@aion0/forge 0.10.39 → 0.10.41

package/lib/telegram-bot.ts

@@ -1570,7 +1570,13 @@ async function sendNoteToDocsClaude(chatId: number, content: string) {
       await new Promise(r => setTimeout(r, 500));
       // cd to doc root and start claude
       const sf = settings.skipPermissions ? ' --dangerously-skip-permissions' : '';
-      spawnSync('tmux', ['send-keys', '-t', SESSION_NAME, `cd "${docRoot}" && claude -c${sf}`, 'Enter'], { timeout: 5000 });
+      // Resolve absolute claude path — bare `claude` rides on tmux pane
+      // PATH which can pick a stale global install. See
+      // feedback_terminal_launch memory.
+      const { resolveTerminalLaunch } = await import('./agents');
+      const launch = resolveTerminalLaunch('claude', 'telegram');
+      const claudeCmd = `"${launch.cliCmd}"`;
+      spawnSync('tmux', ['send-keys', '-t', SESSION_NAME, `cd "${docRoot}" && ${claudeCmd} -c${sf}`, 'Enter'], { timeout: 5000 });
       // Wait for Claude to start up
       await new Promise(r => setTimeout(r, 3000));
       await send(chatId, '🚀 Auto-started Docs Claude session.');
@@ -1590,7 +1596,13 @@ async function sendNoteToDocsClaude(chatId: number, content: string) {
   if (paneCmd === 'zsh' || paneCmd === 'bash' || paneCmd === 'fish' || !paneCmd) {
     try {
       const sf = settings.skipPermissions ? ' --dangerously-skip-permissions' : '';
-      spawnSync('tmux', ['send-keys', '-t', SESSION_NAME, `cd "${docRoot}" && claude -c${sf}`, 'Enter'], { timeout: 5000 });
+      // Resolve absolute claude path — bare `claude` rides on tmux pane
+      // PATH which can pick a stale global install. See
+      // feedback_terminal_launch memory.
+      const { resolveTerminalLaunch } = await import('./agents');
+      const launch = resolveTerminalLaunch('claude', 'telegram');
+      const claudeCmd = `"${launch.cliCmd}"`;
+      spawnSync('tmux', ['send-keys', '-t', SESSION_NAME, `cd "${docRoot}" && ${claudeCmd} -c${sf}`, 'Enter'], { timeout: 5000 });
       await new Promise(r => setTimeout(r, 3000));
       await send(chatId, '🚀 Auto-started Claude in Docs session.');
     } catch {

package/lib/workflow-marketplace.ts

@@ -1,28 +1,45 @@
 /**
- * Workflow Marketplace — sync recipes + pipelines from a Git repo.
+ * Workflow Marketplace — sync recipes + pipelines from one or more Git
+ * repos. Mirrors the connector marketplace's multi-source model:
  *
- * Repo layout (default: aiwatching/forge-workflow):
+ *   Priority 0..N-1: Enterprise repos (the SAME repos used by connector
+ *     sync — each enterprise registry.json declares its connectors AND
+ *     its workflow templates). Workflow side reads the recipes/pipelines
+ *     arrays out of the cache connector sync already wrote.
+ *
+ *   Priority N (lowest): Public — settings.workflowRepoUrl (default
+ *     aiwatching/forge-workflow). Fetched via raw.githubusercontent.com.
+ *
+ * Repo layout (same in public and enterprise):
  *
  *   registry.json
- *     { version, updated_at, recipes: [...summary], pipelines: [...summary] }
- *   recipes/<name>/recipe.yaml   ← the actual recipe content
- *   recipes/<name>/info.json     ← optional richer metadata (rating, tags)
+ *     { version, recipes: [...], pipelines: [...], (connectors: [...])  }
+ *   recipes/<name>/recipe.yaml
+ *   recipes/<name>/info.json (optional)
  *   pipelines/<name>/pipeline.yaml
- *   pipelines/<name>/info.json
+ *   pipelines/<name>/info.json (optional)
  *
- * Local cache: <dataDir>/workflow-cache.json — last fetched registry.
- * Installed status is derived by checking the files on disk under
- *   <dataDir>/recipes/  (handled by lib/jobs/recipes.ts)
- *   <dataDir>/flows/    (handled by lib/pipeline.ts)
+ * Local cache: <dataDir>/workflow-cache.json — public registry only.
+ * Enterprise registries live in the connector cache; we read them via
+ * `readSourceRegistry` from lib/connectors/sync.ts. Installed status
+ * is derived by scanning files on disk under <dataDir>/recipes/ and
+ * <dataDir>/flows/ (handled by lib/jobs/recipes.ts and lib/pipeline.ts).
  */
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import YAML from 'yaml';
 import { getDataDir } from './dirs';
 import { loadSettings } from './settings';
 import { listRecipes } from './jobs/recipes';
 import { listWorkflows } from './pipeline';
+import {
+  listEnterpriseSourceMetas,
+  readSourceRegistry,
+  fetchSourceFile,
+  type SourceMeta,
+  type RegistryFile,
+} from './connectors/sync';
 
 export type WorkflowKind = 'recipe' | 'pipeline';
 
@@ -40,23 +57,43 @@ export interface MarketplaceEntry {
   installed: boolean;
   installed_version?: string;
   has_update?: boolean;
+  /** Which marketplace source provided the winning entry. */
+  source_id?: string;
+  /** Other sources that also list this name but were outranked. */
+  hidden_sources?: { source_id: string; display_name: string; version: string }[];
 }
 
 const CACHE_FILE = () => join(getDataDir(), 'workflow-cache.json');
 const REQUEST_TIMEOUT_MS = 10_000;
 
-function baseUrl(): string {
-  return (loadSettings().workflowRepoUrl || '').replace(/\/+$/, '');
+const DEFAULT_PUBLIC_REPO = 'https://raw.githubusercontent.com/aiwatching/forge-workflow/main';
+
+function publicBaseUrl(): string {
+  return (loadSettings().workflowRepoUrl || '').trim().replace(/\/+$/, '') || DEFAULT_PUBLIC_REPO;
 }
 
-interface RegistryFile {
-  version: number;
-  updated_at?: string;
-  recipes?: Array<Partial<MarketplaceEntry>>;
-  pipelines?: Array<Partial<MarketplaceEntry>>;
+/** Public workflow source meta — separate repo from connectors, so we
+ *  build it locally rather than reusing the connector sync's `public`. */
+function publicWorkflowSource(priority: number): SourceMeta {
+  return {
+    id: 'public',
+    display_name: 'Public',
+    is_enterprise: false,
+    priority,
+    fetch_mode: 'raw',
+    base_url: publicBaseUrl(),
+  };
 }
 
-function readCache(): RegistryFile | null {
+/** Ordered list of workflow sources, highest priority first. */
+function listSources(): SourceMeta[] {
+  const enterprise = listEnterpriseSourceMetas();
+  return [...enterprise, publicWorkflowSource(enterprise.length)];
+}
+
+// ─── Public cache I/O ──────────────────────────────────────
+
+function readPublicCache(): RegistryFile | null {
   try {
     const path = CACHE_FILE();
     if (!existsSync(path)) return null;
@@ -64,15 +101,31 @@ function readCache(): RegistryFile | null {
   } catch { return null; }
 }
 
-function writeCache(data: RegistryFile): void {
+function writePublicCache(data: RegistryFile): void {
   mkdirSync(getDataDir(), { recursive: true });
   writeFileSync(CACHE_FILE(), JSON.stringify(data, null, 2), { mode: 0o600 });
 }
 
+function readSourceData(source: SourceMeta): RegistryFile | null {
+  if (source.is_enterprise) {
+    // Piggyback on connector sync's per-source cache — enterprise
+    // registry.json contains recipes/pipelines alongside connectors.
+    return readSourceRegistry(source.id);
+  }
+  return readPublicCache();
+}
+
 // ─── Sync ──────────────────────────────────────────────────
 
+/**
+ * Refresh the workflow registry for every source whose registry we
+ * own. Enterprise registries are owned by the connector sync — those
+ * are pulled in `lib/connectors/sync.ts#syncRegistry`. This function
+ * just refreshes the public workflow registry; the UI typically
+ * triggers both syncs back-to-back.
+ */
 export async function syncMarketplace(): Promise<{ ok: boolean; recipes: number; pipelines: number; error?: string }> {
-  const base = baseUrl();
+  const base = publicBaseUrl();
   if (!base) return { ok: false, recipes: 0, pipelines: 0, error: 'workflowRepoUrl is empty' };
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
@@ -85,8 +138,8 @@ export async function syncMarketplace(): Promise<{ ok: boolean; recipes: number;
     clearTimeout(timer);
     if (!res.ok) return { ok: false, recipes: 0, pipelines: 0, error: `registry fetch failed: HTTP ${res.status}` };
     const data = (await res.json()) as RegistryFile;
-    writeCache(data);
-    console.log(`[workflow-marketplace] synced ${data.recipes?.length ?? 0} recipes + ${data.pipelines?.length ?? 0} pipelines`);
+    writePublicCache(data);
+    console.log(`[workflow-marketplace] public synced ${data.recipes?.length ?? 0} recipes + ${data.pipelines?.length ?? 0} pipelines`);
     return { ok: true, recipes: data.recipes?.length ?? 0, pipelines: data.pipelines?.length ?? 0 };
   } catch (e) {
     clearTimeout(timer);
@@ -96,7 +149,7 @@ export async function syncMarketplace(): Promise<{ ok: boolean; recipes: number;
   }
 }
 
-// ─── List (merged registry + installed) ────────────────────
+// ─── List (merged across sources) ──────────────────────────
 
 function compareVersions(a: string, b: string): number {
   const pa = (a || '0.0.0').split('.').map(Number);
@@ -108,34 +161,68 @@ function compareVersions(a: string, b: string): number {
   return 0;
 }
 
+interface PendingEntry {
+  winning_source: SourceMeta;
+  raw: NonNullable<RegistryFile['recipes']>[number] | NonNullable<RegistryFile['pipelines']>[number];
+  hidden: { source_id: string; display_name: string; version: string }[];
+}
+
+/** Walk sources in priority order; first occurrence wins, later ones
+ *  collect into hidden_sources on the winning entry. */
+function mergeAcrossSources(
+  kindKey: 'recipes' | 'pipelines',
+  sources: SourceMeta[],
+): Map<string, PendingEntry> {
+  const out = new Map<string, PendingEntry>();
+  for (const source of sources) {
+    const data = readSourceData(source);
+    const items = (data?.[kindKey] || []) as NonNullable<RegistryFile['recipes']>;
+    for (const item of items) {
+      if (!item?.name) continue;
+      const existing = out.get(item.name);
+      if (!existing) {
+        out.set(item.name, { winning_source: source, raw: item, hidden: [] });
+      } else {
+        existing.hidden.push({
+          source_id: source.id,
+          display_name: source.display_name,
+          version: item.version || '0.0.0',
+        });
+      }
+    }
+  }
+  return out;
+}
+
+function toEntry(kind: WorkflowKind, pe: PendingEntry): MarketplaceEntry {
+  const r = pe.raw;
+  return {
+    kind,
+    name: r.name,
+    display_name: r.display_name || r.name,
+    description: r.description,
+    version: r.version || '0.0.0',
+    author: r.author,
+    tags: r.tags,
+    score: r.score ?? 0,
+    rating: r.rating ?? 0,
+    source: 'registry',
+    source_id: pe.winning_source.id,
+    hidden_sources: pe.hidden.length ? pe.hidden : undefined,
+    installed: false,
+  };
+}
+
 export function listMarketplace(): { recipes: MarketplaceEntry[]; pipelines: MarketplaceEntry[] } {
-  const cache: RegistryFile = readCache() || { version: 1, recipes: [], pipelines: [] };
+  const sources = listSources();
   const installedRecipes = listRecipes();
   const installedWorkflows = listWorkflows();
 
+  // Recipes
   const recipeMap = new Map<string, MarketplaceEntry>();
-  for (const r of (cache.recipes || [])) {
-    if (!r.name) continue;
-    recipeMap.set(r.name, {
-      kind: 'recipe',
-      name: r.name,
-      display_name: r.display_name || r.name,
-      description: r.description,
-      version: r.version || '0.0.0',
-      author: r.author,
-      tags: r.tags,
-      score: r.score ?? 0,
-      rating: r.rating ?? 0,
-      source: 'registry',
-      installed: false,
-    });
+  for (const [name, pe] of mergeAcrossSources('recipes', sources)) {
+    recipeMap.set(name, toEntry('recipe', pe));
   }
-  // Marketplace = registry catalog ONLY. Recipes / pipelines that
-  // exist only locally (uploaded copy, hand-edited file, custom
-  // workflow) belong to the user and don't show here — Marketplace
-  // is for browsing the remote forge-workflow repo. We still mark
-  // registry items as `installed` when a local copy exists, so the
-  // UI can show "your local copy is on v0.2.0, registry is v0.3.0".
   for (const ir of installedRecipes) {
     const cached = recipeMap.get(ir.name);
     if (cached) {
@@ -143,31 +230,14 @@ export function listMarketplace(): { recipes: MarketplaceEntry[]; pipelines: Mar
       cached.installed_version = ir.version;
       cached.has_update = compareVersions(cached.version, ir.version) > 0;
     }
-    // else: local-only recipe — intentionally skipped
+    // local-only recipe — intentionally skipped (Marketplace = remote catalog)
   }
 
+  // Pipelines
   const pipelineMap = new Map<string, MarketplaceEntry>();
-  for (const p of (cache.pipelines || [])) {
-    if (!p.name) continue;
-    pipelineMap.set(p.name, {
-      kind: 'pipeline',
-      name: p.name,
-      display_name: p.display_name || p.name,
-      description: p.description,
-      version: p.version || '0.0.0',
-      author: p.author,
-      tags: p.tags,
-      score: p.score ?? 0,
-      rating: p.rating ?? 0,
-      source: 'registry',
-      installed: false,
-    });
+  for (const [name, pe] of mergeAcrossSources('pipelines', sources)) {
+    pipelineMap.set(name, toEntry('pipeline', pe));
   }
-  // Same model for pipelines: Marketplace lists only registry items.
-  // Local-only workflows (yours, edited, custom) live in the
-  // Pipelines tab list — they're shown there, not here. This split
-  // keeps "browse upstream catalog" and "manage your local files"
-  // as two distinct mental modes.
   for (const iw of installedWorkflows) {
     if (iw.builtin) continue;
     const cached = pipelineMap.get(iw.name);
@@ -175,7 +245,7 @@ export function listMarketplace(): { recipes: MarketplaceEntry[]; pipelines: Mar
       cached.installed = true;
       cached.installed_version = (iw as any).version || cached.version;
     }
-    // else: local-only pipeline — intentionally skipped
+    // local-only pipeline — intentionally skipped
   }
 
   return {
@@ -186,53 +256,50 @@ export function listMarketplace(): { recipes: MarketplaceEntry[]; pipelines: Mar
 
 // ─── Install ───────────────────────────────────────────────
 
-async function fetchText(url: string): Promise<string | null> {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
-  try {
-    // Cache-bust + no-cache so a Sync click bypasses any intermediate
-    // HTTP cache and pulls the latest yaml from the repo CDN.
-    const sep = url.includes('?') ? '&' : '?';
-    const res = await fetch(`${url}${sep}_t=${Date.now()}`, {
-      signal: controller.signal,
-      headers: { 'Cache-Control': 'no-cache', 'User-Agent': 'forge-workflow-sync/1.0' },
-    });
-    clearTimeout(timer);
-    if (!res.ok) return null;
-    return await res.text();
-  } catch { clearTimeout(timer); return null; }
+/** Find the highest-priority source that lists `name` for `kind`. */
+function findEntrySource(kind: WorkflowKind, name: string): SourceMeta | null {
+  const kindKey = kind === 'recipe' ? 'recipes' : 'pipelines';
+  for (const source of listSources()) {
+    const data = readSourceData(source);
+    const items = (data?.[kindKey] || []) as Array<{ name?: string }>;
+    if (items.some(i => i?.name === name)) return source;
+  }
+  return null;
+}
+
+/** Try a few candidate paths inside a source — `<kind>/<name>/<kind>.yaml`
+ *  first (canonical), then the flat `<kind>/<name>.yaml` fallback. */
+async function fetchWorkflowYaml(source: SourceMeta, kind: WorkflowKind, name: string): Promise<string | null> {
+  const subdir = kind === 'recipe' ? 'recipes' : 'pipelines';
+  const file = kind === 'recipe' ? 'recipe.yaml' : 'pipeline.yaml';
+  const candidates = [`${subdir}/${name}/${file}`, `${subdir}/${name}.yaml`];
+  for (const path of candidates) {
+    try {
+      const text = await fetchSourceFile(source, path);
+      if (text) return text;
+    } catch {
+      // try next candidate
+    }
+  }
+  return null;
 }
 
 export async function installFromMarketplace(
   kind: WorkflowKind,
   name: string,
   opts: { target_name?: string; overwrite?: boolean } = {},
-): Promise<{ ok: boolean; error?: string; installed_as?: string }> {
-  const base = baseUrl();
-  if (!base) return { ok: false, error: 'workflowRepoUrl is empty' };
+): Promise<{ ok: boolean; error?: string; installed_as?: string; source_id?: string }> {
   if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) return { ok: false, error: 'invalid name' };
-
   const targetName = opts.target_name || name;
   if (!/^[a-z0-9][a-z0-9_-]*$/.test(targetName)) {
     return { ok: false, error: `target_name "${targetName}" must be lowercase alphanumerics + hyphens/underscores` };
   }
 
-  // Recipes live under recipes/<name>/recipe.yaml, pipelines under
-  // pipelines/<name>/pipeline.yaml. Falls back to a flat file too,
-  // for repos that don't use a per-item folder.
-  const subdir = kind === 'recipe' ? 'recipes' : 'pipelines';
-  const file = kind === 'recipe' ? 'recipe.yaml' : 'pipeline.yaml';
-  const candidates = [
-    `${base}/${subdir}/${name}/${file}`,
-    `${base}/${subdir}/${name}.yaml`,
-  ];
-
-  let yamlText: string | null = null;
-  for (const url of candidates) {
-    yamlText = await fetchText(url);
-    if (yamlText) break;
-  }
-  if (!yamlText) return { ok: false, error: `${kind} "${name}" not found in registry` };
+  const source = findEntrySource(kind, name);
+  if (!source) return { ok: false, error: `${kind} "${name}" not found in registry — try Sync` };
+
+  const yamlText = await fetchWorkflowYaml(source, kind, name);
+  if (!yamlText) return { ok: false, error: `${kind} "${name}" file not reachable in ${source.id}` };
 
   // Validate it parses + has the right shape before writing.
   let parsed: any;
@@ -255,16 +322,16 @@ export async function installFromMarketplace(
     return { ok: false, error: `"${targetName}" already exists locally — pass overwrite=true to replace it, or choose a different name` };
   }
 
-  // If renaming, rewrite the yaml's top-level `name:` so the on-disk
-  // copy matches its filename. Without this the file would be loaded
-  // as the original name and collide with other clones.
+  // Rename rewrites the yaml's top-level `name:` so the on-disk copy
+  // matches its filename. Without this the file would be loaded under
+  // the original name and collide with other clones.
   let outputYaml = yamlText;
   if (targetName !== name) {
     parsed.name = targetName;
     outputYaml = YAML.stringify(parsed);
   }
   writeFileSync(targetPath, outputYaml, { mode: 0o600 });
-  return { ok: true, installed_as: targetName };
+  return { ok: true, installed_as: targetName, source_id: source.id };
 }
 
 // ─── Uninstall ─────────────────────────────────────────────
@@ -274,7 +341,6 @@ export function uninstallFromMarketplace(kind: WorkflowKind, name: string): { ok
   const dir = kind === 'recipe' ? join(getDataDir(), 'recipes') : join(getDataDir(), 'flows');
   const yamlPath = join(dir, `${name}.yaml`);
   const ymlPath = join(dir, `${name}.yml`);
-  const { unlinkSync } = require('node:fs');
   if (existsSync(yamlPath)) { unlinkSync(yamlPath); return { ok: true }; }
   if (existsSync(ymlPath)) { unlinkSync(ymlPath); return { ok: true }; }
   return { ok: false, error: 'not installed' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.10.39",
+  "version": "0.10.41",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {

package/{middleware.ts → proxy.ts}

@@ -1,6 +1,6 @@
 import { NextResponse, type NextRequest } from 'next/server';
 
-export function middleware(req: NextRequest) {
+export function proxy(req: NextRequest) {
   // Skip auth entirely in dev mode
   const isDev = process.env.NODE_ENV !== 'production' || process.env.FORGE_DEV === '1';
   if (isDev) {
@@ -15,6 +15,7 @@ export function middleware(req: NextRequest) {
     pathname.startsWith('/login') ||
     pathname.startsWith('/api/auth') ||
     pathname === '/api/version' ||
+    pathname === '/api/bridge-info' ||
     pathname.startsWith('/api/telegram') ||
     (pathname.startsWith('/api/workspace') && (pathname.endsWith('/smith') || pathname === '/api/workspace')) ||
     pathname.startsWith('/_next') ||

package/src/core/db/database.ts

@@ -20,10 +20,16 @@ export function getDb(dbPath: string): Database.Database {
 }
 
 function initSchema(db: Database.Database) {
-  // Migrations for existing tables (catch duplicate column errors silently)
+  // Migrations for existing tables — silence both
+  //   "duplicate column" (column already added on a prior run) AND
+  //   "no such table"   (fresh DB — table doesn't exist yet, will be
+  //                      CREATEd in the block below; ALTER is irrelevant).
+  // Anything else (typo in SQL, real corruption) still logs as an error.
   const migrate = (sql: string) => {
     try { db.exec(sql); } catch (e: any) {
-      if (!String(e.message).includes('duplicate column')) console.error('[db] Migration failed:', sql, e.message);
+      const msg = String(e.message);
+      if (msg.includes('duplicate column') || msg.includes('no such table')) return;
+      console.error('[db] Migration failed:', sql, e.message);
     }
   };
   migrate('ALTER TABLE tasks ADD COLUMN scheduled_at TEXT');

package/templates/connector-config-template.json

@@ -83,13 +83,6 @@
     "enabled": true
   },
 
-  "jenkins": {
-    "config": {
-      "instances": "[{\"name\":\"default-jenkins\",\"base_url\":\"http://nac-dev-jenkins.fortinet-us.com:8080\",\"username\":\"${jenkins_username}\",\"api_token\":\"${jenkins_api_token}\",\"gitlab_pat\":\"${gitlab_pat}\",\"gitlab_token_name\":\"${gitlab_token_name}\",\"gitlab_token_name_param\":\"${gitlab_token_name}\",\"gitlab_pat_param\":\"\",\"inject_params\":\"[{\\\"name\\\":\\\"TOKEN_USER\\\",\\\"value\\\":\\\"${gitlab_token_name}\\\"},{\\\"name\\\":\\\"TOKEN_PASSWORD\\\",\\\"value\\\":\\\"${gitlab_pat}\\\"}]\"}]"
-    },
-    "enabled": true
-  },
-
   "tp": {
     "config": {
       "base_url": "https://nac-tp.fortinet-us.com",