@aion0/forge 0.10.3 → 0.10.5

package/RELEASE_NOTES.md

@@ -1,11 +1,11 @@
-# Forge v0.10.3
+# Forge v0.10.5
 
 Released: 2026-05-30
 
-## Changes since v0.10.2
+## Changes since v0.10.4
 
 ### Other
-- fix(settings): unmask apiProfiles.*.apiKey on POST (regression in v0.10.0)
+- fix(chat/anthropic): normalize baseURL to include /v1 (fix Not Found regression)
 
 
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.2...v0.10.3
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.4...v0.10.5

package/lib/agents/migrate.ts

@@ -24,9 +24,8 @@
  * no-op (returns false, no save).
  */
 
-import { writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
-import YAML from 'yaml';
 import { getDataDir } from '../dirs';
 import type { Settings } from '../settings';
 
@@ -130,23 +129,17 @@ function detectsLegacyShape(settings: Settings): boolean {
   return false;
 }
 
-function writeBackup(settings: Settings): void {
+function writeBackup(_settings: Settings): void {
+  // Raw byte copy of settings.yaml — never re-serialize the decrypted
+  // in-memory form. v0.10.x shipped a YAML.stringify(settings) backup
+  // that leaked plaintext API tokens + ANTHROPIC_AUTH_TOKEN into the
+  // data dir. Fixed in v0.10.4+.
   try {
+    const src = join(getDataDir(), 'settings.yaml');
+    if (!existsSync(src)) return;
     const ts = Date.now();
     const backupPath = join(getDataDir(), `settings.backup.agents-${ts}.yaml`);
-    const slice = {
-      _backup_note: 'Pre-migration snapshot of agent-related settings. Safe to delete after verifying migration worked.',
-      _backup_ts: new Date(ts).toISOString(),
-      agents: settings.agents,
-      defaultAgent: settings.defaultAgent,
-      chatAgent: settings.chatAgent,
-      telegramAgent: settings.telegramAgent,
-      docsAgent: settings.docsAgent,
-      telegramModel: settings.telegramModel,
-      taskModel: settings.taskModel,
-      pipelineModel: settings.pipelineModel,
-    };
-    writeFileSync(backupPath, YAML.stringify(slice), 'utf-8');
+    copyFileSync(src, backupPath);
     console.log(`[migrate-agents] backup → ${backupPath}`);
   } catch (err) {
     console.warn('[migrate-agents] backup write failed (continuing anyway):', err instanceof Error ? err.message : err);

package/lib/chat/llm/anthropic.ts

@@ -50,9 +50,16 @@ function decodeToolName(name: string): string { return name.replace(/__/g, '.');
 
 function makeClient(apiKey: string, baseUrl: string) {
   const oauth = isOauthToken(apiKey);
+  // @ai-sdk/anthropic appends `/messages` directly onto the baseURL (unlike
+  // @anthropic-ai/sdk which inserts `/v1/`). If the URL doesn't end in /v1,
+  // the request goes to `${host}/messages` and 404s. Forge's defaultBaseUrl
+  // returns the host without /v1 to match the other SDK — normalize here.
+  const normalized = baseUrl
+    ? baseUrl.replace(/\/+$/, '') + (/\/v\d+$/.test(baseUrl.replace(/\/+$/, '')) ? '' : '/v1')
+    : undefined;
   return createAnthropic({
     apiKey: oauth ? '' : apiKey,
-    baseURL: baseUrl || undefined,
+    baseURL: normalized,
     headers: oauth
       ? {
           authorization: `Bearer ${apiKey}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.3",
+  "version": "0.10.5",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {