English · 简体中文

FlowForge turns a natural-language product brief into a reviewable plan and a local-first CRUD app. The model produces typed ProductPlan and AppSpec data; a trusted compiler, artifact verifier, and sandbox handshake create and admit the executable result.

See FlowForge work

Fixture-mode walkthrough shown. The pipeline, compiler, verifier, sandbox handshake, generated runtime, and persistence are real; only the model responses use reviewed fixtures.

Start from a brief, review the proposed product plan, build a version, use the generated app, and continue with natural-language revisions when a live AI provider is configured.

What you get

• A review checkpoint before compilation. Edit and approve the title, audience, fields, features, assumptions, and theme before a build begins.
• Constrained generation. The AI produces structured plans and app specs; FlowForge does not execute arbitrary model-generated code.
• A runnable data app. Generated apps support create, edit, delete, search, optional filters, and summary counts for one core entity.
• Failure-safe versions. Successful builds are stored as immutable versions; a failed build never replaces the current working version.
• Inspectable runtime behavior. Desktop, tablet, and mobile previews sit beside source, build events, artifact checks, and runtime diagnostics.
• Local-first persistence and export. Projects, versions, and records stay in IndexedDB. A version can also be recompiled into a standalone HTML file with its own fresh localStorage data.

How it works

The trust boundary is deliberate: the model proposes structured data, while deterministic code owns HTML, CSS, the CRUD runtime, content security policy, artifact checks, and preview admission.

Quick start — no API key required

Requires Node.js 22 or newer.

git clone https://github.com/Totoro-qaq/flowforge.git
cd flowforge
npm ci
cp .env.example .env.local

For the keyless development path, set these values in .env.local:

AI_FIXTURE_MODE=true
RATE_LIMIT_BACKEND=memory

Then start the app:

npm run dev

Open http://localhost:3000, click one of the three built-in example cards, keep the semantic plan unchanged, and confirm the build. Theme changes are supported in this path.

Fixture mode is intentionally narrow:

• it accepts only the exact prompts inserted by the built-in example cards;
• changing plan semantics such as fields or features breaks fixture matching;
• natural-language revision is unavailable;
• production rejects fixture mode and the in-memory rate limiter.

Connect a live AI provider

FlowForge calls an OpenAI-compatible Chat Completions endpoint and requires a model that supports JSON Object responses.

AI_API_KEY=your-server-only-key
AI_BASE_URL=https://api.openai.com/v1
AI_MODEL=your-json-capable-model
AI_THINKING_MODE=auto
AI_FIXTURE_MODE=false

AI_BASE_URL is optional and defaults to https://api.openai.com/v1. Never prefix the key with NEXT_PUBLIC_, and never commit .env.local.

For Zhipu GLM-5.2, use:

AI_BASE_URL=https://open.bigmodel.cn/api/paas/v4
AI_MODEL=glm-5.2
AI_THINKING_MODE=auto

AI_THINKING_MODE accepts auto, disabled, or enabled. The default auto mode disables Thinking for GLM-5 models on Zhipu endpoints to improve structured-output reliability; set it to enabled when deeper reasoning is worth the additional latency. Other OpenAI-compatible providers do not receive that provider-specific field. Each provider request has a 45-second timeout, and the Vercel Function duration for Agent routes is 60 seconds.

CI and fixture tests do not validate a live model. Before publishing a deployment, run one complete prompt, build, CRUD, and revision flow with the exact provider and model you configured.

Verify the repository

npm run lint
npm test
npm run build

The automated suite covers domain schemas, reviewed fixtures, constrained revision rules, compilation, artifact verification, persistence queries, runtime messaging, and standalone export.

Deploy to Vercel

You do not need to rent a server. Import this public repository from Vercel's New Project page, then configure the following Production environment variables:

AI_API_KEY=...
AI_BASE_URL=...
AI_MODEL=...
AI_THINKING_MODE=auto
AI_FIXTURE_MODE=false

APP_ORIGIN=https://your-project.vercel.app
SESSION_SIGNING_SECRET=<output-of-openssl-rand-hex-32>

RATE_LIMIT_BACKEND=redis
RATE_LIMIT_STORE_URL=your-upstash-compatible-rest-url
RATE_LIMIT_STORE_TOKEN=...
RATE_LIMIT_MAX=5
RATE_LIMIT_WINDOW_SECONDS=600

Generate a signing secret locally with openssl rand -hex 32. After Vercel assigns the production URL, set APP_ORIGIN to that exact origin and redeploy. The Redis-backed limiter is required because serverless instances cannot share an in-memory counter.

The root vercel.json pins the build command to npm run validate:production-env && npm run build. Missing or invalid production configuration therefore fails before compilation instead of creating a deployment whose UI works while generation is broken. Preview deployments run the same validation. Use Production for the public assessment; if Preview is enabled, its APP_ORIGIN must match that branch's Preview domain or generation requests will be rejected by design.

After deployment:

1. Visit /api/health to confirm the application is reachable. This is a liveness endpoint, not a provider or Redis readiness check.
2. In a private browser window, run a full live-provider build and CRUD flow.
3. Trigger one natural-language revision, then confirm that a new version is saved and existing records still work. This is the primary extension beyond first-time generation.

Data and safety boundaries

• Builder projects, versions, build events, and app records live in the current browser's IndexedDB; there are no accounts or cross-device sync.
• Clearing site data removes locally stored projects and records.
• Previewed apps run in an opaque-origin iframe sandbox. Runtime messages check both the active iframe source and a one-time nonce.
• Generated artifacts deny external scripts, default network access, nested frames, navigation, and dynamic code through CSP and static verification.
• A failed build attempt never replaces the last successful version.
• Exported HTML starts with a separate, empty local data store; it does not copy records from the Builder.

Current scope

• Single-page, single-entity table apps with 2–6 fields.
• Field types: text, number, date, boolean, and select.
• Each project is limited to 20 saved versions and 200 app records.
• No arbitrary code, third-party packages, connectors, multi-page apps, collaboration, cloud database, sharing, or one-click hosting for generated apps.
• Destructive revisions that delete a field or change an existing field type are rejected to protect stored records.
• The Builder interface is currently Chinese-first.

Stack

Next.js 16 · React 19 · TypeScript · Zod · Vitest · IndexedDB

License

FlowForge is available under the MIT License.