ForgeGuard v1.1.0 — Risk Gate and CLI

ForgeGuard v1.1.0 — Risk Gate and CLI

ForgeGuard v1.1.0 extends the initial guardrail model with two major capabilities: explicit engineering risk classification and a portable CLI installer for Agent Skills.

Highlights

Risk Gate

ForgeGuard now classifies consequential work before execution using four levels:

• Low — routine, reversible changes with limited blast radius;
• Medium — behavior, dependency, contract, or infrastructure changes that require compatibility and rollback awareness;
• High — security, authentication, cryptography, billing, production deployment, data-transforming migrations, breaking contracts, and distributed consistency changes;
• Critical — destructive production data operations, irreversible migrations, large-scale credential/key changes, security-control disablement, or other operations with extreme blast radius and weak rollback guarantees.

For High and Critical work, ForgeGuard requires explicit reasoning about blast radius, failure modes, rollback/recovery, and verification before execution.

Critical operations are never executed automatically and require explicit user approval immediately before the consequential step.

Preparation vs execution

The Risk Gate distinguishes preparing a risky change from executing it.

ForgeGuard can still prepare:

• migration files;
• deployment manifests;
• key-rotation plans;
• destructive-operation runbooks;
• breaking API transition plans;

without immediately applying them to production. The approval gate applies to the irreversible or production-impacting execution step.

npm/npx CLI

ForgeGuard now ships with a zero-runtime-dependency Node.js CLI.

The package name is:

@gendbytemaster/forgeguard

The executable is:

forgeguard

Supported commands:

forgeguard install
forgeguard status
forgeguard uninstall

Supported options include:

--client codex|claude|cursor|all
--global
--force
--dry-run

The CLI installs the complete engineering-guardrails/ directory into the appropriate Agent Skills location for the selected client.

Run directly from GitHub

ForgeGuard can be executed with npx before npm registry publication:

npx --yes github:GendByteMaster/ForgeGuard install

Other examples:

npx --yes github:GendByteMaster/ForgeGuard status
npx --yes github:GendByteMaster/ForgeGuard install --client codex
npx --yes github:GendByteMaster/ForgeGuard install --global
npx --yes github:GendByteMaster/ForgeGuard install --dry-run

After publication to npm, the intended command is:

npx @gendbytemaster/forgeguard install

or:

npm install -g @gendbytemaster/forgeguard
forgeguard install

Multi-client installation

ForgeGuard understands the native Agent Skills paths used by supported clients:

Client	Project location
OpenAI Codex	.agents/skills/engineering-guardrails/
Claude Code	.claude/skills/engineering-guardrails/
Cursor	.agents/skills/engineering-guardrails/ or .cursor/skills/engineering-guardrails/

Codex and Cursor can share the .agents/skills installation instead of maintaining duplicate copies.

CLI verification

The CLI is designed to be tested across supported Node.js versions and includes CI coverage for:

• Node.js 18;
• Node.js 20;
• Node.js 22;
• package construction through npm pack --dry-run;
• installation/status/uninstallation behavior.

npm publication workflow

The repository includes a publication workflow intended to publish @gendbytemaster/forgeguard from a GitHub Release once npm authentication or Trusted Publishing is configured for the package.

GitHub repository access alone does not authorize publication to the npm registry; npm account configuration remains a separate trust boundary.

Updated skill structure

engineering-guardrails/
├── SKILL.md
└── references/
    ├── commit-policy.md
    ├── goal-policy.md
    ├── gsd-workflow.md
    ├── risk-gate.md
    └── subagent-policy.md

The repository also now contains the CLI package and release tooling:

bin/forgeguard.js
package.json
.github/workflows/
docs/
examples/

Upgrade from v1.0.0

If ForgeGuard is copied manually into a project, replace the complete engineering-guardrails/ directory with the v1.1.0 version so that SKILL.md and references/risk-gate.md remain synchronized.

If using the CLI from GitHub, rerun:

npx --yes github:GendByteMaster/ForgeGuard install --force

After npm publication:

npx @gendbytemaster/forgeguard install --force

Compatibility

ForgeGuard remains language-, framework-, and repository-host agnostic. The v1.1.0 changes add workflow controls and installation tooling without requiring a specific application stack.

Breaking changes

None for the Agent Skill behavior expected by v1.0.0 users.

The Risk Gate adds stricter approval requirements around High and Critical execution steps. This is an intentional safety behavior rather than an API incompatibility.

Verification

Before publishing this release, verify:

• package.json and SKILL.md both report 1.1.0;
• the CLI starts successfully on supported Node.js versions;
• install, status, and uninstall work in an isolated test directory;
• npm pack --dry-run includes the CLI and complete engineering-guardrails/ skill;
• release notes and changelog describe only features present in the repository.

License

MIT.