
+          suggestedCommands: [command, "npm run release:publish-alpha"],
+        }),
+      ],
+      nextActions: [command, "npm run release:publish-alpha"],
+      failureKind: "npm-dist-tags-unavailable",
+      exitCode: 1,
+    };
+  }
+
+  const alphaVersion = tags.alpha ?? null;
+  const latestVersion = tags.latest ?? null;
+  const alphaMatches = alphaVersion === packageVersion;
+  const latestMatches = latestVersion === packageVersion;
+  const data = {
+    command,
+    packageName,
+    packageVersion,
+    alphaVersion,
+    latestVersion,
+    alphaMatches,
+    latestMatches,
+    source,
+  };
+  if (alphaMatches && latestMatches) {
+    return {
+      ok: true,
+      data,
+      diagnostics: [],
+      exitCode: 0,
+    };
+  }
+
+  const nextActions: string[] = [];
+  const diagnostics: ReturnType<typeof createDiagnostic>[] = [];
+  if (!alphaMatches) {
+    nextActions.push("npm run release:publish-alpha");
+    diagnostics.push(createDiagnostic({
+      severity: "warning",
+      code: FORGE_RELEASE_NPM_DIST_TAG_STALE,
+      message: `${packageName}@alpha points to ${alphaVersion ?? "none"}, not local version ${packageVersion}`,
+      fixHint: "Publish the current package with the alpha tag before asking users to install forgeos@alpha.",
+      suggestedCommands: ["npm run release:publish-alpha", command],
+    }));
+  }
+  if (!latestMatches) {
+    const promote = `npm dist-tag add ${packageName}@${packageVersion} latest`;
+    nextActions.push(promote);
+    nextActions.push("configure NPM_TOKEN in GitHub Actions secrets, or run npm login locally before promoting latest");
+    diagnostics.push(createDiagnostic({
+      severity: "warning",
+      code: FORGE_RELEASE_NPM_DIST_TAG_STALE,
+      message: `${packageName}@latest points to ${latestVersion ?? "none"}, not local version ${packageVersion}`,
+      fixHint: `Promote latest after the alpha package is verified: ${promote}`,
+      suggestedCommands: [promote, command],
+    }));
+  }
+  return {
+    ok: false,
+    data,
+    diagnostics,
+    nextActions,
+    failureKind: !alphaMatches ? "npm-alpha-dist-tag-stale" : "npm-latest-dist-tag-stale",
+    exitCode: 1,
+  };
+}
+
+export async function runReleaseDoctorCommand(command: Extract<ForgeCommand, { kind: "release" }>): Promise<ReleaseDoctorResult> {
+  const release = await runReleaseCommand({
+    ...command,
+    action: "check",
+    allowMissingLocalRelease: true,
+    provider: command.provider as import("../compiler/release/types.ts").ReleaseExportProvider | undefined,
+    target: command.target as import("../compiler/release/types.ts").ReleaseExportProvider | undefined,
+  });
+  const sourcemaps = await runReleaseCommand({
+    ...command,
+    area: "sourcemaps",
+    action: "check",
+    provider: command.provider as import("../compiler/release/types.ts").ReleaseExportProvider | undefined,
+    target: command.target as import("../compiler/release/types.ts").ReleaseExportProvider | undefined,
+  });
+  const selfHost = await runSelfHostCommand({
+    subcommand: "check",
+    workspaceRoot: command.workspaceRoot,
+    json: command.json,
+    withWeb: true,
+    postgresVersion: "16",
+    runtimePort: 3765,
+    webPort: 3000,
+    preparedOnly: true,
+  });
+  const docs = runDocsCheckCommand({
+    workspaceRoot: command.workspaceRoot,
+    json: command.json,
+  });
+  const deployProduction = await runDeployCommand({
+    subcommand: "check",
+    workspaceRoot: command.workspaceRoot,
+    json: command.json,
+    target: "docker",
+    production: true,
+  });
+  const packagePack = runPackagePackDryRun(command.workspaceRoot);
+  const npmDistTags = runNpmDistTagCheck(command.workspaceRoot);
+  const checks: ReleaseDoctorCheck[] = [
+    {
+      name: "release-prepared",
+      ok: release.ok,
+      requiredForPublish: true,
+      state: (release.data as { state?: string } | undefined)?.state,
+      result: release,
+    },
+    {
+      name: "sourcemaps",
+      ok: sourcemaps.ok,
+      requiredForPublish: true,
+      result: sourcemaps,
+    },
+    {
+      name: "self-host",
+      ok: selfHost.ok,
+      requiredForPublish: false,
+      state: selfHost.state,
+      result: selfHost,
+    },
+    {
+      name: "deploy-production",
+      ok: deployProduction.ok,
+      requiredForPublish: false,
+      requiredForProduction: true,
+      result: deployProduction,
+    },
+    {
+      name: "docs",
+      ok: docs.ok,
+      requiredForPublish: true,
+      result: docs,
+    },
+    {
+      name: "npm-pack-dry-run",
+      ok: packagePack.ok,
+      requiredForPublish: true,
+      result: packagePack,
+    },
+    {
+      name: "npm-dist-tags",
+      ok: npmDistTags.ok,
+      requiredForPublish: false,
+      state: npmDistTags.failureKind ?? (npmDistTags.data.source === "skipped" ? "skipped" : "current"),
+      result: npmDistTags,
+    },
+  ];
+  const failed = checks.filter((check) => !check.ok).map((check) => check.name);
+  const notPrepared = checks
+    .filter((check) => check.state === "missing-prepared-release" || check.state === "not-prepared")
+    .map((check) => check.name);
+  const publishBlockers = checks
+    .filter((check) => check.requiredForPublish && !check.ok)
+    .map((check) => check.name);
+  const productionBlockers = checks
+    .filter((check) => check.requiredForProduction && !check.ok)
+    .map((check) => check.name);
+  const notPreparedPublishBlockers = checks
+    .filter((check) => check.requiredForPublish && (check.state === "missing-prepared-release" || check.state === "not-prepared"))
+    .map((check) => check.name);
+  const readyToPublish = publishBlockers.length === 0 && notPreparedPublishBlockers.length === 0;
+  const readyForProductionDeploy = productionBlockers.length === 0;
+  return {
+    schemaVersion: "0.1.0",
+    ok: readyToPublish,
+    readyToPublish,
+    readyForProductionDeploy,
+    summary: {
+      checks: checks.length,
+      failed,
+      notPrepared,
+      publishBlockers,
+      productionBlockers,
+    },
+    checks,
+    nextActions: uniqueNextActions(checks.flatMap((check) => check.result.nextActions ?? [])),
+    exitCode: readyToPublish ? 0 : 1,
+  };
+}
+
+function formatManifestHuman(result: {
+  subcommand: "validate" | "import";
+  path: string;
+  imported?: boolean;
+  serviceCount?: number;
+  diagnostics: import("../compiler/types/diagnostic.ts").Diagnostic[];
+  exitCode: number;
+}): string {
+  const errors = result.diagnostics.filter((diagnostic) => diagnostic.severity === "error");
+  const warnings = result.diagnostics.filter((diagnostic) => diagnostic.severity === "warning");
+  const lines = [
+    `manifest: ${result.subcommand}`,
+    `path: ${result.path}`,
+    result.subcommand === "import" ? `imported: ${result.imported ? "yes" : "no"}` : null,
+    result.serviceCount !== undefined ? `external services: ${result.serviceCount}` : null,
+    `errors: ${errors.length}`,
+    `warnings: ${warnings.length}`,
+  ].filter((line): line is string => line !== null);
+  for (const diagnostic of result.diagnostics) {
+    lines.push(`${diagnostic.severity} ${diagnostic.code}: ${diagnostic.message}`);
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+function runManifestCommand(command: Extract<ForgeCommand, { kind: "manifest" }>): {
+  subcommand: "validate" | "import";
+  path: string;
+  imported?: boolean;
+  serviceCount?: number;
+  diagnostics: import("../compiler/types/diagnostic.ts").Diagnostic[];
+  exitCode: number;
+} {
+  if (command.subcommand === "validate") {
+    const checked = readRepositoryManifest(command.workspaceRoot, { manifestPath: command.path });
+    if (checked.manifest || checked.diagnostics.length) return { subcommand: "validate", path: command.path, diagnostics: checked.diagnostics.map(message => createDiagnostic({ severity: "error", code: "FORGE_REPOSITORY_MANIFEST", message })), exitCode: checked.manifest ? 0 : 1 };
+    const result = readExternalManifestFile(command.path);
+    const hasErrors = result.diagnostics.some((diagnostic) => diagnostic.severity === "error");
+    return {
+      subcommand: "validate",
+      path: command.path,
+      diagnostics: result.diagnostics,
+      exitCode: hasErrors ? 1 : 0,
+    };
+  }
+
+  const result = importExternalManifest(command.workspaceRoot, command.path);
+  const hasErrors = result.diagnostics.some((diagnostic) => diagnostic.severity === "error");
+  return {
+    subcommand: "import",
+    path: result.path,
+    imported: result.imported,
+    serviceCount: result.graph.services.length,
+    diagnostics: result.diagnostics,
+    exitCode: hasErrors ? 1 : 0,
+  };
+}
+
 export async function runInspectCommand(
   target: InspectTarget,
   workspaceRoot: string,
+  options: { full?: boolean; brief?: boolean; ergonomics?: boolean } = {},
 ): Promise<InspectResult> {
   const dataPaths: Partial<Record<InspectTarget, string>> = {
     app: `${GENERATED_DIR}/appGraph.json`,
@@ -396,6 +1650,7 @@ export async function runInspectCommand(
     ai: `${GENERATED_DIR}/aiRegistry.json`,
     queries: `${GENERATED_DIR}/queryRegistry.json`,
     api: `${GENERATED_DIR}/api.json`,
+    external: `${GENERATED_DIR}/externalServices.json`,
     client: `${GENERATED_DIR}/clientManifest.json`,
     frontend: `${GENERATED_DIR}/frontendGraph.json`,
     auth: `${GENERATED_DIR}/authRegistry.json`,
@@ -431,7 +1686,155 @@ export async function runInspectCommand(
     };
   }
 
+  if (target === "summary") {
+    return {
+      target,
+      data: buildInspectSummary(workspaceRoot),
+      warnings: [],
+      errors: [],
+      exitCode: 0,
+    };
+  }
+
+  if (target === "schema") {
+    const result = buildSchemaInspect(workspaceRoot);
+    return {
+      target,
+      data: result.data,
+      warnings: [],
+      errors: result.errors,
+      exitCode: result.errors.length > 0 ? 1 : 0,
+      failureKind: result.errors.length > 0 ? "missing_artifact" : undefined,
+    };
+  }
+
+  if (target === "drift") {
+    return {
+      target,
+      data: buildDriftInspect(workspaceRoot),
+      warnings: [],
+      errors: [],
+      exitCode: 0,
+    };
+  }
+
+  if (target === "handoff") {
+    return {
+      target,
+      data: buildHandoffInspect(workspaceRoot),
+      warnings: [],
+      errors: [],
+      exitCode: 0,
+    };
+  }
+
+  if (target === "ui" && options.ergonomics) {
+    const result = await runUiCommand({
+      subcommand: "audit",
+      workspaceRoot,
+      json: true,
+      headed: false,
+      browser: "chromium",
+      trace: "off",
+      screenshot: "off",
+      video: "off",
+      baseUrl: "http://127.0.0.1:3000",
+      runtimeUrl: "http://127.0.0.1:3765",
+      reuseServers: false,
+      startServers: false,
+      all: true,
+      changed: false,
+      ci: false,
+      timeoutMs: 30_000,
+    });
+    return {
+      target,
+      data: {
+        schemaVersion: "0.1.0",
+        mode: "ergonomics",
+        ok: result.ok,
+        manifest: result.manifest,
+        scenarios: result.scenarios ?? [],
+        diagnostics: result.diagnostics,
+        nextActions: [
+          "forge ui audit --json",
+          "forge inspect frontend --json",
+          "forge inspect capabilities --json",
+        ],
+      },
+      warnings: result.diagnostics.filter((diagnostic) => diagnostic.severity === "warning"),
+      errors: result.diagnostics.filter((diagnostic) => diagnostic.severity === "error"),
+      exitCode: result.exitCode,
+      failureKind: result.exitCode === 0 ? undefined : "ui_ergonomics",
+    };
+  }
+
+  if (target === "imported") {
+    const result = inspectBrownfieldImport(workspaceRoot);
+    return {
+      target,
+      data: formatBrownfieldImportJson(result),
+      warnings: [],
+      errors: [],
+      exitCode: result.exitCode,
+      failureKind: result.failureKind,
+    };
+  }
+
   if (target === "all") {
+    if (options.brief) {
+      const brief = buildInspectBrief(workspaceRoot);
+      return {
+        target,
+        data: brief,
+        warnings: [],
+        errors: [],
+        exitCode: 0,
+      };
+    }
+    if (!options.full) {
+      const summary = buildInspectSummary(workspaceRoot);
+      const schema = buildSchemaInspect(workspaceRoot);
+      const drift = buildDriftInspect(workspaceRoot);
+      const handoff = buildHandoffInspect(workspaceRoot);
+      const framework = buildFrameworkInspect(workspaceRoot);
+      const errors = [
+        ...schema.errors,
+      ];
+      return {
+        target,
+        data: {
+          schemaVersion: "0.1.0",
+          compact: true,
+          payload: {
+            mode: "compact",
+            purpose: "agent diagnostic bundle",
+            includes: ["summary", "schema", "drift", "handoff", "framework"],
+            omitted: ["large generated registries", "module graph", "full runtime graph payloads"],
+            fullCommand: "forge inspect all --full --json",
+            briefCommand: "forge inspect all --brief --json",
+          },
+          summary: summary.summary,
+          inspections: {
+            summary,
+            schema: schema.data,
+            drift,
+            handoff,
+            framework,
+          },
+          nextActions: [
+            "forge inspect summary --json",
+            "forge inspect schema --json",
+            "forge inspect handoff --json",
+            "forge inspect all --full --json",
+          ],
+        },
+        warnings: [],
+        errors,
+        exitCode: errors.length > 0 ? 1 : 0,
+        failureKind: errors.length > 0 ? "missing_artifact" : undefined,
+      };
+    }
     const aggregatePaths: Array<[string, string]> = [
       ["app", `${GENERATED_DIR}/appGraph.json`],
       ["data", `${GENERATED_DIR}/dataGraph.json`],
@@ -443,6 +1846,7 @@ export async function runInspectCommand(
       ["workflows", `${GENERATED_DIR}/workflowRegistry.json`],
       ["telemetry", `${GENERATED_DIR}/telemetryRegistry.json`],
       ["ai", `${GENERATED_DIR}/aiRegistry.json`],
+      ["externalServices", `${GENERATED_DIR}/externalServices.json`],
       ["client", `${GENERATED_DIR}/clientManifest.json`],
       ["frontend", `${GENERATED_DIR}/frontendGraph.json`],
       ["auth", `${GENERATED_DIR}/authRegistry.json`],
@@ -467,6 +1871,7 @@ export async function runInspectCommand(
     ];
     const data: Record<string, unknown> = {};
     const errors = [];
+    data.summary = buildInspectSummary(workspaceRoot).summary;
     for (const [key, relative] of aggregatePaths) {
       const value = readGeneratedJson<unknown>(workspaceRoot, relative);
       if (value === null) {
@@ -484,6 +1889,17 @@ export async function runInspectCommand(
     }
     data.framework = buildFrameworkInspect(workspaceRoot);
     data.diagnostics = errors;
+    data.compact = false;
+    data.payload = {
+      mode: "full",
+      purpose: "complete generated machine contract",
+      includes: aggregatePaths.map(([key]) => key),
+      compactCommand: "forge inspect all --json",
+      briefCommand: "forge inspect all --brief --json",
+    };
+    data.nextActions = errors.length > 0
+      ? ["forge status --json", "forge generate", "forge check --json"]
+      : ["forge inspect all --json", "forge check --json"];
     return {
       target,
       data,
@@ -557,6 +1973,16 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       }
       return 0;
     }
+    case "last": {
+      const result = runLastCommand({ workspaceRoot: command.workspaceRoot });
+      process.stdout.write(command.json ? formatLastJson(result) : formatLastHuman(result));
+      return result.exitCode;
+    }
+    case "baseline": {
+      const result = runBaselineCommand(command);
+      process.stdout.write(command.json ? formatBaselineJson(result) : formatBaselineHuman(result));
+      return result.exitCode;
+    }
     case "new": {
       const result = await runNewCommand({
         name: command.name,
@@ -564,11 +1990,12 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         packageManager: command.packageManager,
         install: command.install,
         git: command.git,
+        fieldTest: command.fieldTest,
         forgePackageSpec: command.forgePackageSpec,
         localForge: command.localForge,
         workspaceRoot: command.workspaceRoot,
       });
-      process.stdout.write(formatNewHuman(result));
+      process.stdout.write(command.json ? formatNewJson(result) : formatNewHuman(result));
       return result.exitCode;
     }
     case "build": {
@@ -598,6 +2025,15 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       }
       return result.exitCode;
     }
+    case "docs": {
+      const result = runDocsCheckCommand(command);
+      if (command.json) {
+        process.stdout.write(formatJsonResult(result));
+      } else {
+        process.stdout.write(formatDocsCheckHuman(result));
+      }
+      return result.exitCode;
+    }
     case "agent-contract": {
       if (command.subcommand === "print") {
         const result = runAgentContractPrint(command.workspaceRoot);
@@ -617,7 +2053,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         concurrency: 4,
       });
       if (command.json) {
-        process.stdout.write(formatJsonResult(buildGenerateJson(result)));
+        process.stdout.write(formatJsonResult(buildGenerateJson(result, { workspaceRoot: command.workspaceRoot })));
       } else {
         process.stdout.write(formatAgentContractHuman(command.subcommand, result));
         writeHumanGenerate(result);
@@ -625,6 +2061,25 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       return result.exitCode;
     }
     case "doctor": {
+      if (command.target === "agent") {
+        const result = await runAgentCommand({
+          subcommand: "doctor",
+          workspaceRoot: command.workspaceRoot,
+          json: command.json,
+          target: command.agentTarget ?? "codex",
+          dryRun: false,
+          force: false,
+          preserveUserSections: true,
+          skills: true,
+          rules: true,
+        });
+        if (command.json) {
+          process.stdout.write(formatAgentJson(result));
+        } else {
+          process.stdout.write(formatAgentHuman(result));
+        }
+        return result.exitCode;
+      }
       if (command.target === "windows") {
         const result = await runWindowsDoctorCommand({ workspaceRoot: command.workspaceRoot });
         if (command.json) {
@@ -634,6 +2089,21 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         }
         return result.exitCode;
       }
+      if (command.target === "delta") {
+        const result = await runDeltaDoctor(command.workspaceRoot);
+        process.stdout.write(command.json ? formatDeltaDoctorJson(result) : formatDeltaDoctorHuman(result));
+        return result.exitCode;
+      }
+      if (command.target === "pglite") {
+        const result = await runPgliteDoctorCommand({ workspaceRoot: command.workspaceRoot });
+        process.stdout.write(command.json ? formatPgliteDoctorJson(result) : formatPgliteDoctorHuman(result));
+        return result.exitCode;
+      }
+      if (command.target === "runtime") {
+        const result = await runRuntimeDoctorCommand({ workspaceRoot: command.workspaceRoot });
+        process.stdout.write(command.json ? formatRuntimeDoctorJson(result) : formatRuntimeDoctorHuman(result));
+        return result.exitCode;
+      }
       const result = await runDoctorCommand({ workspaceRoot: command.workspaceRoot });
       if (command.json) {
         process.stdout.write(formatDoctorJson(result));
@@ -672,6 +2142,44 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       }
       return result.exitCode;
     }
+    case "authmd": {
+      const result = runAuthMdCommand(command);
+      if (command.json) {
+        process.stdout.write(formatAuthMdJson(result));
+      } else {
+        process.stdout.write(formatAuthMdHuman(result));
+      }
+      return result.exitCode;
+    }
+    case "workos": {
+      const result = runWorkOSCommand(command);
+      if (command.json) {
+        process.stdout.write(formatWorkOSJson(result));
+      } else {
+        process.stdout.write(formatWorkOSHuman(result));
+      }
+      return result.exitCode;
+    }
+    case "deploy": {
+      const result = await runDeployCommand(command);
+      process.stdout.write(command.json ? formatDeployJson(result) : formatDeployHuman(result));
+      return result.exitCode;
+    }
+    case "golden-path": {
+      const result = await runGoldenPathCommand(command);
+      process.stdout.write(command.json ? formatGoldenPathJson(result) : formatGoldenPathHuman(result));
+      return result.exitCode;
+    }
+    case "field-test": {
+      const result = await runFieldTestCommand(command);
+      process.stdout.write(command.json ? formatFieldTestJson(result) : formatFieldTestHuman(result));
+      return result.exitCode;
+    }
+    case "seed": {
+      const result = await runSeedCommand(command);
+      process.stdout.write(command.json ? formatSeedJson(result) : formatSeedHuman(result));
+      return result.exitCode;
+    }
     case "rls": {
       const result = await runRlsCommand(command);
       if (command.json) {
@@ -691,6 +2199,30 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       return result.exitCode;
     }
     case "release": {
+      if (command.action === "doctor") {
+        const result = await runReleaseDoctorCommand(command);
+        if (command.json) {
+          process.stdout.write(formatJsonResult(result));
+        } else {
+          process.stdout.write(
+            [
+              `release doctor ${result.ok ? "ok" : "failed"}`,
+              `ready to publish: ${result.readyToPublish ? "yes" : "no"}`,
+              `ready for production deploy: ${result.readyForProductionDeploy ? "yes" : "no"}`,
+              ...result.checks.map((check) => {
+                const scope = check.requiredForPublish
+                  ? "publish"
+                  : check.requiredForProduction
+                    ? "production"
+                    : "optional";
+                return `${check.ok ? "ok" : "fail"} ${check.name} [${scope}]${check.state ? ` (${check.state})` : ""}`;
+              }),
+              ...(result.nextActions.length > 0 ? ["", "Next:", ...result.nextActions.map((action) => `  ${action}`)] : []),
+            ].join("\n").concat("\n"),
+          );
+        }
+        return result.exitCode;
+      }
       const result = await runReleaseCommand({
         ...command,
         provider: command.provider as import("../compiler/release/types.ts").ReleaseExportProvider | undefined,
@@ -766,19 +2298,143 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       }
       return result.exitCode;
     }
-    case "agent": {
-      const result = await runAgentCommand(command.options);
-      if (command.options.json) {
-        process.stdout.write(formatAgentJson(result));
-      } else {
-        process.stdout.write(formatAgentHuman(result));
+    case "bench": {
+      const result = await runCompilerBenchCommand(command.options);
+      process.stdout.write(
+        command.options.json
+          ? formatCompilerBenchJson(result)
+          : formatCompilerBenchHuman(result),
+      );
+      return result.exitCode;
+    }
+    case "cair": {
+      let root: string;
+      try { root = await resolveRepositoryRoot({ cwd: command.options.workspaceRoot, root: command.options.root, projectId: command.options.projectId, manifestPath: command.options.manifestPath }); }
+      catch (error) {
+        const diagnostic = createDiagnostic({ severity: "error", code: "FORGE_REPOSITORY_ROOT", message: (error as Error).message });
+        if (command.options.json || command.options.format === "json") process.stdout.write(formatJsonResult({ ok: false, diagnostics: [diagnostic], exitCode: 1 }));
+        else console.error(`error ${diagnostic.code}: ${diagnostic.message}`);
+        return 1;
+      }
+      const repository = readRepositoryManifest(root, { manifestPath: command.options.manifestPath });
+      if (repository.manifest || repository.diagnostics.length || command.options.root || command.options.projectId) command.options.workspaceRoot = root;
+      const result = runCairCommand(command.options);
+      process.stdout.write(
+        command.options.json || command.options.format === "json"
+          ? formatCairJson(result)
+          : formatCairHuman(result),
+      );
+      return result.exitCode;
+    }
+    case "delta": {
+      if (command.subcommand === "compact") {
+        const result = await runDeltaCompact({
+          workspaceRoot: command.workspaceRoot,
+          dryRun: command.dryRun,
+        });
+        process.stdout.write(command.json ? formatDeltaCompactJson(result) : formatDeltaCompactHuman(result));
+        return result.exitCode;
+      }
+      if (command.subcommand === "prune") {
+        const result = await runDeltaPrune({
+          workspaceRoot: command.workspaceRoot,
+          olderThan: command.olderThan,
+          dryRun: command.dryRun,
+          yes: command.yes,
+        });
+        process.stdout.write(command.json ? formatDeltaPruneJson(result) : formatDeltaPruneHuman(result));
+        return result.exitCode;
       }
+      if (command.subcommand === "export") {
+        const result = await runDeltaExport({
+          workspaceRoot: command.workspaceRoot,
+          redacted: command.redacted,
+          output: command.output,
+          limit: command.limit,
+        });
+        process.stdout.write(command.json ? formatDeltaExportJson(result) : formatDeltaExportHuman(result));
+        return result.exitCode;
+      }
+      if (command.subcommand === "repair") {
+        const result = await runDeltaRepair({
+          workspaceRoot: command.workspaceRoot,
+          dryRun: command.dryRun,
+          yes: command.yes,
+        });
+        process.stdout.write(command.json ? formatDeltaRepairJson(result) : formatDeltaRepairHuman(result));
+        return result.exitCode;
+      }
+      const result = await runDeltaStatus(command.workspaceRoot, { verbose: command.verbose });
+      process.stdout.write(command.json ? formatDeltaStatusJson(result) : formatDeltaStatusHuman(result));
+      return result.exitCode;
+    }
+    case "session": {
+      const result = await runDeltaSessionCommand({
+        workspaceRoot: command.workspaceRoot,
+        subcommand: command.subcommand,
+        sessionId: command.sessionId,
+        sourceSessionId: command.sourceSessionId,
+        operationId: command.operationId,
+        title: command.title,
+        limit: command.limit,
+      });
+      process.stdout.write(command.json ? formatDeltaSessionJson(result) : formatDeltaSessionHuman(result));
       return result.exitCode;
     }
+    case "timeline": {
+      const result = await runDeltaTimeline({
+        workspaceRoot: command.workspaceRoot,
+        target: command.target,
+        kind: command.kindFilter,
+        session: command.sessionId,
+        limit: command.limit,
+        rebuild: command.rebuild,
+        causal: command.causal,
+        staleProofs: command.staleProofs,
+      });
+      process.stdout.write(command.json ? formatDeltaTimelineJson(result) : formatDeltaTimelineHuman(result));
+      return result.exitCode;
+    }
+    case "explain": {
+      const result = await runDeltaExplain({
+        workspaceRoot: command.workspaceRoot,
+        thing: command.thing,
+      });
+      process.stdout.write(command.json ? formatDeltaExplainJson(result) : formatDeltaExplainHuman(result));
+      return result.exitCode;
+    }
+    case "agent": {
+      const heartbeat = command.options.subcommand === "onboard"
+        ? startCommandHeartbeat({
+            label: `agent onboard ${command.options.target ?? "codex"}`,
+            initialPhase: "prepare-hooks-memory-and-dev-snapshot",
+          })
+        : null;
+      try {
+        const result = await runAgentCommand(command.options);
+        if (command.options.json) {
+          process.stdout.write(formatAgentJson(result));
+        } else {
+          process.stdout.write(formatAgentHuman(result));
+        }
+        return result.exitCode;
+      } finally {
+        heartbeat?.stop();
+      }
+    }
+    case "fabric": {
+      return runFabricCommand(command);
+    }
+    case "evolution": {
+      return runEvolutionCommand(command);
+    }
+    case "mcp": {
+      return runMcpServe(command.workspaceRoot);
+    }
     case "review": {
       const result = runReviewCommand(command.options);
       if (command.options.json) {
-        process.stdout.write(formatReviewJson(result));
+        process.stdout.write(formatReviewJson(result, { full: command.options.full }));
       } else if (command.options.md && result.report) {
         process.stdout.write(renderReviewMarkdown(result.report));
       } else if (command.options.sarif && result.report && !command.options.write) {
@@ -802,7 +2458,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
     }
     case "generate": {
       const result = await runGenerateCommand({
-        workspaceRoot: process.cwd(),
+        workspaceRoot: command.workspaceRoot,
         check: command.check,
         dryRun: command.dryRun,
         json: command.json,
@@ -810,7 +2466,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       });
 
       if (command.json) {
-        process.stdout.write(formatJsonResult(buildGenerateJson(result)));
+        process.stdout.write(formatJsonResult(buildGenerateJson(result, { workspaceRoot: command.workspaceRoot })));
       } else {
         writeHumanGenerate(result);
       }
@@ -820,16 +2476,162 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
     case "add": {
       const result = await runAddCommand(command.alias, command.options);
       if (command.options.json) {
-        process.stdout.write(formatJsonResult(buildAddJson(result)));
+        process.stdout.write(formatJsonResult(buildAddJson(result, { workspaceRoot: command.options.workspaceRoot })));
       } else {
         writeHumanAdd(result);
       }
       return result.exitCode;
     }
+    case "manifest": {
+      const result = runManifestCommand(command);
+      if (command.json) {
+        process.stdout.write(formatJsonResult(result));
+      } else {
+        process.stdout.write(formatManifestHuman(result));
+      }
+      return result.exitCode;
+    }
+    case "repository": {
+      const result = await runRepositoryCommand(command.options);
+      process.stdout.write(`${JSON.stringify(result, null, command.options.json ? 2 : 2)}\n`);
+      return result.exitCode;
+    }
+    case "import": {
+      const result = runBrownfieldImportCommand(command.options);
+      if (command.options.json) {
+        process.stdout.write(formatJsonResult(formatBrownfieldImportJson(result)));
+      } else {
+        process.stdout.write(formatBrownfieldImportHuman(result));
+      }
+      return result.exitCode;
+    }
+    case "status": {
+      const result = await runStatusCommand(command.workspaceRoot);
+      if (command.json) {
+        process.stdout.write(formatJsonResult(result.data));
+      } else {
+        process.stdout.write(formatStatusHuman(result));
+      }
+      return result.exitCode;
+    }
+    case "changed": {
+      const result = runChangedCommand(command.workspaceRoot, {
+        authoredOnly: command.authoredOnly,
+        reviewOnly: command.reviewOnly,
+        commitReady: command.commitReady,
+      });
+      if (command.json) {
+        process.stdout.write(formatJsonResult(result.data));
+      } else {
+        process.stdout.write(formatChangedHuman(result));
+      }
+      return result.exitCode;
+    }
+    case "diff": {
+      const changed = runChangedCommand(command.workspaceRoot);
+      const diffPlan = changed.data.diffPlan as { authoredDiffCommand: string; generatedDiffCommand: string; fullDiffCommand: string };
+      const gitSummary = command.target === "authored" ? buildWorkspaceGitSummary(command.workspaceRoot) : null;
+      const authoredPaths = gitSummary ? authoredChangePaths(gitSummary.changeSummary.changed) : null;
+      const authoredAvailable = command.target !== "authored" || (gitSummary?.available === true && authoredPaths !== null);
+      const exitCode = changed.exitCode === 0 && authoredAvailable ? 0 : 1;
+      const commandText = command.target === "generated"
+        ? diffPlan.generatedDiffCommand
+        : command.target === "full"
+          ? diffPlan.fullDiffCommand
+          : diffPlan.authoredDiffCommand;
+      if (command.json) {
+        process.stdout.write(formatJsonResult({
+          schemaVersion: "0.1.0",
+          ok: exitCode === 0,
+          target: command.target,
+          command: commandText,
+          exitCode,
+        }));
+        return exitCode;
+      }
+      if (command.target === "authored") {
+        if (!authoredAvailable || !authoredPaths) return 1;
+        if (authoredPaths.length === 0) return 0;
+        const result = spawnSync("git", ["diff", "--", ...authoredPaths.map((file) => `:(top,literal)${file}`)], {
+          cwd: command.workspaceRoot,
+          stdio: "inherit",
+          windowsHide: true,
+        });
+        return result.status === 0 ? 0 : 1;
+      }
+      const result = spawnSync(commandText, {
+        cwd: command.workspaceRoot,
+        shell: true,
+        stdio: "inherit",
+        windowsHide: true,
+      });
+      return result.status === 0 ? 0 : 1;
+    }
+    case "handoff": {
+      const result = await runHandoffCommand(command);
+      process.stdout.write(command.json ? formatHandoffJson(result) : formatHandoffHuman(result));
+      return result.exitCode;
+    }
+    case "studio": {
+      if (command.subcommand === "bridge" && !command.once && !command.dryRun) {
+        return runStudioBridgeLoop(command, (result) => {
+          process.stdout.write(command.json ? formatStudioBridgeEventJson(result) : formatStudioBridgeHuman(result));
+        });
+      }
+      if (command.subcommand === "watch" && !command.once && !command.dryRun) {
+        return runStudioWatchLoop(command, (result) => {
+          process.stdout.write(command.json ? formatStudioWatchJson(result) : formatStudioWatchHuman(result));
+        });
+      }
+      const result = command.subcommand === "snapshot"
+        ? await runStudioSnapshotCommand(command)
+        : command.subcommand === "watch"
+          ? await runStudioWatchCommand(command)
+          : command.subcommand === "bridge"
+            ? await runStudioBridgeCommand(command)
+            : command.subcommand === "codex-server"
+              ? await runStudioCodexServerCommand(command)
+              : command.subcommand === "doctor"
+                ? await runStudioDoctorCommand(command)
+                : command.subcommand === "open"
+                  ? await runStudioOpenCommand(command)
+                  : await runStudioAttachCommand(command);
+      process.stdout.write(
+        command.json
+          ? command.subcommand === "snapshot"
+            ? formatStudioSnapshotJson(result as Awaited<ReturnType<typeof runStudioSnapshotCommand>>)
+            : command.subcommand === "watch"
+              ? formatStudioWatchJson(result as Awaited<ReturnType<typeof runStudioWatchCommand>>)
+              : command.subcommand === "bridge"
+                ? formatStudioBridgeJson(result as Awaited<ReturnType<typeof runStudioBridgeCommand>>)
+                : command.subcommand === "codex-server"
+                  ? formatStudioCodexServerJson(result as Awaited<ReturnType<typeof runStudioCodexServerCommand>>)
+                  : command.subcommand === "doctor"
+                    ? formatStudioDoctorJson(result as Awaited<ReturnType<typeof runStudioDoctorCommand>>)
+                    : command.subcommand === "open"
+                      ? formatStudioOpenJson(result as Awaited<ReturnType<typeof runStudioOpenCommand>>)
+                      : formatStudioAttachJson(result as Awaited<ReturnType<typeof runStudioAttachCommand>>)
+          : command.subcommand === "snapshot"
+            ? formatStudioSnapshotHuman(result as Awaited<ReturnType<typeof runStudioSnapshotCommand>>)
+            : command.subcommand === "watch"
+              ? formatStudioWatchHuman(result as Awaited<ReturnType<typeof runStudioWatchCommand>>)
+              : command.subcommand === "bridge"
+                ? formatStudioBridgeHuman(result as Awaited<ReturnType<typeof runStudioBridgeCommand>>)
+                : command.subcommand === "codex-server"
+                  ? formatStudioCodexServerHuman(result as Awaited<ReturnType<typeof runStudioCodexServerCommand>>)
+                  : command.subcommand === "doctor"
+                    ? formatStudioDoctorHuman(result as Awaited<ReturnType<typeof runStudioDoctorCommand>>)
+                    : command.subcommand === "open"
+                      ? formatStudioOpenHuman(result as Awaited<ReturnType<typeof runStudioOpenCommand>>)
+                      : formatStudioAttachHuman(result as Awaited<ReturnType<typeof runStudioAttachCommand>>),
+      );
+      return result.exitCode;
+    }
     case "inspect": {
       const result = await runInspectCommand(
         command.target,
-        process.cwd(),
+        command.workspaceRoot,
+        { full: command.full, brief: command.brief, ergonomics: command.ergonomics },
       );
       if (command.json) {
         process.stdout.write(formatJsonResult(buildInspectJson(result)));
@@ -841,11 +2643,12 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       return result.exitCode;
     }
     case "check": {
-      const result = await runCheckCommand(process.cwd(), {
+      const checkWorkspaceRoot = process.cwd();
+      const result = await runCheckCommand(checkWorkspaceRoot, {
         strictSecrets: command.strictSecrets,
       });
       if (command.json) {
-        process.stdout.write(formatJsonResult(buildGenerateJson(result)));
+        process.stdout.write(formatJsonResult(buildCheckJson(result, { workspaceRoot: checkWorkspaceRoot })));
       } else {
         writeHumanGenerate(result);
       }
@@ -867,6 +2670,32 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       );
 
       if (command.queryMode && command.name) {
+        const external = resolveExternalQualifiedName(command.workspaceRoot, command.name, "query");
+        if (external) {
+          const run = await runExternalEntry(command.workspaceRoot, {
+            kind: "query",
+            serviceName: external.serviceName,
+            entryName: external.entryName,
+            args: command.args,
+            auth: resolveAuthFromCli({
+              userId: command.userId,
+              tenantId: command.tenantId,
+              role: command.role,
+            }),
+          });
+          const payload = { run };
+          if (command.json) {
+            process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+          } else {
+            process.stdout.write(
+              run.ok
+                ? `${JSON.stringify(run.result, null, 2)}\n`
+                : `${run.diagnostics.map((diagnostic) => `error ${diagnostic.code}: ${diagnostic.message}`).join("\n")}\n`,
+            );
+          }
+          return run.exitCode;
+        }
+
         const tableMap = readGeneratedJson<{ tableMap: Record<string, import("../compiler/data-graph/sql/serialize.ts").TableMapEntry> }>(
           command.workspaceRoot,
           `${GENERATED_DIR}/db.json`,
@@ -905,6 +2734,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         userId: command.userId,
         tenantId: command.tenantId,
         role: command.role,
+        args: command.args,
         workspaceRoot: command.workspaceRoot,
       });
 
@@ -940,8 +2770,15 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         webOnly: command.webOnly,
         open: command.open,
         webPort: command.webPort,
+        publicApiUrl: command.publicApiUrl,
         telemetry: command.telemetry,
         envFile: command.envFile,
+        skipStartupConsole: command.skipStartupConsole,
+        detach: command.detach,
+        seed: command.seed,
+        seedCommand: command.seedCommand,
+        seedAllTenants: command.seedAllTenants,
+        lifecycle: command.lifecycle,
       });
       return result.exitCode;
     }
@@ -967,6 +2804,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         workspaceRoot: command.workspaceRoot,
         db: command.db,
         databaseUrl: command.databaseUrl,
+        local: command.local,
         json: command.json,
       });
 
@@ -1087,6 +2925,7 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         workspaceRoot: command.workspaceRoot,
         json: command.json,
         redacted: command.redacted,
+        target: command.target,
       });
 
       if (command.json) {
@@ -1160,5 +2999,5 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
   }
 }
 
-export { runVerifyCommand };
+export { runChangedCommand, runVerifyCommand };
 export type { VerifyOptions, VerifyResult };