# Changelog

## Score

- CAI 43 → 46 (+3.4)
- Rubric changed (rubric-2026.09.9 → rubric-2026.09.17) — scores are not directly comparable.

## Lenses

- Code Health 87 → 87 (+0.1)
- Architecture 96 → 94 (-1.5)
- Maturity 44 → 44 (-0.1)
- Readiness 89 → 85 (-4.2)
- Security 36 → 57 (+21.0)
- Domain Modelling 91 → 90 (-1.5)
- Event Sourcing 100 → 100 (+0.0)
- Accessibility 30 → 30 (+0.0)
- Performance 85 (new)

## Resolved (14)

- High vulnerability: [GHSA redacted] (Cargo.lock)
- High vulnerability: [GHSA redacted] (Cargo.lock)
- Hotspot: crates/forge_main/src/ui.rs (crates/forge_main/src/ui.rs)
- Hotspot: crates/forge_repo/src/provider/openai.rs (crates/forge_repo/src/provider/openai.rs)
- Hotspot: crates/forge_repo/src/provider/openai_responses/response.rs (crates/forge_repo/src/provider/openai_responses/response.rs)
- Hotspot: crates/forge_repo/src/provider/provider_repo.rs (crates/forge_repo/src/provider/provider_repo.rs)
- Hotspot: crates/forge_select/src/preview.rs (crates/forge_select/src/preview.rs)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (crates/forge_repo/src/provider/anthropic.rs)
- Off-boarding risk: anonymized user #1
- Off-boarding risk: anonymized user #2
- Repeated repair: crates/forge_app/src/dto/openai/transformers/pipeline.rs (crates/forge_app/src/dto/openai/transformers/pipeline.rs)
- Repeated repair: crates/forge_app/src/transformers/model_specific_reasoning.rs (crates/forge_app/src/transformers/model_specific_reasoning.rs)
- Repeated repair: crates/forge_repo/src/provider/anthropic.rs (crates/forge_repo/src/provider/anthropic.rs)
- TooManyFields: Request (crates/forge_app/src/dto/openai/request.rs)

## New (28)

- Dependency hygiene PARTLY measured — Cargo dependencies read, dependency currency not (crates.io unreachable)
- Duplicate intent: Both methods appear to retrieve the list of available tools. The naming convention differs ('get' vs 'list') and they reside in different service layers (API vs App), suggesting a lack of clear separation of concerns or a redundant wrapper.
- Duplicate intent: Both methods resolve the provider for a given agent. The API layer duplicates the resolver's functionality.
- Duplicate intent: Both methods retrieve agent information. The API layer duplicates the repository method without a clear differentiator in the signature (both return generic Result).
- Duplicate intent: Both methods retrieve all provider-specific models. The identical naming across different types suggests a copy-paste pattern or lack of abstraction, but the existence of both implies potential redundancy or unclear ownership.
- Duplicate intent: Both methods retrieve the list of available models. Similar to the tools issue, this duplication across API and App layers without clear distinction in signature or naming is inconsistent.
- High CVE: [GHSA redacted] (Cargo.lock)
- High CVE: [GHSA redacted] (Cargo.lock)
- Inconsistent naming and signature for shell execution: The API exposes `execute_shell_command` and `execute_shell_command_raw`, while the underlying infrastructure exposes `execute_command` and `execute_command_raw`. The 'shell' prefix is inconsistent between layers. Additionally, the parameters differ significantly (API uses `working_dir` and no `env_vars` explicitly in the raw version, while Infra uses `env_vars` and `silent`), making the mapping unclear.
- Inconsistent return types for similar operations: `API.get_agent_model` returns `ModelId` directly, while `AgentProviderResolver.get_model` returns `Result`. This inconsistency in error handling (one throws/panics on failure, the other returns a Result) is confusing for API consumers.
- Low cohesion: Context (LCOM4 4) (crates/forge_domain/src/context.rs)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (crates/forge_repo/src/provider/anthropic.rs)
- Off the main sequence: forge_config
- Off the main sequence: forge_display
- Off the main sequence: forge_eventsource_stream
- Off the main sequence: forge_fs
- Off the main sequence: forge_json_repair
- Off the main sequence: forge_select
- Off the main sequence: forge_stream
- …and 8 more

## Changes since last survey

- 55 commits — 51 feature/other, 4 fixes

## By area

- (root) — 52 commits
- crates/forge_app — 3 commits

## Notable commits

- fix: Revert "chore(deps): update rust crate html2md to v0.2.17" (#3951)
- fix: fix(deps): pin html2md to 0.2.15 to fix android build (#3949)
- fix: fix(deps): update rust crate posthog-rs to 0.27.0 (#3941)
- fix: fix: Claude Sonnet 5.5 support for claude_code and anthropic providers (#3947)
- change: chore(deps): update aws-sdk-rust monorepo (#3906)
- change: chore(deps): update aws-sdk-rust monorepo (#3927)
- change: chore(deps): update aws-sdk-rust monorepo (#3932)
- change: chore(deps): update dependency @ai-sdk/google-vertex to v5.0.95 (#3939)
- change: chore(deps): update dependency @ai-sdk/google-vertex to v5.0.98 (#3944)
- change: chore(deps): update dependency @types/node to v24.13.5 (#3882)
- change: chore(deps): update dependency @types/node to v24.13.6 (#3907)
- change: chore(deps): update dependency @types/node to v24.19.0 (#3934)
- change: chore(deps): update dependency ai to v7.0.118 (#3940)
- change: chore(deps): update dependency ai to v7.0.122 (#3945)
- change: chore(deps): update dependency chalk to v6.0.1 (#3938)
- change: chore(deps): update dependency csv-parse to v7.0.3 (#3933)
- change: chore(deps): update dependency p-limit to v7.3.2 (#3883)
- change: chore(deps): update dependency p-limit to v7.3.3 (#3905)
- change: chore(deps): update dependency tsx to v4.23.13 (#3885)
- change: chore(deps): update dependency tsx to v4.23.15 (#3923)
- …and 35 more