@aion0/forge 0.10.37 → 0.10.39

package/RELEASE_NOTES.md

@@ -1,8 +1,12 @@
-# Forge v0.10.37
+# Forge v0.10.39
 
-Released: 2026-06-04
+Released: 2026-06-05
 
-## Changes since v0.10.36
+## Changes since v0.10.38
 
+### Other
+- feat(chat): auto-link bug/MR/CVE refs in AI output (#32)
+- fix(chat): heal orphan tool_use blocks in session history
 
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.36...v0.10.37
+
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.38...v0.10.39

package/app/api/chat/link-patterns/route.ts

@@ -0,0 +1,23 @@
+/**
+ * GET /api/chat/link-patterns
+ *
+ * Returns the chat-output linkify rules with all `{base_url}` placeholders
+ * expanded against installed connector configs. Patterns whose connector
+ * isn't installed/configured are filtered out — chat UI just renders the
+ * remaining ones via remarkLinkify (lib/chat/remark-linkify.ts).
+ */
+
+import { NextResponse } from 'next/server';
+import { getActiveLinkPatterns, serializePatterns } from '@/lib/chat/link-patterns';
+
+export async function GET() {
+  try {
+    const patterns = serializePatterns(getActiveLinkPatterns());
+    return NextResponse.json({ ok: true, patterns });
+  } catch (e) {
+    return NextResponse.json(
+      { ok: false, error: e instanceof Error ? e.message : String(e), patterns: [] },
+      { status: 500 },
+    );
+  }
+}

package/app/api/onboarding/route.ts

@@ -58,6 +58,11 @@ interface OnboardingPayload {
     setAsDefault?: boolean;
   };
   connectorValues?: Record<string, string>;     // template ${key} → value
+  /** Subset of template connector ids to install. Missing/empty = install
+   *  everything in the template. Unselected ids are skipped entirely —
+   *  no installFromRegistry, no setConnectorConfig. Lets users opt out of
+   *  Jenkins/NAC/FortiNCM etc. on first run. */
+  selectedConnectors?: string[];
   pipelines?: string[];                          // marketplace names to install
   projectRoots?: string[];                       // paths to append
 }
@@ -154,13 +159,19 @@ function applyCliAgent(a: OnboardingPayload['cliAgent']): string | null {
   return null;
 }
 
-async function applyConnectors(values: Record<string, string> | undefined): Promise<{
+async function applyConnectors(
+  values: Record<string, string> | undefined,
+  selectedConnectors: string[] | undefined,
+): Promise<{
   applied: string[];
   installed_from_registry: string[];
   skipped_missing_manifest: string[];
+  skipped_unselected: string[];
   fields_preserved: Array<{ connector: string; field: string }>;
 }> {
   const template = resolveTemplate();
+  // Undefined = install everything; explicit [] = install nothing.
+  const selected = selectedConnectors ? new Set(selectedConnectors) : null;
   // Auto-inject user identity from settings so connectors (e.g. tp.username)
   // can reference {user_name} / {user_email} without prompting again.
   // User-supplied values still win over auto-injected ones.
@@ -173,10 +184,12 @@ async function applyConnectors(values: Record<string, string> | undefined): Prom
   const applied: string[] = [];
   const installedFromRegistry: string[] = [];
   const missing: string[] = [];
+  const skippedUnselected: string[] = [];
   const preserved: Array<{ connector: string; field: string }> = [];
 
   for (const [id, row] of Object.entries(template)) {
     if (id.startsWith('_')) continue;     // metadata keys
+    if (selected && !selected.has(id)) { skippedUnselected.push(id); continue; }
     let def = getConnector(id);
     if (!def) {
       // Manifest not on disk yet — fetch from forge-connectors registry
@@ -217,6 +230,7 @@ async function applyConnectors(values: Record<string, string> | undefined): Prom
     applied,
     installed_from_registry: installedFromRegistry,
     skipped_missing_manifest: missing,
+    skipped_unselected: skippedUnselected,
     fields_preserved: preserved,
   };
 }
@@ -299,6 +313,30 @@ export async function GET() {
   // which froze Dashboard mount + every other API on the same worker.
   const detected: Array<{ name: string; path: string; version: string }> = [];
 
+  // Connector list from the template (excluding `_*` metadata keys),
+  // in template order. UI renders this as checkboxes — default all
+  // selected, user can opt out before Apply. `default_enabled` mirrors
+  // the template's `enabled:` (e.g. fortincm is opt-in).
+  const templateConnectors: Array<{
+    id: string;
+    default_enabled: boolean;
+    has_prompts: boolean;
+    already_installed: boolean;
+  }> = [];
+  for (const [connId, row] of Object.entries(template)) {
+    if (connId.startsWith('_')) continue;
+    const cfg = (row as any)?.config ?? {};
+    const hasPrompts = Object.values(cfg).some(
+      v => typeof v === 'string' && /\$\{[a-zA-Z0-9_]+\}/.test(v),
+    );
+    templateConnectors.push({
+      id: connId,
+      default_enabled: (row as any)?.enabled !== false,
+      has_prompts: hasPrompts,
+      already_installed: !!getInstalledConnector(connId),
+    });
+  }
+
   // Per-prompt "already set" probe — for each ${key} the template uses,
   // find which connector field references it and check if that field
   // is already non-empty. Lets the wizard show "•••• (keep existing)"
@@ -342,6 +380,7 @@ export async function GET() {
       projectRoots: settings.projectRoots || [],
     },
     detected_cli: detected,
+    template_connectors: templateConnectors,
     template_prompts: template._prompts || {},
     prompt_values_set: promptValuesSet,
     prompt_targets: promptTargets,
@@ -392,7 +431,7 @@ export async function POST(req: Request) {
   }
 
   try {
-    const r = await applyConnectors(payload.connectorValues);
+    const r = await applyConnectors(payload.connectorValues, payload.selectedConnectors);
     phases.push({ phase: 'connectors', ok: true, detail: r });
   } catch (e) {
     phases.push({ phase: 'connectors', ok: false, error: e instanceof Error ? e.message : String(e) });

package/app/chat/page.tsx

@@ -386,7 +386,7 @@ export default function ChatPage() {
             ))}
             {partial && (
               <RoleBlock role="assistant">
-                <MarkdownContent content={partial} />
+                <MarkdownContent content={partial} linkify />
                 <span className="inline-block w-2 h-3 ml-0.5 align-text-bottom bg-[var(--accent)] animate-pulse" />
               </RoleBlock>
             )}
@@ -501,7 +501,7 @@ function MessageView({ m }: { m: Message }) {
   return (
     <RoleBlock role={m.role} ts={m.ts}>
       {m.blocks.map((b, i) => (
-        <BlockView key={i} b={b} />
+        <BlockView key={i} b={b} role={m.role} />
       ))}
       {m.error && (
         <div className="text-xs text-red-400 border border-red-500/30 bg-red-500/5 rounded-md p-2 mt-1">
@@ -512,9 +512,9 @@ function MessageView({ m }: { m: Message }) {
   );
 }
 
-function BlockView({ b }: { b: ContentBlock }) {
+function BlockView({ b, role }: { b: ContentBlock; role?: 'user' | 'assistant' }) {
   if (b.type === 'text') {
-    return <MarkdownContent content={b.text} />;
+    return <MarkdownContent content={b.text} linkify={role === 'assistant'} />;
   }
   if (b.type === 'tool_use') {
     return <ToolUseBlockView name={b.name} input={b.input} />;

package/components/MarkdownContent.tsx

@@ -1,12 +1,68 @@
 'use client';
 
+import { useEffect, useState } from 'react';
 import Markdown from 'react-markdown';
 import remarkGfm from 'remark-gfm';
+import { remarkLinkify } from '@/lib/chat/remark-linkify';
+import type { SerializablePattern } from '@/lib/chat/link-patterns';
+
+// Module-level cache so every MarkdownContent instance shares one fetch.
+// Patterns rarely change (only when connector base_url is edited) so a
+// per-tab cache is sufficient; refresh requires a reload.
+let _patternsCache: SerializablePattern[] | null = null;
+let _patternsPromise: Promise<SerializablePattern[]> | null = null;
+function loadPatterns(): Promise<SerializablePattern[]> {
+  if (_patternsCache) return Promise.resolve(_patternsCache);
+  if (_patternsPromise) return _patternsPromise;
+  _patternsPromise = fetch('/api/chat/link-patterns')
+    .then(r => r.json())
+    .then(j => {
+      _patternsCache = Array.isArray(j?.patterns) ? j.patterns : [];
+      return _patternsCache!;
+    })
+    .catch(() => {
+      _patternsCache = [];
+      return _patternsCache;
+    });
+  return _patternsPromise;
+}
+
+export default function MarkdownContent({
+  content,
+  linkify,
+}: {
+  content: string;
+  /** Enable auto-link of bug#/!MR/CVE etc. Only set true for AI chat output. */
+  linkify?: boolean;
+}) {
+  const [patterns, setPatterns] = useState<SerializablePattern[]>(() =>
+    linkify ? (_patternsCache || []) : [],
+  );
+  useEffect(() => {
+    if (!linkify) return;
+    if (_patternsCache) { setPatterns(_patternsCache); return; }
+    let cancelled = false;
+    loadPatterns().then(p => { if (!cancelled) setPatterns(p); });
+    return () => { cancelled = true; };
+  }, [linkify]);
+
+  // remarkPlugins uses unified's plugin convention:
+  //   `plugin` alone  → unified calls `plugin()` internally
+  //   `[plugin, opts]` → unified calls `plugin(opts)` internally
+  // Passing `remarkLinkify(patterns)` directly was wrong — that's an
+  // already-resolved transformer; unified would call it again with no
+  // tree, which crashed with "Cannot use 'in' operator to search for
+  // 'children' in undefined".
+  const plugins: any[] = linkify && patterns.length > 0
+    ? [remarkGfm, [remarkLinkify, patterns]]
+    : [remarkGfm];
+
+  // Defensive — react-markdown chokes if children is undefined/non-string.
+  const safeContent = typeof content === 'string' ? content : '';
 
-export default function MarkdownContent({ content }: { content: string }) {
   return (
     <Markdown
-      remarkPlugins={[remarkGfm]}
+      remarkPlugins={plugins}
       components={{
         h1: ({ children }) => <h1 className="text-base font-bold text-[var(--text-primary)] mt-3 mb-1">{children}</h1>,
         h2: ({ children }) => <h2 className="text-sm font-bold text-[var(--text-primary)] mt-3 mb-1">{children}</h2>,
@@ -67,7 +123,7 @@ export default function MarkdownContent({ content }: { content: string }) {
         td: ({ children }) => <td className="border border-[var(--border)] px-3 py-1.5 text-[11px]">{children}</td>,
       }}
     >
-      {content}
+      {safeContent}
     </Markdown>
   );
 }

package/components/OnboardingWizard.tsx

@@ -49,6 +49,13 @@ interface OnboardingState {
     projectRoots: string[];
   };
   detected_cli: Array<{ name: string; path: string; version: string }>;
+  /** All non-meta connector ids in the template, in template order. */
+  template_connectors: Array<{
+    id: string;
+    default_enabled: boolean;
+    has_prompts: boolean;
+    already_installed: boolean;
+  }>;
   template_prompts: Record<string, PromptDef>;
   /** Per ${key} prompt: true = at least one target field already has a real value;
    *  leave blank to keep it. Backend's applyConnectors preserves existing on empty. */
@@ -138,6 +145,11 @@ export function OnboardingDrawer({ onClose, onComplete }: { onClose: () => void;
 
   // Section 3: Connector template values (one per ${key})
   const [connectorValues, setConnectorValues] = useState<Record<string, string>>({});
+  // Section 3.5: which template connectors to install. Default = all
+  // (populated from template_connectors on state load). User-typed values
+  // for un-selected connectors are kept in connectorValues so re-checking
+  // restores them — only the payload skips unselected ones.
+  const [selectedConnectors, setSelectedConnectors] = useState<Set<string>>(new Set());
 
   // Section 4: Pipelines
   const [selectedPipelines, setSelectedPipelines] = useState<Set<string>>(new Set());
@@ -179,7 +191,7 @@ export function OnboardingDrawer({ onClose, onComplete }: { onClose: () => void;
   // drawer into a "checks" view that runs glab-sync / login-status /
   // backend monitor probes — so users see what's actually live before
   // we dismiss the wizard.
-  type CheckState = { status: 'pending' | 'running' | 'ok' | 'fail'; message?: string; detail?: any };
+  type CheckState = { status: 'pending' | 'running' | 'ok' | 'fail' | 'skipped'; message?: string; detail?: any };
   const [phase, setPhase] = useState<'form' | 'checks'>('form');
   const [checks, setChecks] = useState<Record<string, CheckState>>({
     glabCli: { status: 'pending' },
@@ -188,19 +200,29 @@ export function OnboardingDrawer({ onClose, onComplete }: { onClose: () => void;
   });
 
   async function runChecks() {
-    // glab sync — only meaningful if gitlab connector enabled w/ a token.
-    setChecks(c => ({ ...c, glabCli: { status: 'running' } }));
-    fetch('/api/connectors/gitlab/sync-cli', { method: 'POST' })
-      .then(r => r.json().then(j => ({ ok: r.ok && j.ok !== false, j })))
-      .then(({ ok, j }) => setChecks(c => ({
-        ...c,
-        glabCli: {
-          status: ok ? 'ok' : 'fail',
-          message: ok ? 'glab CLI synced with GitLab token' : (j.error || j.stderr || 'sync failed'),
-          detail: j,
-        },
-      })))
-      .catch(e => setChecks(c => ({ ...c, glabCli: { status: 'fail', message: e.message } })));
+    // glab sync — only meaningful when the user opted into gitlab.
+    // Avoid hitting the API at all when gitlab isn't selected, otherwise
+    // the route returns a hard error ("not installed or not enabled")
+    // and the check shows red for something the user explicitly skipped.
+    if (!selectedConnectors.has('gitlab')) {
+      setChecks(c => ({ ...c, glabCli: {
+        status: 'skipped',
+        message: 'gitlab not selected — skipped',
+      } }));
+    } else {
+      setChecks(c => ({ ...c, glabCli: { status: 'running' } }));
+      fetch('/api/connectors/gitlab/sync-cli', { method: 'POST' })
+        .then(r => r.json().then(j => ({ ok: r.ok && j.ok !== false, j })))
+        .then(({ ok, j }) => setChecks(c => ({
+          ...c,
+          glabCli: {
+            status: ok ? 'ok' : 'fail',
+            message: ok ? 'glab CLI synced with GitLab token' : (j.error || j.stderr || 'sync failed'),
+            detail: j,
+          },
+        })))
+        .catch(e => setChecks(c => ({ ...c, glabCli: { status: 'fail', message: e.message } })));
+    }
 
     // Login status — POST triggers fresh check across all sources.
     setChecks(c => ({ ...c, loginStatus: { status: 'running' } }));
@@ -250,7 +272,7 @@ export function OnboardingDrawer({ onClose, onComplete }: { onClose: () => void;
     if (!initializedRef.current) { initializedRef.current = true; return; }
     setDirty(true);
   }, [displayName, displayEmail, apiKey, apiBaseUrl, apiModel, apiProfileId, apiProvider,
-      connectorValues, selectedPipelines, projectInput, cliAgentId, cliAgentPath]);
+      connectorValues, selectedConnectors, selectedPipelines, projectInput, cliAgentId, cliAgentPath]);
   // Inline marketplace sync (so user doesn't have to leave the wizard
   // to populate the pipeline list when it's empty / stale).
   const [syncingMarket, setSyncingMarket] = useState(false);
@@ -301,6 +323,20 @@ export function OnboardingDrawer({ onClose, onComplete }: { onClose: () => void;
       setDisplayEmail(s.current.displayEmail);
       setSelectedPipelines(new Set(s.suggested_pipelines));
 
+      // Default-select rules:
+      //   - template ships enabled=true → on by default
+      //   - user already installed it (any prior run / manual setup) →
+      //     on, even if template ships enabled=false (e.g. fortincm).
+      //     Otherwise re-running the wizard would silently deselect a
+      //     working connector and the next Apply would skip writing
+      //     fresh tokens to it.
+      const defaultSelected = new Set(
+        (s.template_connectors || [])
+          .filter(c => c.default_enabled || c.already_installed)
+          .map(c => c.id),
+      );
+      setSelectedConnectors(defaultSelected);
+
       // Pre-fill any prompt that declares a `default` (e.g. jenkins
       // instance name = "default-jenkins"). User-set values from a prior
       // run would shadow these via the "currently set" path on apply.
@@ -339,7 +375,7 @@ export function OnboardingDrawer({ onClose, onComplete }: { onClose: () => void;
     }).catch(() => setState({
       ok: false, onboardingCompleted: false,
       current: { displayName: '', displayEmail: '', apiProfileIds: [], apiProfile: null, chatAgent: '', defaultAgent: '', agents: [], projectRoots: [] },
-      detected_cli: [], template_prompts: {}, prompt_values_set: {}, prompt_targets: {}, suggested_pipelines: [],
+      detected_cli: [], template_connectors: [], template_prompts: {}, prompt_values_set: {}, prompt_targets: {}, suggested_pipelines: [],
     }));
   }, []);
 
@@ -356,9 +392,19 @@ export function OnboardingDrawer({ onClose, onComplete }: { onClose: () => void;
     if (applying) return;
     setApplying(true); setResult(null);
     try {
+      // Strip values whose target connector got unchecked — keeping them
+      // in state lets the user re-check and recover the typed value, but
+      // we don't want to write tokens into connectors we're not installing.
+      const filteredValues: Record<string, string> = {};
+      for (const [k, v] of Object.entries(connectorValues)) {
+        const targets = state?.prompt_targets?.[k] || [];
+        const anyTargetSelected = targets.some(t => selectedConnectors.has(t.connector));
+        if (anyTargetSelected || targets.length === 0) filteredValues[k] = v;
+      }
       const payload: any = {
         identity: { displayName, displayEmail },
-        connectorValues,
+        connectorValues: filteredValues,
+        selectedConnectors: Array.from(selectedConnectors),
         pipelines: Array.from(selectedPipelines),
         projectRoots: projectInput.split(/[\n,]/).map(s => s.trim()).filter(Boolean),
       };
@@ -638,54 +684,84 @@ export function OnboardingDrawer({ onClose, onComplete }: { onClose: () => void;
         </Section>
 
         {/* ── 3. Connectors ────────────────────────────────────── */}
-        <Section title="3. Connector tokens" hint="Forge ships a Fortinet template. Shared keys (e.g. GitLab PAT for both gitlab + jenkins) are asked once. Tokens encrypted at rest.">
-          {promptGroups.length === 0 && (
+        <Section title="3. Connector tokens" hint="Pick which connectors to install. Default = team-recommended set. Shared keys (e.g. GitLab PAT also used by Jenkins) only asked once.">
+          {(state.template_connectors || []).length === 0 && (
             <p className="text-[10px] text-amber-500">
               No template loaded. Make sure the marketplace has been synced (Settings → Connectors → Sync).
             </p>
           )}
-          {promptGroups.map(([connector, keys]) => (
-            <div key={connector} className="border-l-2 border-[var(--accent)]/40 pl-2.5 space-y-2.5">
-              <div className="text-[10px] font-mono uppercase tracking-wider text-[var(--accent)]">
-                {connector}
-              </div>
-              {keys.map(key => {
-                const p = prompts[key];
-                const v = connectorValues[key] ?? '';
-                const isSet = !!state.prompt_values_set?.[key];
-                const targets = state.prompt_targets?.[key] || [];
-                const sharedWith = targets.filter(t => t.connector !== connector);
-                return (
-                  <div key={key} className="space-y-1">
-                    <label className="text-[10px] font-medium text-[var(--text-primary)] flex items-center gap-1.5 flex-wrap">
-                      {p.label}
-                      {p.required && !isSet && <span className="text-red-500">*</span>}
-                      {!p.required && !isSet && <span className="text-[9px] text-[var(--text-secondary)]">(optional)</span>}
-                      {isSet && <span className="text-[9px] text-emerald-500">● currently set</span>}
-                      {p.url && (
-                        <a href={p.url} target="_blank" rel="noopener noreferrer" className="ml-auto text-[10px] text-[var(--accent)] hover:underline" title={p.url}>
-                          ↗ {p.url_label || 'Get token'}
-                        </a>
-                      )}
-                    </label>
-                    {p.hint && <p className="text-[9px] text-[var(--text-secondary)] leading-snug">{p.hint}</p>}
-                    {sharedWith.length > 0 && (
-                      <p className="text-[9px] text-[var(--text-secondary)] font-mono">
-                        also used by: {sharedWith.map(t => `${t.connector}.${t.field}`).join(', ')}
-                      </p>
-                    )}
-                    <input
-                      type={p.secret ? 'password' : 'text'}
-                      className={inputCls + ' font-mono'}
-                      value={v}
-                      onChange={e => setConnectorValues({ ...connectorValues, [key]: e.target.value })}
-                      placeholder={isSet ? '•••••••• (leave blank to keep current)' : (p.required ? 'required' : 'leave blank')}
-                    />
-                  </div>
-                );
-              })}
+          {/* Bulk select/deselect */}
+          {(state.template_connectors || []).length > 0 && (
+            <div className="flex items-center gap-1.5 text-[10px] text-[var(--text-secondary)]">
+              <button
+                type="button"
+                onClick={() => setSelectedConnectors(new Set((state.template_connectors || []).map(c => c.id)))}
+                className="px-1.5 py-0.5 border border-[var(--border)] rounded hover:border-[var(--text-primary)]"
+              >Select all</button>
+              <button
+                type="button"
+                onClick={() => setSelectedConnectors(new Set())}
+                className="px-1.5 py-0.5 border border-[var(--border)] rounded hover:border-[var(--text-primary)]"
+              >Deselect all</button>
+              <span className="ml-auto">{selectedConnectors.size}/{(state.template_connectors || []).length} selected</span>
             </div>
-          ))}
+          )}
+          {(state.template_connectors || []).map(({ id: connector, has_prompts, already_installed }) => {
+            const checked = selectedConnectors.has(connector);
+            const promptKeys = (promptGroups.find(([c]) => c === connector)?.[1]) || [];
+            const toggle = () => {
+              setSelectedConnectors(prev => {
+                const next = new Set(prev);
+                if (next.has(connector)) next.delete(connector); else next.add(connector);
+                return next;
+              });
+            };
+            return (
+              <div key={connector} className={`border-l-2 pl-2.5 space-y-2 ${checked ? 'border-[var(--accent)]/40' : 'border-[var(--border)] opacity-60'}`}>
+                <label className="flex items-center gap-1.5 text-[11px] cursor-pointer">
+                  <input type="checkbox" checked={checked} onChange={toggle} />
+                  <span className="font-mono uppercase tracking-wider text-[var(--accent)]">{connector}</span>
+                  {already_installed && <span className="text-[9px] text-emerald-500">● installed</span>}
+                  {!has_prompts && <span className="text-[9px] text-[var(--text-secondary)]">(no tokens needed)</span>}
+                </label>
+                {checked && promptKeys.map(key => {
+                  const p = prompts[key];
+                  const v = connectorValues[key] ?? '';
+                  const isSet = !!state.prompt_values_set?.[key];
+                  const targets = state.prompt_targets?.[key] || [];
+                  const sharedWith = targets.filter(t => t.connector !== connector);
+                  return (
+                    <div key={key} className="space-y-1 ml-5">
+                      <label className="text-[10px] font-medium text-[var(--text-primary)] flex items-center gap-1.5 flex-wrap">
+                        {p.label}
+                        {p.required && !isSet && <span className="text-red-500">*</span>}
+                        {!p.required && !isSet && <span className="text-[9px] text-[var(--text-secondary)]">(optional)</span>}
+                        {isSet && <span className="text-[9px] text-emerald-500">● currently set</span>}
+                        {p.url && (
+                          <a href={p.url} target="_blank" rel="noopener noreferrer" className="ml-auto text-[10px] text-[var(--accent)] hover:underline" title={p.url}>
+                            ↗ {p.url_label || 'Get token'}
+                          </a>
+                        )}
+                      </label>
+                      {p.hint && <p className="text-[9px] text-[var(--text-secondary)] leading-snug">{p.hint}</p>}
+                      {sharedWith.length > 0 && (
+                        <p className="text-[9px] text-[var(--text-secondary)] font-mono">
+                          also used by: {sharedWith.map(t => `${t.connector}.${t.field}`).join(', ')}
+                        </p>
+                      )}
+                      <input
+                        type={p.secret ? 'password' : 'text'}
+                        className={inputCls + ' font-mono'}
+                        value={v}
+                        onChange={e => setConnectorValues({ ...connectorValues, [key]: e.target.value })}
+                        placeholder={isSet ? '•••••••• (leave blank to keep current)' : (p.required ? 'required' : 'leave blank')}
+                      />
+                    </div>
+                  );
+                })}
+              </div>
+            );
+          })}
         </Section>
 
         {/* ── 4. Pipelines ─────────────────────────────────────── */}
@@ -876,17 +952,19 @@ function CheckRow({
 }: {
   title: string;
   hint?: string;
-  state: { status: 'pending' | 'running' | 'ok' | 'fail'; message?: string; detail?: any };
+  state: { status: 'pending' | 'running' | 'ok' | 'fail' | 'skipped'; message?: string; detail?: any };
   renderDetail?: (d: any) => React.ReactNode;
 }) {
   const [open, setOpen] = useState(false);
   const icon = state.status === 'ok' ? '✓'
     : state.status === 'fail' ? '✗'
     : state.status === 'running' ? '⟳'
+    : state.status === 'skipped' ? '–'
     : '○';
   const color = state.status === 'ok' ? 'text-emerald-500'
     : state.status === 'fail' ? 'text-red-400'
     : state.status === 'running' ? 'text-amber-500'
+    : state.status === 'skipped' ? 'text-[var(--text-secondary)]'
     : 'text-[var(--text-secondary)]';
   return (
     <div className="border border-[var(--border)] rounded p-2.5 space-y-1">

package/lib/chat/agent-loop.ts

@@ -25,6 +25,7 @@ import {
 } from './tool-dispatcher';
 import { getMemoryStore } from './memory-store';
 import { buildMemoryContext } from './build-memory-context';
+import { buildReferencePromptSection } from './reference-prompt';
 import { buildMemoryTools } from './memory-tools';
 import { buildStartWatchTool } from '../watch/start-watch-tool';
 import { estimateTokens } from '../memory/token-estimate';
@@ -98,6 +99,84 @@ function trimOrphanToolResults(history: Message[]): Message[] {
   return i === 0 ? history : history.slice(i);
 }
 
+/**
+ * Heal sessions where an assistant `tool_use` lacks a matching follow-up
+ * `tool_result` (e.g. user hit Stop mid-execution, stream crashed, tool
+ * runner threw without persisting). Both Anthropic and OpenAI reject
+ * requests with orphan tool calls — AI SDK surfaces this as
+ * `AI_MissingToolResultsError`.
+ *
+ * Strategy: for every assistant message containing tool_use blocks,
+ * collect the ids that are NOT covered by the immediately-next message's
+ * tool_results, then synthesize stub `tool_result` blocks for the
+ * missing ones and prepend them to that next user message (creating one
+ * if needed). Synthesized result text says the call was interrupted so
+ * the model can recover sensibly on retry.
+ */
+function healOrphanToolUses(history: Message[]): Message[] {
+  if (history.length === 0) return history;
+  const out: Message[] = [];
+  for (let i = 0; i < history.length; i += 1) {
+    const m = history[i];
+    out.push(m);
+    if (m.role !== 'assistant' || !Array.isArray(m.blocks)) continue;
+
+    const toolUses = m.blocks.filter(
+      (b): b is ToolUseBlock => (b as any)?.type === 'tool_use',
+    );
+    if (toolUses.length === 0) continue;
+
+    // Examine the next message (if any) for matching tool_results.
+    const next = history[i + 1];
+    const coveredIds = new Set<string>();
+    if (next?.role === 'user' && Array.isArray(next.blocks)) {
+      for (const b of next.blocks) {
+        if ((b as any).type === 'tool_result' && (b as ToolResultBlock).tool_use_id) {
+          coveredIds.add((b as ToolResultBlock).tool_use_id);
+        }
+      }
+    }
+
+    const missing = toolUses.filter((tu) => !coveredIds.has(tu.id));
+    if (missing.length === 0) continue;
+
+    console.warn(
+      `[agent-loop] healed ${missing.length} orphan tool_use(s) in session history ` +
+      `(ids: ${missing.map((t) => t.id).join(', ')}). Likely cause: cancelled / crashed prior turn.`,
+    );
+
+    const stubBlocks: ToolResultBlock[] = missing.map((tu) => ({
+      type: 'tool_result',
+      tool_use_id: tu.id,
+      content: JSON.stringify({
+        ok: false,
+        error: 'previous tool call did not finish (interrupted or crashed); retry the request',
+      }),
+      is_error: true,
+    }));
+
+    if (next?.role === 'user' && Array.isArray(next.blocks)
+        && next.blocks.some((b) => (b as any).type === 'tool_result')) {
+      // Existing pairing message — splice stubs in front of its blocks
+      // so the surviving real results still apply in their original order.
+      history[i + 1] = { ...next, blocks: [...stubBlocks, ...next.blocks] };
+    } else {
+      // No follow-up at all — inject a fresh user message right after this
+      // assistant turn. We mutate `history` so the loop sees it next iter,
+      // but push to `out` here so order is preserved.
+      const injected: Message = {
+        id: `synthetic-${m.id}`,
+        session_id: m.session_id,
+        role: 'user',
+        blocks: stubBlocks,
+        ts: m.ts + 1,
+      };
+      out.push(injected);
+    }
+  }
+  return out;
+}
+
 export interface AgentEvent {
   type:
     | 'text_delta'      // assistant text streaming
@@ -324,6 +403,19 @@ function buildSystemPrompt(
     }
   }
 
+  // Reference format guide — encourages the LLM to emit markdown links
+  // for bug ids / MR ids / CVE etc., using each connector's real base_url.
+  // Front-end remark-linkify (lib/chat/remark-linkify.ts) is the safety
+  // net when the LLM forgets and writes plain text.
+  // Wrap in try/catch — system prompt assembly is hot path; an unread
+  // connector-configs.json must not break the entire chat turn.
+  try {
+    const refSection = buildReferencePromptSection();
+    if (refSection) lines.push('', refSection);
+  } catch (e) {
+    console.warn('[agent-loop] buildReferencePromptSection failed:', (e as Error).message);
+  }
+
   if (sessionSystemPrompt) {
     lines.push('', sessionSystemPrompt);
   }
@@ -651,8 +743,10 @@ export async function runTurn(args: RunTurnArgs): Promise<{ ok: boolean; error?:
       // the LLM calls connector_open, subsequent iterations pick that up.
       // (Computed off a preview slice of history — refined below once
       // we have the real history under budget.)
-      const previewHistory = trimOrphanToolResults(
-        listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, 8_000, estimateTokens),
+      const previewHistory = healOrphanToolUses(
+        trimOrphanToolResults(
+          listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, 8_000, estimateTokens),
+        ),
       );
       const newOpenSet = computeOpenSet(previewHistory, assistantBlocksAccum);
       const setChanged = newOpenSet.size !== openSet.size ||
@@ -704,8 +798,10 @@ export async function runTurn(args: RunTurnArgs): Promise<{ ok: boolean; error?:
         return { ok: false, error: 'profile context budget exhausted' };
       }
 
-      const history = trimOrphanToolResults(
-        listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, historyBudget, estimateTokens),
+      const history = healOrphanToolUses(
+        trimOrphanToolResults(
+          listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, historyBudget, estimateTokens),
+        ),
       );
       if (history.length === 0) {
         cb({ type: 'error', data: { error: 'Conversation context is empty after trimming an oversized result. Clear the chat or retry with a narrower query.' } });

package/lib/chat/link-patterns.ts

@@ -0,0 +1,138 @@
+/**
+ * Chat auto-link patterns — turn natural prose like `Mantis #1226625`,
+ * `MR !14860`, `bug 1234567`, `CVE-2024-0001` into clickable links.
+ *
+ * Disambiguation: every pattern requires a prose anchor word — `Mantis`,
+ * `bug`, `MR`, `merge request`, `issue`, `BDSA-`, `CVE-`. We intentionally
+ * do NOT match bare `#N` (ambiguous: GitHub issue / GitLab / Mantis).
+ *
+ * Rules live in this single file (not in connector manifests) so adding
+ * a new pattern doesn't require bumping any connector version. Patterns
+ * referencing a connector's base_url (`baseUrlFrom: 'mantis'`) are
+ * auto-skipped when that connector is not installed.
+ *
+ * URL template syntax:
+ *   {0}            → the entire regex match
+ *   {1}, {2}, ...  → capture groups
+ *   {base_url}     → connector's installed base_url, trailing slash stripped
+ *
+ * The chat system prompt also injects a "Reference Format" guide built
+ * from the same connector base_urls (see lib/chat/reference-prompt.ts)
+ * so the LLM is nudged to emit markdown links directly — these regexes
+ * are a safety net for plain-text mentions.
+ */
+
+import { getInstalledConnector } from '../connectors/registry';
+
+export interface LinkPattern {
+  id: string;
+  /** Regex with the `g` flag — required so we can iterate all matches. */
+  regex: RegExp;
+  /** Connector id whose `config.base_url` populates `{base_url}` in `url`.
+   *  Omit when the pattern is self-contained (e.g. CVE → nvd.nist.gov). */
+  baseUrlFrom?: string;
+  /** URL template — see syntax above. */
+  url: string;
+  /** Tooltip template (same syntax). Defaults to the matched text. */
+  label?: string;
+}
+
+/** Raw patterns. `baseUrlFrom` is resolved by getActiveLinkPatterns. */
+export const LINK_PATTERNS: LinkPattern[] = [
+  {
+    // Matches "Mantis #1226625", "mantis bug 1226625", "bug #1234567",
+    // "bug 1234567". 4–8 digits caps false positives on small numbers
+    // like list indices ("bug 3" etc.).
+    id: 'mantis-bug',
+    regex: /\b(?:mantis(?:\s+bug)?\s*#?|bug\s*#?)(\d{4,8})\b/gi,
+    baseUrlFrom: 'mantis',
+    url: '{base_url}/view.php?id={1}',
+    label: 'Mantis #{1}',
+  },
+  {
+    // Matches "MR !14860", "MR 14860", "merge request !14860", "!14860".
+    // The lookbehind on the bare-`!N` form keeps `not!42` / `1!42` /
+    // `foo!42bar` out, and allows CJK-adjacent (`测试!14860`).
+    id: 'gitlab-mr',
+    regex: /(?:\b(?:MR|merge\s+request)\s+!?|(?<![A-Za-z0-9])!)(\d+)\b/gi,
+    baseUrlFrom: 'gitlab',
+    url: '{base_url}/-/merge_requests/{1}',
+    label: 'MR !{1}',
+  },
+  {
+    // Matches "issue #789", "issue 789", "gitlab issue #789". 3+ digits
+    // minimum keeps "issue 1" / "issue 12" out (too noisy).
+    id: 'gitlab-issue',
+    regex: /\b(?:gitlab\s+issue\s*#?|gl\s*issue\s*#?|issue\s*#?)(\d{3,})\b/gi,
+    baseUrlFrom: 'gitlab',
+    url: '{base_url}/-/issues/{1}',
+    label: 'Issue #{1}',
+  },
+  {
+    id: 'blackduck-bdsa',
+    regex: /\b(BDSA-\d{4}-\d+)\b/g,
+    baseUrlFrom: 'blackduck',
+    url: '{base_url}/api/vulnerabilities/{1}',
+    label: '{1}',
+  },
+  {
+    id: 'cve',
+    regex: /\b(CVE-\d{4}-\d+)\b/g,
+    url: 'https://nvd.nist.gov/vuln/detail/{1}',
+    label: '{1}',
+  },
+];
+
+export interface CompiledPattern {
+  id: string;
+  regex: RegExp;
+  /** url template after {base_url} expansion */
+  urlTemplate: string;
+  labelTemplate: string;
+}
+
+/**
+ * Resolve `baseUrlFrom` against installed connector configs and drop
+ * patterns whose connector isn't configured. Returns the safe-to-render
+ * set; UI fetches this once and reuses it per chat session.
+ */
+export function getActiveLinkPatterns(): CompiledPattern[] {
+  const out: CompiledPattern[] = [];
+  for (const p of LINK_PATTERNS) {
+    let urlTemplate = p.url;
+    if (p.baseUrlFrom) {
+      const cfg = getInstalledConnector(p.baseUrlFrom)?.config as
+        | { base_url?: string }
+        | undefined;
+      const base = (cfg?.base_url || '').trim().replace(/\/+$/, '');
+      if (!base) continue;          // skip — connector unconfigured
+      urlTemplate = urlTemplate.replace('{base_url}', base);
+    }
+    out.push({
+      id: p.id,
+      regex: p.regex,
+      urlTemplate,
+      labelTemplate: p.label ?? '{0}',
+    });
+  }
+  return out;
+}
+
+/** Serializable form for sending to the browser. */
+export interface SerializablePattern {
+  id: string;
+  source: string;       // regex.source — re-hydrated client-side
+  flags: string;        // regex.flags
+  url: string;
+  label: string;
+}
+
+export function serializePatterns(patterns: CompiledPattern[]): SerializablePattern[] {
+  return patterns.map(p => ({
+    id: p.id,
+    source: p.regex.source,
+    flags: p.regex.flags.includes('g') ? p.regex.flags : p.regex.flags + 'g',
+    url: p.urlTemplate,
+    label: p.labelTemplate,
+  }));
+}

package/lib/chat/reference-prompt.ts

@@ -0,0 +1,81 @@
+/**
+ * Build a "Reference Format" block for the chat system prompt that lists
+ * each installed connector's URL pattern and asks the LLM to emit
+ * markdown links directly when mentioning IDs.
+ *
+ * Output goes into buildSystemPrompt in agent-loop.ts. Base URLs are read
+ * from connector-configs.json so the prompt only mentions connectors the
+ * user has actually configured — no broken/placeholder URLs leak.
+ */
+
+import { getInstalledConnector } from '../connectors/registry';
+
+interface RefLine {
+  /** Human reference type for the prompt. */
+  label: string;
+  /** Example template the LLM should follow. */
+  example: string;
+}
+
+/**
+ * Returns a markdown-friendly multiline string section, or empty string
+ * if no connector is configured for any of the rules. Caller appends it
+ * verbatim to the system prompt.
+ */
+export function buildReferencePromptSection(): string {
+  const out: RefLine[] = [];
+
+  // Helper — read base_url from a connector, trailing slash stripped.
+  const baseOf = (id: string): string | null => {
+    const cfg = getInstalledConnector(id)?.config as { base_url?: string } | undefined;
+    const v = (cfg?.base_url || '').trim().replace(/\/+$/, '');
+    return v || null;
+  };
+
+  const mantis = baseOf('mantis');
+  if (mantis) {
+    out.push({
+      label: 'Mantis bug',
+      example: `[Mantis #1226625](${mantis}/view.php?id=1226625)`,
+    });
+  }
+
+  const gitlab = baseOf('gitlab');
+  if (gitlab) {
+    out.push({
+      label: 'GitLab merge request',
+      example: `[MR !14860](${gitlab}/-/merge_requests/14860)`,
+    });
+    out.push({
+      label: 'GitLab issue',
+      example: `[Issue #789](${gitlab}/-/issues/789)`,
+    });
+  }
+
+  const blackduck = baseOf('blackduck');
+  if (blackduck) {
+    out.push({
+      label: 'Black Duck advisory',
+      example: `[BDSA-2024-0001](${blackduck}/api/vulnerabilities/BDSA-2024-0001)`,
+    });
+  }
+
+  // Always include — self-contained, doesn't need a connector
+  out.push({
+    label: 'CVE',
+    example: '[CVE-2024-1234](https://nvd.nist.gov/vuln/detail/CVE-2024-1234)',
+  });
+
+  if (out.length === 0) return '';
+
+  const lines = [
+    'Reference format — when mentioning these IDs in your reply, emit them as inline markdown links (substitute the real id):',
+  ];
+  for (const r of out) {
+    lines.push(`- ${r.label}: ${r.example}`);
+  }
+  lines.push(
+    'Always use the URLs shown above; do NOT invent hostnames. If a category is not listed, just mention the id as plain text — the UI will auto-link known patterns as a fallback.',
+  );
+  return lines.join('\n');
+}

package/lib/chat/remark-linkify.ts

@@ -0,0 +1,132 @@
+/**
+ * Remark plugin: auto-link known references (bug#, !MR, CVE-, …) in
+ * markdown text nodes. Skips text inside code/inlineCode/link parents
+ * so existing markdown links and code samples render untouched.
+ *
+ * Multi-pattern: caller passes a pre-compiled list (typically from
+ * /api/chat/link-patterns). Patterns whose backing connector isn't
+ * configured are already filtered server-side.
+ */
+
+import { visit, SKIP } from 'unist-util-visit';
+import type { SerializablePattern } from './link-patterns';
+
+interface MdastNode { type: string; [k: string]: any }
+interface MdastText extends MdastNode { type: 'text'; value: string }
+interface MdastParent extends MdastNode { children: MdastNode[] }
+
+interface ClientPattern {
+  id: string;
+  regex: RegExp;
+  urlTemplate: string;
+  labelTemplate: string;
+}
+
+/** Hydrate `{ source, flags }` into RegExp objects once per render. */
+export function hydratePatterns(patterns: SerializablePattern[]): ClientPattern[] {
+  return patterns.map(p => ({
+    id: p.id,
+    regex: new RegExp(p.source, p.flags),
+    urlTemplate: p.url,
+    labelTemplate: p.label,
+  }));
+}
+
+interface Hit {
+  start: number;
+  end: number;
+  matchText: string;
+  url: string;
+  label: string;
+}
+
+/** Expand {0}, {1}, ... in a template string using a RegExp match array. */
+function expand(tmpl: string, match: RegExpExecArray): string {
+  return tmpl.replace(/\{(\d+)\}/g, (_, idx) => match[Number(idx)] ?? '');
+}
+
+/** Find every non-overlapping match across all patterns in one string.
+ *  Earlier patterns win in case of overlap. */
+function findHits(text: string, patterns: ClientPattern[]): Hit[] {
+  const hits: Hit[] = [];
+  for (const p of patterns) {
+    // Clone — running .exec mutates lastIndex on a shared regex.
+    const re = new RegExp(p.regex.source, p.regex.flags);
+    let m: RegExpExecArray | null;
+    while ((m = re.exec(text)) !== null) {
+      const start = m.index;
+      const matchText = m[0];
+      const end = start + matchText.length;
+      // Overlap check against already-accepted hits (first-wins).
+      if (hits.some(h => !(end <= h.start || start >= h.end))) continue;
+      hits.push({
+        start,
+        end,
+        matchText,
+        url: expand(p.urlTemplate, m),
+        label: expand(p.labelTemplate, m),
+      });
+      if (m.index === re.lastIndex) re.lastIndex++;     // zero-width safety
+    }
+  }
+  hits.sort((a, b) => a.start - b.start);
+  return hits;
+}
+
+/** Splice hits into a text node, returning new mdast children. */
+function spliceText(value: string, hits: Hit[]): MdastNode[] {
+  const out: MdastNode[] = [];
+  let cursor = 0;
+  for (const h of hits) {
+    if (h.start > cursor) {
+      out.push({ type: 'text', value: value.slice(cursor, h.start) });
+    }
+    out.push({
+      type: 'link',
+      url: h.url,
+      title: h.label,
+      children: [{ type: 'text', value: h.matchText }],
+    });
+    cursor = h.end;
+  }
+  if (cursor < value.length) {
+    out.push({ type: 'text', value: value.slice(cursor) });
+  }
+  return out;
+}
+
+const SKIP_PARENT_TYPES = new Set(['link', 'linkReference', 'code', 'inlineCode']);
+
+export function remarkLinkify(patterns: SerializablePattern[]) {
+  if (!patterns.length) return () => {};
+  const compiled = hydratePatterns(patterns);
+
+  return (tree: MdastNode) => {
+    visit(tree as any, 'text', (node: any, index: number | undefined, parent: any) => {
+      try {
+        if (!parent || index == null) return;
+        const n = node as MdastText;
+        const p = parent as MdastParent;
+        if (!n || typeof n.value !== 'string') return;
+        if (!Array.isArray(p?.children)) return;
+        if (SKIP_PARENT_TYPES.has(p.type)) return;
+
+        const hits = findHits(n.value, compiled);
+        if (!hits.length) return;
+
+        const replacement = spliceText(n.value, hits);
+        // Sanity — every replacement child must be a proper node with a type.
+        if (!replacement.every(r => r && typeof (r as any).type === 'string')) return;
+
+        p.children.splice(index, 1, ...replacement);
+        return [SKIP, index + replacement.length];
+      } catch (e) {
+        // Linkify is a nice-to-have — never let it crash the chat render.
+        if (typeof console !== 'undefined') {
+          console.warn('[remark-linkify] visit failed, skipping node:', (e as Error)?.message);
+        }
+        return;
+      }
+    });
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.37",
+  "version": "0.10.39",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {
@@ -56,6 +56,7 @@
     "react-markdown": "^10.1.0",
     "remark-gfm": "^4.0.1",
     "undici": "^8.3.0",
+    "unist-util-visit": "^5.1.0",
     "ws": "^8.19.0",
     "yaml": "^2.8.2",
     "zod": "^4.3.6"

package/templates/connector-config-template.json

@@ -113,7 +113,7 @@
       "username": "admin",
       "password": "${fortincm_password}"
     },
-    "enabled": false
+    "enabled": true
   },
 
   "scap": {