
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
Command-line tools for form0, the open-source schema-driven form ecosystem by paqu.io. Scaffold, validate, test and preview form schemas locally.
[!NOTE] form0 is in active development and is available to use today. Its schema format and core concepts are stable in practice, but releases before 1.0 may include breaking changes. Pin your versions and review the release notes when upgrading. A formally stable release is coming.
form0-cli is the canonical entry point for the form0 open-source ecosystem.
It is an interactive command-line toolkit for creating projects and building, validating,
previewing, testing, and serving form schemas locally.
Install the CLI globally to get the form0 command:
npm install -g form0-cli
Or run without a global install:
npx form0-cli
Requires Node.js 22.19.0 or newer.
Start the interactive shell:
form0
Initialize a standard project:
initStart the dev server:
form0> serve
Open the live preview at http://localhost:3030 (or the port printed in the terminal).
What you get in a Standard project:
form.schema.json with a starter formform0.config.js for CLI settingstest.js for local engine checkssupporting-images/ for field assetspackage.json and README.md scaffoldingThis workflow assumes the dev server is running (serve) and the live preview is open.
Enter schema edit mode:
form0(server)> schema edit
Editor required: set
EDITORorVISUAL(for example,export EDITOR=code).
Preview the schema:
form0(server,schema)> preview
Add a NumericField after a field by row id:
form0(server,schema)> add NumericField after <id>
Example template:
{
"data_name": "quantity",
"label": "Quantity",
"min": 1,
"max": 100,
"format": "integer"
}
Add a CalculatedField after the new field:
form0(server,schema)> add CalculatedField after <new-id>
Example template:
{
"data_name": "total",
"label": "Total",
"display": { "style": "numeric" },
"calculate": "$quantity * 2"
}
Save and close your editor. The schema is saved and validated automatically.
Exit schema edit mode:
form0(server,schema)> q
Stop the dev server:
form0(server)> serve stop
Start directly with form0 ai [schema], or enter ai from the interactive shell. AI composes with
the live server, so serve followed by ai produces a form0(server,ai)> prompt and broadcasts
validated drafts to the browser without saving them.
The selected provider receives the complete form schema and installed form0 authoring catalog.
Every change is a transient semantic mutation batch: inspect it with /preview or /diff, then use
/apply or /discard. Writes require explicit approval, are atomic, and are rejected if the schema
changed on disk. /undo stages the last saved version for approval.
Provider authentication and per-schema conversations are stored under ~/.form0-cli/ai/, not in
projects or schemas. Pi exposes its provider catalog; the preview baseline covers OpenAI API keys and
Codex OAuth, Anthropic API keys and Claude OAuth, Gemini API keys, OpenRouter key/OAuth, and local
Ollama models. Environment credentials remain supported. Use /providers, /login, /model, and
/privacy inside AI mode. /status shows the selected provider and model, locally configured
authentication sources, draft state, schema path, cloud policy, and conversation persistence without
contacting a provider. Use /model without an argument to show the current model.
The selected model is part of the per-schema Pi conversation and is restored when AI mode is
re-entered. /new and /clear keep the current model for the new conversation. If that model is no
longer available or authenticated, the CLI shows Pi's fallback warning instead of silently changing
it.
While a request is running, the CLI displays [AI] Thinking with <provider>/<model>… and changes the
prompt to form0(ai,busy)> (or form0(server,ai,busy)>). Natural-language input entered while busy
is queued in order as follow-up requests; an empty Enter only redraws the prompt. /help, /status,
/privacy, and /cancel remain available. /cancel stops the active request and clears queued
follow-ups; other commands are unavailable until processing has finished.
ai.allowCloud: false on the form or any field blocks cloud models with no CLI override. Any
requiresConsent: true asks before the first cloud request and after switching cloud providers.
Otherwise provider selection counts as consent after the CLI states that the full schema is sent.
The agent may read relevant Markdown from https://docs.form0.dev, beginning at llms.txt; fetched
text is untrusted supplementary guidance and installed core catalogs win on conflicts. There is no
filesystem, shell, arbitrary web, extension, skill, MCP, image, or record-data access. Forms that do
not fit completely in the selected model context are refused rather than truncated. Calculations and
events are checked by form0-core before approval, but generated JavaScript still deserves review.
form0)init [dir] - Initialize a project (Standard/Web/Mobile)load / load <file> - Interactive load or load a specific schema filepreview - Show the schema summaryvalidate - Validate the current schemarun [--values <input>] - Run the engine with optional valueswatch [--auto-run] [--auto-validate] - Watch schema changesserve [--app] [--port] [--host] - Start live preview; --app runs the app dev server from form0.config.jsschema edit - Open the schema editorai - Enter preview AI authoring modeschema import <csv> [--force] / schema export [csv] [--force] - Convert JSON ↔ CSVschema convert formio <json> [options] - Preview: Convert an exported Form.io form schema to form0schema keys - Generate missing field keystest [dir] - Run the test.js file in a projectconnector <action> - Manage connectors (install/configure/test/reload/status/remove/uninstall/list)values / fields - Show stored values or valid field namesreload - Reload the current schema filestatus - Show the current session statusclear / clear values - Clear screen or stored valuestheme [name] / locale [name] - View or change theme/localehelp / exit - Help or quitform0 init [dir]
form0 validate <schema>
form0 preview <schema>
form0 run <schema> --values <json|string|file>
form0 watch [schema] --auto-run --auto-validate
form0 serve [schema] --port 3030 --host localhost --app
form0 schema import <csv> [-o <json>] [-f]
form0 schema export [csv] [-i <json>] [-f]
form0 schema convert formio <json> [-o <json>] [--report <json>] [--dry-run] [--allow-lossy] [-f]
form0 test [dir]
form0 connector <action> [name]
form0 theme [name]
form0 locale [name]
form0 interactive # or: form0 shell
form0 ai [schema] # preview AI authoring
form0-cli accepts JSON strings or files for --values:
form0 run form.schema.json --values '{"name":"Alice","age":25}'
form0 run form.schema.json --values values.json
form0 run form.schema.json --values values.yaml
Invalid fields are filtered out with warnings based on the schema.
The preview server is a local development tool: it loads configured connector modules and executes
schema behavior. Use trusted projects and connectors. It binds to localhost by default; if you use
--host to expose it to another interface, only do so on a trusted network.
Do not report suspected vulnerabilities through public issues. See SECURITY.md for private reporting instructions.
See SUPPORT.md for help and CONTRIBUTING.md to contribute.
FAQs
Command-line tools for form0, the open-source schema-driven form ecosystem by paqu.io. Scaffold, validate, test and preview form schemas locally.
The npm package form0-cli receives a total of 42 weekly downloads. As such, form0-cli popularity was classified as not popular.
We found that form0-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.