@aion0/forge 0.10.38 → 0.10.40

package/RELEASE_NOTES.md

@@ -1,8 +1,11 @@
-# Forge v0.10.38
+# Forge v0.10.40
 
 Released: 2026-06-05
 
-## Changes since v0.10.37
+## Changes since v0.10.39
 
+### Other
+- fix(server): portable port-pid lookup so Linux without lsof can stop (#33)
 
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.37...v0.10.38
+
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.10.39...v0.10.40

package/app/api/chat/link-patterns/route.ts

@@ -0,0 +1,23 @@
+/**
+ * GET /api/chat/link-patterns
+ *
+ * Returns the chat-output linkify rules with all `{base_url}` placeholders
+ * expanded against installed connector configs. Patterns whose connector
+ * isn't installed/configured are filtered out — chat UI just renders the
+ * remaining ones via remarkLinkify (lib/chat/remark-linkify.ts).
+ */
+
+import { NextResponse } from 'next/server';
+import { getActiveLinkPatterns, serializePatterns } from '@/lib/chat/link-patterns';
+
+export async function GET() {
+  try {
+    const patterns = serializePatterns(getActiveLinkPatterns());
+    return NextResponse.json({ ok: true, patterns });
+  } catch (e) {
+    return NextResponse.json(
+      { ok: false, error: e instanceof Error ? e.message : String(e), patterns: [] },
+      { status: 500 },
+    );
+  }
+}

package/app/chat/page.tsx

@@ -386,7 +386,7 @@ export default function ChatPage() {
             ))}
             {partial && (
               <RoleBlock role="assistant">
-                <MarkdownContent content={partial} />
+                <MarkdownContent content={partial} linkify />
                 <span className="inline-block w-2 h-3 ml-0.5 align-text-bottom bg-[var(--accent)] animate-pulse" />
               </RoleBlock>
             )}
@@ -501,7 +501,7 @@ function MessageView({ m }: { m: Message }) {
   return (
     <RoleBlock role={m.role} ts={m.ts}>
       {m.blocks.map((b, i) => (
-        <BlockView key={i} b={b} />
+        <BlockView key={i} b={b} role={m.role} />
       ))}
       {m.error && (
         <div className="text-xs text-red-400 border border-red-500/30 bg-red-500/5 rounded-md p-2 mt-1">
@@ -512,9 +512,9 @@ function MessageView({ m }: { m: Message }) {
   );
 }
 
-function BlockView({ b }: { b: ContentBlock }) {
+function BlockView({ b, role }: { b: ContentBlock; role?: 'user' | 'assistant' }) {
   if (b.type === 'text') {
-    return <MarkdownContent content={b.text} />;
+    return <MarkdownContent content={b.text} linkify={role === 'assistant'} />;
   }
   if (b.type === 'tool_use') {
     return <ToolUseBlockView name={b.name} input={b.input} />;

package/bin/forge-server.mjs

@@ -289,17 +289,59 @@ if (!isStop) {
   }
 }
 
+// ── Find pids listening on a TCP port (portable) ──
+// macOS ships lsof; minimal Linux containers (RHEL/CentOS/Alpine) often
+// don't. Try lsof → ss (iproute2, ~universal on modern Linux) → fuser
+// (psmisc) in order. Empty result means no listener, period.
+//
+// Without this, `forge server stop` on Linux silently leaked next-server
+// because `lsof -ti:8403` threw ENOENT and the whole stop path was
+// wrapped in try/catch — the port lookup just disappeared.
+function findPortPids(port) {
+  // 1) lsof
+  try {
+    const out = execSync(`lsof -ti:${port}`, {
+      encoding: 'utf-8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+    if (out) return [...new Set(out.split('\n').map(s => s.trim()).filter(Boolean))];
+  } catch { /* fall through */ }
+  // 2) ss -tlnp — line looks like:
+  //    LISTEN 0 511 *:8403 ... users:(("next-server",pid=903438,fd=14))
+  try {
+    const out = execSync(`ss -tlnp 2>/dev/null`, {
+      encoding: 'utf-8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const pids = new Set();
+    for (const line of out.split('\n')) {
+      // Match port at end of local-address field, before either whitespace
+      // (IPv4 `*:8403 `) or end-of-field (IPv6 `[::]:8403 `).
+      if (!new RegExp(`:${port}\\b`).test(line)) continue;
+      for (const m of line.matchAll(/pid=(\d+)/g)) pids.add(m[1]);
+    }
+    if (pids.size) return [...pids];
+  } catch { /* fall through */ }
+  // 3) fuser
+  try {
+    const out = execSync(`fuser ${port}/tcp 2>/dev/null`, {
+      encoding: 'utf-8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const pids = out.trim().split(/\s+/).filter(p => /^\d+$/.test(p));
+    if (pids.length) return [...new Set(pids)];
+  } catch { /* nothing more */ }
+  return [];
+}
+
 // ── Reset terminal server (kill port + tmux sessions) ──
 if (resetTerminal) {
   console.log(`[forge] Resetting terminal server (port ${terminalPort})...`);
-  try {
-    const pids = execSync(`lsof -ti:${terminalPort}`, { encoding: 'utf-8' }).trim();
-    for (const pid of pids.split('\n').filter(Boolean)) {
-      try { execSync(`kill ${pid.trim()}`); } catch {}
+  const pids = findPortPids(terminalPort);
+  if (pids.length === 0) {
+    console.log(`[forge] No process on port ${terminalPort}`);
+  } else {
+    for (const pid of pids) {
+      try { process.kill(parseInt(pid), 'SIGTERM'); } catch {}
     }
     console.log(`[forge] Killed terminal server on port ${terminalPort}`);
-  } catch {
-    console.log(`[forge] No process on port ${terminalPort}`);
   }
 }
 
@@ -338,14 +380,10 @@ function cleanupOrphans() {
   try {
     // Kill processes on our ports
     for (const port of [webPort, terminalPort]) {
-      try {
-        const pids = execSync(`lsof -ti:${port}`, { encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] }).trim();
-        for (const pid of pids.split('\n').filter(Boolean)) {
-          const p = pid.trim();
-          if (p === myPid || protectedPids.has(p)) continue;
-          try { process.kill(parseInt(p), 'SIGTERM'); } catch {}
-        }
-      } catch {}
+      for (const p of findPortPids(port)) {
+        if (p === myPid || protectedPids.has(p)) continue;
+        try { process.kill(parseInt(p), 'SIGTERM'); } catch {}
+      }
     }
     // Kill standalone processes: our instance's + orphans without any tag
     try {
@@ -365,11 +403,25 @@ function cleanupOrphans() {
     // imported lib/task-manager (directly or via lib/pipeline) starts its
     // own setInterval task runner that never exits — those run in parallel
     // with the real runner and silently steal tasks. Detect via lsof on
-    // workflow.db, exclude our own next-server + standalones.
+    // workflow.db (Mac), with a fuser fallback for lsof-less Linux.
     try {
       const dbPath = join(DATA_DIR, 'workflow.db');
-      const lsofOut = execSync(`lsof -t "${dbPath}"`, { encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] }).trim();
-      for (const pid of lsofOut.split('\n').map(s => s.trim()).filter(Boolean)) {
+      let holders = [];
+      try {
+        const out = execSync(`lsof -t "${dbPath}"`, {
+          encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+        holders = out.split('\n').map(s => s.trim()).filter(Boolean);
+      } catch {
+        try {
+          // `fuser <file>` writes pids to stderr, not stdout. Merge streams.
+          const out = execSync(`fuser "${dbPath}" 2>&1`, {
+            encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'],
+          });
+          holders = out.replace(/^.*?:/, '').trim().split(/\s+/).filter(p => /^\d+$/.test(p));
+        } catch { /* both unavailable — zombie scan disabled */ }
+      }
+      for (const pid of holders) {
         if (pid === myPid || protectedPids.has(pid)) continue;
         let cmd = '';
         try {
@@ -458,25 +510,35 @@ async function stopServer() {
   } catch {}
   try { unlinkSync(PID_FILE); } catch {}
 
-  // Also kill by port (in case PID file is stale)
-  const portPids = [];
-  try {
-    const pids = execSync(`lsof -ti:${webPort}`, { encoding: 'utf-8', timeout: 3000 }).trim();
-    for (const p of pids.split('\n').filter(Boolean)) {
-      const pid = parseInt(p.trim());
-      try { process.kill(pid, 'SIGTERM'); stopped = true; portPids.push(pid); } catch {}
-    }
-    if (pids) console.log(`[forge] Killed processes on port ${webPort}`);
-  } catch {}
+  // Also kill by port (in case PID file is stale). Use findPortPids
+  // so Linux-without-lsof still works.
+  const portPids = findPortPids(webPort);
+  for (const p of portPids) {
+    const pid = parseInt(p);
+    try { process.kill(pid, 'SIGTERM'); stopped = true; } catch {}
+  }
+  if (portPids.length > 0) console.log(`[forge] Killed processes on port ${webPort}`);
 
-  // Force kill after 2 seconds if SIGTERM didn't work
+  // Force kill survivors after 2 seconds.
   if (portPids.length > 0) {
     await new Promise(r => setTimeout(r, 2000));
     for (const pid of portPids) {
-      try { process.kill(pid, 'SIGKILL'); } catch {}
+      try { process.kill(parseInt(pid), 'SIGKILL'); } catch {}
     }
   }
 
+  // Final verify — if anything still listens on the port (e.g. a child
+  // re-bound, or our SIGKILL hit EPERM), surface it loudly. Silent leak
+  // is exactly the bug we're fixing.
+  const survivors = findPortPids(webPort);
+  if (survivors.length > 0) {
+    console.warn(
+      `[forge] WARNING: port ${webPort} still bound by pid(s) ${survivors.join(', ')} after stop. ` +
+      `Likely a different user / cron-launched / sudo'd instance. ` +
+      `Run: kill ${survivors.join(' ')}  (or with sudo) to free it.`,
+    );
+  }
+
   if (!stopped) {
     console.log('[forge] No running server found');
   }

package/components/MarkdownContent.tsx

@@ -1,12 +1,68 @@
 'use client';
 
+import { useEffect, useState } from 'react';
 import Markdown from 'react-markdown';
 import remarkGfm from 'remark-gfm';
+import { remarkLinkify } from '@/lib/chat/remark-linkify';
+import type { SerializablePattern } from '@/lib/chat/link-patterns';
+
+// Module-level cache so every MarkdownContent instance shares one fetch.
+// Patterns rarely change (only when connector base_url is edited) so a
+// per-tab cache is sufficient; refresh requires a reload.
+let _patternsCache: SerializablePattern[] | null = null;
+let _patternsPromise: Promise<SerializablePattern[]> | null = null;
+function loadPatterns(): Promise<SerializablePattern[]> {
+  if (_patternsCache) return Promise.resolve(_patternsCache);
+  if (_patternsPromise) return _patternsPromise;
+  _patternsPromise = fetch('/api/chat/link-patterns')
+    .then(r => r.json())
+    .then(j => {
+      _patternsCache = Array.isArray(j?.patterns) ? j.patterns : [];
+      return _patternsCache!;
+    })
+    .catch(() => {
+      _patternsCache = [];
+      return _patternsCache;
+    });
+  return _patternsPromise;
+}
+
+export default function MarkdownContent({
+  content,
+  linkify,
+}: {
+  content: string;
+  /** Enable auto-link of bug#/!MR/CVE etc. Only set true for AI chat output. */
+  linkify?: boolean;
+}) {
+  const [patterns, setPatterns] = useState<SerializablePattern[]>(() =>
+    linkify ? (_patternsCache || []) : [],
+  );
+  useEffect(() => {
+    if (!linkify) return;
+    if (_patternsCache) { setPatterns(_patternsCache); return; }
+    let cancelled = false;
+    loadPatterns().then(p => { if (!cancelled) setPatterns(p); });
+    return () => { cancelled = true; };
+  }, [linkify]);
+
+  // remarkPlugins uses unified's plugin convention:
+  //   `plugin` alone  → unified calls `plugin()` internally
+  //   `[plugin, opts]` → unified calls `plugin(opts)` internally
+  // Passing `remarkLinkify(patterns)` directly was wrong — that's an
+  // already-resolved transformer; unified would call it again with no
+  // tree, which crashed with "Cannot use 'in' operator to search for
+  // 'children' in undefined".
+  const plugins: any[] = linkify && patterns.length > 0
+    ? [remarkGfm, [remarkLinkify, patterns]]
+    : [remarkGfm];
+
+  // Defensive — react-markdown chokes if children is undefined/non-string.
+  const safeContent = typeof content === 'string' ? content : '';
 
-export default function MarkdownContent({ content }: { content: string }) {
   return (
     <Markdown
-      remarkPlugins={[remarkGfm]}
+      remarkPlugins={plugins}
       components={{
         h1: ({ children }) => <h1 className="text-base font-bold text-[var(--text-primary)] mt-3 mb-1">{children}</h1>,
         h2: ({ children }) => <h2 className="text-sm font-bold text-[var(--text-primary)] mt-3 mb-1">{children}</h2>,
@@ -67,7 +123,7 @@ export default function MarkdownContent({ content }: { content: string }) {
         td: ({ children }) => <td className="border border-[var(--border)] px-3 py-1.5 text-[11px]">{children}</td>,
       }}
     >
-      {content}
+      {safeContent}
     </Markdown>
   );
 }

package/lib/chat/agent-loop.ts

@@ -25,6 +25,7 @@ import {
 } from './tool-dispatcher';
 import { getMemoryStore } from './memory-store';
 import { buildMemoryContext } from './build-memory-context';
+import { buildReferencePromptSection } from './reference-prompt';
 import { buildMemoryTools } from './memory-tools';
 import { buildStartWatchTool } from '../watch/start-watch-tool';
 import { estimateTokens } from '../memory/token-estimate';
@@ -98,6 +99,84 @@ function trimOrphanToolResults(history: Message[]): Message[] {
   return i === 0 ? history : history.slice(i);
 }
 
+/**
+ * Heal sessions where an assistant `tool_use` lacks a matching follow-up
+ * `tool_result` (e.g. user hit Stop mid-execution, stream crashed, tool
+ * runner threw without persisting). Both Anthropic and OpenAI reject
+ * requests with orphan tool calls — AI SDK surfaces this as
+ * `AI_MissingToolResultsError`.
+ *
+ * Strategy: for every assistant message containing tool_use blocks,
+ * collect the ids that are NOT covered by the immediately-next message's
+ * tool_results, then synthesize stub `tool_result` blocks for the
+ * missing ones and prepend them to that next user message (creating one
+ * if needed). Synthesized result text says the call was interrupted so
+ * the model can recover sensibly on retry.
+ */
+function healOrphanToolUses(history: Message[]): Message[] {
+  if (history.length === 0) return history;
+  const out: Message[] = [];
+  for (let i = 0; i < history.length; i += 1) {
+    const m = history[i];
+    out.push(m);
+    if (m.role !== 'assistant' || !Array.isArray(m.blocks)) continue;
+
+    const toolUses = m.blocks.filter(
+      (b): b is ToolUseBlock => (b as any)?.type === 'tool_use',
+    );
+    if (toolUses.length === 0) continue;
+
+    // Examine the next message (if any) for matching tool_results.
+    const next = history[i + 1];
+    const coveredIds = new Set<string>();
+    if (next?.role === 'user' && Array.isArray(next.blocks)) {
+      for (const b of next.blocks) {
+        if ((b as any).type === 'tool_result' && (b as ToolResultBlock).tool_use_id) {
+          coveredIds.add((b as ToolResultBlock).tool_use_id);
+        }
+      }
+    }
+
+    const missing = toolUses.filter((tu) => !coveredIds.has(tu.id));
+    if (missing.length === 0) continue;
+
+    console.warn(
+      `[agent-loop] healed ${missing.length} orphan tool_use(s) in session history ` +
+      `(ids: ${missing.map((t) => t.id).join(', ')}). Likely cause: cancelled / crashed prior turn.`,
+    );
+
+    const stubBlocks: ToolResultBlock[] = missing.map((tu) => ({
+      type: 'tool_result',
+      tool_use_id: tu.id,
+      content: JSON.stringify({
+        ok: false,
+        error: 'previous tool call did not finish (interrupted or crashed); retry the request',
+      }),
+      is_error: true,
+    }));
+
+    if (next?.role === 'user' && Array.isArray(next.blocks)
+        && next.blocks.some((b) => (b as any).type === 'tool_result')) {
+      // Existing pairing message — splice stubs in front of its blocks
+      // so the surviving real results still apply in their original order.
+      history[i + 1] = { ...next, blocks: [...stubBlocks, ...next.blocks] };
+    } else {
+      // No follow-up at all — inject a fresh user message right after this
+      // assistant turn. We mutate `history` so the loop sees it next iter,
+      // but push to `out` here so order is preserved.
+      const injected: Message = {
+        id: `synthetic-${m.id}`,
+        session_id: m.session_id,
+        role: 'user',
+        blocks: stubBlocks,
+        ts: m.ts + 1,
+      };
+      out.push(injected);
+    }
+  }
+  return out;
+}
+
 export interface AgentEvent {
   type:
     | 'text_delta'      // assistant text streaming
@@ -324,6 +403,19 @@ function buildSystemPrompt(
     }
   }
 
+  // Reference format guide — encourages the LLM to emit markdown links
+  // for bug ids / MR ids / CVE etc., using each connector's real base_url.
+  // Front-end remark-linkify (lib/chat/remark-linkify.ts) is the safety
+  // net when the LLM forgets and writes plain text.
+  // Wrap in try/catch — system prompt assembly is hot path; an unread
+  // connector-configs.json must not break the entire chat turn.
+  try {
+    const refSection = buildReferencePromptSection();
+    if (refSection) lines.push('', refSection);
+  } catch (e) {
+    console.warn('[agent-loop] buildReferencePromptSection failed:', (e as Error).message);
+  }
+
   if (sessionSystemPrompt) {
     lines.push('', sessionSystemPrompt);
   }
@@ -651,8 +743,10 @@ export async function runTurn(args: RunTurnArgs): Promise<{ ok: boolean; error?:
       // the LLM calls connector_open, subsequent iterations pick that up.
       // (Computed off a preview slice of history — refined below once
       // we have the real history under budget.)
-      const previewHistory = trimOrphanToolResults(
-        listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, 8_000, estimateTokens),
+      const previewHistory = healOrphanToolUses(
+        trimOrphanToolResults(
+          listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, 8_000, estimateTokens),
+        ),
       );
       const newOpenSet = computeOpenSet(previewHistory, assistantBlocksAccum);
       const setChanged = newOpenSet.size !== openSet.size ||
@@ -704,8 +798,10 @@ export async function runTurn(args: RunTurnArgs): Promise<{ ok: boolean; error?:
         return { ok: false, error: 'profile context budget exhausted' };
       }
 
-      const history = trimOrphanToolResults(
-        listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, historyBudget, estimateTokens),
+      const history = healOrphanToolUses(
+        trimOrphanToolResults(
+          listMessagesCapped(args.sessionId, HISTORY_MSG_BUDGET, historyBudget, estimateTokens),
+        ),
       );
       if (history.length === 0) {
         cb({ type: 'error', data: { error: 'Conversation context is empty after trimming an oversized result. Clear the chat or retry with a narrower query.' } });

package/lib/chat/link-patterns.ts

@@ -0,0 +1,138 @@
+/**
+ * Chat auto-link patterns — turn natural prose like `Mantis #1226625`,
+ * `MR !14860`, `bug 1234567`, `CVE-2024-0001` into clickable links.
+ *
+ * Disambiguation: every pattern requires a prose anchor word — `Mantis`,
+ * `bug`, `MR`, `merge request`, `issue`, `BDSA-`, `CVE-`. We intentionally
+ * do NOT match bare `#N` (ambiguous: GitHub issue / GitLab / Mantis).
+ *
+ * Rules live in this single file (not in connector manifests) so adding
+ * a new pattern doesn't require bumping any connector version. Patterns
+ * referencing a connector's base_url (`baseUrlFrom: 'mantis'`) are
+ * auto-skipped when that connector is not installed.
+ *
+ * URL template syntax:
+ *   {0}            → the entire regex match
+ *   {1}, {2}, ...  → capture groups
+ *   {base_url}     → connector's installed base_url, trailing slash stripped
+ *
+ * The chat system prompt also injects a "Reference Format" guide built
+ * from the same connector base_urls (see lib/chat/reference-prompt.ts)
+ * so the LLM is nudged to emit markdown links directly — these regexes
+ * are a safety net for plain-text mentions.
+ */
+
+import { getInstalledConnector } from '../connectors/registry';
+
+export interface LinkPattern {
+  id: string;
+  /** Regex with the `g` flag — required so we can iterate all matches. */
+  regex: RegExp;
+  /** Connector id whose `config.base_url` populates `{base_url}` in `url`.
+   *  Omit when the pattern is self-contained (e.g. CVE → nvd.nist.gov). */
+  baseUrlFrom?: string;
+  /** URL template — see syntax above. */
+  url: string;
+  /** Tooltip template (same syntax). Defaults to the matched text. */
+  label?: string;
+}
+
+/** Raw patterns. `baseUrlFrom` is resolved by getActiveLinkPatterns. */
+export const LINK_PATTERNS: LinkPattern[] = [
+  {
+    // Matches "Mantis #1226625", "mantis bug 1226625", "bug #1234567",
+    // "bug 1234567". 4–8 digits caps false positives on small numbers
+    // like list indices ("bug 3" etc.).
+    id: 'mantis-bug',
+    regex: /\b(?:mantis(?:\s+bug)?\s*#?|bug\s*#?)(\d{4,8})\b/gi,
+    baseUrlFrom: 'mantis',
+    url: '{base_url}/view.php?id={1}',
+    label: 'Mantis #{1}',
+  },
+  {
+    // Matches "MR !14860", "MR 14860", "merge request !14860", "!14860".
+    // The lookbehind on the bare-`!N` form keeps `not!42` / `1!42` /
+    // `foo!42bar` out, and allows CJK-adjacent (`测试!14860`).
+    id: 'gitlab-mr',
+    regex: /(?:\b(?:MR|merge\s+request)\s+!?|(?<![A-Za-z0-9])!)(\d+)\b/gi,
+    baseUrlFrom: 'gitlab',
+    url: '{base_url}/-/merge_requests/{1}',
+    label: 'MR !{1}',
+  },
+  {
+    // Matches "issue #789", "issue 789", "gitlab issue #789". 3+ digits
+    // minimum keeps "issue 1" / "issue 12" out (too noisy).
+    id: 'gitlab-issue',
+    regex: /\b(?:gitlab\s+issue\s*#?|gl\s*issue\s*#?|issue\s*#?)(\d{3,})\b/gi,
+    baseUrlFrom: 'gitlab',
+    url: '{base_url}/-/issues/{1}',
+    label: 'Issue #{1}',
+  },
+  {
+    id: 'blackduck-bdsa',
+    regex: /\b(BDSA-\d{4}-\d+)\b/g,
+    baseUrlFrom: 'blackduck',
+    url: '{base_url}/api/vulnerabilities/{1}',
+    label: '{1}',
+  },
+  {
+    id: 'cve',
+    regex: /\b(CVE-\d{4}-\d+)\b/g,
+    url: 'https://nvd.nist.gov/vuln/detail/{1}',
+    label: '{1}',
+  },
+];
+
+export interface CompiledPattern {
+  id: string;
+  regex: RegExp;
+  /** url template after {base_url} expansion */
+  urlTemplate: string;
+  labelTemplate: string;
+}
+
+/**
+ * Resolve `baseUrlFrom` against installed connector configs and drop
+ * patterns whose connector isn't configured. Returns the safe-to-render
+ * set; UI fetches this once and reuses it per chat session.
+ */
+export function getActiveLinkPatterns(): CompiledPattern[] {
+  const out: CompiledPattern[] = [];
+  for (const p of LINK_PATTERNS) {
+    let urlTemplate = p.url;
+    if (p.baseUrlFrom) {
+      const cfg = getInstalledConnector(p.baseUrlFrom)?.config as
+        | { base_url?: string }
+        | undefined;
+      const base = (cfg?.base_url || '').trim().replace(/\/+$/, '');
+      if (!base) continue;          // skip — connector unconfigured
+      urlTemplate = urlTemplate.replace('{base_url}', base);
+    }
+    out.push({
+      id: p.id,
+      regex: p.regex,
+      urlTemplate,
+      labelTemplate: p.label ?? '{0}',
+    });
+  }
+  return out;
+}
+
+/** Serializable form for sending to the browser. */
+export interface SerializablePattern {
+  id: string;
+  source: string;       // regex.source — re-hydrated client-side
+  flags: string;        // regex.flags
+  url: string;
+  label: string;
+}
+
+export function serializePatterns(patterns: CompiledPattern[]): SerializablePattern[] {
+  return patterns.map(p => ({
+    id: p.id,
+    source: p.regex.source,
+    flags: p.regex.flags.includes('g') ? p.regex.flags : p.regex.flags + 'g',
+    url: p.urlTemplate,
+    label: p.labelTemplate,
+  }));
+}

package/lib/chat/reference-prompt.ts

@@ -0,0 +1,81 @@
+/**
+ * Build a "Reference Format" block for the chat system prompt that lists
+ * each installed connector's URL pattern and asks the LLM to emit
+ * markdown links directly when mentioning IDs.
+ *
+ * Output goes into buildSystemPrompt in agent-loop.ts. Base URLs are read
+ * from connector-configs.json so the prompt only mentions connectors the
+ * user has actually configured — no broken/placeholder URLs leak.
+ */
+
+import { getInstalledConnector } from '../connectors/registry';
+
+interface RefLine {
+  /** Human reference type for the prompt. */
+  label: string;
+  /** Example template the LLM should follow. */
+  example: string;
+}
+
+/**
+ * Returns a markdown-friendly multiline string section, or empty string
+ * if no connector is configured for any of the rules. Caller appends it
+ * verbatim to the system prompt.
+ */
+export function buildReferencePromptSection(): string {
+  const out: RefLine[] = [];
+
+  // Helper — read base_url from a connector, trailing slash stripped.
+  const baseOf = (id: string): string | null => {
+    const cfg = getInstalledConnector(id)?.config as { base_url?: string } | undefined;
+    const v = (cfg?.base_url || '').trim().replace(/\/+$/, '');
+    return v || null;
+  };
+
+  const mantis = baseOf('mantis');
+  if (mantis) {
+    out.push({
+      label: 'Mantis bug',
+      example: `[Mantis #1226625](${mantis}/view.php?id=1226625)`,
+    });
+  }
+
+  const gitlab = baseOf('gitlab');
+  if (gitlab) {
+    out.push({
+      label: 'GitLab merge request',
+      example: `[MR !14860](${gitlab}/-/merge_requests/14860)`,
+    });
+    out.push({
+      label: 'GitLab issue',
+      example: `[Issue #789](${gitlab}/-/issues/789)`,
+    });
+  }
+
+  const blackduck = baseOf('blackduck');
+  if (blackduck) {
+    out.push({
+      label: 'Black Duck advisory',
+      example: `[BDSA-2024-0001](${blackduck}/api/vulnerabilities/BDSA-2024-0001)`,
+    });
+  }
+
+  // Always include — self-contained, doesn't need a connector
+  out.push({
+    label: 'CVE',
+    example: '[CVE-2024-1234](https://nvd.nist.gov/vuln/detail/CVE-2024-1234)',
+  });
+
+  if (out.length === 0) return '';
+
+  const lines = [
+    'Reference format — when mentioning these IDs in your reply, emit them as inline markdown links (substitute the real id):',
+  ];
+  for (const r of out) {
+    lines.push(`- ${r.label}: ${r.example}`);
+  }
+  lines.push(
+    'Always use the URLs shown above; do NOT invent hostnames. If a category is not listed, just mention the id as plain text — the UI will auto-link known patterns as a fallback.',
+  );
+  return lines.join('\n');
+}

package/lib/chat/remark-linkify.ts

@@ -0,0 +1,132 @@
+/**
+ * Remark plugin: auto-link known references (bug#, !MR, CVE-, …) in
+ * markdown text nodes. Skips text inside code/inlineCode/link parents
+ * so existing markdown links and code samples render untouched.
+ *
+ * Multi-pattern: caller passes a pre-compiled list (typically from
+ * /api/chat/link-patterns). Patterns whose backing connector isn't
+ * configured are already filtered server-side.
+ */
+
+import { visit, SKIP } from 'unist-util-visit';
+import type { SerializablePattern } from './link-patterns';
+
+interface MdastNode { type: string; [k: string]: any }
+interface MdastText extends MdastNode { type: 'text'; value: string }
+interface MdastParent extends MdastNode { children: MdastNode[] }
+
+interface ClientPattern {
+  id: string;
+  regex: RegExp;
+  urlTemplate: string;
+  labelTemplate: string;
+}
+
+/** Hydrate `{ source, flags }` into RegExp objects once per render. */
+export function hydratePatterns(patterns: SerializablePattern[]): ClientPattern[] {
+  return patterns.map(p => ({
+    id: p.id,
+    regex: new RegExp(p.source, p.flags),
+    urlTemplate: p.url,
+    labelTemplate: p.label,
+  }));
+}
+
+interface Hit {
+  start: number;
+  end: number;
+  matchText: string;
+  url: string;
+  label: string;
+}
+
+/** Expand {0}, {1}, ... in a template string using a RegExp match array. */
+function expand(tmpl: string, match: RegExpExecArray): string {
+  return tmpl.replace(/\{(\d+)\}/g, (_, idx) => match[Number(idx)] ?? '');
+}
+
+/** Find every non-overlapping match across all patterns in one string.
+ *  Earlier patterns win in case of overlap. */
+function findHits(text: string, patterns: ClientPattern[]): Hit[] {
+  const hits: Hit[] = [];
+  for (const p of patterns) {
+    // Clone — running .exec mutates lastIndex on a shared regex.
+    const re = new RegExp(p.regex.source, p.regex.flags);
+    let m: RegExpExecArray | null;
+    while ((m = re.exec(text)) !== null) {
+      const start = m.index;
+      const matchText = m[0];
+      const end = start + matchText.length;
+      // Overlap check against already-accepted hits (first-wins).
+      if (hits.some(h => !(end <= h.start || start >= h.end))) continue;
+      hits.push({
+        start,
+        end,
+        matchText,
+        url: expand(p.urlTemplate, m),
+        label: expand(p.labelTemplate, m),
+      });
+      if (m.index === re.lastIndex) re.lastIndex++;     // zero-width safety
+    }
+  }
+  hits.sort((a, b) => a.start - b.start);
+  return hits;
+}
+
+/** Splice hits into a text node, returning new mdast children. */
+function spliceText(value: string, hits: Hit[]): MdastNode[] {
+  const out: MdastNode[] = [];
+  let cursor = 0;
+  for (const h of hits) {
+    if (h.start > cursor) {
+      out.push({ type: 'text', value: value.slice(cursor, h.start) });
+    }
+    out.push({
+      type: 'link',
+      url: h.url,
+      title: h.label,
+      children: [{ type: 'text', value: h.matchText }],
+    });
+    cursor = h.end;
+  }
+  if (cursor < value.length) {
+    out.push({ type: 'text', value: value.slice(cursor) });
+  }
+  return out;
+}
+
+const SKIP_PARENT_TYPES = new Set(['link', 'linkReference', 'code', 'inlineCode']);
+
+export function remarkLinkify(patterns: SerializablePattern[]) {
+  if (!patterns.length) return () => {};
+  const compiled = hydratePatterns(patterns);
+
+  return (tree: MdastNode) => {
+    visit(tree as any, 'text', (node: any, index: number | undefined, parent: any) => {
+      try {
+        if (!parent || index == null) return;
+        const n = node as MdastText;
+        const p = parent as MdastParent;
+        if (!n || typeof n.value !== 'string') return;
+        if (!Array.isArray(p?.children)) return;
+        if (SKIP_PARENT_TYPES.has(p.type)) return;
+
+        const hits = findHits(n.value, compiled);
+        if (!hits.length) return;
+
+        const replacement = spliceText(n.value, hits);
+        // Sanity — every replacement child must be a proper node with a type.
+        if (!replacement.every(r => r && typeof (r as any).type === 'string')) return;
+
+        p.children.splice(index, 1, ...replacement);
+        return [SKIP, index + replacement.length];
+      } catch (e) {
+        // Linkify is a nice-to-have — never let it crash the chat render.
+        if (typeof console !== 'undefined') {
+          console.warn('[remark-linkify] visit failed, skipping node:', (e as Error)?.message);
+        }
+        return;
+      }
+    });
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.38",
+  "version": "0.10.40",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {
@@ -56,6 +56,7 @@
     "react-markdown": "^10.1.0",
     "remark-gfm": "^4.0.1",
     "undici": "^8.3.0",
+    "unist-util-visit": "^5.1.0",
     "ws": "^8.19.0",
     "yaml": "^2.8.2",
     "zod": "^4.3.6"