# agent-forge
**Repository Path**: huanminabc/agent-forge
## Basic Information
- **Project Name**: agent-forge
- **Description**: 万能的agent 想法决定你的上线
- **Primary Language**: Unknown
- **License**: MIT
- **Default Branch**: main
- **Homepage**: None
- **GVP Project**: No
## Statistics
- **Stars**: 0
- **Forks**: 0
- **Created**: 2026-08-30
- **Last Updated**: 2026-09-20
## Categories & Tags
**Categories**: Uncategorized
**Tags**: None
## README
> New issues and PRs from new contributors are auto-closed by default. Maintainers review auto-closed issues daily. See [CONTRIBUTING.md](CONTRIBUTING.md).
# Agent Forge
这是 Agent Forge 的代码代理工作区：一个极简、可扩展、专注编写代码的 AI Agent。
* **[@agent-forge/coding-agent](packages/coding-agent)**: Interactive coding agent CLI
* **[@agent-forge/agent-core](packages/agent)**: Agent runtime with tool calling and state management
* **[@agent-forge/ai](packages/ai)**: Unified multi-provider LLM API (OpenAI, Anthropic, Google, …)
To learn more about Agent Forge:
* [Read the overall architecture handbook](docs/design/整体架构手册.md)
* [Read the core architecture constitution](docs/design/核心架构宪法.md)
* [Read the incremental delivery and handoff plan](docs/plans/增量交付与交接计划.md)
* [Read the memory system design](docs/design/记忆系统设计.md)
* Ask the agent to explain the current architecture and available plugins
## All Packages
| Package | Description |
|---------|-------------|
| **[@agent-forge/telemetry](packages/telemetry)** | Vendor-neutral telemetry contracts, reference adapter, conformance tests, and typed schemas |
| **[@agent-forge/ai](packages/ai)** | Unified multi-provider LLM API (OpenAI, Anthropic, Google, etc.) |
| **[@agent-forge/agent-core](packages/agent)** | Agent runtime with tool calling and state management |
| **[@agent-forge/coding-agent](packages/coding-agent)** | Interactive coding agent CLI |
| **[@agent-forge/tui](packages/tui)** | Terminal UI library with differential rendering |
External chat automation and workflow integrations belong in plugins or separate hosts.
## Permissions & Containerization
Agent Forge does not include a built-in permission or approval policy for filesystem, process, network, or credential access. By default, it runs with the permissions of the user and process that launched it.
> **full-control is not a sandbox.** The default `full-control` mode lets the model edit files and run processes directly. `readonly` is a capability mode (a narrower default tool surface), not a security boundary — it does not isolate the filesystem, network, or processes.
If you need stronger boundaries, add an external policy plugin or containerize the host. See [packages/coding-agent/docs/containerization.md](packages/coding-agent/docs/containerization.md) for deployment patterns:
- **Gondolin extension**: route selected tools into a local Linux micro-VM.
- **Plain Docker**: run the whole `agent-forge` process in a local container.
- **External policy host**: run the process under a user-selected policy or sandbox.
## Contributing
See [CONTRIBUTING.md](CONTRIBUTING.md) for contribution guidelines and [AGENTS.md](AGENTS.md) for project-specific rules (for both humans and agents).
## Development
```bash
npm install --ignore-scripts # Install all dependencies without running lifecycle scripts
npm run build # Refresh model data, then build all packages
npm run build:offline # Rebuild using existing model data without network access
npm run check # Lint, format, and type check
./test.sh # Run deterministic offline/mock tests; provider credentials are cleared even if present
# Real-model E2E is intentionally separate: npm run test:real-e2e (explicit authorization required)
./pi-test.sh # Compatibility launcher for running Agent Forge from sources
```
## Building standalone binaries from release source
GitHub releases include a versioned source archive covered by the release's `SHA256SUMS` file. Extract it and run the same build script used for the official standalone binaries:
```bash
VERSION=""
tar -xzf "agent-forge-${VERSION}-source.tar.gz"
cd "agent-forge-${VERSION}"
./scripts/build-binaries.sh --offline-model-data --platform linux-x64 --out "$PWD/out"
```
The source archive includes the generated provider model data used for the release. `--offline-model-data` builds with that snapshot instead of refreshing it from live provider catalogs. The script still installs dependencies, builds the monorepo, compiles the Bun executable, and stages its runtime assets. Package maintainers who provide dependencies separately can pass `--skip-install --skip-deps`.
## Supply-chain hardening
We treat npm dependency changes as reviewed code changes.
- Direct external dependencies are pinned to exact versions. Internal workspace packages remain version-ranged.
- `.npmrc` sets `save-exact=true` and `min-release-age=2` to avoid same-day dependency releases during npm resolution.
- `package-lock.json` is the dependency ground truth. Pre-commit blocks accidental lockfile commits unless `PI_ALLOW_LOCKFILE_CHANGE=1` is set.
- `npm run check` verifies pinned direct deps, native TypeScript import compatibility, and the generated coding-agent shrinkwrap.
- The published CLI package includes `packages/coding-agent/npm-shrinkwrap.json`, generated from the root lockfile, to pin transitive deps for npm users.
- Release smoke tests use `npm run release:local` to build, pack, and create isolated npm and Bun installs outside the repo before tagging a release.
- Local release installs and documented npm installs use `--ignore-scripts` where supported.
- CI installs with `npm ci --ignore-scripts`, and a scheduled GitHub workflow runs `npm audit --omit=dev` plus `npm audit signatures --omit=dev`.
- Shrinkwrap generation has an explicit allowlist for dependency lifecycle scripts; new lifecycle-script deps fail checks until reviewed.
## License
MIT
Agent Forge