cat/forge

A file on the default branch shows its blame and history

2026-11-03T22:06:49-07:00

Each file page on the default branch gets a blame.json beside it: the commit that last changed each line, and the commits that changed the file, each with the review it landed in. The page draws them on demand, blame as a column before the line numbers, history as a panel. A build runs git blame only for files commits touched since the last one.

Approval rules by path, and agent reviews signed like CI

2026-11-03T22:06:49-07:00

.forge/approvals on the default branch says how many approvals a change to it needs, and from whom, by the files it touches; the rules are read from the branch before the change, so a review can't loosen its own. forge.requireapproval holds the gate to them, forge land checks the same verdict, and a live review's page opens with what landing needs. forge critique runs the reviewer the target branch names (.forge/review) over a review on your machine. Its findings become comments marked agent and blocking, and a statement of what it reviewed and what is still open is signed into refs/notes/review; later runs review only what changed and carry open findings until they are resolved. A rule's "+ agent" wants one of the tip's tree with nothing blocking open.

CI reports metrics, and a repo's insights charts them by commit

2026-11-03T21:22:29-07:00

.forge/ci writes "name number [unit]" lines to $FORGE_METRICS; forge attest signs them into the statement as metric lines. The lake keeps them in ci_metrics, and commits gains the tree, so a repo's insights page charts each metric on its default branch, a reworded commit keeping its values. A lake made before a column existed gets it when next opened to write.

code-search-range reads its results without node's warnings

2026-11-03T20:22:03-07:00

On node 26 sqlite-wasm's look at localStorage makes node print an ExperimentalWarning on stderr, which the scenario's log takes as its first line, so the check that the first result is many/zz.txt:1 failed though the search was right. The scenario's code-search-bench runs pass --no-warnings.

The activity grid fills its panel's width

2026-11-03T20:20:10-07:00

Cells were 13px at most and left in the panel, so on a wide page the 53 weeks took about 790px and left the rest empty. Now the cell is always the panel's width over 53 weeks, less the gaps, at least 10px: the grid spans the panel at any width, and narrower boxes shrink and then drop the oldest weeks as before. ui.njk's comment and DESIGN.md say so.

Insights says where its numbers come from once

2026-10-19T07:26:15-06:00

A repo's insights shows its activity grid as a chart, without the list

2026-10-19T07:19:42-06:00

The insights page had the activity grid and, under it, the latest events, with a picked day listing that day's. Now the grid is a chart like the others on the page: a figure panel whose head strip has its total and what it counts, and no list. ui.activity takes still, which makes each day a span named and titled with its count, with no tabindex, no aria-pressed and no hover or pointer in style.css; ui.ts repaints still grids from activity.json in the reader's days, and a click or a day's address picks nothing. The owner page's grid is as it was. activity.json now carries only each event's time, newest first, so repoActivity drops the kinds, texts, links and the title and subject subqueries, and lib/forge.ts drops recent. DESIGN.md and the style guide show the still grid. Scenario: the insights page has spans and no list, activity.json is days and times, and clicking a day or opening a day's address leaves the grid unpicked.

The demo's clock starts at midnight, so CI's render check holds all day

2026-10-19T07:19:42-06:00

BSD date -j -f %Y-%m-%d fills the hour it isn't given from the current time, so the demo started on 2026-09-01 at whatever time it was made and, about 35 clock hours later, finished on 09-02 or, made after about 12:40 UTC, on 09-03. The render check in .forge/ci renders at 2026-09-02, so after midday the insights pages' activity grids ended a day early there and differed from 11ty's, on main too. make-demo.sh starts at 2026-09-01 00:00:00 UTC and the check renders at 2026-09-02 00:00:00, both spelled out for BSD and GNU date; the demo now ends on 09-02 around 11:00, whenever it is made.

A scenario: a CI note's runner is never account@hostname

2026-10-19T01:42:59-06:00

whoami_at already gives the forge user and a made-up machine name (the hostname only seeds its hash), and no other path writes the hostname. This holds it: with the forge user named as the local account, the runner isn't that account at this hostname, and the hostname is nowhere in the note.

A restored identity.db from litestream is the git user's alone

2026-10-19T01:42:59-06:00

forge restore moved litestream's copy of identity.db into place with whatever mode litestream gave it; forge identity restore made it 600 first, and now identity_pick does too. Scenario: a stand-in litestream writes the file readable by anyone, and the restored one is 600.

The edge can send the mirror bucket a token

2026-10-19T01:42:59-06:00

With the Fly secret FORGE_MIRROR_TOKEN set, the edge sends it as X-Forge-Mirror-Token on each request for the offline copy, so a Cloudflare WAF rule in front of the bucket can later refuse requests without it. Without the secret the header is empty. Scenario: the bucket sees the token, and the reply doesn't carry it.

Offline, the edge never redirects to another site's address

2026-10-19T01:42:59-06:00

The edge's offline copy added a folder's slash with redir {path}/, so //evil.example/x answered 308 to //evil.example/x/, another site. A path that starts // or /\ (decoded) isn't redirected now; it is asked of the copy as it is and gets its 404. Caddy's path matchers see the path with its slashes merged, so the check reads {path} itself. Scenario: a folder still gets its slash, and //, /%5C and /%2F paths get no Location.

Insights exports give a build's reason as push or other

2026-10-19T01:42:59-06:00

builds.parquet carried each build's reason, and the reasons private and removed said when a repo went private or away. The exports now say push, or other for everything else; the lake keeps the real reason. lib/insights.ts and the README also say what happens to a repo's facts when it goes public again: they are published with it, from while it was private too, as its whole history is then. Scenario: the lake has private and removed, the exports only push and other.

A repo gone private or removed leaves the index before the mirror syncs, and a removed one leaves the lake

2026-10-19T01:42:59-06:00

ssh private and repo rm started the index and owner build in the background and then the mirror's sync within 30 seconds, while that build could still be waiting on build.lock, so the listing could linger in the offline copy. They build the index before returning now (rebuild_index), unless builds are off. repo rm deleted only the repo's exports, so its rows stayed in the lake and came back in the exports of a new repo under the same name: lib/lake.ts forget takes them out of every table, with the lake's note of where it read the repo's sources, under the lake's lock. Scenarios: the listing is gone when the command returns, and a reused name starts with no history.

Only owners with a public repo have a page

2026-10-19T01:42:59-06:00

Every directory under the forge's root got an owner page, and forge user add makes one for each new user, so // said who had an account. Owner pages are built only for owners with at least one public repo now, and a build of the index (or of one repo, or @owner) takes away the page of an owner who no longer has one, whose last repo went private or was removed. Scenario: no page for a user with no repos or only private ones, and one that goes when the last public repo does.

Event streams are capped, and the Node servers time out slow requests

2026-10-19T01:42:59-06:00

The events server took any number of open streams. Now at most FORGE_EVENTS_MAX (2,000) are open for people not signed in to a private repo's stream, and FORGE_EVENTS_PER_IP (16) from one address; past either it answers 503 with Retry-After. The private, events and pages servers give a request's headers 10 seconds and the whole request 30 to arrive (a response, such as the event stream, may run on). Caddy has no rate-limit module in the container's build, so per-address limits in Caddy are left for later. Scenario: the per-address and overall caps, and a closed stream freeing its place.

Invites check the code first, and count posts per address

2026-10-19T01:42:01-06:00

/login/invite/accept and forge user accept checked the key before the code, so anyone could ask whether a key had an account here ("that key is already on this forge"). The code is checked first now, on the web and in the shell, and without a live invite every post gets the same expired answer, whatever its key. The rate limit was one bucket for the whole forge that every post counted against, so junk posts could use up an invitee's turns: posts are counted per address now, 10 a minute, and only those with a live invite's code. Scenarios: a dead code answers the same for any key, and the per-address, live-only count.

Sign-in challenges keep nothing on the server, belong to one browser, and are rate limited

2026-10-19T01:42:01-06:00

/login/options kept challenges in a map of 1000 that dropped the oldest, so anyone could push out a sign-in in progress by asking for options in a loop. A challenge now carries its expiry and an HMAC (a key the server makes when it starts) over it, what it is for and the browser that asked, which gets a five-minute __Host-forge-challenge cookie with a random id; verify checks all of that and remembers used nonces until they expire. A challenge fetched by one client can't be completed by another. Each address may ask for options 20 times a minute (lib/limits.ts). The address is X-Forge-Client-IP, which Caddy sets from {client_ip}, replacing any a client sent; in the container Caddy trusts Fly-Client-IP from the loopback tunnel only. Scenarios: a flood of 1500 options requests doesn't break a sign-in, the per-address limit, the limit through Caddy despite a spoofed header, and a challenge refused from another browser.

The forge's own pages send HSTS, nosniff, a referrer policy and a CSP

2026-10-19T01:37:59-06:00

Caddy adds Strict-Transport-Security to every response on the forge's hostname, and to its pages (not /sites/ or /previews/, which are anyone's) X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin and a CSP of frame-ancestors 'self', base-uri 'none' and object-src 'none'. Each is set only if the response has none, so the sign-in and private pages keep their stricter ones. Nothing scripts, styles, fonts or wasm load is restricted.

go get's reply answers only for name paths, and loads nothing

2026-10-19T01:37:59-06:00

The ?go-get=1 reply echoed the owner and repo from the decoded path into an HTML page, so a link with markup in it reflected that markup on the forge's origin. The matcher now takes only name characters, so any other path falls through to the page it would get without go-get=1, and the reply says default-src 'none' and nosniff. Scenarios: hostile segments get the plain 404, and real module paths still get their go-import tag.

Front matter for people and repos, bauhaus avatars, and a grid of days

2026-10-19T00:32:43-06:00

An owner's page opens with who they are: an avatar drawn from their name (lib/avatar.ts, cat's bauhaus pattern generator cut down to a 3 by 3 grid in five new avatar tokens), their name, the bio and link they set with ssh profile, and their repos, sites and the month they joined. Then the repos they pinned, or their three most recently active, the shelf tabs, their activity grid and the list. The avatars replace the home page's letters. ssh profile prints what a page says; profile bio, link and pin set it, --clear clears one. Anyone sets their own; lib/profile.ts checks it (one line of 120 characters, one https:// link, up to three of their own public repos) and keeps it in .forge/profiles, which backups carry. A change rebuilds that page and the home page only (forge build @owner). A repo's code page opens with its name, what it is about, its topics (its shelf and its .forge/topics) and a column of facts: its site, latest release, main's CI, open reviews, the license (an SPDX id from the text, else a link to the file) and its languages by bytes in the default branch, without vendored, generated or lock files. The activity grid (ui.activity, lib/activity.ts, ui.ts) is a year of days, a button each, on an owner's page (commits on their public repos' default branches, following the picked tab) and a repo's insights (its pushes, landed reviews, releases, site deploys and CI results). Picking a day narrows the list under it; the address keeps it as # or #/. Cells are 13px at most, left in the panel; narrower, they shrink to 10px and then the oldest weeks go. forge lake now keeps the default branches' commits and exports each owner's commit times and each repo's events as activity.json, which the build puts in the page and beside it, and which the page fetches for fresher counts. With JS the days are the reader's, without they are UTC. A private repo counts on no public page. A shelf's list under its tabs no longer has a head strip saying the tab again; the tabs' counts follow the globe. DESIGN.md says so, and how people and the grid are shown.

The README follows AP style, and DESIGN.md says docs do

2026-10-19T00:23:08-06:00

No serial comma in a simple series, numbers per AP, long sentences split. DESIGN.md gains Words in docs: docs prose is AP style, interface chrome keeps the lowercase rules.

cat and fox are the people in the README and /design/

2026-10-19T00:22:51-06:00

The guide says what forge is; how it works moves to internals

2026-10-19T00:22:51-06:00

The guide is now what you can do, a command or two each: browse, reviews, CI, sites and releases, people, the cheat sheet, and what isn't there yet. The push walkthrough, identity files, ref rules, deploy and release internals, hosting and the server's own commands are on the internals page, updated for the private server. Prior art is in the README only. The guide's tokens match the forge's, and its tables and cheat sheet sit in panels.

The offline copy leaves out file pages, and syncs at most hourly

2026-10-19T00:07:18-06:00

A shelf's link followed on its own owner page opens that shelf

2026-10-18T23:30:04-06:00

An owner's "all" is one list of every repo, newest first

2026-10-18T23:23:26-06:00

Times in a column are compact and line up; times in a sentence say ago

2026-10-18T23:11:53-06:00

A dead invite's refusal in its panel

2026-10-18T22:50:09-06:00

With the steps in panels, a dead invite link left the "join forge" head strip with nothing under it and the refusal below the panel, which read as a broken box. The refusal now takes the form's place in the panel.

/login/'s steps in panels, named "forge" in lowercase

2026-10-18T22:42:15-06:00

The sign-in page's headings were sentence case and named the domain: "Join src.rest", "Add a passkey", then "You are fox on src.rest" and "For fox on src.rest" under it. Now each step is a ui.panel whose head strip names it in lowercase chrome, with the forge's name: sign in, join forge, add a passkey for fox, signed in as fox. The passkey step says who it is for once, in its head strip. ssh commands on the page still show the real host, to copy.