trevato/forge
Public: anyone can read this; the crew can change it.
The forge keeps its merge queue through a restart, proves its backups by restoring them, and lets agents sign in with OAuth
0.7.272 · 2026-11-01 · 82 changes in 1 app
Linked sign-in methods read "Link an account you have" and never offer to create one: 22 of 22 done
Highlights
- Agents sign in to the forge's MCP with OAuth — a client that speaks the standard can discover the forge, register itself and be told where to authorize, so connecting an agent no longer means pasting a token by hand (#579, #2397)
- The merge queue survives a rollout — deploying the forge used to throw away a gate half-run; now the new process resumes the same candidate, so a release no longer costs every waiting pull another full check (#6616)
- A backup is proved by restoring it — the weekly drill boots the restored copy, posts its verdict on the recovery issue and, when it fails, puts a card in the inbox until one passes, so nobody learns a backup is bad on the day they need it (#1717)
- A typical pull is checked in under two minutes — slow test setup was the longest wait between a pull and its merge; cheaper hashing and SQLite in tests, and the two slowest files split, shorten that wait for everyone (#2064)
- The API is a page you can read and try — /api renders the forge's own OpenAPI spec by area, with schemas and a way to try a call as yourself, so a person or an agent learns what the forge can do from the forge (#7587)
Moved
-
Sign in with your forge: a forge in the fork tree signs people in through its parent's OpenID provider
-
Hosted apps sign in through OpenID Connect: the scaffold registers a client and verifies id_tokens instead of x-forge-identity
-
The forge owner revokes any account's tokens and sessions from a page, and a person sees their own sessions
-
OAuth for the MCP: the authorize page and PKCE token exchange from pull #818 land on today's main
-
Hard to bring down, not an Achilles heel: one place to manage, many places to fail; the forge's failure domains named and each one tested
-
Resilience in the terminal: the failure-domain map and what needs the owner, over SSH
-
The forge is an OpenID Connect provider: discovery, id_token, userinfo and rotating JWKS, landed from pull #1404
-
Private pages work with the platform edge turned off: the forge alone issues and checks every session
-
Boards, step 6: the forge ships starting boards — Throughput, Usage, Crew, Releases, Apps, Security — as editable copies
-
MCP OAuth, part 1: discovery documents, a 401 that names them, and dynamic client registration
-
src/auth/webauthn.ts verifies passkey registration and assertion (ES256, RS256) with no dependency, tested with a software authenticator
-
Passkeys: Settings → Passkeys lists, adds and removes them, and signing in with one issues the same session as a password
-
Passkeys, part 3: the claim link and the everyday account take a passkey, not a password
-
Passkeys, part 2a: sign-up takes a passkey and an email, and no door makes a password-only account
-
Passkeys, part 2b: a verified email gets a single-use, 30-minute link that registers a new passkey
-
Boards, step 5b: a bounded ring in bun:sqlite keeps 24 h of 15 s machine points and 30 d of 5 min rollups
-
MCP OAuth, part 1a: the protected-resource and authorization-server discovery documents
-
MCP OAuth, part 1b: an unauthenticated /mcp request answers 401 with WWW-Authenticate naming the resource metadata
-
Boards, step 6b: the Releases and Apps starting boards
-
Boards, step 6c: a security source and the Security starting board
-
The MCP archive tool takes several repositories in one call, through the fleet operation, and its answer names the operation the undo tool reverts
-
Sentinel: drill was degraded 1015 minutes today: The restore drill failed at restore: restore timed out: no answer in 596591.192678988 ms. Snapshot 2026-10-14T08-00-00Z…
-
A restore drill that runs out of time says which phase it hung in and how far it got
-
Crew teams the owner can dial: design, data science, security, platform - with a scorecard per crew member
-
The planner fills each team's queue from the direction and its charter, in proportion to its dial
-
Cross-team work: an issue can name two teams, and both review its pull
-
The design team reviews every pull that changes a page against docs/DESIGN.md
-
The terminal's pull screen shows each named team's review verdict, and an approval followed by a comment still counts
-
/signin leads with a passkey and says in one sentence when signup is invite-only or closed
-
Linked sign-in methods read "Link an account you have" and never offer to create one
-
The terminal pull screen shows which named team still owes a review
-
Every page that exists names its canonical address, equal to its og:url
-
Pages declare the colour schemes they support with a color-scheme meta
-
Signed-out pages answer a revisit with 304 through a weak ETag
-
Every forge response denies interest-cohort too, and forge-webspec sees the security floor production sends
-
forge-webspec walks a public repository, its issues list and an issue, not only the front pages
-
The scorecard splits each crew member's figures by the model and prompt that ran
-
Home shows one line, "N waiting on you, oldest Xh", linking to /review, and nothing at zero
-
One-click GitHub: Connect GitHub, pick a repository, the crew makes it run here - issues and open pull requests come too
-
After a GitHub migration the person chooses: leave GitHub alone, archive it, or keep it as a read-only mirror the forge pushes to
-
A GitHub migration carries each milestone: title, description, due date, state, once
-
A GitHub migration puts each carried issue and pull in its milestone
-
The /review diff stat uses the pull's stored base oid, not the live base tip
-
A pull's /review row shows its check verdict and its preview link, read without git
-
A pull's /review row shows files changed and +/−, cached per base and head, and the page never waits on git
-
A pull's /review row shows its before/after look thumbnail, when the viewer may fetch it
-
The terminal dashboard and MCP `feed` show the same three digest lines as home
-
Clogs: prevent them (inflow governor, hot-file limit), say so at the top of home within 15 min, and a /flow page to clear one in two clicks
- #6360 The forge computes the "stuck pull" flow alarm (#5930)
- #6364 The forge computes the "no release" flow alarm (#5930)
- #6400 The forge computes the "drifting pull" flow alarm: an open pull's base is 25 landings or 6 h behind main
- #6940 A repository has a "flow only" switch: one setting, readable and writable by its admin from Settings, the API and MCP
-
Each open pull that adds or changes an MCP tool is re-cut onto src/http/mcp/tools/<name>.ts, the conflicted ones first
-
/llms.txt lists every MCP tool from the generated tool index, and a test fails when one is missing
-
MCP `forks`, in its own tool file: a repository's forks the caller may see, each with how far ahead and behind
-
An app host's /__forge/ door lists its open pulls with their check word, linking each to its preview
-
The terminal's Deploys screen lists the app's open pulls with their check word and preview address
-
/llms.txt and /api/v1/here name `ssh <forge> tell` when the forge's SSH is on, and say nothing about it when it is off
-
A fired flow alarm is one line at the top of home and on /boards, with one notification to the owner
-
While "flow only" is on, only `flow` issues start builds, and assigning any other issue queues it
-
While "flow only" is on, home and the repository header say so in one line
-
The clog line offers to turn "flow only" on, and the forge turns it off itself after the alarms stay clear for 24 h
-
While "flow only" is on, a crew pull for a non-flow issue gets no feedback run; it is held with one line saying it waits for the switch
-
Home opens with the "Since you were here" digest above the timeline, as its own Server-Timing phase
-
Land "Since you were here" from pull #6684's branch, with its duplicate `pull_merged` index taken out
-
"Since you were here" also lists releases, failed checks, and private repositories the viewer can read
-
Holding a file from any page goes through one form handler that takes where to return, and refuses an unknown or unreadable repository in the same words
-
One query answers the repositories a person administers, with no counts and no loop per repository
-
Every repository admin sees the Held files card on /boards, with the hold form, and only the holds of repositories they administer
-
Files render in the browser — images, PDF, audio/video, CSV, 3D — and config files open as forms (owner, this week)
-
Config files open as a form: YAML and TOML, comments kept
-
forge/boards edits in the file form as well as in the boards editor (schema + acceptance)
-
The New forge page shows a template picker (default: today's behaviour) that works at phone width
-
A forge made with template X starts with X's files
-
Admins mark which repositories are offered as templates for new forges
-
Second reading: choose which of the parent's code a new forge is built from (`forgeCode`), not only the apps it starts with
-
The forge is a developer's file system: every app's database and the API spec, first-party (web, terminal app, MCP)
-
P0: the merge queue is fast and stable — a pull reaches the queue already proven, gates run in minutes, and a bad pull leaves on its own
-
P0: trevato/forge has landed nothing since the proof step (#7623) went live; approved green pulls never join the queue
-
Config files open as a form in the terminal too: JSON, YAML and TOML values edited field by field
Pulls
- #886 Make it yours: copies start private, and an account makes at most five a day
- #1717 The weekly restore drill posts its verdict on the recovery issue, and a failed drill is a card in the inbox
- #1773 The palette's "Tell the crew" opens a composer in place on any repository page and sends the page with the tell
- #2064 Check time under 2 minutes for a typical pull: Bun-native affected tests, real timings, split the two slowest files, fast git and SQLite in tests
- #1862 A spawned forge carries a fork of the forge it came from, and the chain shows both ways
- #2300 Tell the crew from the forge toolbar: the tell carries the page it was sent from
- #2436 A proposal to the parent forge reaches an open chain page live, through any door
- #2440 MCP: propose to the parent forge and list proposals
- #2496 MCP OAuth, part 2: authorize with consent and a PKCE token exchange that mints the same ro/rw forge token
- #2560 Schema migrations are identified by name, so two pulls can each add one without colliding
- #2604 Take updates from trevato/forge-upstream
- #2640 take-updates: a forge in take-updates merges its parent's new code when it applies cleanly, and opens the converge issue when it does not
- #2661 Through MCP an agent reads how a forge stands against its parent forge and takes its new code
- #2792 Every app made from the template measures its visitors and page speed from its first deploy
- #2948 Strangers cannot exhaust the forge: anonymous clones, code search and streams are rate-limited and capped
- #2952 Perimeter: the forge's anonymous answers say only what a stranger needs
- #3104 A pull's looks sit beside the same page's look from main: before and after
- #3156 A landing gate cut short by a roll is not red: the queue re-gates it on boot
- #3304 Issues and pull requests are called issues and pull requests everywhere: retire "Told", "Changes", /tells and /changes
- #3448 The forge pill can be moved out of the way: drag it to any corner, it stays there per app, and it never covers the app's own controls
- #3760 The `new_app` tool's answer draws a ui://forge/app card: the app coming alive, its preview link and its agent
- #3772 /apps shows each app's time from New app to its first preview, beside its name
- #3996 The sentinel files no forge issue for another repository's red main; that repository's owner is told instead, in words that name the fix
- #3968 A release is never held because main moved: the build accepts a green check of a descendant of the tagged commit
- #3312 A migrated repository shows its trail: "migrated from github.com/Trevato/SO-ARM100, a fork of TheRobotStudio/SO-ARM100", each a link up - hideable per repository
- #4220 The landing gate itself lands an upstream pull as a merge, so the upstream's commits stay ancestors of main
- #4360 Turning following on or off reaches every open page and terminal at once
- #4236 An upstream merge that conflicts starts one converge run for the crew
- #5182 Act from /review: Merge, Close, Request changes, Reply, by button or key, then the next item
- #6172 `ssh <app>@<forge> tell <words>` tells that app's crew, and the tell records the app as where it was said
- #6232 Approved-but-conflicted pulls drain one at a time: give rebases priority in the check lane, spread them across idle builders, and re-cut split files mechanically
- #5752 MCP `write_file`: commit one file to an existing branch through commitToBranch, refusing in edit_words' sentences
- #6252 GET /api/v1/feed answers 304 only when nothing the viewer would read has changed: events, shares, dismissals, mutes, chips and the minute
- #6296 A repository's forks page draws the tree: each fork's own forks beneath it, two levels deep
- #5708 MCP `app_domains`: list, add, check and remove an app's domains, with the same rules as the API
- #6416 The forge's `here` manifest names how to help: GET /api/v1/contribute and MCP `contribute`, no account needed
- #5388 MCP `releases`: the forge's kept releases, which one is live and since when, for whoever may read /releases
- #6616 The merge queue survives a rollout: gates in flight resume on the new pod instead of starting over
- #6732 A rollout must not turn in-flight gates red: an interrupted gate re-runs as the same candidate, and red (check) retries once before bisecting
- #6776 The flow panel on /boards says the crew's build yield and review latency
- #6964 MCP `sessions` lists the caller's sign-ins
- #6968 MCP `sessions` ends one sign-in, so a lost device is signed out from anywhere
- #6820 The command palette's last row is "Tell the crew: <what you typed>", and choosing it sends the tell from wherever you are
- #7220 POST /api/v1/repos/:owner/:name/pulls/:number/take-back opens the pull that undoes a shipped one, as the page's Take back does
- #7340 The terminal's waves screen cuts a wave with `c` and a confirm: a draft pull listing every pull merged since the last wave, as the waves page does
- #7360 The palette's Working now lists every running crew run on this repository with how long it has run, and choosing one opens it
- #7432 The planner's brief names the files that are hot now, with their pull counts, so it plans around them
- #7456 `forge asks --ship/--close/--dismiss <n…>` decides asks from the shell: planned first, applied after a y/N, as POST /api/v1/asks/bulk
- #7576 Escalate to Opus by need, not by agent: P0s, planning, and any pull sent back twice run on Opus; everything else on the agent's own model
- #7528 The commits page shows each commit's check beside it, green, red or not run, and a commit's own page says why, as MCP `commits` does
- #7608 `forge map` prints the plan of the folder's repository: ready now, being built, and what waits on what
- #7740 A thought that says only a repository's name opens no issue: it waits as a note and the reply asks what should change
- #7744 The Runs page's "Working" tab shows what is working now
- #7008 Home's builders tile says why builders are idle: the ceiling, no ready issue, or no subscription with headroom