v0.19.0 — Skill import inference, skills validation lint, and default-deny PDP governance

Forge v0.19.0 makes shipping AI agents from existing skill folders faster and safer: importing a SKILL.md folder now infers its metadata.forge build block, a new forge skills validate command catches the silent tool-registration failures that used to only surface at runtime, and the tool→script binding is more forgiving. This release also lands a full documentation sweep, including default-deny Policy Decision Point (PDP) governance guidance for MCP and API tools.

Forge is a secure, portable AI agent runtime — run agents locally, in the cloud, or in enterprise environments without exposing inbound tunnels.

Highlights

• Import a plain skill folder and get a working Forge agent — metadata.forge is inferred when the SKILL.md has none (#412, #415).
• forge skills validate — surface invalid **Input:** keys, missing backing scripts, and orphan scripts before runtime, with a non-zero exit for CI (#418, #419).
• Forgiving tool→script binding — a ## Tool: some_name now binds to either scripts/some_name.* or scripts/some-name.* (#418, #419).
• Full documentation sweep — MCP/API/PDP schema, audit-event catalog, and default-deny PDP governance for prose skills (#416).

Features

Skill import infers metadata.forge (#412, #415)

forge skills import and forge init --from-skill-dir now generate a metadata.forge block when the imported SKILL.md doesn't have one — the common case for real-world skill folders that ship only name + description. Forge:

• derives requires.bins from the script interpreters it finds (.py → python3, .js → node);
• reports candidate egress_domains (http(s) hosts referenced in scripts) and requires.env (environment reads — Python os.environ / os.getenv, JavaScript process.env, and shell $VAR / ${VAR}, minus locally-assigned and common shell variables);
• prints a paste-ready suggested block by default. The high-confidence interpreter bins can be written into the vendored SKILL.md with --write-forge-meta; the egress/env candidates always stay printed for review and are never auto-declared, so an agent's egress allowlist is never silently widened.

Import writes are atomic with a re-parse guard so a partial or malformed injection can't corrupt the vendored skill.

# Turn a folder of SKILL.md + scripts into a Forge agent
forge init my-agent --from-skill-dir ./ai-budget-increase-evaluator
# ...or import into an existing project, writing the inferred bins:
forge skills import ./ai-budget-increase-evaluator --write-forge-meta

New: forge skills validate tool-registration lint (#418, #419)

Two skill-registration failures used to be silent — a tool would simply not appear at runtime, with at most one error-log line. forge skills validate now scans the whole skill tree (the main SKILL.md and every skills/*/SKILL.md) and reports each, using Forge's own parser so the check can never drift from enforcement:

Check	Severity	Why it matters
**Input:** property key outside ^[a-zA-Z0-9_.-]{1,64}$	error	The LLM provider rejects the entire request, so Forge drops the whole tool at startup.
A ## Tool: with no backing scripts/<name>.{sh,py,js}	error	The tool never registers.
A scripts/*.{sh,py,js} with no ## Tool: heading	warning	Reachable only via run_skill_script; dead weight if unreferenced.

It exits non-zero on any error, so CI can gate on it — replacing the external lints teams maintained as approximations of Forge's parser.

forge skills validate   # non-zero exit if any tool would fail to register

More forgiving tool→script binding (#418, #419)

A ## Tool: some_name previously bound only to scripts/some-name.{sh,py,js} (underscores forced to hyphens), so an author who named the file some_name.sh got a silently-missing tool. It now binds to either name form — scripts/some_name.* or scripts/some-name.* — with the hyphenated form winning only if both exist, so every existing skill resolves identically. Resolution priority is otherwise unchanged (skill-local before shared, shell → python → node), and path-traversal hardening is preserved.

Documentation

Full documentation sync sweep + rolling anchor (#416)

A comprehensive sweep audited every feature merged between v0.17.1 and v0.18.1 against the docs and closed the gaps:

• Reference schema — added the complete mcp:, apis: (per-operation API tools), and pdp: blocks, plus egress allowed_tcp / allowed_private_cidrs and defer approver fields.
• Audit catalog — documented llm_call_failed and the mcp_auth_required / mcp_auth_resolved / mcp_auth_timeout events, always-on error-field redaction, and channel-sender attribution.
• Governance — a managed Policy Decision Point (PDP) section, per-operation API tools, and a default-deny PDP example showing how MCP and API calls made from a prose skill are still governed per operation at BeforeToolExec (govern the tool the model picks, not just the ones you listed).
• Rolling anchor (docs/sync-docs-state.md) so future documentation sweeps run incrementally instead of re-scanning history.

Install / upgrade

# Homebrew
brew upgrade initializ/tap/forge

Prebuilt binaries and checksums.txt for macOS, Linux, and Windows (amd64/arm64) are attached to this release below.

Who should upgrade

Anyone importing existing SKILL.md folders into Forge, anyone authoring skill tools (validate before shipping), and operators governing MCP/API tool calls with a Policy Decision Point. This release is additive and backward-compatible — existing skills and configs are unaffected.

Full changelog: v0.18.1...v0.19.0