@aion0/forge 0.10.36 → 0.10.37

package/components/SettingsModal.tsx

@@ -831,6 +831,31 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
           />
         </div>
 
+        {/* Re-run Onboarding */}
+        <div className="space-y-2">
+          <label className="text-xs text-[var(--text-secondary)] font-semibold uppercase">
+            Onboarding
+          </label>
+          <button
+            type="button"
+            onClick={async () => {
+              await fetch('/api/onboarding', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ action: 'reset' }),
+              });
+              // Reload so the Dashboard banner re-renders.
+              window.location.reload();
+            }}
+            className="text-[11px] px-2.5 py-1 border border-[var(--accent)] text-[var(--accent)] rounded hover:bg-[var(--accent)] hover:text-white"
+          >
+            ↺ Re-run Onboarding wizard
+          </button>
+          <p className="text-[10px] text-[var(--text-secondary)]">
+            Re-opens the first-run setup banner. Existing values are preserved — the wizard never overwrites non-empty fields.
+          </p>
+        </div>
+
         {/* Admin Password */}
         <div className="space-y-2">
           <label className="text-xs text-[var(--text-secondary)] font-semibold uppercase">
@@ -1041,6 +1066,23 @@ function ProfileRow({ id, cfg, inputClass, onUpdate, onDelete, isApi: isApiProp
                   className={inputClass + ' font-mono'}
                 />
               </div>
+              <div>
+                <label className="text-[8px] text-[var(--text-secondary)]">
+                  Max input tokens — total prompt cap (system + memory + history + tools). Default 200000 (Claude Code working window). Anything beyond gets strictly compressed: memory tail dropped first, then oldest history. Lower it (e.g. 12000) for 16k-context legacy models.
+                </label>
+                <input
+                  type="number"
+                  min={4000}
+                  value={cfg.maxInputTokens ?? ''}
+                  onChange={e => {
+                    const raw = e.target.value.trim();
+                    const n = raw === '' ? undefined : Number(raw);
+                    onUpdate({ ...cfg, maxInputTokens: Number.isFinite(n) ? n : undefined });
+                  }}
+                  placeholder="200000  (default — Claude Code 200k)"
+                  className={inputClass + ' font-mono'}
+                />
+              </div>
               <div className="flex items-center gap-2 pt-1">
                 <button
                   onClick={runTest}

package/components/WebTerminal.tsx

@@ -268,6 +268,16 @@ const WebTerminal = forwardRef<WebTerminalHandle, WebTerminalProps>(function Web
   const [expandedRoot, setExpandedRoot] = useState<string | null>(null);
   const [availableAgents, setAvailableAgents] = useState<{ id: string; name: string; detected?: boolean }[]>([]);
   const [selectedAgent, setSelectedAgent] = useState<string>('');
+  // Cached default-agent cliCmd. Resolved once on mount (fast in theory but
+  // the route can take 1–5s when many concurrent fetches saturate workers).
+  // openSessionInTerminal reads this directly — no await per session restore.
+  const defaultAgentCmdRef = useRef<string>('claude');
+  useEffect(() => {
+    fetch('/api/agents?resolve=')
+      .then(r => r.json())
+      .then(info => { if (info?.cliCmd) defaultAgentCmdRef.current = info.cliCmd; })
+      .catch(() => { /* keep bare 'claude' */ });
+  }, []);
   const [defaultAgentId, setDefaultAgentId] = useState('claude');
 
   // Restore shared state from server after mount
@@ -359,7 +369,12 @@ const WebTerminal = forwardRef<WebTerminalHandle, WebTerminalProps>(function Web
       const sf = skipPermissions ? ' --dangerously-skip-permissions' : '';
       let mcpFlag = '';
       try { const { getMcpFlag } = await import('@/lib/session-utils'); mcpFlag = await getMcpFlag(projectPath); } catch {}
-      const cmd = `cd "${projectPath}" && claude --resume ${sessionId}${sf}${mcpFlag}\n`;
+      // Use the cached default-agent cliCmd. Pre-fetched on mount above;
+      // if still 'claude' (fetch slow / pending), we use bare claude — old
+      // behavior, wrong if conda-base shadows the real one, but at least
+      // doesn't block the command from appearing.
+      const agentCmd = defaultAgentCmdRef.current;
+      const cmd = `cd "${projectPath}" && ${agentCmd} --resume ${sessionId}${sf}${mcpFlag}\n`;
       pendingCommands.set(paneId, cmd);
       const projectName = projectPath.split('/').pop() || 'Terminal';
       const newTab: TabState = {

package/lib/chat/agent-loop.ts

@@ -47,15 +47,25 @@ import type {
 // sentinel message below so the user knows why the turn stopped.
 const MAX_ITERATIONS = 24;
 const MAX_TOKENS = 16000;
-// Working-window budgets for the LLM history. Capped by message count
-// AND by token estimate (whichever hits first), see design §8. Older
-// raw is summarized by the memory-standalone Temper Summary sub-task
-// and recalled via buildMemoryContext as compact blocks instead.
+// Working-window message-count cap. Token cap is dynamic per-profile
+// (see DEFAULT_MAX_INPUT_TOKENS + ApiProfile.maxInputTokens). Older raw
+// is summarized by the memory-standalone Temper Summary sub-task and
+// recalled via buildMemoryContext as compact blocks.
 const HISTORY_MSG_BUDGET = 60;
-// Bumped 8000 → 32000 — modern models all ≥ 200k context; 8000 was
-// stripping single oversized tool results (e.g. mantis.search_bugs
-// returning 20k chars), leaving history empty after orphan-trim.
-const HISTORY_TOKEN_BUDGET = 32000;
+// Default total input ceiling when the profile doesn't set one. Matches
+// Claude Code's 200k working window — modern Claude / DeepSeek-V3 /
+// Qwen-Max all expose ≥ 200k context. Anything beyond this gets strictly
+// compressed (memory tail trimmed first, then oldest history evicted).
+// Lower it per-profile (e.g. 12000) for older 16k-context models —
+// Forge auto-trims memory then history to fit.
+const DEFAULT_MAX_INPUT_TOKENS = 200_000;
+// Reserved for the model's reply so we don't have to fight Anthropic
+// hard limits where max_tokens is part of the context budget.
+const OUTPUT_RESERVE_TOKENS = MAX_TOKENS;
+// Absolute floor — if even after trimming memory we can't fit this
+// many tokens of history, the profile's ceiling is unworkable and we
+// surface a clear error instead of sending a useless request.
+const MIN_HISTORY_TOKENS = 2_000;
 // Hard cap on a single tool_result stored into the conversation (chars).
 // A giant result (e.g. a connector returning a full test tree) would
 // otherwise blow the whole HISTORY_TOKEN_BUDGET, push its paired
@@ -112,6 +122,9 @@ export interface ProviderResolution {
   apiKey: string;
   baseUrl: string;
   model: string;
+  /** Total input-token ceiling for chat (system + memory + history + tools).
+   *  Falls back to DEFAULT_MAX_INPUT_TOKENS when the profile leaves it unset. */
+  maxInputTokens?: number;
 }
 
 /**
@@ -204,6 +217,7 @@ export function resolveProvider(sessionProvider: string | null, sessionModel: st
     apiKey: profile.apiKey,
     baseUrl: profile.baseUrl || defaultBaseUrl(profile.provider),
     model,
+    maxInputTokens: profile.maxInputTokens,
   };
 }
 
@@ -607,8 +621,11 @@ export async function runTurn(args: RunTurnArgs): Promise<{ ok: boolean; error?:
   let openConnectorTools = allConnectorTools.filter((t) => openSet.has(t.name.split('.')[0]!));
   let allTools: LlmTool[] = [...builtinToolDefs, ...openConnectorTools];
 
+  // Keep memContext separate from `system` — we may need to trim it
+  // per-iteration when the profile's maxInputTokens is tight. The
+  // assembled string is recomputed each iter (after open-set + memory
+  // trim). `system` here holds the base (no memory section).
   let system = buildSystem(openConnectorTools, openSet);
-  if (memContext) system += '\n\n─── Memory context (auto-loaded) ───\n' + memContext;
   if (memStore.enabled) {
     const searchHint = memStore.kind === 'local'
       ? '• memory_search is keyword LIKE over local blocks + episodes — useful for finding past notes; prefer memory_get_block / memory_list_blocks for first-person facts.'
@@ -627,23 +644,17 @@ export async function runTurn(args: RunTurnArgs): Promise<{ ok: boolean; error?:
     while (iter < MAX_ITERATIONS) {
       iter += 1;
 
-      const history = trimOrphanToolResults(
-        listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, HISTORY_TOKEN_BUDGET, estimateTokens),
-      );
-      // Belt-and-suspenders: tool_result truncation should keep a complete
-      // pair in-window, but if history is somehow empty, fail clearly
-      // instead of letting the provider throw "messages must not be empty".
-      if (history.length === 0) {
-        cb({ type: 'error', data: { error: 'Conversation context is empty after trimming an oversized result. Clear the chat or retry with a narrower query.' } });
-        return { ok: false, error: 'empty history' };
-      }
-
       // ── Recompute open set every iteration ──────────────────────
       // Scan history (since last user text msg) + this turn's accumulated
       // blocks → which connectors are open right now. Then filter tools.
       // First iteration: only user-text auto-opens seed the set. After
       // the LLM calls connector_open, subsequent iterations pick that up.
-      const newOpenSet = computeOpenSet(history, assistantBlocksAccum);
+      // (Computed off a preview slice of history — refined below once
+      // we have the real history under budget.)
+      const previewHistory = trimOrphanToolResults(
+        listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, 8_000, estimateTokens),
+      );
+      const newOpenSet = computeOpenSet(previewHistory, assistantBlocksAccum);
       const setChanged = newOpenSet.size !== openSet.size ||
         [...newOpenSet].some((n) => !openSet.has(n));
       if (setChanged) {
@@ -651,23 +662,69 @@ export async function runTurn(args: RunTurnArgs): Promise<{ ok: boolean; error?:
         openConnectorTools = allConnectorTools.filter((t) => openSet.has(t.name.split('.')[0]!));
         allTools = [...builtinToolDefs, ...openConnectorTools];
         system = buildSystem(openConnectorTools, openSet);
-        if (memContext) system += '\n\n─── Memory context (auto-loaded) ───\n' + memContext;
         console.log(`[chat] open set → {${[...openSet].join(',')}} (${openConnectorTools.length} connector tools active)`);
       }
 
+      // ── Dynamic context budget ──────────────────────────────────
+      // Total profile cap (default 60k, override per profile). Subtract
+      // fixed contributors (system, tools schema) and reservation for
+      // the model's reply → what's left splits between memory + history.
+      // Memory gets trimmed (from tail = least-pinned recall hits) when
+      // history would dip below the floor.
+      const maxInputTokens = provider.maxInputTokens || DEFAULT_MAX_INPUT_TOKENS;
+      const systemTok = Math.ceil(system.length / 4);
+      const toolsTok = Math.ceil(JSON.stringify(allTools).length / 4);
+      const fixedTok = systemTok + toolsTok + OUTPUT_RESERVE_TOKENS;
+
+      let memCtxTrimmed = memContext;
+      let memCtxTok = Math.ceil(memCtxTrimmed.length / 4);
+      let historyBudget = maxInputTokens - fixedTok - memCtxTok;
+
+      if (historyBudget < MIN_HISTORY_TOKENS) {
+        // Need to recover from memory. Each token = ~4 chars; cut from the
+        // END of memContext (renderMemoryContext emits pinned blocks first,
+        // recall hits last → tail is the least-pinned, easiest to drop).
+        const shortBy = MIN_HISTORY_TOKENS - historyBudget;
+        const charsToDrop = Math.min(memCtxTrimmed.length, shortBy * 4);
+        if (charsToDrop > 0) {
+          memCtxTrimmed = memCtxTrimmed.slice(0, memCtxTrimmed.length - charsToDrop)
+            + (memCtxTrimmed.length - charsToDrop > 0 ? '\n[… memory context trimmed to fit profile.maxInputTokens]' : '');
+          memCtxTok = Math.ceil(memCtxTrimmed.length / 4);
+          historyBudget = maxInputTokens - fixedTok - memCtxTok;
+        }
+      }
+
+      if (historyBudget < 500) {
+        cb({ type: 'error', data: { error:
+          `API profile maxInputTokens=${maxInputTokens} too small: ` +
+          `baseline (system=${systemTok} + tools=${toolsTok} + memory=${memCtxTok} + reserve=${OUTPUT_RESERVE_TOKENS}) ` +
+          `already takes ${fixedTok + memCtxTok} tokens. ` +
+          `Raise maxInputTokens in Settings → API Profiles, or pick a model with a larger context window.`
+        } });
+        return { ok: false, error: 'profile context budget exhausted' };
+      }
+
+      const history = trimOrphanToolResults(
+        listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, historyBudget, estimateTokens),
+      );
+      if (history.length === 0) {
+        cb({ type: 'error', data: { error: 'Conversation context is empty after trimming an oversized result. Clear the chat or retry with a narrower query.' } });
+        return { ok: false, error: 'empty history' };
+      }
+
+      // Stitch trimmed memContext onto base system for this call only.
+      const systemForCall = memCtxTrimmed
+        ? `${system}\n\n─── Memory context (auto-loaded) ───\n${memCtxTrimmed}`
+        : system;
+
       assistantBlocksAccum = [];
       let currentTextBuf = '';
 
       // ── Token composition log (input side, BEFORE the call) ──
-      // Heuristic char/4. Lets you correlate later with the provider's
-      // real usage.input_tokens — if the gap widens turn-over-turn, the
-      // memory/tools blob is silently growing.
-      const _systemTok = Math.ceil(system.length / 4);
-      const _memCtxTok = Math.ceil(memContext.length / 4);
-      const _toolsTok  = Math.ceil(JSON.stringify(allTools).length / 4);
       const _historyTok = history.reduce((s, m) => s + estimateTokens(m), 0);
       const _historyMsgs = history.length;
-      console.log(`[chat-tokens] session=${args.sessionId} turn=${iter} est_in=${_systemTok + _historyTok + _toolsTok} system=${_systemTok} history=${_historyTok}(${_historyMsgs}msgs) memory=${_memCtxTok} tools=${_toolsTok}`);
+      const _est_in = systemTok + memCtxTok + toolsTok + _historyTok;
+      console.log(`[chat-tokens] session=${args.sessionId} turn=${iter} cap=${maxInputTokens} est_in=${_est_in} system=${systemTok} memory=${memCtxTok}${memCtxTrimmed.length < memContext.length ? '(trimmed)' : ''} tools=${toolsTok} history=${_historyTok}(${_historyMsgs}msgs) reserve=${OUTPUT_RESERVE_TOKENS}`);
 
       const result = await streamLlm(
         {
@@ -675,7 +732,7 @@ export async function runTurn(args: RunTurnArgs): Promise<{ ok: boolean; error?:
           apiKey: provider.apiKey,
           baseUrl: provider.baseUrl,
           model: provider.model,
-          system,
+          system: systemForCall,
           history,
           tools: allTools,
           maxTokens: MAX_TOKENS,

package/lib/chat/llm/openai.ts

@@ -80,8 +80,12 @@ export const openaiAdapter: LlmAdapter = {
     // Some providers (litellm/vLLM) reject `tools: []` — they want the
     // field omitted entirely when there are no tools.
     const hasTools = Object.keys(tools).length > 0;
+    // Force /v1/chat/completions. @ai-sdk/openai v3 routes the default
+    // factory to the Responses API (/v1/responses), which only OpenAI
+    // first-party hosts — DeepSeek/Qianwen/LiteLLM proxies/vLLM/Ollama
+    // all 400 on it. .chat() picks the universally-supported endpoint.
     const result = streamText({
-      model: client(req.model),
+      model: client.chat(req.model),
       system: req.system,
       messages: historyToModelMessages(req.history),
       ...(hasTools ? { tools } : {}),

package/lib/chat/session-store.ts

@@ -231,6 +231,18 @@ function touchSession(id: string): void {
 
 // ─── Messages ────────────────────────────────────────────
 
+// Cap any single field to 64KB before it hits sqlite. LLM proxies (LiteLLM,
+// vLLM) sometimes return error payloads listing every message that failed
+// validation — a 188-turn chat trips 6000+ entries and the JSON balloons
+// to 25+ MB. One bad row drags out every UI page-load that touches it,
+// so truncate at write time.
+const FIELD_BYTE_CAP = 64 * 1024;
+function capLargeText(s: string | undefined | null): string | null {
+  if (s == null) return null;
+  if (s.length <= FIELD_BYTE_CAP) return s;
+  return s.slice(0, FIELD_BYTE_CAP) + `\n… (truncated, full length ${s.length} chars)`;
+}
+
 export function appendMessage(opts: {
   session_id: string;
   role: Role;
@@ -238,13 +250,21 @@ export function appendMessage(opts: {
   error?: string;
 }): Message {
   ensureSchema();
+  // Truncate any text block that's gone runaway (e.g. a streamed error
+  // message stuffed into the assistant turn for UI display).
+  const cappedBlocks = opts.blocks.map(b => {
+    if (b.type === 'text' && b.text.length > FIELD_BYTE_CAP) {
+      return { ...b, text: capLargeText(b.text)! };
+    }
+    return b;
+  });
   const row: MessageRow = {
     id: randomUUID(),
     session_id: opts.session_id,
     role: opts.role,
-    blocks: JSON.stringify(opts.blocks),
+    blocks: JSON.stringify(cappedBlocks),
     ts: Date.now(),
-    error: opts.error ?? null,
+    error: capLargeText(opts.error),
   };
   db().prepare(`
     INSERT INTO chat_messages (id, session_id, role, blocks, ts, error)

package/lib/chat/tool-dispatcher.ts

@@ -709,7 +709,7 @@ function findConnectorTool(qualified: string): {
  * the extension's runner finishes those at execution time.
  */
 function buildConnectorPayload(
-  def: { id: string; name: string; runner?: 'main' | 'isolated'; host_match?: string; login_redirect?: string },
+  def: { id: string; name: string; runner?: 'main' | 'isolated'; host_match?: string; login_redirect?: string; tab_strategy?: 'reuse' | 'ephemeral' },
   entry: ConnectorEntry,
   settings: Record<string, any>,
 ) {
@@ -747,6 +747,11 @@ function buildConnectorPayload(
     host_match: hostMatch,
     login_redirect: loginRedirect,
     runner: def.runner || entry.runner || 'main',
+    // Connector-level opt-in: 'ephemeral' = always open a fresh background
+    // tab, close after. Missing/'reuse' = pick an existing matching tab.
+    // Was being silently dropped — extension never saw it, so manifests
+    // with tab_strategy:ephemeral (mantis, tp) ran in reuse mode.
+    ...(def.tab_strategy ? { tab_strategy: def.tab_strategy } : {}),
     entries: [expandedEntry],
   };
 }

package/lib/help-docs/17-connectors.md

@@ -340,6 +340,57 @@ X-Forge-Token: …
 or `multipart/form-data` with a `file` field accepting `.yaml`,
 `.yml`, or `.zip`. Zip must have `manifest.yaml` at the root.
 
+### POST /api/connectors/import-config-template
+
+Bulk-fill `connector-configs.json` from a JSON template. The Settings →
+Connectors panel exposes this as the **↥ Import Template** button.
+
+The template format:
+
+```json
+{
+  "_README": "...",
+  "_prompts": {
+    "gitlab_pat": {
+      "label": "GitLab PAT",
+      "hint": "where to grab it",
+      "secret": true,
+      "required": true
+    }
+  },
+  "gitlab": {
+    "config": { "base_url": "https://...", "token": "${gitlab_pat}" },
+    "enabled": true
+  }
+}
+```
+
+Behavior:
+
+- Two-phase: `multipart/form-data` (analyze) returns deduplicated list of
+  `${key}` placeholders the user still needs to fill. `application/json
+  {template, values}` (apply) substitutes and merges.
+- Same placeholder key referenced from multiple connectors (e.g.
+  `gitlab_pat` used by `gitlab.token` AND `jenkins.instances[0].gitlab_pat`)
+  is asked **once** and applied to every target.
+- Static values (non-placeholder) are applied as-is.
+- **Existing non-empty fields are preserved** — the template never
+  overwrites a real token a user already configured (a `TODO_*` carry-over
+  is treated as empty and gets overwritten).
+- Connectors whose manifest is not installed yet are skipped and reported
+  in the result. Sync the marketplace first, then re-import.
+- Keys starting with `_` (`_README`, `_prompts`, etc.) are metadata.
+
+Forge ships a default template at `templates/connector-config-template.json`,
+bundled into the build. The Import button always works out of the box.
+Users can override the bundled one by dropping their own at
+`<dataDir>/config-template.json` — the GET endpoint picks the override
+first, else falls back to the bundle.
+
+Each prompt may include `url` + `url_label`, surfaced in the modal as
+a "↗ Get token" link next to the field so the user can jump straight
+to the page that issues the value.
+
 ## Migration from pre-v0.9
 
 Pre-v0.9 Forge stored connectors as built-in plugins under

package/lib/settings.ts

@@ -64,6 +64,15 @@ export interface ApiProfile {
   model: string;
   apiKey: string;
   baseUrl?: string;
+  /**
+   * Total input-token ceiling for chat. Includes system prompt + connector
+   * catalog + memory context (summary + Temper recall) + history. Forge
+   * dynamically trims (memory tail dropped first, then oldest history)
+   * to keep the assembled prompt under this. Defaults to 200k (Claude
+   * Code's working window) when unset; lower it (e.g. 12000) for older
+   * 16k-context models that would otherwise truncate server-side.
+   */
+  maxInputTokens?: number;
 }
 
 /**
@@ -186,6 +195,12 @@ export interface Settings {
   pipelineTmpKeepFailedDays: number;
   pipelineTmpKeepCancelledDays: number;
   pipelineTmpGcIntervalHours: number;
+  /**
+   * First-run onboarding wizard. False (or absent) → Forge shows the
+   * wizard on every launch until the user completes it or skips. True
+   * → silent. Settings → "Re-run Onboarding" sets it back to false.
+   */
+  onboardingCompleted: boolean;
 }
 
 const defaults: Settings = {
@@ -236,6 +251,7 @@ const defaults: Settings = {
   pipelineTmpKeepFailedDays: 3,
   pipelineTmpKeepCancelledDays: 3,
   pipelineTmpGcIntervalHours: 6,
+  onboardingCompleted: false,
 };
 
 /** Decrypt nested apiKey fields in agents (legacy migration window) +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.36",
+  "version": "0.10.37",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {

package/templates/connector-config-template.json

@@ -0,0 +1,131 @@
+{
+  "_README": "Team template — import via Forge UI: Settings → Connectors → 'Import Template' button. Forge scans the ${key} placeholders, asks you once for each (shared keys like gitlab_pat are asked once and applied everywhere). After import, existing non-empty values are preserved — template never overwrites your real tokens.",
+
+  "_prompts": {
+    "gitlab_token_name": {
+      "label": "GitLab token name",
+      "hint": "Identifier of your GitLab token (typically your AD/LDAP login, e.g. 'zliu'). Reused by Jenkins as the gitlab_token_name + injected as TOKEN_USER build param.",
+      "group": "gitlab",
+      "required": true
+    },
+    "gitlab_pat": {
+      "label": "GitLab Personal Access Token",
+      "hint": "Scope: read_api + api. Reused as TOKEN_PASSWORD build param for Jenkins-triggered jobs.",
+      "url": "https://dops-git106.fortinet-us.com/-/user_settings/personal_access_tokens",
+      "url_label": "Open GitLab PAT page",
+      "secret": true,
+      "required": true
+    },
+    "jenkins_username": {
+      "label": "Jenkins username",
+      "hint": "Your Jenkins login (AD/LDAP), e.g. 'zliu'.",
+      "group": "jenkins",
+      "required": true
+    },
+    "jenkins_api_token": {
+      "label": "Jenkins API Token",
+      "hint": "User avatar → Configure → API Token → Add new",
+      "url": "http://nac-dev-jenkins.fortinet-us.com:8080/me/configure",
+      "url_label": "Open Jenkins user configure page",
+      "secret": true,
+      "required": true,
+      "group": "jenkins"
+    },
+    "blackduck_api_token": {
+      "label": "Black Duck API Token",
+      "hint": "User menu → My Access Tokens → Create new. Forge auto-exchanges for ~2h JWT.",
+      "url": "https://dops-blackduck.fortinet-us.com/api/current-user/tokens",
+      "url_label": "Open Black Duck tokens page",
+      "secret": true,
+      "required": true
+    },
+    "nac_admin_password": {
+      "label": "NAC admin password (optional)",
+      "hint": "Used by SSH + REST login() fallback. Leave blank if you'll pass per-call.",
+      "secret": true,
+      "required": false
+    },
+    "fortincm_password": {
+      "label": "FortiNCM admin password (optional)",
+      "hint": "Only needed if you use NCM",
+      "secret": true,
+      "required": false
+    }
+  },
+
+  "gitlab": {
+    "config": {
+      "base_url": "https://dops-git106.fortinet-us.com/",
+      "token": "${gitlab_pat}"
+    },
+    "enabled": true
+  },
+
+  "mantis": {
+    "config": {
+      "base_url": "https://mantis.fortinet.com/",
+      "default_project": "FortiNAC"
+    },
+    "enabled": true
+  },
+
+  "pmdb": {
+    "config": {
+      "base_url": "https://pmdb.fortinet.com/"
+    },
+    "enabled": true
+  },
+
+  "teams": {
+    "config": {
+      "base_url": "https://teams.microsoft.com/"
+    },
+    "enabled": true
+  },
+
+  "jenkins": {
+    "config": {
+      "instances": "[{\"name\":\"default-jenkins\",\"base_url\":\"http://nac-dev-jenkins.fortinet-us.com:8080\",\"username\":\"${jenkins_username}\",\"api_token\":\"${jenkins_api_token}\",\"gitlab_pat\":\"${gitlab_pat}\",\"gitlab_token_name\":\"${gitlab_token_name}\",\"gitlab_token_name_param\":\"${gitlab_token_name}\",\"gitlab_pat_param\":\"\",\"inject_params\":\"[{\\\"name\\\":\\\"TOKEN_USER\\\",\\\"value\\\":\\\"${gitlab_token_name}\\\"},{\\\"name\\\":\\\"TOKEN_PASSWORD\\\",\\\"value\\\":\\\"${gitlab_pat}\\\"}]\"}]"
+    },
+    "enabled": true
+  },
+
+  "tp": {
+    "config": {
+      "base_url": "https://nac-tp.fortinet-us.com",
+      "api_base_url": "https://nac-tp.fortinet-us.com:8000",
+      "username": "${user_name}"
+    },
+    "enabled": true
+  },
+
+  "nac": {
+    "config": {
+      "port": "22",
+      "username": "admin",
+      "password": "${nac_admin_password}"
+    },
+    "enabled": true
+  },
+
+  "fortincm": {
+    "config": {
+      "username": "admin",
+      "password": "${fortincm_password}"
+    },
+    "enabled": false
+  },
+
+  "scap": {
+    "config": {},
+    "enabled": true
+  },
+
+  "blackduck": {
+    "config": {
+      "base_url": "https://dops-blackduck.fortinet-us.com",
+      "api_token": "${blackduck_api_token}"
+    },
+    "enabled": true
+  }
+}