🔒 Context Forge v4.0.1 — Security audit cleanup (0 vulnerabilities)

Same-day patch on top of v4.0.0. `npm install context-forge@4.0.0 && npm audit` reported 15 vulnerabilities. All 15 are now resolved, and `npm audit` reports clean for both the full tree and `--omit=dev`.

What changed

Before	After
`@anthropic-ai/claude-code` in `dependencies` (11 high-severity CLI-surface CVEs flagged)	Moved to optional `peerDependencies` — no longer bundled. Resolves all 11 in one move.
Static `import { query } from '@anthropic-ai/claude-code'`	Lazy `require()` with runtime guards. Graceful degradation if missing or replaced by claude-code 2.x (CLI-only).
`npm audit` shows 1 critical + 6 high + 4 moderate + 4 low	`npm audit` reports 0 vulnerabilities.

Critical fix: handlebars 4.7.8 → patched

Eight GHSAs against handlebars 4.x — prototype pollution, JS injection via AST type confusion, DoS via malformed decorators, etc. — were the critical entry. Patched via `npm audit fix` (non-breaking).

Other patched transitive deps: `glob`, `minimatch`, `picomatch`, `brace-expansion`, `flatted`, `ajv`, `uuid`, `@isaacs/brace-expansion`, `@eslint/plugin-kit`.

AI features still work

If you already have `@anthropic-ai/claude-code` installed (most context-forge users do — it's Claude Code), `context-forge init --ai-prp` runs exactly as before. The library is loaded dynamically and detected at runtime.

If you don't have it, AI features degrade gracefully to deterministic-template fallbacks (you'll see a warning) and `init` continues without crashing.

Upgrade

```bash
npm install -g context-forge@4.0.1
```

If you use AI features:

```bash
npm install -g @anthropic-ai/claude-code@^1.0.128
```

(Use 1.x because the 2.x branch is CLI-only and removed the programmatic `query()` API context-forge uses. Migrating to direct `@anthropic-ai/sdk` `messages.create` calls is scheduled for v4.1.0 W11 — once that lands, you can upgrade to claude-code 2.x without losing AI features.)

Verification

• `npm audit` → 0 vulnerabilities (full + `--omit=dev`)
• `tsc --noEmit` (main + TUI projects): clean
• `npm run lint`: 0 errors
• `npm run build`: clean
• Integration smoke: 8/8 expected files emitted

🤖 Generated with Claude Code

🛠️ Context Forge v4.0.0 — Claude-current refresh

The first major refresh in nine months. Context Forge now generates everything a modern (May 2026) Claude Code project expects — and the init wizard is a full-screen Ink TUI.

Headlines

Area	What ships
.claude/settings.json generator	One canonical settings.json wiring hooks (all 8 lifecycle events), mcpServers, statusLine, outputStyles, and permissions.allow / permissions.deny. $schema points at JSON SchemaStore.
Sub-agents generator	.claude/agents/<name>.md files with frontmatter (name, description, tools, model). Five defaults: code-reviewer, test-runner, plan-architect, security-auditor, prp-executor.
Skills generator	.claude/skills/<name>/SKILL.md with project-specific procedures. Three defaults; auto-derives test framework, language, and deploy target from your stack.
Slash commands as real .md files	21 commands across 6 subdirs (PRPs/, orchestration/, checkpoints/, quality/, session/, migration/), each with allowed-tools, argument-hint, description, model frontmatter.
Modern hook lifecycle	All 8 events (PreToolUse, PostToolUse, SessionStart, UserPromptSubmit, PreCompact, Stop, SubagentStop, Notification) wired through settings.json. 14 bash + 4 Python scripts, all chmod 0o755 automatically via the new `GeneratedFile.mode` field.
Ink TUI wizard for `init`	10 keyboard-driven screens. ESC = back, Enter = advance, Ctrl-C = clean exit. `--no-tui` falls back to the legacy inquirer flow for CI and non-TTY.
2026 model lineup	Zero `claude-3-*` IDs remain in `src/`. Key validation uses Haiku 4.5; default planning is Opus 4.7; balanced default is Sonnet 4.6. SDK pinned to `@anthropic-ai/sdk ^0.94.0`.

Install

```bash
npm install -g context-forge
context-forge init
```

Also in this release: v3.3.0 (SDK + model bump)

If you want only the SDK + model refresh as a drop-in patch (no new generators, no TUI), all of those changes are part of v4.0.0 too — see the `v3.3.0` section of `CHANGELOG.md` for the precise file-level changes:

• `@anthropic-ai/sdk` `^0.56.0` → `^0.94.0`
• `@anthropic-ai/claude-code` `^1.0.51` → `^1.0.128` (intentional hold-back from 2.x while we plan the v4.1.0 migration to direct `@anthropic-ai/sdk` calls — 2.x removed the programmatic `query()` export that `AIIntelligenceService` depends on)
• `keyManager.ts:196` `claude-3-haiku-20240307` → `claude-haiku-4-5-20251001`
• `apiKeyManager.ts:138` `claude-3-5-sonnet-20241022` → `claude-sonnet-4-6`

Roadmap → v4.1.0

• W11 — Direct SDK paths for AI features. Migrate `AIIntelligenceService` from the `claude-code` `query()` wrapper to direct `@anthropic-ai/sdk` `messages.create` calls. Unblocks prompt caching (5-min TTL on large system prompts) and extended thinking for planning paths.
• TUIs for `analyze` / `enhance` / `migrate`. Currently only `init` has the Ink TUI.
• `@anthropic-ai/claude-code` 2.x migration. Depends on W11.
• Plugins. `.claude/plugins.json` scaffolding for the marketplace.

Provenance

This release was produced by a 9-worker orchestrated run (8 wave-1 workers in parallel + 1 README-rewrite worker in wave-2). The per-worker ledger, decision log, and verification evidence are in `ORCHESTRATION.md`.

Full per-version diff: see `CHANGELOG.md`.

🤖 Generated with Claude Code

🦄 Context Forge v3.2.9 - Nuxt 4 Support

🦄 Context Forge v3.2.9 - Nuxt 4 Support

🎉 What's New

🦄 Full Nuxt 4 Integration

• New Framework Option: Complete support for Nuxt 4 with Vue 3
• Modern Architecture: New app/ directory structure support
• Enhanced TypeScript: Better integration with auto-imports
• Vue 3 Guidelines: Composition API best practices
• SSR Ready: Server-side rendering configuration
• Validation Commands: Nuxt-specific build, test, and lint commands

📊 Feature Highlights

• 🏗️ New app/ directory structure documentation
• ⚡ Enhanced TypeScript integration with Nuxt 4
• 🎯 Vue 3 Composition API development guidelines
• 🔄 Auto-imports and server-side rendering setup
• 📋 25+ slash commands with Nuxt 4 support
• 🤖 AI-powered PRP generation for Nuxt projects

🚀 Usage

# Install the latest version
npm install -g context-forge@3.2.9

# Initialize a new Nuxt 4 project
context-forge init --output my-nuxt-app

# Select "Nuxt 4 (Vue-based, full-stack)" as frontend framework

📦 Technical Changes

Added

• Nuxt 4 frontend framework option in tech stack prompts
• templates/claude/tech-stacks/nuxt4.md template
• Nuxt 4 project structure generator
• Validation commands: nuxt typecheck, nuxt build, nuxt dev
• State management options: Pinia, Vuex, built-in Nuxt state
• Enhanced README with Nuxt 4 examples and documentation

Fixed

• Issue #7: Add support for Nuxt4

🔄 Migration

No breaking changes - existing projects continue to work as expected.

🙏 Acknowledgments

Thanks to @timezyme for requesting Nuxt 4 support!

---

Full Changelog: v3.2.8...v3.2.9

v3.2.7 - Fix Feature Prioritization Error

🐛 Bug Fix

Fixed

• Fixed checkbox prompt error when all features are selected during feature prioritization
• Added validation to ensure not all features can be marked as must-have for MVP
• Added conditional logic to skip nice-to-have prompt when no features remain

Error Resolved

Previously, when users selected all available features and tried to mark them all as must-have, the following error would occur:

[checkbox prompt] No selectable choices. All choices are disabled.

This has been fixed by:

1. Preventing users from selecting all features as must-have (with helpful validation message)
2. Gracefully handling the case where all features are selected as must-have

Added

• Unit tests for feature prioritization edge cases

Installation

npm install -g context-forge@3.2.7

What's Changed

• Fix checkbox prompt error in feature prioritization by @webdevtodayjason in 12b6821

Full Changelog: v3.2.6...v3.2.7

v3.2.4 - Inquirer v12 Compatibility Fix

🐛 Bug Fixes

• Fixed checkbox prompt error: Resolved "No selectable choices. All choices are disabled" error in init command
  • Added explicit disabled: false to all selectable checkbox choices for Inquirer v12 compatibility
  • Fixed invalid disabled string values in IDE selection (changed to boolean)
  • Updated all checkbox prompts across the codebase: features.ts, ideSelection.ts, projectConfig.ts, checkpointConfig.ts
  • Users can now successfully run context-forge init and select features without errors

🔧 Technical Details

• Issue: Inquirer v12 requires explicit disabled property configuration for checkbox choices
• Solution: Added disabled: false to all selectable choices and disabled: true for unavailable options
• Affected files: features selection, IDE selection, project configuration extras, and checkpoint configuration

📦 Installation

npm install -g context-forge@3.2.4

Fixes #4

Context Forge v3.2.0 - Autonomous AI Orchestration

🤖 Autonomous AI Orchestration Release

This major release introduces groundbreaking autonomous AI orchestration capabilities, enabling teams of AI agents to work on your project 24/7 without human intervention.

✨ Key Features

🚀 Orchestration Command

• Deploy autonomous AI agent teams in small, medium, or large configurations
• Three-tier hierarchy: Orchestrator → Project Managers → Developers/QA/DevOps
• Self-managing agents with automatic workload distribution

🔄 Self-Scheduling System

• Agents schedule their own check-ins (5-60 minute intervals)
• Adaptive scheduling based on workload
• Automatic recovery from crashes or disconnections

🖥️ Tmux Integration

• Full tmux session management for AI agents
• Real-time monitoring capabilities
• Agent health checks and status tracking

💬 Inter-Agent Communication

• Structured message protocols
• Status updates and task assignments
• Escalation handling for blockers

📊 Enhanced Claude Code Integration

• 25+ slash commands including orchestration commands
• 4 specialized hooks for workflow automation
• Comprehensive progress tracking

🏗️ Technical Implementation

New services: TmuxManager, OrchestrationService, AgentCommunicationService, SelfSchedulingService, GitDisciplineService

📚 Documentation

• Comprehensive orchestration guide
• Step-by-step tutorial
• Best practices for autonomous development

Transform your development workflow with 24/7 autonomous AI teams!

Context Forge v3.1.4 - Checkpoints, Hooks & Advanced Workflow

🚀 Context Forge v3.1.4 - Major Enhancement Release

✨ What's New

🛑 Human-in-the-Loop Checkpoint System

• Checkpoint Configuration: Add checkpoints to your development workflow with custom triggers
• Smart Milestone Detection: Automatic checkpoint triggers for critical tasks (database, auth, deployment)
• Custom Milestones: Create project-specific checkpoints with verification steps
• Blocking Approvals: Pause development at critical points until human verification

🪝 Claude Code Hooks Integration

• Context Preservation: PreCompact hook saves critical project information
• Quality Gates: PreSubmit hook runs linting and tests before submission
• PRP Tracking: Automated progress tracking for Product Requirement Prompts
• External Hooks: Copy hooks from external repositories with copy-hooks command

🎯 Enhanced Workflow Commands

• New CLI Commands: copy-hooks for external hook management
• Advanced Configuration: Hooks and checkpoints integration in project setup
• Professional Workflow: Enterprise-grade safeguards for production development

🔧 Technical Improvements

New Files Added

• src/cli/commands/copy-hooks.ts - External hooks repository integration
• src/cli/prompts/checkpointConfig.ts - Checkpoint system configuration
• src/generators/checkpointCommands.ts - Checkpoint command templates
• src/generators/hooks.ts - Claude Code hooks generation

Enhanced Features

• 20+ Slash Commands: Including checkpoint commands (/checkpoint, /should-checkpoint, /milestone-gate)
• Context Engineering: Advanced context preservation across development sessions
• Quality Automation: Automated linting, testing, and validation gates
• Project Safety: Critical milestone verification system

📋 Usage

Enable Checkpoints

# During project initialization
context-forge init
# Select 'Human-in-the-Loop Checkpoints' in extras

Enable Hooks

# During project initialization  
context-forge init
# Select 'Claude Code hooks integration' in extras

# Or copy from external repository
context-forge copy-hooks --source ../claude-hooks-repo

Available Hooks

• PreCompact.py: Preserves project context before compaction
• ContextRotation.py: Manages context during long sessions
• PreSubmit.py: Validates code quality before submission
• PRPTracking.py: Tracks PRP implementation progress

🎉 Impact

This release transforms Context Forge from a configuration generator into a comprehensive AI-assisted development platform with:

• Enterprise-Grade Safety: Human verification at critical milestones
• Professional Workflow: Automated quality gates and context management
• Development Efficiency: Advanced PRP system with one-pass implementation
• Context Intelligence: Smart preservation and rotation of project knowledge

📖 Full Documentation

Visit our documentation for complete setup guides and usage examples.

---

Breaking Changes: None - This is a backward-compatible enhancement release.
Requirements: Node.js 16+, Compatible with all supported AI IDEs

v3.1.3 - Retrofit Existing Projects & PreCompact Hook Integration

🎉 What's New

🔧 Retrofit Existing Projects

• NEW: context-forge analyze command
• Transform existing codebases into AI-ready projects
• Auto-detects tech stack & project structure
• Asks about future development plans
• Generates PRPs for each planned feature
• Never overwrites existing files (appends to CLAUDE.md with clear markers)
• Creates comprehensive retrofit summary

🔗 PreCompact Hook Integration

• Works with Claude Hooks Manager
• PRPs auto-reload when Claude compacts conversations
• Maintains project understanding during long sessions
• Preserves validation gates
• Seamless support for Claude Code v1.0.48+

🚀 PRP Support for 6 AI IDEs

Product Requirement Prompts now available for:

• Claude Code
• Cursor IDE
• Windsurf
• Cline
• GitHub Copilot
• Gemini

Installation

npm install -g context-forge@3.1.3

Retrofitting Example

cd your-existing-project
context-forge analyze

This will:

1. Analyze your project structure
2. Detect your tech stack
3. Ask about planned features
4. Generate AI-optimized documentation
5. Create individual PRPs for each feature

Full Changelog

• Add analyze command for retrofitting existing projects
• Implement smart project analysis with tech stack detection
• Add interactive retrofit flow with future planning prompts
• CLAUDE.md append mode preserves existing content
• Generate PRPs for planned features
• Add comprehensive file tree summary
• Implement secure API key management with .gitignore
• Add PreCompact hook integration documentation
• Update README with prominent What's New section

v0.2.0 - Multi-IDE Support

🎉 Major Release: Multi-IDE Support

This release transforms Context Forge from a Claude Code-specific tool into a universal AI IDE configuration generator, supporting 7+ major AI coding assistants.

✨ New Features

• Multi-IDE Support: Added support for 7 AI-powered IDEs and assistants:

  • Claude Code (Anthropic) - Full PRP support
  • Cursor IDE - MDC format with hierarchical rules
  • Windsurf IDE - Cascade AI integration with workflows
  • Cline (formerly Claude Dev) - Advanced context management
  • Roo Code - Workspace rules with YAML configuration
  • GitHub Copilot - Custom instructions with VS Code settings
  • Gemini (Google) - CLI and Code Assist integration

• Interactive IDE Selection: New interactive prompt during init to select one or multiple IDEs

• IDE-Specific Adapters: Modular adapter architecture for easy extensibility

• Enhanced Documentation: Comprehensive guides for each IDE in docs/ide-configs/

• Improved Marketing: Updated README with IDE comparison table and feature highlights

🔧 Technical Improvements

• Implemented adapter pattern for IDE configurations
• Added --ide flag support for CLI
• Created IDEAdapter base class for consistent implementation
• Added TypeScript types for IDE information and selection
• Enhanced project configuration to support multiple target IDEs

📦 Installation

```bash
npm install -g context-forge@0.2.0
```

📚 Documentation

See the README for detailed usage instructions and IDE-specific guides.

Full Changelog: v0.1.0...v0.2.0