forgefy-cli 0.1.0__tar.gz → 0.3.0__tar.gz

{forgefy_cli-0.1.0/src/forgefy_cli.egg-info → forgefy_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgefy-cli
-Version: 0.1.0
+Version: 0.3.0
 Summary: Forgefy CLI — coding assistance with local and hosted model-provider profiles.
 License-Expression: LicenseRef-Proprietary
 Project-URL: Homepage, https://forgefy.app
@@ -27,18 +27,28 @@ coverage depend on the selected model; no model is guaranteed to be best at ever
 
 ## Install
 
+No Python required — installs a standalone `forgefy` binary and puts it on
+your PATH, the same way Ollama's or Claude Code's installer does:
+
+macOS / Linux:
+```sh
+curl -fsSL https://raw.githubusercontent.com/Polybamz/forgefy-cli/main/install.sh | sh
+```
+
+Windows (PowerShell):
 ```powershell
-pip install forgefy-cli
+irm https://raw.githubusercontent.com/Polybamz/forgefy-cli/main/install.ps1 | iex
 ```
 
-Not yet published to PyPI? Install straight from GitHub instead:
+Already have Python? `pip`/`pipx` work too — prefer `pipx` over plain `pip`,
+since `pip install` can silently install to a user directory that isn't on
+your PATH:
 
 ```powershell
-pip install git+https://github.com/Polybamz/forgefy-cli.git
+pipx install forgefy-cli
 ```
 
-Either way this creates the `forgefy` executable on your PATH (inside whichever
-Python environment you ran `pip install` in):
+Either way, open a new terminal and you should have the `forgefy` command:
 
 ```powershell
 forgefy --help
@@ -119,14 +129,26 @@ is not a secret scanner: review every file and prompt before sending. Requests h
 & 'C:\Users\USER\Desktop\polycarp\.venv\Scripts\forgefy.exe' chat --provider ollama --model llama3:latest
 ```
 
-Chat retains conversation history in memory for follow-up questions. `/new` clears it,
-`/help` lists commands, and `/exit` or `/quit` ends the session. EOF exits normally;
-Ctrl+C cancels. History is not saved to disk. Each request resends retained history,
-so hosted-provider usage can grow each turn. No automatic paid fallback occurs.
-Oldest complete user/assistant pairs are omitted when conversational content exceeds
-120,000 characters; system/skill instructions are additional. This is a character cap,
-not a token budget. Failed requests preserve prior history. Chat accepts single-line
-turns and skill plugins; explicit `--file` context is currently supported by `run` only.
+Chat retains conversation history for follow-up questions. `/new` clears it, `/help`
+lists commands, and `/exit` or `/quit` ends the session. EOF exits normally; Ctrl+C
+cancels. Each request resends retained history, so hosted-provider usage can grow each
+turn. No automatic paid fallback occurs. Oldest complete user/assistant pairs are
+omitted when conversational content exceeds 120,000 characters; system/skill
+instructions are additional. This is a character cap, not a token budget. Failed
+requests preserve prior history. Chat accepts single-line turns and skill plugins;
+explicit `--file` context is currently supported by `run` only.
+
+Replies stream to the terminal as they're generated by default; `--no-stream` waits for
+the complete response instead (both `chat` and `run`).
+
+Every session is saved to disk under `--session NAME` (default `"default"`,
+`~/.forgefy/history/NAME.json`, permissioned 0600 where the OS supports it — override
+the directory with `FORGEFY_HISTORY_DIR`). A fresh run always **starts empty**, even
+under a name that already has history — add `--resume` to load that session's prior
+turns first. `--no-history` skips saving entirely, for a fully ephemeral session like
+older versions of this CLI. Session files can contain source code and other workspace
+content pasted into the conversation; they're local-only and never uploaded anywhere by
+this tool.
 
 ## Approved file editing
 
@@ -159,17 +181,31 @@ means the model finished, not that its changes are correct or tested. Applied ed
 remain on disk if the session stops or fails—there is no session-wide rollback.
 Use version control or backups and review the printed list of files actually changed.
 
-Editing currently supports replacements only: no file creation, deletion, shell commands,
-or custom skill files. Its integration tests use mocked model responses and temporary
-files; live model-driven editing has not been verified.
+Editing currently supports replacements and, with `--allow-commands`, running shell
+commands — no file deletion or custom skill files yet. Its integration tests use mocked
+model responses and temporary files; live model-driven editing has not been verified.
+
+### Running commands (`--allow-commands`)
+
+Off by default. With it, the model gains a `run_command` tool — use it to build, lint,
+or run tests on the files it just edited, closing the loop that used to require you to
+verify changes yourself. The safety model is identical to file edits: the model proposes
+one exact command, you see it and the working directory, and must type `yes` before
+anything runs. **It is not a sandbox** — an approved command runs with your full user
+privileges, filesystem access, and network, exactly as if you'd typed it yourself.
+Approval is the only boundary; review every command before approving it, the same way
+you'd review a diff. `--command-timeout` (default 120s) kills a hung command; stdout and
+stderr are each capped at 32,000 characters before being shown back to the model.
 
 ## Current boundaries
 
-This release can apply approved replacements, but it does **not** execute
-commands, run tests on generated code, stream tokens, persist chat history, or connect
-to the Forgefy admin catalogue. Provider profiles and skill files are the initial plugin
-interfaces, not a full autonomous coding-agent system. Output is untrusted: inspect it
-before running anything. Tests use mocked HTTP, not live model quality benchmarks.
+This release can apply approved replacements and, opt-in, run approved shell commands
+(`--allow-commands`) — but that opt-in is not a sandbox, so read the section above before
+turning it on. It does not connect to the Forgefy admin catalogue. Provider profiles and
+skill files are the initial plugin interfaces, not a full autonomous coding-agent system.
+Output is untrusted: inspect it before running anything, whether it's a file diff or a
+command result. Tests use mocked HTTP (and, for the process-level suite, a real loopback
+server), not live model quality benchmarks.
 
 ## Tests
 
@@ -179,12 +215,26 @@ pytest
 
 ## Releasing (maintainers)
 
-CI runs on every push/PR (`.github/workflows/ci.yml`). To publish a new version to PyPI:
+CI runs on every push/PR (`.github/workflows/ci.yml`). One tag produces both
+distribution channels:
 
 1. Bump `version` in `pyproject.toml` and commit.
 2. `git tag vX.Y.Z && git push origin vX.Y.Z`.
-3. `.github/workflows/release.yml` builds, tests, and publishes via PyPI Trusted
-   Publishing — no token stored in the repo. One-time setup: on the PyPI project's
-   *Publishing* settings, add a Trusted Publisher for `Polybamz/forgefy-cli`,
-   workflow `release.yml`, environment `pypi`.
+3. `.github/workflows/release.yml` then, in parallel:
+   - builds and publishes the PyPI package via Trusted Publishing — no token
+     stored in the repo. One-time setup: on the PyPI project's *Publishing*
+     settings, add a Trusted Publisher for `Polybamz/forgefy-cli`, workflow
+     `release.yml`, environment `pypi`.
+   - builds a standalone `forgefy` binary for Windows/macOS/Linux with
+     PyInstaller and attaches them to a GitHub Release for the tag — what
+     `install.sh`/`install.ps1` fetch. No setup needed; uses the repo's
+     built-in `GITHUB_TOKEN`.
+
+To build the standalone binary locally (e.g. to test before tagging):
+
+```powershell
+pip install -e . pyinstaller
+pyinstaller --onefile --name forgefy --paths src --hidden-import anyio._backends._asyncio --distpath dist_native --workpath build_native --specpath build_native build_installer/entrypoint.py
+.\dist_native\forgefy.exe --help
+```
 

{forgefy_cli-0.1.0 → forgefy_cli-0.3.0}/README.md

@@ -6,18 +6,28 @@ coverage depend on the selected model; no model is guaranteed to be best at ever
 
 ## Install
 
+No Python required — installs a standalone `forgefy` binary and puts it on
+your PATH, the same way Ollama's or Claude Code's installer does:
+
+macOS / Linux:
+```sh
+curl -fsSL https://raw.githubusercontent.com/Polybamz/forgefy-cli/main/install.sh | sh
+```
+
+Windows (PowerShell):
 ```powershell
-pip install forgefy-cli
+irm https://raw.githubusercontent.com/Polybamz/forgefy-cli/main/install.ps1 | iex
 ```
 
-Not yet published to PyPI? Install straight from GitHub instead:
+Already have Python? `pip`/`pipx` work too — prefer `pipx` over plain `pip`,
+since `pip install` can silently install to a user directory that isn't on
+your PATH:
 
 ```powershell
-pip install git+https://github.com/Polybamz/forgefy-cli.git
+pipx install forgefy-cli
 ```
 
-Either way this creates the `forgefy` executable on your PATH (inside whichever
-Python environment you ran `pip install` in):
+Either way, open a new terminal and you should have the `forgefy` command:
 
 ```powershell
 forgefy --help
@@ -98,14 +108,26 @@ is not a secret scanner: review every file and prompt before sending. Requests h
 & 'C:\Users\USER\Desktop\polycarp\.venv\Scripts\forgefy.exe' chat --provider ollama --model llama3:latest
 ```
 
-Chat retains conversation history in memory for follow-up questions. `/new` clears it,
-`/help` lists commands, and `/exit` or `/quit` ends the session. EOF exits normally;
-Ctrl+C cancels. History is not saved to disk. Each request resends retained history,
-so hosted-provider usage can grow each turn. No automatic paid fallback occurs.
-Oldest complete user/assistant pairs are omitted when conversational content exceeds
-120,000 characters; system/skill instructions are additional. This is a character cap,
-not a token budget. Failed requests preserve prior history. Chat accepts single-line
-turns and skill plugins; explicit `--file` context is currently supported by `run` only.
+Chat retains conversation history for follow-up questions. `/new` clears it, `/help`
+lists commands, and `/exit` or `/quit` ends the session. EOF exits normally; Ctrl+C
+cancels. Each request resends retained history, so hosted-provider usage can grow each
+turn. No automatic paid fallback occurs. Oldest complete user/assistant pairs are
+omitted when conversational content exceeds 120,000 characters; system/skill
+instructions are additional. This is a character cap, not a token budget. Failed
+requests preserve prior history. Chat accepts single-line turns and skill plugins;
+explicit `--file` context is currently supported by `run` only.
+
+Replies stream to the terminal as they're generated by default; `--no-stream` waits for
+the complete response instead (both `chat` and `run`).
+
+Every session is saved to disk under `--session NAME` (default `"default"`,
+`~/.forgefy/history/NAME.json`, permissioned 0600 where the OS supports it — override
+the directory with `FORGEFY_HISTORY_DIR`). A fresh run always **starts empty**, even
+under a name that already has history — add `--resume` to load that session's prior
+turns first. `--no-history` skips saving entirely, for a fully ephemeral session like
+older versions of this CLI. Session files can contain source code and other workspace
+content pasted into the conversation; they're local-only and never uploaded anywhere by
+this tool.
 
 ## Approved file editing
 
@@ -138,17 +160,31 @@ means the model finished, not that its changes are correct or tested. Applied ed
 remain on disk if the session stops or fails—there is no session-wide rollback.
 Use version control or backups and review the printed list of files actually changed.
 
-Editing currently supports replacements only: no file creation, deletion, shell commands,
-or custom skill files. Its integration tests use mocked model responses and temporary
-files; live model-driven editing has not been verified.
+Editing currently supports replacements and, with `--allow-commands`, running shell
+commands — no file deletion or custom skill files yet. Its integration tests use mocked
+model responses and temporary files; live model-driven editing has not been verified.
+
+### Running commands (`--allow-commands`)
+
+Off by default. With it, the model gains a `run_command` tool — use it to build, lint,
+or run tests on the files it just edited, closing the loop that used to require you to
+verify changes yourself. The safety model is identical to file edits: the model proposes
+one exact command, you see it and the working directory, and must type `yes` before
+anything runs. **It is not a sandbox** — an approved command runs with your full user
+privileges, filesystem access, and network, exactly as if you'd typed it yourself.
+Approval is the only boundary; review every command before approving it, the same way
+you'd review a diff. `--command-timeout` (default 120s) kills a hung command; stdout and
+stderr are each capped at 32,000 characters before being shown back to the model.
 
 ## Current boundaries
 
-This release can apply approved replacements, but it does **not** execute
-commands, run tests on generated code, stream tokens, persist chat history, or connect
-to the Forgefy admin catalogue. Provider profiles and skill files are the initial plugin
-interfaces, not a full autonomous coding-agent system. Output is untrusted: inspect it
-before running anything. Tests use mocked HTTP, not live model quality benchmarks.
+This release can apply approved replacements and, opt-in, run approved shell commands
+(`--allow-commands`) — but that opt-in is not a sandbox, so read the section above before
+turning it on. It does not connect to the Forgefy admin catalogue. Provider profiles and
+skill files are the initial plugin interfaces, not a full autonomous coding-agent system.
+Output is untrusted: inspect it before running anything, whether it's a file diff or a
+command result. Tests use mocked HTTP (and, for the process-level suite, a real loopback
+server), not live model quality benchmarks.
 
 ## Tests
 
@@ -158,12 +194,26 @@ pytest
 
 ## Releasing (maintainers)
 
-CI runs on every push/PR (`.github/workflows/ci.yml`). To publish a new version to PyPI:
+CI runs on every push/PR (`.github/workflows/ci.yml`). One tag produces both
+distribution channels:
 
 1. Bump `version` in `pyproject.toml` and commit.
 2. `git tag vX.Y.Z && git push origin vX.Y.Z`.
-3. `.github/workflows/release.yml` builds, tests, and publishes via PyPI Trusted
-   Publishing — no token stored in the repo. One-time setup: on the PyPI project's
-   *Publishing* settings, add a Trusted Publisher for `Polybamz/forgefy-cli`,
-   workflow `release.yml`, environment `pypi`.
+3. `.github/workflows/release.yml` then, in parallel:
+   - builds and publishes the PyPI package via Trusted Publishing — no token
+     stored in the repo. One-time setup: on the PyPI project's *Publishing*
+     settings, add a Trusted Publisher for `Polybamz/forgefy-cli`, workflow
+     `release.yml`, environment `pypi`.
+   - builds a standalone `forgefy` binary for Windows/macOS/Linux with
+     PyInstaller and attaches them to a GitHub Release for the tag — what
+     `install.sh`/`install.ps1` fetch. No setup needed; uses the repo's
+     built-in `GITHUB_TOKEN`.
+
+To build the standalone binary locally (e.g. to test before tagging):
+
+```powershell
+pip install -e . pyinstaller
+pyinstaller --onefile --name forgefy --paths src --hidden-import anyio._backends._asyncio --distpath dist_native --workpath build_native --specpath build_native build_installer/entrypoint.py
+.\dist_native\forgefy.exe --help
+```
 

{forgefy_cli-0.1.0 → forgefy_cli-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgefy-cli"
-version = "0.1.0"
+version = "0.3.0"
 description = "Forgefy CLI — coding assistance with local and hosted model-provider profiles."
 readme = "README.md"
 requires-python = ">=3.11"

forgefy_cli-0.3.0/src/forgefy_cli/auth.py

@@ -0,0 +1,65 @@
+"""Local storage for the credential `forgefy login` obtains.
+
+config.py is explicit that provider credentials are read only from the
+environment and never stored in config.toml. This module doesn't relax that:
+Provider.headers() still reads only os.environ. `forgefy login` just gives
+one more, opt-in way to populate $FORGEFY_API_KEY for the process — from a
+single-purpose file the user created by explicitly running `login`, kept out
+of config.toml and permissioned as tightly as the OS allows, the same
+convention `gh`/`docker`/`npm` use for their own login credential.
+"""
+from __future__ import annotations
+
+import json
+import os
+import stat
+from pathlib import Path
+
+
+def credentials_path() -> Path:
+    return Path(
+        os.environ.get("FORGEFY_CREDENTIALS", str(Path.home() / ".forgefy" / "credentials.json"))
+    ).expanduser()
+
+
+def save_credentials(api_key: str) -> Path:
+    path = credentials_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps({"api_key": api_key}), encoding="utf-8")
+    try:
+        os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)  # 0600 — no-op on Windows, effective on POSIX
+    except OSError:
+        pass  # best-effort; some filesystems (e.g. certain network mounts) reject chmod
+    return path
+
+
+def load_credentials() -> str | None:
+    path = credentials_path()
+    if not path.exists():
+        return None
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError, UnicodeDecodeError):
+        return None
+    key = data.get("api_key") if isinstance(data, dict) else None
+    return key if isinstance(key, str) and key else None
+
+
+def clear_credentials() -> bool:
+    path = credentials_path()
+    if path.exists():
+        path.unlink()
+        return True
+    return False
+
+
+def bootstrap_env() -> None:
+    """Populate $FORGEFY_API_KEY from the stored credential if not already set.
+
+    Called once at CLI startup, before providers are resolved. An explicitly
+    exported FORGEFY_API_KEY always wins over a stored one.
+    """
+    if not os.environ.get("FORGEFY_API_KEY"):
+        key = load_credentials()
+        if key:
+            os.environ["FORGEFY_API_KEY"] = key

{forgefy_cli-0.1.0 → forgefy_cli-0.3.0}/src/forgefy_cli/chat.py

@@ -9,9 +9,28 @@ from .providers import ProviderError
 LEAVING = "/exit or /quit (leave), /new (clear history), /help (commands)"
 
 
-def chat_loop(client, model: str, system: str, input_fn: Callable[..., str] = input, output: Callable[[str], None] = print) -> int:
-    """Read user turns until /exit, /quit or end of input. History is sent each turn."""
-    history: list[tuple[str, str]] = []
+def print_fragment(text: str) -> None:
+    """Default on_token: write one streamed piece with no newline, flushed immediately."""
+    print(text, end="", flush=True)
+
+
+def chat_loop(client, model: str, system: str, input_fn: Callable[..., str] = input, output: Callable[[str], None] = print,
+              on_token: Callable[[str], None] | None = print_fragment,
+              history: list[tuple[str, str]] | None = None,
+              on_turn: Callable[[list[tuple[str, str]]], None] = lambda h: None) -> int:
+    """Read user turns until /exit, /quit or end of input. History is sent each turn.
+
+    `on_token`, when not None, streams the reply to it fragment-by-fragment as
+    it's generated (default: print live); the accumulated reply is then NOT
+    also passed to `output`, to avoid printing it twice — pass on_token=None
+    for the old blocking behavior, where `output(reply)` prints it once, whole.
+
+    `history` seeds a resumed session (see forgefy_cli.history); `on_turn` is
+    called with the updated history after every completed exchange and after
+    /new, so a caller can persist it incrementally — a crash mid-session loses
+    at most the in-flight turn, not the whole conversation.
+    """
+    history = list(history or [])
     while True:
         try:
             line = input_fn("you> ").strip()
@@ -23,6 +42,7 @@ def chat_loop(client, model: str, system: str, input_fn: Callable[..., str] = in
             return 0
         if line == "/new":
             history.clear()
+            on_turn(history)
             output("Context cleared.")
             continue
         if line == "/help":
@@ -39,11 +59,15 @@ def chat_loop(client, model: str, system: str, input_fn: Callable[..., str] = in
             del candidate[:2]  # Always discard a complete user/assistant pair.
             removed += 1
         try:
-            reply = client.chat(model, system, candidate)
+            reply = client.chat(model, system, candidate, on_token=on_token)
         except (ProviderError, ValueError) as exc:
             output(f"Forgefy: {exc}")
             continue
         history = candidate + [("assistant", reply)]
+        on_turn(history)
         if removed:
             output(f"Context limit: omitted {removed} oldest turn pair(s).")
-        output(reply)
+        if on_token is None:
+            output(reply)
+        else:
+            output("")  # the reply was already streamed; just close the line

{forgefy_cli-0.1.0 → forgefy_cli-0.3.0}/src/forgefy_cli/cli.py

@@ -2,23 +2,31 @@
 from __future__ import annotations
 
 import argparse
+from importlib.metadata import PackageNotFoundError, version
 import os
 from pathlib import Path
 import sys
 
 import httpx
 
-from .chat import chat_loop
+from .auth import bootstrap_env
+from .chat import chat_loop, print_fragment
 from .config import TEMPLATE, config_path, load_config
 from .context import build_prompt
 from .editing import edit_files
+from .history import load_session, save_session, session_path
 from .providers import ModelClient, ProviderError
 from .skills import SKILLS, system_prompt
 
+try:
+    _VERSION = version("forgefy-cli")
+except PackageNotFoundError:  # running from source without an install record
+    _VERSION = "0.0.0-dev"
+
 
 def parser() -> argparse.ArgumentParser:
-    result = argparse.ArgumentParser(prog="forgefy", description="Forgefy: local or hosted coding assistance. Run/chat suggest; edit applies approved file changes. No command execution.")
-    result.add_argument("--version", action="version", version="Forgefy CLI 0.1.0")
+    result = argparse.ArgumentParser(prog="forgefy", description="Forgefy: local or hosted coding assistance. Run/chat suggest; edit applies approved file changes and, with --allow-commands, runs approved shell commands.")
+    result.add_argument("--version", action="version", version=f"Forgefy CLI {_VERSION}")
     sub = result.add_subparsers(dest="command", required=True)
     run = sub.add_parser("run", help="Send one coding request and print the response")
     run.add_argument("prompt", help="Coding request; use '-' to read from stdin")
@@ -28,11 +36,16 @@ def parser() -> argparse.ArgumentParser:
     run.add_argument("--file", action="append", default=[], help="Explicit relative file to send; repeatable. Review for secrets first.")
     run.add_argument("--skill", choices=sorted(SKILLS), default="code")
     run.add_argument("--skill-file", type=Path, action="append", default=[], help="Trusted Markdown instructions to send; repeatable")
+    run.add_argument("--no-stream", action="store_true", help="Wait for the full response instead of printing it as it streams")
     chat = sub.add_parser("chat", help="Multi-turn conversation; replies are suggestions to review")
     chat.add_argument("--provider", help="Provider profile name (default: config or ollama)")
     chat.add_argument("--model", help="Exact provider model ID; no automatic paid fallback")
     chat.add_argument("--skill", choices=sorted(SKILLS), default="code")
     chat.add_argument("--skill-file", type=Path, action="append", default=[], help="Trusted Markdown instructions to send; repeatable")
+    chat.add_argument("--no-stream", action="store_true", help="Wait for each full response instead of printing it as it streams")
+    chat.add_argument("--session", default="default", help="Named session to save to disk (default: 'default')")
+    chat.add_argument("--resume", action="store_true", help="Load previous turns from --session before starting; without this, every run starts fresh (but is still saved)")
+    chat.add_argument("--no-history", action="store_true", help="Don't load or save this session at all; ephemeral like before")
     edit = sub.add_parser("edit", help="Edit explicitly selected existing files with approval for every diff")
     edit.add_argument("prompt", help="Requested change")
     edit.add_argument("--provider", help="Provider profile; requires a tool-calling model")
@@ -41,8 +54,14 @@ def parser() -> argparse.ArgumentParser:
     edit.add_argument("--file", action="append", default=[], help="Allowed existing relative file; repeatable")
     edit.add_argument("--create", action="append", default=[], help="Approved relative path to create; repeatable, parent dir must exist")
     edit.add_argument("--max-turns", type=int, default=12, help="Maximum model requests (1–30; default 12)")
+    edit.add_argument("--allow-commands", action="store_true",
+                       help="Let the model propose shell commands (e.g. to run tests); each still requires your approval. Not sandboxed.")
+    edit.add_argument("--command-timeout", type=int, default=120, help="Seconds before an approved command is killed (default 120)")
     models = sub.add_parser("models", help="List live provider model IDs (availability and pricing vary)")
     models.add_argument("--provider")
+    login = sub.add_parser("login", help="Sign in with your Forgefy account via the browser (device code)")
+    login.add_argument("--api-url", help="Override FORGEFY_API_URL for this login only")
+    sub.add_parser("logout", help="Remove the locally stored Forgefy account credential")
     sub.add_parser("providers", help="List built-in and configured provider plugins")
     sub.add_parser("skills", help="List built-in coding skills")
     sub.add_parser("doctor", help="Check configuration and key presence without sending requests")
@@ -53,7 +72,15 @@ def parser() -> argparse.ArgumentParser:
 
 def main(argv: list[str] | None = None) -> int:
     args = parser().parse_args(argv)
+    bootstrap_env()
     try:
+        if args.command == "login":
+            from .login import device_login
+            with httpx.Client(timeout=15) as http:
+                return device_login(http, api_url=args.api_url)
+        if args.command == "logout":
+            from .login import logout
+            return logout()
         if args.command == "config":
             path = config_path()
             if args.init:
@@ -90,7 +117,8 @@ def main(argv: list[str] | None = None) -> int:
         with httpx.Client(timeout=httpx.Timeout(120, connect=10)) as http:
             client = ModelClient(provider, http)
             if args.command == "edit":
-                                return edit_files(client, model, args.prompt, args.workspace, args.file, args.max_turns, args.create)
+                return edit_files(client, model, args.prompt, args.workspace, args.file, args.max_turns,
+                                   args.create, args.allow_commands, args.command_timeout)
             if args.command == "models":
                 for model_id in client.models():
                     print(model_id)
@@ -98,10 +126,28 @@ def main(argv: list[str] | None = None) -> int:
                 prompt = sys.stdin.read(120001) if args.prompt == "-" else args.prompt
                 prompt = build_prompt(prompt, args.workspace, args.file)
                 print(f"Sending request to {name} / {model}. Provider pricing applies; no fallback.", file=sys.stderr)
-                print(client.complete(model, system, prompt))
+                if args.no_stream:
+                    print(client.complete(model, system, prompt))
+                else:
+                    client.complete(model, system, prompt, on_token=print_fragment)
+                    print()
             else:
                 print(f"Chatting with {name} / {model}. /exit to leave; replies are suggestions to review, never executed.", file=sys.stderr)
-                chat_loop(client, model, system)
+                if args.no_history:
+                    initial_history, on_turn = [], (lambda h: None)
+                else:
+                    initial_history = load_session(args.session) if args.resume else []
+                    on_turn = lambda h: save_session(args.session, h)  # noqa: E731
+                    if args.resume and initial_history:
+                        print(f"Resumed session '{args.session}' ({len(initial_history) // 2} previous turn(s)). "
+                              f"/new to start fresh.", file=sys.stderr)
+                    elif args.resume:
+                        print(f"No previous history for session '{args.session}' — starting fresh.", file=sys.stderr)
+                    else:
+                        print(f"Session '{args.session}' will be saved to {session_path(args.session)}. "
+                              f"Use --resume to continue it next time.", file=sys.stderr)
+                chat_on_token = None if args.no_stream else print_fragment
+                chat_loop(client, model, system, on_token=chat_on_token, history=initial_history, on_turn=on_turn)
         return 0
     except (ValueError, OSError, ProviderError) as exc:
         print(f"Forgefy: {exc}", file=sys.stderr)

forgefy_cli-0.3.0/src/forgefy_cli/command_tools.py

@@ -0,0 +1,92 @@
+"""Explicit, approval-gated shell command execution.
+
+Opt-in only: `forgefy edit --allow-commands`. Kept in its own module, separate
+from file_tools.py (whose docstring promises no shell execution) — that
+promise stays true by default; this is what a caller turns on deliberately.
+
+Not a sandbox. A command approved here runs with the user's full OS
+privileges, filesystem access, and network — the only safety boundary is the
+same one file edits already use: the model proposes an exact command, the
+user sees it and must approve it before anything runs.
+"""
+from __future__ import annotations
+
+import json
+import subprocess
+from pathlib import Path
+from typing import Callable
+
+# Matches file_tools.FILE_LIMIT — keeps a tool result within the CLI's
+# character-budget context cap regardless of how chatty a command's output is.
+OUTPUT_LIMIT = 32000
+DEFAULT_TIMEOUT = 120
+
+RUN_COMMAND_TOOL = {
+    "type": "function",
+    "function": {
+        "name": "run_command",
+        "description": (
+            "Run one exact shell command line in the workspace root, after user approval. "
+            "Use to build, lint, or run tests on files you've edited. Runs with the user's "
+            "full privileges and network access — it is not sandboxed."
+        ),
+        "parameters": {
+            "type": "object",
+            "properties": {"command": {"type": "string"}},
+            "required": ["command"],
+            "additionalProperties": False,
+        },
+    },
+}
+
+
+def _truncate(text: str) -> str:
+    if len(text) <= OUTPUT_LIMIT:
+        return text
+    omitted = len(text) - OUTPUT_LIMIT
+    return text[:OUTPUT_LIMIT] + f"\n...[truncated, {omitted} more characters]"
+
+
+class CommandRunner:
+    def __init__(self, workspace: Path, approve: Callable[[str], bool], timeout: int = DEFAULT_TIMEOUT) -> None:
+        self.root = workspace
+        self.approve = approve
+        self.timeout = timeout
+        self.ran: list[str] = []
+
+    def execute(self, arguments: str) -> str:
+        try:
+            args = json.loads(arguments)
+            if not isinstance(args, dict) or set(args) != {"command"} or not isinstance(args["command"], str):
+                raise ValueError("Tool arguments do not match the schema.")
+            command = args["command"].strip()
+            if not command:
+                raise ValueError("command must be nonempty.")
+        except (ValueError, TypeError) as exc:
+            return json.dumps({"error": str(exc)})
+
+        if not self.approve(f"$ {command}\n(cwd: {self.root})"):
+            return json.dumps({"error": "The user declined to run this command; it did not run."})
+
+        try:
+            result = subprocess.run(
+                command,
+                shell=True,  # the command is one already-approved string, not argv — approval IS the trust boundary
+                cwd=self.root,
+                capture_output=True,
+                timeout=self.timeout,
+                text=True,
+                errors="replace",
+                check=False,  # exit_code is reported back to the model, never raised
+            )
+        except subprocess.TimeoutExpired:
+            return json.dumps({"error": f"Command timed out after {self.timeout}s."})
+        except OSError as exc:
+            return json.dumps({"error": f"Could not run command: {exc}"})
+
+        self.ran.append(command)
+        return json.dumps({
+            "exit_code": result.returncode,
+            "stdout": _truncate(result.stdout),
+            "stderr": _truncate(result.stderr),
+        })