Fix scope guard false positives on system paths

.github/dependabot.yml

@@ -1,7 +1,12 @@
 version: 2
 updates:
   - package-ecosystem: "npm"
-    directory: "/"
+    directory: "/container"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/cli"
     schedule:
       interval: "weekly"
 

.github/workflows/ci.yml

@@ -3,8 +3,10 @@ name: CI
 on:
   push:
     branches: [main, staging]
+    paths: ['container/**']
   pull_request:
     branches: [main, staging]
+    paths: ['container/**']
 
 jobs:
   test:
@@ -15,6 +17,7 @@ jobs:
         with:
           node-version: 18
       - run: npm test
+        working-directory: container
 
   lint:
     runs-on: ubuntu-latest
@@ -24,6 +27,7 @@ jobs:
         with:
           node-version: 18
       - run: npx @biomejs/biome check setup.js test.js
+        working-directory: container
 
   test-plugins:
     runs-on: ubuntu-latest
@@ -34,3 +38,14 @@ jobs:
           python-version: "3.x"
       - run: pip install pytest
       - run: pytest tests/ -v
+        working-directory: container
+
+  test-cli:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install
+        working-directory: cli
+      - run: bun test
+        working-directory: cli

.github/workflows/deploy-docs.yml

@@ -3,7 +3,7 @@ name: Deploy Docs
 on:
   push:
     branches: [main]
-    paths: ['docs/**', '.devcontainer/CHANGELOG.md']
+    paths: ['docs/**', 'container/.devcontainer/CHANGELOG.md']
   workflow_dispatch:
 
 permissions:

.github/workflows/docs-ci.yml

@@ -2,7 +2,7 @@ name: Docs CI
 
 on:
   pull_request:
-    paths: ['docs/**', '.devcontainer/CHANGELOG.md']
+    paths: ['docs/**', 'container/.devcontainer/CHANGELOG.md']
 
 jobs:
   build:

.github/workflows/publish-features.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
   push:
     branches: [main]
-    paths: ['.devcontainer/features/**']
+    paths: ['container/.devcontainer/features/**']
 
 jobs:
   publish:
@@ -19,7 +19,7 @@ jobs:
         uses: devcontainers/action@v1
         with:
           publish-features: "true"
-          base-path-to-features: "./.devcontainer/features"
+          base-path-to-features: "./container/.devcontainer/features"
           generate-docs: "false"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -16,7 +16,7 @@ jobs:
         name: Extract and validate version
         run: |
           TAG="${GITHUB_REF#refs/tags/v}"
-          PKG=$(node -p "require('./package.json').version")
+          PKG=$(node -p "require('./container/package.json').version")
           echo "version=$TAG" >> "$GITHUB_OUTPUT"
           if [ "$TAG" != "$PKG" ]; then
             echo "::error::Tag v${TAG} does not match package.json version ${PKG}"
@@ -38,17 +38,19 @@ jobs:
 
       - name: Run tests
         run: npm test
+        working-directory: container
 
       - name: Publish to npm
         run: npm publish
+        working-directory: container
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Extract changelog section
         id: changelog
         run: |
           VERSION="${{ needs.validate.outputs.version }}"
-          NOTES=$(sed -n "/^## \[v${VERSION}\]/,/^## \[v/{ /^## \[v${VERSION}\]/d; /^## \[v/d; p; }" .devcontainer/CHANGELOG.md)
+          NOTES=$(sed -n "/^## \[v${VERSION}\]/,/^## \[v/{ /^## \[v${VERSION}\]/d; /^## \[v/d; p; }" container/.devcontainer/CHANGELOG.md)
           if [ -z "$NOTES" ]; then
             NOTES="Release v${VERSION}"
           fi

.gitignore

@@ -1,84 +1,64 @@
-# CodeForge Git Ignore
-
-# Environment files with API keys
+# Shared
+node_modules/
+dist/
 .env
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
-
-# DevContainer build cache
-.devcontainer/.dockercache/
-
-# IDE files
-.vscode/settings.json
-*.swp
-*.swo
-*~
-
-# Temporary files
-*.tmp
-*.temp
+.env.*
+!.env.example
+!.env.*.example
+*.log
 .DS_Store
 Thumbs.db
-
-# Logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# Coverage directory used by tools like istanbul
+__pycache__/
+*.pyc
 coverage/
 *.lcov
-
-# nyc test coverage
 .nyc_output
 
-logs
-dev-debug.log
-# Python bytecode
-__pycache__/
-*.pyc
+# Temporary files
+*.tmp
+*.temp
+*.swp
+*.swo
+*~
 
-# Dependency directories
-node_modules/
-# Environment variables
-# Editor directories and files
-.idea
-.vscode
+# IDE
+.vscode/
+.idea/
 *.suo
 *.ntvs*
 *.njsproj
 *.sln
-*.sw?
-# OS specific
 
-# Claude Code directory (user-specific)
-.claude/
+# Runtime
+pids/
+*.pid
+*.seed
+*.pid.lock
 
-# All hidden directories except devcontainer and codeforge
-.*
-!.devcontainer/
-!.devcontainer/**/.claude-plugin/
-!.codeforge/
-!.git/
-!.github/
-!.gitignore
-!.gitattributes
-!.npmignore
+# Container-specific
+container/.claude/
+container/.tmp/
+container/.codeforge/.checksums/
+container/.codeforge/.markers/
+container/.devcontainer/.env
+container/.devcontainer/.secrets
+container/.devcontainer/state/
+container/.devcontainer/config/backups/
+container/.devcontainer/.dockercache/
+container/.devcontainer/**/*.codeforge-new
+container/.devcontainer/**/*.bak
+container/.devcontainer/.codeforge-preserve
 
-# .codeforge per-installation state (not tracked)
-.codeforge/.checksums/
-.codeforge/.markers/
+# CLI-specific
+cli/.pytest_cache/
+cli/.ruff_cache/
 
-# Docs
-docs/node_modules/
-docs/dist/
+# Docs-specific
 docs/.astro/
+
+# OS-generated
+logs/
+dev-debug.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*

CLAUDE.md

@@ -1,8 +1,14 @@
-# CodeForge
+# CodeForge Monorepo
 
-DevContainer configuration project for AI-assisted development with Claude Code.
+This repository contains three packages. Each package manages its own dependencies independently.
 
-See `.devcontainer/CLAUDE.md` for full devcontainer documentation.
+## Packages
+
+| Package | Runtime | Package Manager |
+|---------|---------|-----------------|
+| `container/` | Node.js | npm |
+| `cli/` | Bun | bun |
+| `docs/` | Node.js | npm |
 
 ## Development Rules
 
@@ -13,25 +19,23 @@ See `.devcontainer/CLAUDE.md` for full devcontainer documentation.
 - Feature and fix branches should be created from `staging` and PRed back to `staging`.
 - PRs from `staging` to `main` are used for releases.
 
-### Changelog
+### Package-Specific Rules
 
-Every change MUST have a corresponding entry in `.devcontainer/CHANGELOG.md`.
+Each package has its own `CLAUDE.md` with package-specific development rules:
 
-- New features, enhancements, fixes, and removals each get their own bullet
-- Group related changes under domain headings (`###`) by area (e.g., `### Security`, `### Agent System`, `### Documentation`, `### Configuration`)
-- If an unreleased version section doesn't exist, add changes to the current version's section
-- Write entries from the user's perspective — what changed, not how it was implemented
+- [`container/CLAUDE.md`](container/CLAUDE.md) — changelog, documentation, and configuration rules for the devcontainer package
+- `cli/` — Bun/TypeScript CLI; run `bun test` for tests
+- `docs/` — Astro/Starlight site; run `npm run build` to verify
 
-### Documentation
+### Cross-Package Changes
 
-All user-facing changes MUST be reflected in documentation:
+When a change spans multiple packages, make the changes in a single branch and PR.
+Group related changes in the commit message by package.
 
-- **Plugin changes** → update the plugin's `README.md`
-- **Feature changes** → update `features/README.md` and the feature's `devcontainer-feature.json` if applicable
-- **Config system changes** → update `.devcontainer/CLAUDE.md`
-- **New config files in `.codeforge/config/`** → add entry to `.codeforge/file-manifest.json`
-- **Docs site** → update relevant pages in `docs/` if the docs site exists
+### Testing
 
-### User Configuration
+Run tests for each affected package before committing:
 
-All user-customizable configuration files belong in `.codeforge/`. New config files go in `.codeforge/config/`, with a corresponding entry in `.codeforge/file-manifest.json`.
+- **Container**: `cd container && npm test`
+- **CLI**: `cd cli && bun test`
+- **Docs**: `cd docs && npm run build`