forked from trevato-apps/forge
developer forge - build pins, iterations, displays #11
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/upstream-sync"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Lands everything since 10-13 on this fork's main in one fast-forward. Supersedes #7, #8, #9 and #10, which this branch contains.
accaa65, 10-28) merged in.Replace the hand-installed database trigger with a proper forge setting (default off): when on, accounts younger than 7 days cannot create repositories or forks, refused in the legacy trigger's own words (403 {error: refused}). Agents and admins are exempt. Booting drops legacy triggers carrying the guard's message, so forges carrying the old trigger get the toggle instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>bb67382f0a012df47origin/maininto the branch and pushed. The new hosted-child test file fails two of its five tests when I run it here, so I haven't confirmed the push is green. 01df8e3e53POST …/planin the JSON API (#1170) f9968ec07d/migrate?from=<host>/<owner>/<name>&crew=<agent>opens Migrate with that repository and agent chosen, matched on the origin's full host (#1491) 8537496d6e/migrate?from=<host>/<owner>/<name>&crew=<agent>opens Migrate with that repository and agent chosen, matched on the origin's full host (#1491) 12972e9543A pure SVG card renderer: src/web/og/card.ts turns {kind, title, lines, stat} into a 1200×630 card in the studio's tokens Co-authored-by: trevato <trevato@users.noreply.forge.open-platform.sh>check.fastruns on a pull's push,check.runon the default branch (#1190) d60fcfbe5echeck.fastruns on a pull's push,check.runon the default branch (#1190) 1e6d8563ebbun scripts/test-shards.ts --gaterefuses an unlisted test file by name before any shard starts (#1421) 87da352f93mainagain after I resolved one conflict, insrc/checks/service.ts. It also carries the earlier hosted-child changes: a hosted child's apps are served ahead of the par 25ccef2318mergeableandconflictson every reading of a pull (#1466) ed8659f144maininto the branch. The merge conflicted insrc/kernel/vitals.ts,src/actions/health.tsand `test/vitals.tes 42a7a38e54aa14d6f2removed (#1456) 87f8dca699aa14d6f) 8b55086404aa14d6f) 25cdb4f955asks/feednever mark a conflicted pull green: they say "Conflicts in N files" (#1702) f9715d9aaabun src/main.ts --preflightproves a tree can boot: config parses, migrations dry-run on a copy of the database, then exits 0 or 1 with one line (#1674) dd95d70a60bun src/main.ts --preflightproves a tree can boot: config parses, migrations dry-run on a copy of the database, then exits 0 or 1 with one line (#1674);The accounts page offers "remove the organization too" behind a confirm page that lists everything that will go (#1681);src/ 09ea37181esrc/core/schema.ts, and the thoughts table also claimed 80. 7753c24a4asrc/core/schema.ts, and the thoughts table also claimed 80.;The fault hunt files one issue for each cause degraded more than ten minutes in its day, quoting th 49e8b7303f/og/issue,/og/pulland/og/runcards, reading only what the viewer may read (#1716) e1d9136603/og/issue,/og/pulland/og/runcards, reading only what the viewer may read (#1716) e59eaad685maininto this branch and pushed it. The only conflict was insrc/kernel/vitals.ts, in the import block. My branch had addedBUDGETSfrom./budgets.tsandmainhad added `failedSent c00f179f6amaininto this branch and pushed it. The only conflict was insrc/kernel/vitals.ts, in the import block. My branch had addedBUDGETSfrom./budgets.tsandmainhad added `failedSent;Signup verifies a Turnstile token on the server before it makes an account, through a verifyHuman o d89f435acbtellwithout a repo writes a thought and returns its id (#1722) e54bcc4bc2tellwithout a repo writes a thought and returns its id (#1722) 4c8b1f5437tellwithout a repo writes a thought and returns its id (#1722) cb89767c61tellwithout a r 0f675f7e7bfromon the tell action, the API and the MCP, shown on the issue (#1744) bfdded3141cloud.jsondeclares which vendor uses an app or repository may make, nothing by default, and docs/CLOUD.md states the rule (#1750) 00013984c5bun src/main.ts --rollback <sha>swaps back to a kept release, and refuses one whose schema is behind the live database (#1846) 879e89d330bun src/main.ts --rollback <sha>swaps back to a kept release, and refuses one whose schema is behind the live database (#1846) 37df538afcbun src/main.ts --rollback <sha>swaps back to a kept release, and refuses one whose schema is behind the live database (#1846) a4a8789bf5bun src/main.ts --rollback <sha>swaps back to a kept release, and refuses one whose schema is behind the live database (#1846) 30c2399f10bun src/main.ts --rollback <sha>swaps back to a kept release, and refuses one whose schema is behind the live database (#1846) d31e8afe3abun src/main.ts --rollback <sha>swaps back to a kept release, and refuses one whose schema is behind the live database (#1846) 06f98cb158chooseitem in the feed that opens its deck (#1858) d97c8bde89chooseitem in the feed that opens its deck (#1858) 9d60860327chooseitem in the feed that opens its deck (#1858) 3bb4211966chooseitem in the feed that opens its deck (#1858);A variant group is onechooseitem in the feed that opens its deck (#1858);A variant group is onechooseitem in the feed that opens its deck (#1858);Home is the feed, walked end to end: composer, timeline, a tell, a cr 9927fdd8eftsccheck plusbun test test/flow-card.test.ts test/tui, so the TUI suites passed alongside the card tests. I didn't read its output file; c39146407dmaininto the branch and pushed it. The one conflict was insrc/checks/service.ts, and I kept both sides' changes. f29fb08c50a9aa2f52removed them as unused c3a00de608a9aa2f52removed them as unused;The terminal reads the access log (Settings → Access has no src/tui screen) (#1900);Router: match names the route pattern it matched (#1916);schema-migrations 27e4df4cda9927fdd— error TS5033: Could not write file '.forge-cache/tsc.tsbuildinfo': ENOENT: no s… (#1959) 08526dab479927fdd— error TS5033: Could not write file '.forge-cache/tsc.tsbuildinfo': ENOENT: no s… (#1914) dfe00b064f9927fdd— error TS5033: Could not write file '.forge-cache/tsc.tsbuildinfo': ENOENT: no s… (#1914) b1e91379939927fdd— error TS5033: Could not write file '.forge-cache/tsc.tsbuildinfo': ENOENT: no s… (#1914);A milestone's page shows what its limb cost and landed, with its costliest issues (#1984);A milesto 22e9a7b85236daece— "/boards > a panel keeps its chart and series: chosen in the form, saved in the… (#2042) e466750b6cbun test --changedwith the impact map on the last 50 pulls, keep whichever never missed a red (#2066) bbbbf1f8dabun test --changedwith the impact map on the last 50 pulls, keep whichever never missed a red (#2066);A roll never cuts an in-flight push: the old process stops listening at drain start, not at the end (#2051);Check time under 2 minutes for a typical pull: Bun-native affected 671a261742ca12f0f— "a fork that follows its parent > the terminal's About card says the same sente… (#2101) 8c724a2726live,releasesand a person'srollbackin the forge's SSH terminal, gated as /releases is (#2103) 820d31c63esignup(open, invite or closed) that an admin changes live, kept in the audit (#2169) 39d97d4541signup(open, invite or closed) that an admin changes live, kept in the audit (#2169);Every answered request is counted once, in the server's 75ac70797achild/<name>/...branches and open pulls (#2182) 7dcf24c979child/<name>/...branches and open pulls (#2182);A spawned forge carries a fork of the forge it came from, and the chain shows both ways (#1862);MCP feed and asks take the filter the owner saved, 8bb4d2b4021aecf60— stopped: used 16.1 cores for 30s, over its limit of 16; 5 pull checks wait for … (#2162) fd27b1b2fdea64226— test-shards: over 45 s: test/crew.test.ts (52.5s); 8 pull checks wait for it to… (#2328) 2467da0aedea64226— test-shards: over 45 s: test/crew.test.ts (52.5s); 8 pull checks wait for it to… (#2378) 0521277a76A headless first admin holds only an expiring token. It has no password or passkey, and tokens do not mint tokens, so when its token lapses the forge has an admin and no way in. And `--first-admin` refused because an admin existed. Now, when no admin has a working credential, the command mints a recovery code instead. "Working" means any of: a password, a passkey, a token that has not expired (or never does), a live session, an SSH key, or sign-in with the parent. Every admin counts here (person or agent, suspended or not), so the check refuses as broadly as it can (`adminCanSignIn`, `core/first_admin.ts`). - Same shape as the first-admin code: one `forge_setting` row, sha256 only, 15 minutes, spent by one compare-and-swap, replaced by the next mint. The row also holds the id of the admin it is for (`r`). - Bound at mint to one stranded admin: an active person admin, not suspended or removed. If there are several, `--user <name>` picks one. The command refuses a non-admin, an unknown name, `--user` on a forge with no admin, and any forge where an admin can still sign in. - Redeemed only at `POST /api/v1/first-admin/recover {code, scope, name?, expiresIn?}`. It mints a new token for that existing admin, with the same lifetime rules (a day by default, at most 30 days, never forever), and answers 201 `{user, scope, id, token, expiresAt, expiresIn}`. No account is made. A recovery code is refused at `/api/v1/first-admin` and `/first-admin`; a first-admin code is refused at `/recover`. - Checked again when redeemed: a credential that appears after minting kills the code. - Same throttle, inside the action, before the code is read (`recoverFirstAdmin`). Cross-origin is refused. Every refusal is the same 403. - Audited as `user.recovered` with `via: "first-admin-recovery"`, the token id, scope, expiry and address, plus the usual `token.created`. One log line names the user, never the code or the token. The existing CLI test's admin had no credential, so that forge is now recoverable. The test gives the admin a token, which keeps it a refusal test. Tests (test/first-admin-recovery.test.ts, written first: 8 of the 16 failed against the previous head, the 8 refusal guards passed): recovery end to end, once, then refused; the token's lifetime rules; the 15-minute expiry; each kind of code refused at the other's door; cross-origin and rate limit; nothing logged. Refused for each of the six credentials, held by the stranded admin or by another admin. Expired sessions and tokens don't count. A credential that appears later kills the code. `--user` with several stranded admins; a suspended admin is not recovered."a proposal names only what is actually ahead" lands a pull in bob/lamp right after alice merged bob's first proposal into alice/lamp. That merge moves the untouched fork on the bus (following.ts), and the test's next mergePull reads the fork's main before the move and CASes it after: update-ref fails and the merge returns base_moved. On one core, 3 of 6 runs on main failed that way: error: {"kind":"base_moved"} at test/following.test.ts:852:33 The test now waits, as this file's settle() does, until the fork is synced with the parent's tip before landing the next pull. What it asserts is unchanged. 12 of 12 runs pass on one core.git-ssh and ssh-app drive the real OpenSSH client, so they skip on a machine without it and the branch's validate run never saw them. On CI they failed: alice, no longer admin by signing up first, is unverified, and createRepo refuses her ("repo creation failed"). Same fix as the other suites: seedAdmin, which keeps her the proven admin she was on main.52f8958d, #2614), so the mirror fast-forwards again; no file changes 316aa9706652f8958d, #2614), so the mirror fast-forwards again; no file changes;Through MCP 4986c9c8eebun scripts/smoke.ts <url> --standardsprints them (#2956) 356edf8659c9aa7d6— stopped: used 4193 MiB of memory, over its 4096 MiB limit; 1 pull check wait fo… (#3111) bcf01177e2742eef2— "a pull closed under a running agent > the run is cancelled, and its clone goes… (#3140) be95779906742eef2— "a pull closed under a running agent > the run is cancelled, and its clone goes… (#3 8882d53014742eef2— "a pull closed under a running agent > the run is cancelled, and its clone goes… (#3 0c546ce6b8sizessay what small, medium and large mean (#3218) 69e852e791scorecardreturn each agent's scorecard, all time and last 30 days (#3213) 588fb73f3d742eef2— "a pull closed under a running agent > the run is cancelled, and its clone goes… (#3547) e0b7c5e196742eef2— "a pull closed under a running agent > the run is cancelled, and its clone goes… (#3547);A site admin grants or revokes an app's private destinations on its settings page and through the A 244d4793eabranches: list, create and delete a branch, with the same rules as the branches page (#3656) c7a0211154labels: set an issue's or a pull's labels, with the same rules as the page (#3655) 7205709417review: approve a pull, or request changes with a reason, as the page does (#3657) 2b0fef45e6wait_for: make an issue wait for another, or stop waiting, with the same rules as the issue page (#3659) 0b637de023new_app: make an app from a sentence and get back its URL, its first issue and who is on it (#3677) 5462300926new_apptool's answer draws a ui://forge/app card: the app coming alive, its preview link and its agent (#3760) 5f3c3d632drun_log: read a run's log, or its last N lines, with the same rules as GET …/runs/{id}/log (#3806) 73d7469c00read_file: read a file or list a directory at a ref, with the same rules as GET …/contents (#3810) dadc1da201commits: list a branch's recent commits, with the same rules as GET …/commits (#3811) 5f852c69besearch: find issues, pulls, repositories and code with the same results as /search (#3812) 1387b4ddb0runs: list a repository's recent runs, with the same rules as GET …/runs (#3844) b1c72653c3issue: read one issue with its body, comments, labels and what it waits for (#3354) ac8f53f45dfeedtool's answer draws a ui://forge/feed card: the latest ten items, each a line and a link (#3363) d59444c5d2stat()in ui.ts and a.statsgrid, listed in DESIGN.md's component table (#3997) 6d94b7afde15ed15b— "GET /api/v1/boards/:slug/panels/:id > a panel not grouped by time ignores the … (#3934) 745b304f83pulls: list a repository's open pulls, briefly, with each one's check and review state (#4055) 70c9dc34cbbun installandbun x tsc --noEmit: bun gets a writable temp directory (#4151) 2405852bd0issuereads one issue's title, state, body, labels and assignee, behind the API's read check (#4157) f0a5dad3d4maptool's answer draws a ui://forge/map card: ready now, being worked on, waiting, by pillar (#4178) 62e1278d24close: close or reopen an issue with the same rules as PATCH …/issues/{number} (#4179) 4bad0c39c1issue: a sealed issue the caller may not see is not found, and a pull's number says to usepull(#4341) b483d0b519pick: true, and its answer says which agent the plan picked and why (#3735) 5f62c3ca33388aec8— "apps, runs and the crew on the web > the app strip says how long the first pre… (#4418) 96d6c96b3a.field, not.qf(#3911) e19d20b713afteris a 400 naming the three words" failed o… (#4480) db4b5c209cafteris a 400 naming the three words" failed o… (#4535) a5605c99bd44f9666— "GET /alice/vault/app/answers names its phases and answers under 50 ms" fails; … (#4573) 720d78758444f9666— "GET /alice/vault/app/answers names its phases and answers under 50 ms" fails; … (#4573) 1684eca03ctsc --noUnusedLocalsfinds nothing there (#4744) 05d93e01d7noUnusedLocalsis on in tsconfig.json and test/ is clean (#4774) 977514daf9app_env: list, set and unset an app's environment variables, with the same rules as the API (#4773) 4a94b50970app_env: list, set and unset an app's environment variables, with the same rules as the API (#4773);/explore's kind and sort segments draw §5's .bar, and no class="filters" remains in the markup (#4769);The t 960a50ff96.split, and.dashleaves the stylesheet (#4775) aae9cb76e2prompts: list, add, run and remove an app's prompt sources, with the same rules as the API (#4776) 027c135aa8secrets: list names, set and remove the forge's sealed secrets, never reading a value back (#4802) ea1aa032d4secrets: list names, set and remove the forge's sealed secrets, never reading a value back (#4802);.sys-pair leaves the stylesheet (#4654);A form error on the issue, pull and edit pages is §5's field error, not .error-note (#4807);A pull's /review row shows its check verdict and its preview li 0fe073abd9events:{ items, next_cursor }, bounded, with the reader's view kept (#4781) 12fd6fca0cevents:{ items, next_cursor }, bounded, with the reader's view kept (#4781);.front-controls, .app-shelf leave the stylesheet and docs/DESIGN.md §5d (#4672) cb7a13831dorigins: list the caller's connected origins and their repositories, and sync one, with the same rules as the API (#4828) 0b7da5ce49assigned: the issues and pulls assigned to the caller across every repository (#4829) 8a73ba8979origin_apps: list, add and remove the caller's origin OAuth apps, never reading a secret back (#4835) b687747f62{ items, next_cursor }(#4848) 5de841b8fa960a50f— "a deployed preview's findings are stored under its run, and the run still pass… (#4862) 0b0d200c1faccount_suspend: suspend or unsuspend a person's account, with the same rules as the API (#4884) f50f414ba9account_verify: an admin marks a person's email verified, with the same rules as the API (#4887) 30e321be35agent: create, rename and remove the caller's own agents, with the same rules as the API (#4914) 7512cd6856migratebrings a repository in by URL and, givenjob, reads that job's state and steps (#4389) fc402bf8acemail_verify: the caller asks for a new verification email, with the same limits as the API (#4864) 42a5aaaf90org_teams: create a team in an organization, add a member, and remove a team (#4967) 0cf5dc4c94threads: list a pull's review threads and resolve or reopen one (#4990) f597a45a16repo_settings: change a repository's description, website and visibility, with the same rules as the API (#5029) 527ab71281upstream: read and set the repository a fork follows, and check it now (#4918) 7c3627a000confirm_wait: a person says an issue may go ahead although what it waited for closed dropped or split (#5028) 84b1f438cf{ items, next_cursor }(#5052) e4e4082eeb{ items, next_cursor }(#5052);The OpenAPI document describes the forge's front reads: health, here, front, forge and contribute (#5049);MCP `confirm_wai 8eff2beb8b{ items, next_cursor }, and every test that reads it is updated (#5085) a5aa24a16ePOST /__forge/note/moderate(#5100) ed7bc946e1invites: list the outstanding invites and revoke one, besidemint_invite(#5124) 3085e38170{ items, next_cursor: null }(#5161) 74791bc3b9{ items, next_cursor: null }(#5164) 06c766c347brancheslists a repository's tags withkind: "tags", newest first, with no new tool (#5173) e3bb348dca.front-featuredand its parts leave the stylesheet: no page renders them (#5268) 66d71d7c42.bt-*rules leave the stylesheet: no page renders them (#5269) f897068625.tok-plainleaves the stylesheet: the highlighter never writes it (#5270) 220f9c595a.hexleaves the stylesheet: the settings colour value draws from base utilities (#5272) e44f3c0a3d.map-toolleaves the map's stylesheet: no control renders it (#5274) 2c0b69420bsystem,cloud_account,cloud_accounts(#5304) 0775513b80access,account_role,mint_invite,signup,whoami_can(#5294) 0f6af2845cfeed_chips,next_steps,returns,thought(#5303) 5257d6d98aplan: show the planner's wave and nod or redirect it (#5346) 65efa2737areports: list a repository's reports from outsiders, and accept or dismiss one (#5172) 3f053f48f7repo_labels: list, create and remove a repository's labels (#5030) 17d29f70f2{ items, next_cursor }(#5373) b7ee348169undocumentedentry that now has a row in docs/MCP.md, and the stale entries leave (#5408) d28c8f344fcommitswithoidanswers one commit: its message, files changed and its check (#5174) 35d1086bbfcontribute,family,follow_mode,forges,forge_proposals,propose_to_parent_forge,sever(#5296) 262f7862eeplan: show the planner's wave and nod or redirect it (#5347) cbd75efc3apullanswers with aui://forge/pullcard: title, state, checks, preview link (#5345) 3803951f55egress_grants: list, grant and revoke an app's private destinations, with the same rules as the page (#5659) 17bd31e964.qfleaves the stylesheet and docs/DESIGN.md §5d (#4739) e8d27c67b2.headroomrules leave src/web/style/content.ts and docs/DESIGN.md §5d, and no markup changes (#5711) 2d573538d7app_deploy: redeploy or stop an app's production or a preview, with the same rules as the API (#5709) 1361a86894subscription_budget: set or clear a subscription's whole-life budget, with the same rules as the Subscriptions page (#5454) 2998c98863mirror_set: set or forget the off-box mirror of snapshots, with the same rules as the Backups page (#5457) e8ba7d1dfftelemetry_grant: grant or take back an agent's telemetry:read, with the same rule as the Telemetry page (#5472) ceb8a9728btelemetry_grant: grant or take back an agent's telemetry:read, with the same rule as the Telemetry page (#5472);The Subscriptions page's refusal words live in one module both doors read, and the page is unchanged (#5471);A repository's home names its Server-Timing phases on both paths, the cod 4d54faa085boards,board_write,board_delete,board_pins(#5297) 1b8fc307a3parent_unlink: unlink the caller's account from its parent forge's sign-in, refused when it is the last way in, as Settings does (#5486) d862204dc1hooks: list, add and remove a repository's webhooks, with the same rules as the API (#5706) 1efb817115bun scripts/home-read.ts <url>prints a page as the eye reads it, with its characters, words and fetch time, so the #5735 cold read starts from the same text every time (#5781) 52db484820/alice/forge/mapleaves the sweep's UNNAMED list (#5785) 9e37b15290.subleaves the stylesheet (#4788) 9c2c675efassh_keys: list, add and remove the caller's own SSH keys, with the same rules as the API (#4814) e7748df845whoami_canwithkind: "passkeys"lists the caller's own passkeys, and tools/list grows by no new tool (#5757) c509e41796.bar, and.bformleaves the stylesheet (#5758) cf7dd3da09/answers under 300 ms warm on a forge with 200 repositories and 100 open asks, every phase named (#5811) 11ced3426fupstream: { repo, behind, checkedAt, conflict }for a fork, and MCPreposays the same (#5871) 8e98563dd5merged,closedorparked, as a badge beside its time (#5986) 0e39ca13e5owner:<name>in its one line, and each person row links "their apps" to it (#5993) 1c68922b3ebun scripts/home-eval.tsscores the owner's home against ground truth: which of the five facts that mattered the page states, and which it states wrong (#6006) 03d94e6276bun scripts/home-eval.tsscores the owner's home against ground truth: which of the five facts that mattered the page states, and which it states wr 273bf43c12.breakand.tok's nowrap are base.ts text utilities, and neither stays in content.ts (#4786) d663aea3b9preview: for a preview URL, the app, the pull it previews, its check state and its log link, as the forge pill shows (#5854) 93c610546eaccounts: list the forge's accounts with role, verified and suspended, for an admin (#4815) 4d99f0a7210c82bad5b896efa64eMon 20 Oct, in UTC (#6081) bd321a998f0c82bad— "the host holds cells > cells are available" fails; 2 pull checks wait for it t… (#6061) ecc6f26755ssh <app>@<forge> pullsprints the app's open pulls a viewer may see, newest first, with each head's check word (#6116) 454b8dd3adwordsunder 10 ms for a page of issues (#6135) 707c4bbc1bwordsunder 10 ms for a page of issues (#6135);The signed-out front page's shelf is read under 10 ms (#6133);A production deploy's app.serving event carries the release's version and pull titles, read by one tested function (#6102);/settin dad20e06a2ssh <forge> tell <words>tells the crew in one line from any shell, and prints where it went (#6120) 83fd5fb49a<version> is serving: <first pull> and N more, linking the release commit (#6162) 4f7127f1aa<version> is serving: <first pull> and N more, linking the release commit dc16714eaaflow,proposal_tokens,share,variant,report,attach_look(#5299) fc8f775d6d.numberleaves the stylesheet: an issue's number in a heading draws from base utilities (#5273) a98fdf4c42restore_drill: restore the newest snapshot as a drill and say its verdict, as the Backups page's button does, for a forge admin (#5433) 0696714044assign: set or clear an issue's or a pull's assignee, with the same rules as the API (#5356) c3787d0093drills: each failure domain, its last drill and verdict, and the command that runs it, for a forge admin (#5426) 13cdb24e1essh <forge> tellwhen the forge's SSH is on, and say nothing about it when it is off (#6171) cce056e12bSecureon every cookie the forge sets: the visitor cookie on an app host is Secure over https (#6117) 017fae508bvision: docs/VISION.md's order of work and the repository's current direction, in one answer (#5860) f9f555852essh <app>@<forge> tell <words>tells that app's crew, and the tell records the app as where it was said (#6172) a0474f6f61highlightunder 15 ms for a 100 KB commit (#6187) ec562430e0planphase is 165 ms today (#6185) 77153ecc0bnowandfollowingunder 5 ms each for trevato/forge (#6188) 98ecd5b9faasktoliveunder 50 ms for trevato/forge (#6186) c8ea0f1852lineageunder 5 ms (#6212) dce6dd6390lineageunder 5 ms (#6212);A map's ask-to-live medians come from one batched read:asktoliveunder 50 ms for trevato/forge (#6186);A repository-scoped token reads /api/v1/here, /api/v1/search and /api/v1/explore within its scope, instead 601798fe60601798f— "reviews, threads and the merge gate > require-review refuses the merge until t… (#6215) e2f462289fthought(#5910) 19b0258162exploreanswers with aui://forge/explorecard: the top ten rows, each with its numbers and a link (#5926) a10ad19438runsanswers with theui://forge/runcard, asnowdoes (#5747) 26a66c18aewrite_file: commit one file to an existing branch through commitToBranch, refusing in edit_words' sentences (#5752) 433dad046eorgs: the caller's organizations, and one organization with its teams and their members (#5742) b1fae71ba5telemetry_history: the machine's CPU, memory and disk over the last hours, besidesystem's now (#5726) 2d5f895faatelemetry_history: the machine's CPU, memory and disk over the last hours, besidesystem's now (#5726);MCPorgs: the caller's organizations, and one organization with its teams and their members (#5742);Sentinel: disk was degraded 1072 minutes today: Disk is nearly full: 9% free. (#6240);f b921860cd0wordsunder 5 ms for a page of issues (#6257) 0115381cadwordsunder 5 ms for a page of issues (#6257) 931899bbeeconflictedPullsof one database never reads another's (#6274) 5e956e08c5//path stays on the app (#6278) 84558b44fdherenames a person's or an organization's page, and an unknown name, instead of saying "forge" (#6281) 0d8a5a2d34herenames a person's or an organization's page, and an unknown name, instead of saying "forge" (#6281);A signed-out 404 offers Go home and Explore beside Sign in (#6279);A vision pull shows the direction it will write, and Settings marks which part follows the vision and which is the owner's (#62 b11e1490d5{ items, next_cursor }, and every test that reads it is updated (#5082) 5d5db6e531{ items, next_cursor }, and every test that reads it is updated (#5082);Design: the flags page's forms use the design system, and flag-form leaves §5d (#4413);A repository's forks pag 9bf35af7a2capacity,limits,quotas,sizes(#5302) a951665285app_domains: list, add, check and remove an app's domains, with the same rules as the API (#5708) 89c6baa5fa/__forge/crewhands a reader the app's other side, and a guest of a private app gets none (#6277) 1f41b01ef3931899b— "a private repository is linked only to who may read it" fails; 1 pull check wa… (#6284) bfccfa5f1f.filtersrules leave src/web/style/content.ts (#6301) 868544c283heremanifest names how to help: GET /api/v1/contribute and MCPcontribute, no account needed (#6416) f0c40e04f4.page-headmoves from §5d into the table, with the function that draws it (#4840) a7ed99de91.page-headmoves from §5d into the table, with th 5ad52f4268person: a person's public profile and the repositories the caller may see (#4826) 732cc0c59aprivate_fix: make the private repository a writer fixes a sealed report in, with the same rules as the API (#4993) 70a13a5c43subscription_wake: use a resting subscription again now, as the Subscriptions page's Wake button does, for a forge admin (#5445) bd8fbdfaf7/forge preview <url>and/forge pulls <app>: where am I, and what is open (#6107) a48ee296abwordsunder 5 ms for a page of pulls (#6170) ff02acccefFiles:line, when present, is the only list of files the hot-file hold reads (#6481) 7f5845db23publicOnlyhides a private repository (#6485) 96ff4b1331flowlabel, not only when it is on a hard-coded list (#6505) 8703d3331cnow(#6509) ff84516afe0.7.12 · 2026-10-20 · headline · 4 pulls(#6489) f0fbf5fe930.7.12 · 2026-10-20 · headline · 4 pulls(#6489);A test fails when a flow reading under src/flow/ reads the wall cl 8076f124c2profile: read and update the caller's own name, bio and links, with the same rules as the API (#4837) 34a8ec297cmodel_ceiling,model_grant,scorecard,teams,issue_teams(#5305) ddf13af4a4model_ceiling,model_grant,scorecard,teams,issue_teams(#5305);MCPprofile: read and update the caller's own n b83077d2efreleases: the forge's kept releases, which one is live and since when, for whoever may read /releases (#5388) 890725d3b5snapshot_now: take a snapshot now, as the Backups page's button does, for a forge admin (#5434) ddcfaf97bfbackups_destination: set or forget where snapshots go, with the same validation as the Backups page; a credential is written, never read back (#5449) c3300a8603subscription_add: put a Claude account in the crew's pool, its token write-only, with the same refusals as the Subscriptions page (#5484) d9525886d8passkey_remove: remove one of the caller's own passkeys, only with an admin-scope token, as Settings → Passkeys does (#5485) b689db4d2dtokens: list the caller's own API tokens, with name, scope and when last used, never the secret (#5488) 5122c72594trusted_hosts: read and replace the internal hosts an origin may live on, with the same rules as Settings → Origins (#5491) e8ced9a52e88e4bed— "reviews, threads and the merge gate > require-review refuses the merge until t… (#6650) 7dcd01426erestackleaves: the queue's stacked-prefix search already re-gates a red batch (#6661) 3fc685fdfbvisiblehides admin tools, andplansOnlylets a read-only token only read or plan (#6662) eae1ecd47etoSourceErrorfolds forbidden into unauthorized and anything unknown into unreachable (#6665) 55d076f3c0importLabelsandapplyLabelNamesmake each name once and attach exactly the remote set (#6668) 2b542d0c97under, and a test pinsmilestoneHrefandlimbHref(#6669) 7dfb5aecbeflag_set: set or clear a flag's live value, with the same checks as the Flags page (#5482) 5a354fe2cbsubscription_delete: remove a subscription and its grants, as the Subscriptions page does, for a forge admin (#5508) cfb220cfe6?state=failedlists only failed runs, under a row of state links (#6490) 272886542d.searchleaves the stylesheet (#6568) 6466898391bun scripts/fast.tsprints the test files the fast tier would run for the working tree's diff against main (#6580) 21e75fc746N archived, one tap to /apps?archived=1 (#6602) 3c8aff6396pull_mergedindex taken out (#6721) fed63db691isLocalPathand a form'sbackrefuse every off-origin form (#6630) 4f7e4d3494--, and90s/5m/2h/250ms(#6631) 732680f646owner/namerefuses empty segments:a//b,/a/banda/b/are not a repository (#6633) d2be8e07d3clip(text, max)that folds whitespace and cuts at a code point, never leaving a lone surrogate (#6634) b29fc28a35parseSeattakes onlytop:Nor<issue>:N, and moving a limb then restoring its old seat puts the group back (#6635) 3bf0d1787fissueanswers with aui://forge/issuecard: title, state, assignee, what it waits for (#6673) d14cc55193flowshow them (#6676) 561415b173bun test $(bun scripts/fast.ts)and the type check before pushing, not the whole suite (#6678) 13a7f1a5e5revertCommit: undoing a shipped commit keeps later changes, reports a real conflict, and refuses a merge commit with two parents (#6703) bf3f20bc65readConflictedFiles: diff3 markers from a real two-sided change, one merge for many paths, and nothing for a clean or missing path (#6704) 5b588577d2Stamped, the memo every cached page reads through: stamp change, max age and least-recently-used eviction (#6705) 090b56474dreviewStats: green crew pulls awaiting a verdict, the median wait for one, and verdicts per reviewer in the window (#6708) 824c4502b9mergeForCheck: the check runs on the merge with today's base, in the pull's own repository, and a conflict is said as the change's fault (#6720) 1bd60dbda7previewOf, the answer behind MCPpreview: a preview host names its pull, check and first failure, and anything else is refused plainly (#6727) 789296d136sincerespected, text exactly as kept (#6728) 33b2503ecfvalidCapacityandisCapacityKey: a capacity setting takes only what its kind allows (#6763) 32b453783cclaimUndoandreleaseUndo(#6765) d2bdcbfcbc.menu-itemis a named part of the menu, and leaves the §5d list of page-local classes (#6766) 3a6eb62306clip, so a failing test named with an emoji reads whole (#6764) 257f1dc802readImageandcleanNoteat their edges (#6770) 047902456dclip: a parked reason ending in an emoji keeps it whole (#6768) 30d5ba92f5readReturns' refusals: a bad window, no viewer, and a repository the viewer may not read are refused the same way a missing one is (#6772) c8e43d17acpathCrumbsandrefMenuencode refs and escape names (#6771) 1d86f74039drawRowslines up, drops and never shrinks belowmin(#6773) 65a4adf5bd.repo-descleaves the stylesheet (#6774) 727b08d541feedshow the same three digest lines as home (#6742) cd2161ced7navigationBranch, the release smoke's read of the service worker's navigate branch (#6754) bff3e222ab931899b— "a private repository is linked only to who may read it" fails; 3 pull checks w… (#6643) ef9a70f4da:opens the command palette, and a test proves the?help lists every key the page answers (#6780) 35ae825995parseRegistrationandparseAuthRequestrefuse every bad redirect (#6793) 5c6744c670parseDays, and an invite redeems once, never after it expires (#6794) c041def82bgetVerifiedDomain,primaryDomain,removeDomain(#6799) 500e450a64findPasskey,removePasskeyandnotePasskeyUsednever cross accounts (#6801) c6fa83ac40personOwners,isLastOwner,soleOwnedOrgs(#6800) 4b0ed5b7ccmayView,canSeeSealedandmayViewId(#6805) 41cd73b0baunburnFirstAdmingives back only a spent code (#6806) 538ad4f186getWebhookanddeleteWebhooknever reach another repository's hook (#6807) 9508fd0ec7spendRecoveryworks once and never after expiry (#6808) a5d02177a2bun scripts/flow-report.tsprints every flow read in one page, so each is reachable while its surface is built (#6682) 33e4f359ecupdated:7d(or 1d, 30d) in its one line, and a chip for each narrows to what moved in that window (#6814) bde626f1a7ssh <app>@<forge> pulls: a title cannot carry a terminal escape, and a refused viewer gets the terminal's own refusal (#6834) 2fffd071e9Archivedbadge, on the page and in MCPsearch(#6114) 7fb5677700nowunder 5 ms on the live forge: trevato/forge's home under 50 ms (#6231) ad30fdf14fadministergets a 403 before any admin handler runs (#6864) a29e4381a6{ items, next_cursor }, and MCPexploretakes the cursor (#6417) 58d1fb5910backups_test: check that the snapshot destination is reachable, as the Backups page's Test button does, for a forge admin (#6891) f0a6dbc31bquotasstops telling agents quotas are unenforced: each key says what it bounds (#6899) 623105f1c188e4bed— "reviews, threads and the merge gate > require-review refuses the merge until t… (#6936) 43b5cb9a84{ items, next_cursor }(#5230) 05030f0bdfsessionslists the caller's sign-ins (#6892) e5b2826a0fasks_decide,asks_undecideandasks_proposal(#6942) f882f7211dsessionsends one sign-in, so a lost device is signed out from anywhere (#6968) 0650e5c562mirror_now: bring the off-box mirror level now, as the Backups page's button does, for a forge admin (#6965) 0b0948a8f6mergeunder 20 ms for 130 open pulls (#6900) 25096a839bfeed_dismiss: dismiss or mute a feed item, as the card's menu does (#6967) d36a4a747dsync: sync a mirror now, or reconnect its origin, with the same rules as the API (#6994) 383293e9b6hooksandrepo_labelsshould page like the routes they mirror (#7001) 914ba72014notifyreads, sets or turns off the caller's phone notify URL, needing what the Settings page needs (#6959) 5537abdf68{ items, next_cursor }(#6972) 0ed05a54besubscriptions: the Claude accounts the crew works on and where each is used, never a token, for a forge admin (#6993) fa8fa562e7{ items, next_cursor }(#5229) 60b217fcccflags: every declared flag, why it exists, its default and its live value, for a forge admin (#6991) 72a25b2aadpins: list, pin and unpin the caller's pinned repositories, with the same rules as the API (#7012) 8e5deaab01heretakes an app URL and answers what its /__forge/ door shows: app, environment, pull, who is working, and the links home (#7011) fa674e3fc3agents: list the forge's agents the caller may see, with what each is for (#7046) 0fbe76f4fcorg_create: make an organization, with the same rules as POST /api/v1/orgs (#7047) 966997fdb7forks, in its own tool file: a repository's forks the caller may see, each with how far ahead and behind (#7050) 1eedfd4d01ppops,ddrops only after a confirm, and cancelling keeps the entry (#7079) f720c4fc05no_such_secret, and nothing else in that scope changes (#7108) 0c8a5d2caaboard_pins: with noopit lists the caller's home pins, and pinning matches the API (#7109) 240679fbc5limit(1–100, default 30) and anext_cursor, trevato/forge's first page under 40 KB (#7076) cd66af5cd2mapname what a builder can start now:startable, unassigned and unheld with nothing open in front (#7099) 247de9b394fromthat is not this forge's page or app address is refused (#7125) 1d8511e51bphoneordesktop, and only to a repository that is an app (#7127) 0023165cdagitunder 60 ms for a 30-branch page of trevato/forge (#7054) adcbbb8506feed_chips: switching a chip off hides it fromfeedandasks, and bad input changes nothing (#7072) c2b9bdee1edasks first, and cancelling keeps the file byte for byte (#7077) 638e547936board_write: a person admin saves a board, an agent and a non-admin are refused, and a bad board is not saved (#7082) 09db797165board_delete: a person admin removes a board, an unknown slug isnot_found, an agent is refused (#7107) 5ad9e753dessh_keys: list, add and remove only your own keys, anrwtoken to change, an unknown action refused (#7155) bd44288958signup: reading the mode is free, changing it plans first and needs an admin token, an unknown mode is refused (#7156) bbb6f439b5cloud_account: an unknown verb is refused, and every verb needs an admin with an admin-scope token (#7157) a2441f4fa5limits: an unknown key is refused, out-of-bounds values are refused, and""restores the default (#7158) a6ea611eb5snapshot_now: a forge with nowhere to keep a snapshot says so, and only an admin-scope admin may take one (#7162) 6cd5b1d5b4maplist open issues by default and count the done ones: trevato/forge's answer under 150 KB (#7163) 0abc77aff1steer: say a word to one running crew run by its id, as the run page does (#7165) 17ed266702app_deploy: a writer redeploys or stops an environment, anything else is refused (#7171) c95569d10cvariant: like or dislike only, a later vote replaces the earlier, and a dislike closes the pull with its reason (#7172) 154c5bcd65fork_failed, with no repository row or directory left behind (#7179) 70686d66d3asked:showandordertake only their known values, and a repository the caller cannot read lists nothing (#7180) 59448b483dpropose_to_parent_forgewhen the parent cannot be reached:parent_unreachable, and nothing is proposed (#7192) 9f678c7b7fteams: a person admin changes a team's charter, dial or members, planned first, and a malformed change is refused (#7194) 250d1327cc:0, and absent when SSH is off or the forge is hosted (#7207) 2d7f91600ftake_backopens the pull that undoes a shipped one, with the same rules as the page (#7221) 937e0f8d61rollback: a forge admin plans, then rolls the forge back to a kept release, with the releases page's rules (#7225) 08314249d7asks_acttakes back a mute:listenbrings a muted repository's asks back, as /asks/listen does (#7226) 3d2272513fxand a confirm, as the run page does (#7239) 10ba0b9370drefuses unmerged work,Dsays it will lose it, both ask first (#7078) 2fb8174b35sessionsdoes (#7246) b1c23a425essh_keysdoes (#7247) e1fff441b6wadds or removes a wait, as MCPwait_fordoes (#7248) d151a81ebdapp_deploydoes (#7250) 13e14e7b18merge: a person lands a pull from any MCP client, as the pull page's Merge button does (#7253) 6987cc172coturns it on or off after a plan, as MCPoutsidersdoes (#7263) 89207f9a1fapp_notes: an app's admin lists the notes sent from its forge button, hides one, bans or unbans its sender (#7273) 4afab6272dsand a confirm, as MCPaccount_suspenddoes (#7274) 75b60db094app_envdoes (#7277) b9b21cf8e4flowissues start builds, and assigning any other issue queues it (#6970) bb6af3779ew, as MCPwatchdoes (#7261) 97255017aesubscriptionsdoes (#7262) b155c9741bhand a reason, and lets it go withhagain, as MCPholddoes (#7264) f8ec782d38e, as the page does (#7266) ad8fa949b7visiondoes (#7279) 28850b4d11mirror_setdoes (#7281) 64ac8a0eecflagsanswers whatreadFlagsanswers, for a forge admin (#7285) 2adf588795signupdoes (#7292) e988bf1ccbhealthdoes (#7304) 7ff8945100enteron a run in the terminal opens its log, the last 200 lines, refreshing while it runs, as MCPrun_logdoes (#7306) be2c524a7caand a confirm, as the run page's requeue does (#7307) dd2f40fcb9commitswithoiddoes (#7310) 350eac2780followingdoes (#7311) 6109bb1d95s, and flips oldest/newest witho, as MCPaskeddoes (#7313) 9e9892ecbcvsends a new verification email, as MCPemail_verifydoes (#7314) fb8dc76882dand a confirm, as MCPrestore_drilldoes (#7315) 72b705fb78queue_gatesdoes (#7327) 00b095b166p: every door tried as nobody, a user and an admin, read-only, as MCPprobedoes (#7339) 9260e8fc38cand a confirm: a draft pull listing every pull merged since the last wave, as the waves page does (#7340) 40fb216e69Pnarrows the list to one pillar (#7342) bb1a1303fekind:orsort:words, with each row's numbers (#7356) e7df551c32read_filesays whether a JSON, YAML or TOML file parses, and the line and column where it breaks (#7359) 1831a34e60appstakesarchived: trueand lists the apps put away, as /apps?archived=1 does (#7363) 76354c0468forge asksprints what waits on you, most important first, one line each, as /api/v1/asks answers (#7381) 086698208dgand a confirm, as MCPtelemetry_grantdoes (#7361) 990496e2a6confirm_waitdoes (#7308) 88aafd311dreturnsdoes (#7283) b2e06c6d8d/, and Enter on a release lists every pull it carried (#7364) f8a398c913vand a confirm, as MCPaccount_verifydoes (#7328) dfe7610f2frunsandrun_log(#7395) 2e62cec244forge loginrefuses a plain http:// workbench that is not loopback, so a token never crosses the network in clear (#7397) 59d3afbe7epullsdraws a card in MCP Apps hosts: one row per pull with its check, each linked to its page (#7396) 67d82bf3a4subscription_headroom: set how much of each window the crew leaves for people, as the Subscriptions page does (#7405) 46f9cdd688forge syncgives git the token only for an https (or loopback) remote on the workbench's own host (#7408) 2d11ad21b3t, without going back to the palette (#7425) 57ee8eb419rreads the list again (#7420) b5018959cdflag_winner: make an A/B flag's winning variant the default, through makeWinnerDefault (#7411) e3fc2a270fapp_domainsdoes (#7421) f8781d5514waves: a repository's waves newest first, and one wave's headline, highlights and pulls (#7409) 6651997f66context.pageandfrom(#7417) b48e68b6bdRelieves: <path>is not held by that file being hot, one such build at a time per file (#7431) d1f52d14b2telemetry_historyreads them (#7343) b777405fadread_filedescribes an STL model in words: triangles, size in model units, ASCII or binary (#7362) 081b97fc2fread_filedescribes an MP4, MOV or M4A file in words: duration, and picture size for video (#7365) 832700ee67org_create(#7466) c0ece67422m, and add or remove one after a plan, as MCPapp_membersdoes (#7434) 60aca0fa5anand brings the mirror level withl, after a confirm, as MCPsnapshot_nowandmirror_nowdo (#7358) 24aff76d69askeddraws a card in MCP Apps hosts: what you asked the crew, its state and the pull that closes it (#7457) d53fbe0b93v: newest first, paged, as MCPeventsreads them (#7469) f0733771acm: working, ready now, waiting on what, and parked twice, as MCPmapreads it (#7481) 1c0139fb42visionanswers it, and Enter opens the direction issue (#7484) de824da356Relieves:starts while its file is hot: #7299, #7424 and #7429 are seen through, or the map says why not (#7496) 16f9cd956dtafter a confirm: fast-forward, clean merge, or the converge issue on a conflict, as MCPtake_updatesdoes (#7495) f7453c9a90hooksdoes (#7282) 0157dab769Y, planned first, as MCPmake_it_yoursdoes (#7305) c177ee1fdfs, as the run page's steer box and MCPsteerdo (#7309) 7318f6514en, duplicates one withcand deletes one withDand a confirm, as the /boards page does (#7355) cf42bf096asflips to its source (#7401) c3737f6527forge pullslists the open pulls of the folder's repository: number, title, author, check and preview address (#7406) 77e0908817backups_destinationdoes (#7278) 6e48d8c036forge ship <pull>lands a pull from your shell after a y/N, as the pull page's Merge button does (#7382) cc5e3bef9fdafter a confirm, never showing the token (#7454) 6f5d201684asked [app]says what you asked the crew and what became of each, through MCPasked(#7459) 9c1734adaenotifydoes (#7464) f0f4cac954limitsdoes (#7467) 0d67ee8a3frepo_labelsrenames or recolours a label withaction: "update", as the labels page does (#7502) e007aaef5fcrew: list a repository's crew, put an agent on it or take one off, planned first, as Settings › Crew does (#7503) 2c4ac4efaaflowstarts its run, that issue only, paid by whoever last assigned it (#7520) 56a28f4e36t: reached or not, in words, never a key, as MCPbackups_testdoes (#7398) 57f83b3d6aforgecommand with one example each, and a test fails whenforge helplists one it does not (#7410) 000e465b8dcapacitydoes (#7455) 664a56f0e4forge asks --ship/--close/--dismiss <n…>decides asks from the shell: planned first, applied after a y/N, as POST /api/v1/asks/bulk (#7456) 6463964ce2a(token typed masked) and removes one withDafter a confirm, as MCPsubscription_addandsubscription_deletedo (#7551) 26a0952c00i: the connected Instagram account, fetch now, connect or remove, as Settings › Prompts does (#7564) aee3c188f1app_domainsrefuses in the same sentence as the app's settings page and the terminal, notthe domain is refused: invalid_host(#7606) b83b9cf0efapp_deployrefuses in the deploys page's words, notrefused: <code>(#7607) 3268846d88steerrefuses in the run page's words, notrefused: <code>(#7610) 9b58c6317fkind:orsort:word is not one it knows, and names the ones it takes (#7612) 457f7b6a80template, records it, andGET /api/v1/forges/templates+ MCPtemplateslist what is offered (#7548) 31688d6bdccommitsdoes (#7528) cca8a9aac4crew.governedevent is said per change (#7529) fbdae31d9ffeed_dismissrefuse the same things through src/feed/interact.ts (#7530) 142c66b59athoughtanswers (#7547) d5454e0809new <name> <words>makes an app from the harness through MCPnew_app, after the person confirms (#7504) c25f1e7d80accaa65) into the dev UI stack a7136fef6dA build's Notes section is now one list, kept as notes.json on refs/forge/notes: { "notes": [ { iteration, by, kind, at, text } ] }, the format ui-iterator keeps beside a round. iteration is the pin label. Each note is appended in one commit by its author; a correction is a new note. notes.lock holds every note's fingerprint (sha1 over the five fields, first 12 hex), and an append refuses a notes.json that lost one (notes_lost). People's notes rank first and are highlighted, then agents' notes, then the tag's own note. Each note shows its first line as a title; the rest opens on a click. A writer adds a note in place with Add a note. An agent on the repository's crew may add one too, as kind agent under its own name. An older <label>.md notes file reads as one note by whoever last wrote it, and the next append folds every such file into notes.json. Deleting a pin keeps its notes. PATCH builds/:label and the web form now append; note and body still join into one note. When FORGE_NOTES_INTENT names a doc, a person's note is copied into it once, under "## Iterator notes", in ui-iterator's line format with its hidden fingerprint (core/intent_notes.ts). Agent notes are never copied. Also fixes the panel's Save: the Iterations page root carries data-edit, so a click on Save was taken for an Edit click and never submitted.