SculptForge Files

Added

• Managed policy for studios (docs/guide/studios.md "IT deployment"): policy.json in /etc/sculptforge, /Library/Application Support/SculptForge or C:\ProgramData\SculptForge (or SF_POLICY when there is none) locks AI on or off, network features, the allowed AI providers and addresses, sign-in for AI, AI tools (MCP on or off, never controlling the window, allowed kinds of command), the update check, channel and feed. Locked settings say Managed by your studio; a broken policy fails closed. sculptforge-cli --policy shows what it manages.
• AI audit log: every AI tool (MCP) command, refused ones too, and every Brush Lab and Generate 3D request is a JSON line (time, user, host, client, command, a summary of its settings, result) in a local file or a share the policy names, rotated by size. No artwork, keys or long text. sculptforge-cli --audit-log prints the path.
• Studio sign-in (Okta, Microsoft Entra ID, Google Workspace, Auth0, Keycloak): OpenID Connect device sign-in in the artist's browser, no local listener; tokens in the keychain, sent only to the studio's own AI gateway. Edit > Preferences > AI > Studio sign-in, or sculptforge-cli --sign-in.
• AI provider presets in Edit > Preferences > AI > Provider (also in Brush Lab): Anthropic, OpenAI, Ollama, LM Studio, vLLM, llama.cpp server, LiteLLM proxy (a studio gateway for Bedrock, Vertex AI and Azure OpenAI) and OpenRouter.
• Each release carries a CycloneDX software bill of materials (SculptForge-<version>-sbom.cdx.json), covered by the signed checksums. A one-page security overview for IT reviews is in the guide.

Changed

• An empty shelf is hidden when Customize Shelves is off, and the canvas takes its space; it returns while customizing so items can be dropped back onto it. Saved layouts with empty shelves load as before (#139, thanks ebarranco).

Security

• AI keys (Brush Lab, Hugging Face, fal.ai, Meshy) are stored in the operating system's keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) instead of ai.json; keys already in ai.json move there at the first start. Without a keychain (SF_KEYCHAIN=none), a key lasts for the session; environment variables still work.

Downloads

New here? install/ explains which file to pick, or install with one command: curl -fsSL https://raw.githubusercontent.com/islandmed/SculptForge/main/install/install.sh | sh (macOS / Linux), irm https://raw.githubusercontent.com/islandmed/SculptForge/main/install/install.ps1 | iex (Windows PowerShell). Each file is also attached without its version number (e.g. SculptForge-macos.dmg) so links to releases/latest/download/... always get the newest build.

The builds are not code-signed yet. macOS: right-click the app → Open the first time. Windows: if SmartScreen appears, choose More info → Run anyway. Checksums are in SHA256SUMS.txt.