Merge remote-tracking branch 'origin/main' into feat-dev-server-hmr-17194680974801638956

# Conflicts:
#	cli/src/commands/dev.rs
#	foundry/client/src/migrate/analyzer.rs
#	runtime/Cargo.toml
#	runtime/src/dev/dev_server.rs
#	runtime/src/dev/hot_reload.rs

Co-authored-by: Theaxiom <57013+Theaxiom@users.noreply.github.com>

Author: Copilot

.github/workflows/security.yml

@@ -23,7 +23,13 @@ jobs:
           # sqlx's proc-macro crate pulls unconditionally regardless of features.
           # Forge never performs RSA operations; rsa is never invoked at runtime.
           # Revisit when sqlx gates sqlx-mysql behind a feature flag.
-          ignore: RUSTSEC-2023-0071
+          #
+          # RUSTSEC-2026-0097: rand unsoundness via custom logger + rand::rng().
+          # No patched version exists for rand 0.8.x or 0.9.x. rand is a purely
+          # transitive dependency; Forge defines no custom logger that accesses
+          # rand::rng(), so the unsoundness preconditions are not met.
+          # Remove when a patched rand version is released.
+          ignore: RUSTSEC-2023-0071,RUSTSEC-2026-0097
 
   codeql:
     name: CodeQL

.gitignore

@@ -41,3 +41,4 @@ rust_guardian.*
 # Test artifacts
 *.profraw
 lcov.info
+update_analyzer.sh

Cargo.lock

@@ -44,7 +44,7 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 
 # CLI
-clap = { version = "4", features = ["derive", "cargo", "color", "unicode"] }
+clap = { version = "4", features = ["derive", "cargo", "color", "unicode", "env"] }
 
 # Cryptography
 sha2 = "0.10"

Cargo.toml

@@ -26,3 +26,4 @@ anyhow = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 camino = { workspace = true }
+notify.workspace = true

cli/Cargo.toml

@@ -1,7 +1,8 @@
 //! `forge build` — Compile the project for deployment targets.
 
-use anyhow::Result;
+use anyhow::{Context, Result};
 use clap::Args;
+use std::env;
 
 #[derive(Debug, Args)]
 pub struct BuildArgs {
@@ -13,7 +14,56 @@ pub struct BuildArgs {
     pub minify: bool,
 }
 
-pub async fn run(_args: BuildArgs) -> Result<()> {
-    // TODO: Delegate to forge-compiler
+pub async fn run(args: BuildArgs) -> Result<()> {
+    let current_dir = camino::Utf8PathBuf::try_from(env::current_dir()?)?;
+    let manifest_path = current_dir.join("forge.toml");
+
+    crate::output::info(&format!("Reading manifest at {}", manifest_path));
+
+    let manifest = forge_compiler::parser::forge_toml::parse_forge_toml(&manifest_path)
+        .context("Failed to read or parse forge.toml")?;
+
+    let targets_to_build: Vec<_> = if let Some(target_name) = &args.target {
+        manifest
+            .target
+            .into_iter()
+            .filter(|t| t.name == *target_name)
+            .collect()
+    } else {
+        manifest.target
+    };
+
+    if targets_to_build.is_empty() {
+        crate::output::warn("No targets found to build.");
+        return Ok(());
+    }
+
+    for target in targets_to_build {
+        crate::output::info(&format!("Building target '{}'", target.name));
+
+        let options = forge_compiler::CompileOptions {
+            target: target.target_type.clone(),
+            source_maps: manifest.build.source_maps.unwrap_or(true),
+            minify: args.minify,
+            project_root: current_dir.clone(),
+        };
+
+        match forge_compiler::compile(options) {
+            Ok(output) => {
+                crate::output::success(&format!(
+                    "Successfully built target '{}' ({} assets)",
+                    target.name,
+                    output.assets.len() + 1
+                ));
+            }
+            Err(e) => {
+                crate::output::error(&format!("Failed to build target '{}': {}", target.name, e));
+                return Err(e.into());
+            }
+        }
+    }
+
+    crate::output::success("Build completed successfully");
+
     Ok(())
 }

cli/src/commands/build.rs

@@ -9,7 +9,21 @@ pub struct InitArgs {
     pub directory: Option<camino::Utf8PathBuf>,
 }
 
-pub async fn run(_args: InitArgs) -> Result<()> {
-    // TODO: Add forge.toml to existing project
+pub async fn run(args: InitArgs) -> Result<()> {
+    use forge_shared::init::{init_project, InitOptions};
+
+    let dir = args
+        .directory
+        .unwrap_or_else(|| camino::Utf8PathBuf::from("."));
+
+    let options = InitOptions { target_dir: dir };
+
+    let (initialized_dir, name) = init_project(options)?;
+
+    crate::output::success(&format!(
+        "Initialized Forge project '{}' in {}",
+        name, initialized_dir
+    ));
+
     Ok(())
 }

cli/src/commands/init.rs

@@ -12,7 +12,7 @@ pub struct InstallArgs {
     pub dev: bool,
 }
 
-pub async fn run(_args: InstallArgs) -> Result<()> {
-    // TODO: Delegate to foundry-client resolver
+pub async fn run(args: InstallArgs) -> Result<()> {
+    foundry_client::resolver::install_packages(args.packages, args.dev).await?;
     Ok(())
 }

cli/src/commands/install.rs

@@ -13,8 +13,10 @@
 //! - Database adapter (SQLite default, PostgreSQL)
 //! - Authentication (email+password, passkey, OAuth)
 
-use anyhow::Result;
+use anyhow::{Context, Result};
 use clap::Args;
+use std::fs;
+use std::path::PathBuf;
 
 #[derive(Debug, Args)]
 pub struct NewArgs {
@@ -27,7 +29,71 @@ pub struct NewArgs {
 
 pub async fn run(args: NewArgs) -> Result<()> {
     crate::output::info(&format!("Creating new Forge project: {}", args.name));
-    // TODO: Implement project scaffolding
+
+    let base_path = PathBuf::from(&args.name);
+
+    // Create directory structure
+    fs::create_dir_all(base_path.join("app").join("pages"))
+        .with_context(|| format!("Failed to create project directories in {}", args.name))?;
+
+    // Write forge.toml
+    let forge_toml_content = format!(
+        r#"[project]
+name = "{}"
+version = "0.1.0"
+
+[build]
+entry = "app/root.fx"
+output = ".forge/dist"
+"#,
+        args.name
+    );
+    fs::write(base_path.join("forge.toml"), forge_toml_content)?;
+
+    // Write app/root.fx
+    let root_fx_content = r#"export default function Root({ children }) {
+  return (
+    <html>
+      <head>
+        <title>New Forge App</title>
+      </head>
+      <body>
+        {children}
+      </body>
+    </html>
+  );
+}
+"#;
+    fs::write(base_path.join("app").join("root.fx"), root_fx_content)?;
+
+    // Write app/routes.fx
+    let routes_fx_content = r#"import Home from './pages/Home.fx';
+
+export default [
+  { path: '/', component: Home },
+];
+"#;
+    fs::write(base_path.join("app").join("routes.fx"), routes_fx_content)?;
+
+    // Write app/pages/Home.fx
+    let home_fx_content = r#"export default function Home() {
+  return <h1>Welcome to Forge!</h1>;
+}
+"#;
+    fs::write(
+        base_path.join("app").join("pages").join("Home.fx"),
+        home_fx_content,
+    )?;
+
+    // Write schema.fx
+    fs::write(base_path.join("schema.fx"), "// Empty database schema\n")?;
+
+    // Write foundry.lock
+    fs::write(
+        base_path.join("foundry.lock"),
+        "# foundry.lock — generated by forge, do not edit manually\n",
+    )?;
+
     crate::output::success(&format!(
         "Created {} — run `cd {} && forge dev` to start",
         args.name, args.name

cli/src/commands/new.rs

@@ -1,5 +1,6 @@
 //! `forge publish` — Publish a package to the Foundry registry.
 
+use crate::config::CliConfig;
 use anyhow::Result;
 use clap::Args;
 
@@ -10,7 +11,20 @@ pub struct PublishArgs {
     pub dry_run: bool,
 }
 
-pub async fn run(_args: PublishArgs) -> Result<()> {
-    // TODO: Delegate to foundry-client publish
+pub async fn run(args: PublishArgs) -> Result<()> {
+    let config = CliConfig::load();
+    let registry_url = config
+        .registry_url
+        .unwrap_or_else(|| "https://registry.forgejs.com".to_string());
+
+    let options = foundry_client::publish::PublishOptions {
+        dir: camino::Utf8PathBuf::from("."),
+        dry_run: args.dry_run,
+        registry_url,
+        auth_token: config.auth_token,
+    };
+
+    foundry_client::publish::publish_package(options).await?;
+
     Ok(())
 }